mirror of https://github.com/OISF/suricata
You cannot select more than 25 topics
Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.
95d4776f33
The continuation of a partially received READ reply looked up its file handle in the request map by the reply's xid. As the request map is bounded and evicts the least recently used entries, enough other requests on the flow could evict the entry while the reply was still in progress. The continuation then consumed nothing and its file data was parsed as a new RPC record, which failed and disabled the parser for the flow. Keep the file handle of the in-progress to-client chunk in the state, like is done for the to-server WRITE chunk, and clear it along with the rest of the chunk state. The file transaction itself can also go away while its chunk is in progress, for example when the max-tx limit forces it closed, after which a READ request for the same handle creates a new transaction. A transaction found for the handle whose file is not open, which is also the case after a complete READ reply with eof set, cannot take the chunk either. In these cases consume the chunk up to its known record boundary instead of parsing its data as RPC records or passing it to that transaction. Ticket: #9192 |
2 days ago | |
|---|---|---|
| .. | ||
| .cargo | 2 years ago | |
| derive | 6 days ago | |
| ffi | 2 days ago | |
| htp | 6 days ago | |
| src | 2 days ago | |
| suricatactl | 6 days ago | |
| suricatasc | 6 days ago | |
| sys | 6 days ago | |
| .gitignore | 2 years ago | |
| Cargo.lock.in | 5 days ago | |
| Cargo.toml.in | 6 days ago | |
| Makefile.am | 6 days ago | |
| cbindgen.toml | 4 months ago | |
| rustfmt.toml | ||