Optimization #7018: dns/tcp: allow triggering raw stream reassembly - Suricata - Open Information Security Foundation

Actions

Optimization #7018

closed

JF JF

Task #7026: app-protos: trigger raw stream inspection

dns/tcp: allow triggering raw stream reassembly

Optimization #7018: dns/tcp: allow triggering raw stream reassembly

Added by Juliana Fajardini Reichow almost 2 years ago. Updated over 1 year ago.

Status:

Closed

Priority:

Normal

Assignee:

Juliana Fajardini Reichow

Target version:

Effort:

Difficulty:

Label:

Description

As seen with #7004, DNS over TCP transactions might not be seen by the stream detection engine until a later stage, unless the app-proto triggers the raw parsing of the stream once it knows there's enough data to be parsed.

This could lead to whole transactions being overseen: they're marked as inspected by DetectRunTx, then AppLayerParserTransactionsCleanup frees them, and once it's time to stream rules to match, earlier transactions may not exist for the detection engine any longer, or exist as an id only, but not be retrievable for alert metadata logging.

This is especially true if for some reason we have a DNS rule that doesn't use any DNS keywords, as to the engine this is a payload/stream-only rule.

Subtasks 1 (0 open — 1 closed)

Related issues 4 (0 open — 4 closed)

JF Updated by Juliana Fajardini Reichow almost 2 years ago Actions
Copy link
#1

Related to Bug #7004: app-layer: wrong tx may be logged for stream rules added

JF Updated by Juliana Fajardini Reichow almost 2 years ago Actions
Copy link
#2

Private changed from No to Yes

JF Updated by Juliana Fajardini Reichow almost 2 years ago Actions
Copy link
#3

Parent task set to #7026

JF Updated by Juliana Fajardini Reichow almost 2 years ago Actions
Copy link
#4

Subject changed from dns: allow triggering raw stream reassembly to dns/tcp: allow triggering raw stream reassembly
Description updated (diff)

JF Updated by Juliana Fajardini Reichow almost 2 years ago Actions
Copy link
#5

Description updated (diff)

JF Updated by Juliana Fajardini Reichow almost 2 years ago Actions
Copy link
#6

Description updated (diff)

JF Updated by Juliana Fajardini Reichow almost 2 years ago Actions
Copy link
#7

Tracker changed from Task to Bug

JF Updated by Juliana Fajardini Reichow almost 2 years ago Actions
Copy link
#8

Status changed from New to In Progress

JF Updated by Juliana Fajardini Reichow almost 2 years ago Actions
Copy link
#9

Status changed from In Progress to In Review

JF Updated by Juliana Fajardini Reichow almost 2 years ago Actions
Copy link
#10

Related to Documentation #7031: userguide: document SignatureProperties sigtype added

JF Updated by Juliana Fajardini Reichow almost 2 years ago Actions
Copy link
#11

Related to Bug #7000: pgsql: trigger raw stream reassembly added

JF Updated by Juliana Fajardini Reichow almost 2 years ago Actions
Copy link
#12

Tracker changed from Bug to Optimization

Changing Tracker as per discussion with Philippe and Jason. If I understood it correctly.

JF Updated by Juliana Fajardini Reichow almost 2 years ago Actions
Copy link
#13

PR for review: https://github.com/OISF/suricata/pull/11265

JF Updated by Juliana Fajardini Reichow almost 2 years ago Actions
Copy link
#14

Status changed from In Review to Closed

Merged PR: https://github.com/OISF/suricata/pull/11271

JF Updated by Juliana Fajardini Reichow almost 2 years ago Actions
Copy link
#15

Status changed from Closed to Resolved
Label Needs backport to 7.0 added

OT Updated by OISF Ticketbot almost 2 years ago Actions
Copy link
#16

Subtask #7075 added

OT Updated by OISF Ticketbot almost 2 years ago Actions
Copy link
#17

Label deleted (~~Needs backport to 7.0~~)

JF Updated by Juliana Fajardini Reichow almost 2 years ago Actions
Copy link
#18

Private changed from Yes to No

VJ Updated by Victor Julien over 1 year ago Actions
Copy link
#19

Status changed from Resolved to Closed

PA Updated by Philippe Antoine over 1 year ago Actions
Copy link
#20

Why is this closed but SV test task-7018-ids-dns-keywords does not pass ?

JF Updated by Juliana Fajardini Reichow over 1 year ago Actions
Copy link
#21

Related to Bug #7449: app-layer metadata does not get logged for stream rules and unidirectional protocols added

Actions

Also available in: PDF Atom