Project

General

Profile

Actions

Feature #7114

open
VJ JL

from_base64: allow matching on decode error

Feature #7114: from_base64: allow matching on decode error

Added by Victor Julien almost 2 years ago. Updated about 2 months ago.

Status:
In Review
Priority:
Normal
Assignee:
Target version:
Effort:
Difficulty:
Label:

Description

Thinking about something like:

file.data; from_base64:strict,set_error; content:"BASE64_ECODE_BUF";

Not entirely sure what the buffer should be set to.

It could be used to make sure base64 at an expected location is valid, so it wouldn't match if it decoded correctly.

file.data; from_base64:strict,set_error; bsize:0;

Would also need to see how to express this, as the bsize here is useless.


Related issues 5 (4 open1 closed)

Related to Suricata - Feature #7313: transforms: have option on how to handle failureIn ReviewJeff LucovskyActions
Related to Suricata - Optimization #8466: detect/base64: determine behavior if buf size > buf lengthNewActions
Related to Suricata - Feature #8470: detect/transform: Create anomaly log on transform failureNewActions
Blocked by Suricata - Feature #6487: detect/transform: from_base64ClosedJeff LucovskyActions
Blocks Suricata - Task #8433: detect/transforms: Determine which transforms have error cases and can be handled like from_base64/pcrexformAssignedOISF DevActions
Actions

Also available in: PDF Atom