mirror of https://github.com/OISF/suricata
You cannot select more than 25 topics
Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.
9f8c419dd2
The error arm of a COMPOUND that is fully in hand only set a state event. set_event marks the newest transaction, and there is none when the record's first op is the one that fails: the record was then consumed, nothing was logged, and nothing asked for the missing bytes. A v4 WRITE whose count runs past the end of its record is that case - the parser gives up at the data, so the size check in the WRITE handling, which needs a parsed count, is never reached. Reject what cannot be walked the way a partial record is rejected: scan the bytes the parser was given, and log an oversized WRITE as a write_request_too_large file transaction or another un-walkable record as a malformed one, on a transaction of its own. What the parser skips is not in that set: a defined op this parser does not implement keeps base's event on the newest tx, and an RPCSEC_GSS privacy compound, whose result is opaque by RFC 2203 on the call and the reply alike, is left unparsed with no event at all. Either way the record is bounded by its own marker, and a flow that carries un-parseable v4 traffic leaves a trace in EVE. Ticket: #9265. |
18 hours ago | |
|---|---|---|
| .. | ||
| .cargo | ||
| derive | 5 days ago | |
| ffi | 18 hours ago | |
| htp | 5 days ago | |
| src | 18 hours ago | |
| suricatactl | 5 days ago | |
| suricatasc | 5 days ago | |
| sys | 5 days ago | |
| .gitignore | ||
| Cargo.lock.in | 4 days ago | |
| Cargo.toml.in | 5 days ago | |
| Makefile.am | 5 days ago | |
| cbindgen.toml | 4 months ago | |
| rustfmt.toml | ||