Bug #5220
closedfast_pattern specification in base64_data shouldn't be allowed
Description
It seems that specifying a fast_pattern in base64_data is ignored both from an error/warning standpoint and from an actual fast_pattern assignment by suricata. It seems suricata should warn/fail on fast_pattern assignment in base64_data.
rule example:
alert http $HOME_NET any -> $EXTERNAL_NET any (flow:established,to_server; http.method; content:"POST"; http.request_body; base64_decode:bytes 28; base64_data; content:"something"; fast_pattern; classtype:bad-unknown; sid:123; rev:1;)
suricata.log:
[52155] 29/3/2022 -- 20:20:41 - (detect-engine-loader.c:354) <Info> (SigLoadSignatures) -- 1 rule files processed. 1 rules successfully loaded, 0 rules failed
rules_fast_pattern.log:
== Sid: 123 == alert http $HOME_NET any -> $EXTERNAL_NET any (flow:established,to_server; http.method; content:"POST"; http.request_body; base64_decode:bytes 28; base64_data; content:"something"; fast_pattern; classtype:bad-unknown; sid:123; rev:1;) Fast Pattern analysis: Fast pattern matcher: http request method (http_method) Flags: None Fast pattern set: no Fast pattern only set: no Fast pattern chop set: no Original content: POST Final content: POST
suricata version:
This is Suricata version 7.0.0-dev (99b344336 2022-03-25)
Updated by Victor Julien over 2 years ago
- Description updated (diff)
- Target version changed from TBD to 7.0.0-beta1
- Label Needs backport to 6.0 added
Updated by Jeff Lucovsky over 2 years ago
- Status changed from New to Assigned
- Assignee changed from OISF Dev to Shivani Bhardwaj
- Target version changed from 7.0.0-beta1 to 6.0.5
- Label deleted (
Needs backport to 6.0)
Updated by Jeff Lucovsky over 2 years ago
- Assignee changed from Shivani Bhardwaj to OISF Dev
- Target version changed from 6.0.5 to 7.0.0-beta1
- Label Needs backport to 6.0 added
Updated by Jeff Lucovsky over 2 years ago
- Copied to Bug #5242: fast_pattern specification in base64_data shouldn't be allowed (6.0.x backport) added
Updated by Victor Julien over 2 years ago
- Related to Feature #5245: allow fast_pattern on base64_data strings added
Updated by Shivani Bhardwaj almost 2 years ago
- Label deleted (
Needs backport to 6.0)
Updated by Victor Julien almost 2 years ago
- Target version changed from 7.0.0-beta1 to 8.0.0-beta1
Updated by Victor Julien about 1 year ago
- Assignee changed from OISF Dev to Shivani Bhardwaj
Updated by Philippe Antoine 11 months ago
- Related to Task #6443: Suricon 2023 brainstorm added
Updated by Philippe Antoine 11 months ago
https://github.com/OISF/suricata/pull/7233 was last PR
Updated by Shivani Bhardwaj 11 months ago
Philippe Antoine wrote in #note-11:
https://github.com/OISF/suricata/pull/7233 was last PR
The work on this hasn't started. That PR was accidentally mentioning this issue, I think.
Updated by Shivani Bhardwaj 10 months ago
I was just working on this and noticed that https://redmine.openinfosecfoundation.org/issues/5245 is conflicting to what is asked in this ticket. Which one should be considered valid moving forward?
Updated by Victor Julien 10 months ago
- Related to Feature #6487: transform: from_base64 added
Updated by Shivani Bhardwaj 7 months ago
- Status changed from Assigned to In Progress
Updated by Shivani Bhardwaj 7 months ago · Edited
- Status changed from In Progress to In Review
Closed by: https://github.com/OISF/suricata/pull/10731
Updated by Shivani Bhardwaj 5 months ago · Edited
- Status changed from In Review to Closed