Detect generic uint 4112 v7 by catenacyber · Pull Request #7305 · OISF/suricata

catenacyber · 2022-04-25T16:04:42Z

Link to redmine ticket:
https://redmine.openinfosecfoundation.org/issues/4112
https://redmine.openinfosecfoundation.org/issues/2697

Describe changes:

Makes use of generic DetectUint structure for dsize and dcerpc, ttl, tcpmss, filesize, streamsize (and template2)
Uses pre filter for streamsize on the way

Replaces #7302 with stream size addition

Further work, but this PR can already be merged:

more keywords in C use specific versions, but they are more complex than just an integer
look for uses of set_uint in loggers to see if we can easily a new keywords

> git grep _LT src/*.h | grep DETEC
src/detect-ipproto.h:#define DETECT_IPPROTO_OP_LT     '<' /**< "less than" operator */
src/detect-iprep.h:#define DETECT_IPREP_OP_LT        0
src/detect-tls-cert-validity.h:#define DETECT_TLS_VALIDITY_LT (1<<1) /* less than */
src/detect-urilen.h:#define DETECT_URILEN_LT   0   /**< "less than" operator */

suricata-verify-pr: 809

Ticket: 4112 Move it away from http2 to generic core crate. And use it for DCERPC (and SMB) And remove the C version. Main change in API is the free function is not free itself, but a rust wrapper around unbox.

Ticket: 4112

codecov · 2022-04-25T16:21:19Z

Codecov Report

Merging #7305 (9fa86a4) into master (ddf9c9d) will decrease coverage by 0.13%.
The diff coverage is 73.06%.

@@            Coverage Diff             @@
##           master    #7305      +/-   ##
==========================================
- Coverage   75.82%   75.69%   -0.14%     
==========================================
  Files         656      654       -2     
  Lines      190051   189055     -996     
==========================================
- Hits       144102   143101    -1001     
- Misses      45949    45954       +5

Flag	Coverage Δ
fuzzcorpus	`60.03% <60.69%> (-0.38%)`	⬇️
suricata-verify	`51.68% <34.28%> (+0.14%)`	⬆️
unittests	`61.01% <54.00%> (-0.01%)`	⬇️

Flags with carried forward coverage won't be shown. Click here to find out more.

jasonish · 2022-04-25T17:13:18Z

Minor nit: Our current convention, at least by looking at git log is to have the ticket # as the last line.

catenacyber · 2022-04-25T18:34:31Z

Minor nit: Our current convention, at least by looking at git log is to have the ticket # as the last line.

@victorjulien What is the right format ?
Bug or Ticket ?
With a sharp or not ?
Is it documented somewhere ?

Ticket: 4112

Ticket: 4112 Ticket: 2697 By the way, adds the prefilter feature

suricata-qa · 2022-04-26T02:00:05Z

ERROR:
ERROR: Invalid Signature config error in tlpr1_asan_cfg QA test

ERROR: QA failed on tlpr1_asan_cfg.

Pipeline 7171

victorjulien · 2022-04-30T06:08:19Z

Needs investigation of the qalab failures

victorjulien · 2022-04-30T06:09:42Z

Minor nit: Our current convention, at least by looking at git log is to have the ticket # as the last line.

@victorjulien What is the right format ? Bug or Ticket ? With a sharp or not ? Is it documented somewhere ?

Not documented yet, but here is the regex from the new check-ticket script

"(Task|Feature|Ticket|Bug|Issue)\:?\s+#?(\d+)"

catenacyber · 2022-04-30T11:43:28Z

Not documented yet, but here is the regex from the new check-ticket script
"(Task|Feature|Ticket|Bug|Issue)\:?\s+#?(\d+)"

Ok, is there a difference between the different wordings ?
I guess I have been using Ticket every time

catenacyber · 2022-04-30T11:46:32Z

ERROR: ERROR: Invalid Signature config error in tlpr1_asan_cfg QA test

ERROR: QA failed on tlpr1_asan_cfg.

