Project

General

Profile

Actions

Bug #7019

closed

snmp: probing parser returns ALPROTO_FAILED instead of ALPROTO_UNKNOWN if slice.len() < 4

Added by Philippe Antoine about 1 year ago. Updated 6 days ago.

Status:
Closed
Priority:
Normal
Target version:
Affected Versions:
Effort:
Difficulty:
Label:
Beginner, Good First Issue, Needs Suricata-Verify test, Protocol, Rust

Description

Found with https://github.com/OISF/suricata/pull/11062

This would allow protocol detection evasion on TCP by splitting the PDU into a first small slice and the rest once the first packet is packed

There may be other protocols to check.


Subtasks 1 (0 open1 closed)

Bug #7716: snmp: probing parser returns ALPROTO_FAILED instead of ALPROTO_UNKNOWN if slice.len() < 4 (7.0.x backport)ClosedPhilippe AntoineActions
Actions #1

Updated by Philippe Antoine about 1 year ago

  • Subject changed from snmp: robin parser returns ALPROTO_FAILED instead of ALPROTO_UNKNOWN if slice.len() < 4 to snmp: probing parser returns ALPROTO_FAILED instead of ALPROTO_UNKNOWN if slice.len() < 4
Actions #2

Updated by Philippe Antoine about 1 year ago

  • Label Beginner, Good First Issue, Needs Suricata-Verify test, Protocol, Rust added

Easy fix, hard thing is to craft a pcap for testing

Actions #3

Updated by Philippe Antoine 11 months ago

I think this one can be postponed after 8

Actions #4

Updated by Victor Julien 3 months ago

  • Target version changed from 8.0.0-beta1 to 8.0.0-rc1
Actions #5

Updated by Philippe Antoine 8 days ago

  • Status changed from New to In Review
  • Assignee changed from OISF Dev to Philippe Antoine
Actions #6

Updated by Philippe Antoine 7 days ago

  • Status changed from In Review to Resolved
  • Label Needs backport to 7.0 added
Actions #7

Updated by OISF Ticketbot 7 days ago

  • Subtask #7716 added
Actions #8

Updated by OISF Ticketbot 7 days ago

  • Label deleted (Needs backport to 7.0)
Actions #9

Updated by Philippe Antoine 6 days ago

  • Status changed from Resolved to Closed
Actions

Also available in: Atom PDF