Project

General

Profile

Actions

Bug #5750

open

Spurious "SURICATA DNP3 Length too small" error and failed reassembly

Added by Alex Lasky over 1 year ago. Updated over 1 year ago.

Status:
New
Priority:
Normal
Assignee:
Target version:
Affected Versions:
Effort:
Difficulty:
Label:
Needs backport to 6.0

Description

DNP3 preprocessor fails to correctly reassemble DNP3 fragments in some cases, generating a spurious "SURICATA DNP3 Length too small" error. As the attached two examples show, the problem seems to occur where the final frame of the fragment has an all-zero's payload excluding CRC's and transport byte, though I don't know if this is a necessary or sufficient condition.


Files

DNP3ReassemblyError1.pcap (2.43 KB) DNP3ReassemblyError1.pcap Alex Lasky, 12/12/2022 05:38 AM
DNP3ReassemblyError2.pcap (3.2 KB) DNP3ReassemblyError2.pcap Alex Lasky, 12/12/2022 05:38 AM
DNP3ReassemblyError.json (3.2 KB) DNP3ReassemblyError.json Alex Lasky, 12/12/2022 05:44 AM
Actions #1

Updated by Jason Ish over 1 year ago

  • Assignee changed from OISF Dev to Jason Ish
Actions

Also available in: Atom PDF