Pipeline 7171

@pevma @ct0br0 it looks like old rules are still used in the QA :

$ sudo $SPREFIX/bin/suricata -c $SYAML -T $SARGS
[33](https://gitlab.oisf.net/dev/suricata-ci-trex/-/jobs/156625#L33)[2273626] 26/4/2022 -- 01:33:20 - (suricata.c:1729) <Info> (ParseCommandLine) -- Running suricata under test mode
[34](https://gitlab.oisf.net/dev/suricata-ci-trex/-/jobs/156625#L34)[2273626] 26/4/2022 -- 01:33:20 - (suricata.c:1142) <Notice> (LogVersion) -- This is Suricata version 7.0.0-dev (9fa86a4e5 2022-04-25) running in SYSTEM mode
[35](https://gitlab.oisf.net/dev/suricata-ci-trex/-/jobs/156625#L35)[2273626] 26/4/2022 -- 01:33:36 - (detect-engine-loader.c:185) <Error> (DetectLoadSigFile) -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "alert udp $HOME_NET 1234 -> $EXTERNAL_NET 4000 (msg:"ET MALWARE NAZAR EYService Pong response"; id:1; ttl:<0; content:"101|3b|0000|3b|"; reference:url,blog.malwarelab.pl/posts/nazar_eyservice_comm; classtype:command-and-control; sid:2030055; rev:2; metadata:attack_target Client_Endpoint, created_at 2020_04_29, deployment Perimeter, former_category MALWARE, performance_impact Low, signature_severity Major, updated_at 2020_04_29;)" from file /opt/gitrun/suri/var/lib/suricata/rules/suricata.rules at line 68749
[36](https://gitlab.oisf.net/dev/suricata-ci-trex/-/jobs/156625#L36)[2273626] 26/4/2022 -- 01:33:40 - (detect-engine-loader.c:185) <Error> (DetectLoadSigFile) -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "alert udp $HOME_NET 1234 -> $EXTERNAL_NET 4000 (msg:"ET MALWARE NAZAR EYService OSInfo response"; id:1; ttl:<0; content:"100|3b|"; reference:url,blog.malwarelab.pl/posts/nazar_eyservice_comm; classtype:command-and-control; sid:2030056; rev:2; metadata:attack_target Client_Endpoint, created_at 2020_04_29, deployment Perimeter, former_category MALWARE, performance_impact Low, signature_severity Major, updated_at 2020_08_19;)" from file /opt/gitrun/suri/var/lib/suricata/rules/suricata.rules at line 74939
[37](https://gitlab.oisf.net/dev/suricata-ci-trex/-/jobs/156625#L37)[2273626] 26/4/2022 -- 01:34:39 - (suricata.c:2330) <Error> (LoadSignatures) -- [ERRCODE: SC_ERR_NO_RULES_LOADED(43)] - Loading signatures failed.

Could you fix this ?

pevma · 2022-04-30T11:59:55Z

Yes.I have open an internal ticket to investigate.
The rules are the correct ones , updated ok , seems it might be related to cleaning up the environment.

catenacyber · 2022-05-02T13:08:50Z

Replaced by #7357

The encryption key subfield of the media description field is not logged when it should be. Ticket OISF#7305

catenacyber added 5 commits April 25, 2022 15:32

detect: rust generic functions for integers

45b82b9

Ticket: 4112 Move it away from http2 to generic core crate. And use it for DCERPC (and SMB) And remove the C version. Main change in API is the free function is not free itself, but a rust wrapper around unbox.

detect: use generic integer functions for dsize

1aacfe3

Ticket: 4112

detect: use generic integer functions for ttl

fab3e85

Ticket: 4112

detect: use generic integer functions for template2

c3e56da

detect: use generic integer functions for tcp mss

94d19f3

Ticket: 4112

catenacyber requested review from a team, jasonish and victorjulien as code owners April 25, 2022 16:04

