mirror of https://github.com/OISF/suricata
You cannot select more than 25 topics
Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.
67b5fb7800
The record scanners unwrapped the (0, 2) combination and took every other one as a bare compound. A control procedure or a privacy compound was then scanned as if it were a COMPOUND: the envelope length was read as the first tag, so the scan either stayed incomplete and buffered toward the claim, or rejected a record that has nothing to reject. Scan by the combination the call recorded: hand the credential pair to gss_compound_scan_data, which leaves (0, 1) raw because rpc_gss_svc_none wraps nothing, unwraps (0, 2), and reports a privacy (0, 3) compound as opaque. There is nothing to scan in an encrypted compound, so the record is skipped to its boundary and neither parsed nor scored: the request path keeps the call in the request map for its reply, the reply path drops it. Any other combination is one the full record path rejects as well, so it is malformed, boundedly and without buffering. The v4 request path records the combination whatever it is, not only when it unwraps. Ticket: #9263. |
1 day ago | |
|---|---|---|
| .. | ||
| .cargo | ||
| derive | 5 days ago | |
| ffi | 1 day ago | |
| htp | 5 days ago | |
| src | 1 day ago | |
| suricatactl | 5 days ago | |
| suricatasc | 5 days ago | |
| sys | 5 days ago | |
| .gitignore | ||
| Cargo.lock.in | 4 days ago | |
| Cargo.toml.in | 5 days ago | |
| Makefile.am | 5 days ago | |
| cbindgen.toml | 4 months ago | |
| rustfmt.toml | ||