Project

General

Profile

Actions
Copy link

Task #7026

closed
JF SB

app-protos: trigger raw stream inspection

Task #7026: app-protos: trigger raw stream inspection

Added by Juliana Fajardini Reichow almost 2 years ago. Updated 8 months ago.

Status:
Closed
Priority:
Normal
Assignee:
Shivani Bhardwaj
Target version:
8.0.0-rc1
Effort:
Difficulty:
high
Label:

Description

For application layer protocols over TCP that have transactions, we need to trigger stream inspection once they have at least one full message parseable, to avoid missing alerts that happen early on in the stream (as seen with #7004).

Subtasks 5 (0 open — 5 closed)

Bug #7000: pgsql: trigger raw stream reassemblyClosedJuliana Fajardini ReichowActions
Bug #7001: pgsql: trigger raw stream reassembly (7.0.x backport)ClosedJuliana Fajardini ReichowActions
Optimization #7018: dns/tcp: allow triggering raw stream reassemblyClosedJuliana Fajardini ReichowActions
Optimization #7075: dns/tcp: allow triggering raw stream reassembly (7.0.x backport)ClosedJuliana Fajardini ReichowActions
Optimization #7076: pgsql: trigger raw stream reassembly when tx completedRejectedJuliana Fajardini ReichowActions

Related issues 4 (1 open — 3 closed)

Related to Suricata - Bug #7004: app-layer: wrong tx may be logged for stream rulesClosedShivani BhardwajActions
Related to Suricata - Documentation #4351: doc: explain the engine logic to trigger inspection of TCP dataClosedShivani BhardwajActions
Related to Suricata - Task #7742: ftp: trigger raw stream inspectionClosedShivani BhardwajActions
Related to Suricata - Task #7743: http: trigger raw stream inspectionAssignedShivani BhardwajActions

OT Updated by OISF Ticketbot almost 2 years ago Actions
Copy link
 #1

  • Subtask #7027 added

OT Updated by OISF Ticketbot almost 2 years ago Actions
Copy link
 #2

  • Label deleted (Needs backport to 7.0)

JF Updated by Juliana Fajardini Reichow almost 2 years ago Actions
Copy link
 #3

  • Private changed from No to Yes

JF Updated by Juliana Fajardini Reichow almost 2 years ago Actions
Copy link
 #4

  • Subtask #7018 added

JF Updated by Juliana Fajardini Reichow almost 2 years ago Actions
Copy link
 #5

Enip: should wait for https://github.com/OISF/suricata/pull/10901 to be merged.

JF Updated by Juliana Fajardini Reichow almost 2 years ago Actions
Copy link
 #6

  • Tracker changed from Bug to Optimization
  • Affected Versions deleted (7.0.5, git main)

JF Updated by Juliana Fajardini Reichow almost 2 years ago Actions
Copy link
 #7

  • Private changed from Yes to No

JF Updated by Juliana Fajardini Reichow almost 2 years ago Actions
Copy link
 #8

  • Subtask #7000 added

JF Updated by Juliana Fajardini Reichow almost 2 years ago Actions
Copy link
 #9

  • Subtask #7076 added

JF Updated by Juliana Fajardini Reichow over 1 year ago Actions
Copy link
 #11

  • Related to Bug #7004: app-layer: wrong tx may be logged for stream rules added

VJ Updated by Victor Julien over 1 year ago Actions
Copy link
 #12

  • Status changed from New to Assigned
  • Assignee changed from OISF Dev to Shivani Bhardwaj

VJ Updated by Victor Julien about 1 year ago Actions
Copy link
 #13

  • Related to Documentation #4351: doc: explain the engine logic to trigger inspection of TCP data added

SB Updated by Shivani Bhardwaj about 1 year ago Actions
Copy link
 #14

I think this ticket should be rejected with an update in the title as this just reflects what shall be done to fix the bug stated in #7004. Thoughts?

VJ Updated by Victor Julien about 1 year ago Actions
Copy link
 #15

Shivani Bhardwaj wrote in #note-14:

I think this ticket should be rejected with an update in the title as this just reflects what shall be done to fix the bug stated in #7004. Thoughts?

Not sure, implementing this affects more than tx logging.

SB Updated by Shivani Bhardwaj about 1 year ago Actions
Copy link
 #16

Victor Julien wrote in #note-15:

Not sure, implementing this affects more than tx logging.

I see. Thank you. I shall find that out then and see if the title needs improvement.

SB Updated by Shivani Bhardwaj about 1 year ago Actions
Copy link
 #17

  • Status changed from Assigned to In Progress

VJ Updated by Victor Julien about 1 year ago Actions
Copy link
 #18

  • Target version changed from 8.0.0-beta1 to 8.0.0-rc1

SB Updated by Shivani Bhardwaj 11 months ago Actions
Copy link
 #19

  • Tracker changed from Optimization to Task

SB Updated by Shivani Bhardwaj 11 months ago Actions
Copy link
 #20

  • Subject changed from app-protos: trigger raw stream reassembly to app-protos: trigger raw stream inspection
  • Description updated (diff)

SB Updated by Shivani Bhardwaj 11 months ago Actions
Copy link
 #23

  • Difficulty set to high

SB Updated by Shivani Bhardwaj 10 months ago Actions
Copy link
 #24

  • Related to Task #7742: ftp: trigger raw stream inspection added

SB Updated by Shivani Bhardwaj 10 months ago Actions
Copy link
 #25

  • Related to Task #7743: http: trigger raw stream inspection added

SB Updated by Shivani Bhardwaj 10 months ago Actions
Copy link
 #26

  • Status changed from In Progress to Resolved

VJ Updated by Victor Julien 8 months ago Actions
Copy link
 #27

  • Status changed from Resolved to Closed
Actions
Copy link

Also available in: PDF Atom