catenacyber mentioned this pull request Apr 25, 2022

Detect generic uint 4112 v6 #7302

Closed

catenacyber added 2 commits April 25, 2022 20:39

detect: use generic integer functions for filesize

e7ac01f

Ticket: 4112

detect: use generic integer functions for streamsize

9fa86a4

Ticket: 4112 Ticket: 2697 By the way, adds the prefilter feature

catenacyber force-pushed the detect-generic-uint-4112-v7 branch from 8f96d9a to 9fa86a4 Compare April 25, 2022 18:39

victorjulien marked this pull request as draft April 30, 2022 06:10

catenacyber mentioned this pull request May 2, 2022

Detect generic uint 4112 v8 #7357

Closed

catenacyber closed this May 2, 2022

glongo added a commit to glongo/suricata that referenced this pull request Oct 4, 2024

sdp: log media's encryption key

cbe2942

The encryption key subfield of the media description field is not logged when it should be. Ticket OISF#7305

glongo added a commit to glongo/suricata that referenced this pull request Oct 15, 2024

sdp: log media's encryption key

02aebd4

The encryption key subfield of the media description field is not logged when it should be. Ticket OISF#7305

glongo added a commit to glongo/suricata that referenced this pull request Dec 30, 2024

sdp: log media's encryption key

aa0cea8

The encryption key subfield of the media description field is not logged when it should be. Ticket OISF#7305

glongo added a commit to glongo/suricata that referenced this pull request Feb 9, 2025

sdp: log media's encryption key

3a1f96d

The encryption key subfield of the media description field is not logged when it should be. Ticket OISF#7305

glongo added a commit to glongo/suricata that referenced this pull request Mar 31, 2025

sdp: log media's encryption key

060c4de

The encryption key subfield of the media description field is not logged when it should be. Ticket OISF#7305

glongo added a commit to glongo/suricata that referenced this pull request Apr 2, 2025

sdp: log media's encryption key

8aaa36e

The encryption key subfield of the media description field is not logged when it should be. Ticket OISF#7305

victorjulien pushed a commit to victorjulien/suricata that referenced this pull request Apr 2, 2025

sdp: log media's encryption key

f530c0d

The encryption key subfield of the media description field is not logged when it should be. Ticket OISF#7305

victorjulien pushed a commit to victorjulien/suricata that referenced this pull request Apr 2, 2025

sdp: log media's encryption key

891da0f

The encryption key subfield of the media description field is not logged when it should be. Ticket OISF#7305

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Detect generic uint 4112 v7#7305

Detect generic uint 4112 v7#7305
catenacyber wants to merge 7 commits intoOISF:masterfrom
catenacyber:detect-generic-uint-4112-v7

catenacyber commented Apr 25, 2022

Uh oh!

codecov bot commented Apr 25, 2022 •

edited

Loading

Uh oh!

jasonish commented Apr 25, 2022

Uh oh!

catenacyber commented Apr 25, 2022

Uh oh!

suricata-qa commented Apr 26, 2022

Uh oh!

victorjulien commented Apr 30, 2022

Uh oh!

victorjulien commented Apr 30, 2022

Uh oh!

catenacyber commented Apr 30, 2022

Uh oh!

catenacyber commented Apr 30, 2022

Uh oh!

pevma commented Apr 30, 2022

Uh oh!

catenacyber commented May 2, 2022

Uh oh!

Reviewers

Assignees

Labels

Milestone

Development

Uh oh!

5 participants

Conversation

catenacyber commented Apr 25, 2022

Uh oh!

codecov bot commented Apr 25, 2022 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Codecov Report

Uh oh!

jasonish commented Apr 25, 2022

Uh oh!

catenacyber commented Apr 25, 2022

Uh oh!

suricata-qa commented Apr 26, 2022

Uh oh!

victorjulien commented Apr 30, 2022

Uh oh!

victorjulien commented Apr 30, 2022

Uh oh!

catenacyber commented Apr 30, 2022

Uh oh!

catenacyber commented Apr 30, 2022

Uh oh!

pevma commented Apr 30, 2022

Uh oh!

catenacyber commented May 2, 2022

Uh oh!

Reviewers

Assignees

Labels

Milestone

Development

Uh oh!

5 participants

codecov bot commented Apr 25, 2022 •

edited

Loading