Project

General

Profile

Actions

Bug #5220

open

fast_pattern specification in base64_data shouldn't be allowed

Added by Jason Taylor almost 2 years ago. Updated 28 days ago.

Status:
Assigned
Priority:
Normal
Target version:
Affected Versions:
Effort:
Difficulty:
Label:

Description

It seems that specifying a fast_pattern in base64_data is ignored both from an error/warning standpoint and from an actual fast_pattern assignment by suricata. It seems suricata should warn/fail on fast_pattern assignment in base64_data.

rule example:

alert http $HOME_NET any -> $EXTERNAL_NET any (flow:established,to_server; http.method; content:"POST"; http.request_body; base64_decode:bytes 28; base64_data; content:"something"; fast_pattern; classtype:bad-unknown; sid:123; rev:1;)

suricata.log:

[52155] 29/3/2022 -- 20:20:41 - (detect-engine-loader.c:354) <Info> (SigLoadSignatures) -- 1 rule files processed. 1 rules successfully loaded, 0 rules failed

rules_fast_pattern.log:

== Sid: 123 ==
alert http $HOME_NET any -> $EXTERNAL_NET any (flow:established,to_server; http.method; content:"POST"; http.request_body; base64_decode:bytes 28; base64_data; content:"something"; fast_pattern; classtype:bad-unknown; sid:123; rev:1;)
    Fast Pattern analysis:
        Fast pattern matcher: http request method (http_method)
        Flags: None
        Fast pattern set: no
        Fast pattern only set: no
        Fast pattern chop set: no
        Original content: POST
        Final content: POST

suricata version:
This is Suricata version 7.0.0-dev (99b344336 2022-03-25)


Subtasks 1 (0 open1 closed)

Bug #5242: fast_pattern specification in base64_data shouldn't be allowed (6.0.x backport)RejectedActions

Related issues 3 (3 open0 closed)

Related to Suricata - Feature #5245: allow fast_pattern on base64_data stringsNewOISF DevActions
Related to Suricata - Task #6443: Suricon 2023 brainstormAssignedVictor JulienActions
Related to Suricata - Feature #6487: transform: from_base64In ProgressJeff LucovskyActions
Actions #1

Updated by Victor Julien almost 2 years ago

  • Description updated (diff)
  • Target version changed from TBD to 7.0.0-beta1
  • Label Needs backport to 6.0 added
Actions #2

Updated by Jeff Lucovsky almost 2 years ago

  • Status changed from New to Assigned
  • Assignee changed from OISF Dev to Shivani Bhardwaj
  • Target version changed from 7.0.0-beta1 to 6.0.5
  • Label deleted (Needs backport to 6.0)
Actions #3

Updated by Jeff Lucovsky almost 2 years ago

  • Assignee changed from Shivani Bhardwaj to OISF Dev
  • Target version changed from 6.0.5 to 7.0.0-beta1
  • Label Needs backport to 6.0 added
Actions #4

Updated by Jeff Lucovsky almost 2 years ago

  • Copied to Bug #5242: fast_pattern specification in base64_data shouldn't be allowed (6.0.x backport) added
Actions #5

Updated by Victor Julien over 1 year ago

  • Related to Feature #5245: allow fast_pattern on base64_data strings added
Actions #6

Updated by Shivani Bhardwaj over 1 year ago

  • Subtask #5242 added
Actions #7

Updated by Shivani Bhardwaj over 1 year ago

  • Label deleted (Needs backport to 6.0)
Actions #8

Updated by Victor Julien over 1 year ago

  • Target version changed from 7.0.0-beta1 to 8.0.0-beta1
Actions #9

Updated by Victor Julien 5 months ago

  • Assignee changed from OISF Dev to Shivani Bhardwaj
Actions #10

Updated by Philippe Antoine 3 months ago

  • Related to Task #6443: Suricon 2023 brainstorm added
Actions #12

Updated by Shivani Bhardwaj 3 months ago

Philippe Antoine wrote in #note-11:

https://github.com/OISF/suricata/pull/7233 was last PR

The work on this hasn't started. That PR was accidentally mentioning this issue, I think.

Actions #13

Updated by Shivani Bhardwaj 2 months ago

I was just working on this and noticed that https://redmine.openinfosecfoundation.org/issues/5245 is conflicting to what is asked in this ticket. Which one should be considered valid moving forward?

Actions #14

Updated by Victor Julien 2 months ago

This ticket is about the parser allowing the setting, but then not acting on it. #5245 is about adding proper support. As I think that is non-trivial and might not happen at all, it would be good to fix this issue independent of #5245.

Actions #15

Updated by Victor Julien 2 months ago

Actions

Also available in: Atom PDF