Project

General

Profile

Actions
Copy link

Task #7026

open

app-protos: trigger raw stream inspection

Added by Juliana Fajardini Reichow about 1 year ago. Updated 7 days ago.

Status:
In Progress
Priority:
Normal
Assignee:
Shivani Bhardwaj
Target version:
8.0.0-rc1
Effort:
Difficulty:
high
Label:

Description

For application layer protocols over TCP that have transactions, we need to trigger stream inspection once they have at least one full message parseable, to avoid missing alerts that happen early on in the stream (as seen with #7004).

Subtasks 5 (0 open — 5 closed)

Bug #7000: pgsql: trigger raw stream reassemblyClosedJuliana Fajardini ReichowActions
Bug #7001: pgsql: trigger raw stream reassembly (7.0.x backport)ClosedJuliana Fajardini ReichowActions
Optimization #7018: dns/tcp: allow triggering raw stream reassemblyClosedJuliana Fajardini ReichowActions
Optimization #7075: dns/tcp: allow triggering raw stream reassembly (7.0.x backport)ClosedJuliana Fajardini ReichowActions
Optimization #7076: pgsql: trigger raw stream reassembly when tx completedRejectedJuliana Fajardini ReichowActions

Related issues 2 (2 open — 0 closed)

Related to Suricata - Bug #7004: app-layer: wrong tx may be logged for stream rulesIn ProgressShivani BhardwajActions
Related to Suricata - Documentation #4351: doc: explain the engine logic to trigger inspection of TCP dataAssignedShivani BhardwajActions
Actions
Copy link

Also available in: Atom PDF