suricata

Commit Graph

Author	SHA1	Message	Date
Juliana Fajardini	f839581dba	pgsql: bound tx.responses (configurable) Since the PostgreSQL protocol doesn't impose any clear limits to how many responses a backend could send, add one to the app-proto parser. Using 21-64 as the accepted values, and 64 as the default: The Start-up phase may have up to 17-18 ParameterStatus messages, plus AuthOk, BackendKeyData and ReadyForQuery: 20, with extra room to be on the safer side: 21 And 64 as upper limit, because as we currently summarize query responses, we already don't get flooded by DataRow and Copy responses messages, so we don't expect to see that many responses in a single transaction for the pgsql, with the current implementation. Ticket: #7263	2 months ago
Juliana Fajardini	1b6f4da23b	pgsql: add events Events for: - parsing error when parsing pgsql packet length - parsing error for pgsql requests (post length parsing) - parsing error for pgsql responses (post length parsing) - too many transactions Include `pgsql-events.rules` file, and PGSQL events SID range definition Task #5566	2 years ago

Author

SHA1

Message

Date

Juliana Fajardini

f839581dba

pgsql: bound tx.responses (configurable)

Since the PostgreSQL protocol doesn't impose any clear limits to how
many responses a backend could send, add one to the app-proto parser.

Using 21-64 as the accepted values, and 64 as the default:

The Start-up phase may have up to 17-18 ParameterStatus messages, plus
AuthOk, BackendKeyData and ReadyForQuery: 20, with extra room to be on
the safer side: 21

And 64 as upper limit, because as we currently summarize query
responses, we already don't get flooded by DataRow and Copy responses
messages, so we don't expect to see that many responses in a single
transaction for the pgsql, with the current implementation.

Ticket: #7263

Juliana Fajardini

1b6f4da23b

pgsql: add events

Events for:
- parsing error when parsing pgsql packet length
- parsing error for pgsql requests (post length parsing)
- parsing error for pgsql responses (post length parsing)
- too many transactions

Include `pgsql-events.rules` file, and PGSQL events SID range definition

Task #5566

2 Commits (b0ef8af338b4156dbcdf7619c29cd1dab2a81978)