SDP: implements sticky buffers #11877

glongo · 2024-10-04T13:38:57Z

Make sure these boxes are checked accordingly before submitting your Pull Request -- thank you.

Contribution style:

I have read the contributing guide lines at
https://docs.suricata.io/en/latest/devguide/contributing/contribution-process.html

Our Contribution agreements:

I have signed the Open Information Security Foundation contribution agreement at
https://suricata.io/about/contribution-agreement/ (note: this is only required once)

Changes (if applicable):

I have updated the User Guide (in doc/userguide/) to reflect the changes made
I have updated the JSON schema (in etc/schema.json) to reflect all logging changes
(including schema descriptions)
I have created a ticket at
https://redmine.openinfosecfoundation.org/projects/suricata/issues

Link to ticket: https://redmine.openinfosecfoundation.org/issues/

Describe changes:

Sticky buffers for SDP have been implemented.
sdp.media.bandwidth and sdp.media.attribute sticky buffers have not been implemented yet because the media field is a vector of MediaDescription, and both the bandwidth and attribute fields are vectors as well.
I believe the multi-buffer API cannot handle such a situation.
If I'm not mistaken, a simple solution could be to "stringify" these fields like this:

"media_description": {
    "bandwidth": "AS:64,AS:65,AS:66",
    "attribute": "sendonly,recvonly"
}

Media's encryption key is logged now.

Personal considerations:

The sdp.media.* sticky buffers were initially meant to be named sdp.media_descriptions.*, but I realized the names were too long. I wonder if I should rename the media_description field to media for consistency.
I don't like the name sdp.media.media; I would prefer to rename it to sdp.media.name, or just sdp.media, and adjust the logged field name if necessary.

SV_BRANCH=OISF/suricata-verify#2076

The encryption key subfield of the media description field is not logged when it should be. Ticket OISF#7305

The current parser implementations take a field, such as connection data, and split it into subfields for a specific structure (e.g., struct ConnectionData). However, following this approach requires several sticky buffers to match the whole field, which can make a rule a bit verbose and doesn't offer any advantage for matching specific parts of a field. With this patch, a single line is still split into pieces if it makes sense for parsing purposes, but these pieces are then reassembled into a single string. This way, only one sticky buffer is needed to match the entire field. Ticket OISF#7291

This adds a sticky buffer to match the "Session name" field in both requests and responses. Ticket OISF#7291

This adds a sticky buffer to match the "Session information" field in both requests and responses. Ticket OISF#7291

This adds a sticky buffer to match the "Origin" field in both requests and responses. Ticket OISF#7291

This adds a sticky buffer to match the "Uri" field in both requests and responses. Ticket OISF#7291

This adds a sticky buffer to match the "Email" field in both requests and responses. Ticket OISF#7291

This adds a sticky buffer to match the "Phone number" field in both requests and responses. Ticket OISF#7291

This adds a sticky buffer to match the "Connection data" field in both requests and responses. Ticket OISF#7291

This adds a sticky (multi) buffer to match the "Bandwidth" field in both requests and responses. Ticket OISF#7291

This adds a sticky buffer to match the "Time" field in both requests and responses. Ticket OISF#7291

This adds a sticky buffer to match the "Repeat time" field in both requests and responses. Ticket OISF#7291

This adds a sticky bufffer to match the "Timezone" field in both requests and responses. Ticket OISF#7291

This adds a sticky buffer to match the "Encryption key" field in both requests and responses. Ticket OISF#7291

This adds a sticky (multi) buffer to match the "Attribute" field in both requests and responses. Ticket OISF#7291

This adds a sticky (multi) buffer to match the "Media" subfield of the "Media description" field in both requests and responses. Ticket OISF#7291

This adds a stick (multi) buffer to match the "Session information" subfield of the "Media description" field in both requests and responses. Ticket OISF#7291

This adds a sticky (multi) buffer to match the "Connection data" subfield of the "Media description" field in both requests and responses. Ticket OISF#7291

This adds a sticky (multi) buffer to match the "Encryption key" subfield of the "Media description" field in both requests and responses. Ticket OISF#7291

codecov · 2024-10-04T14:13:09Z

Codecov Report

Attention: Patch coverage is 92.07921% with 80 lines in your changes missing coverage. Please review.

Project coverage is 82.65%. Comparing base (501f79c) to head (43dafab).
Report is 4 commits behind head on master.

Additional details and impacted files

@@            Coverage Diff             @@
##           master   #11877      +/-   ##
==========================================
+ Coverage   82.56%   82.65%   +0.08%     
==========================================
  Files         912      913       +1     
  Lines      249354   250254     +900     
==========================================
+ Hits       205880   206835     +955     
+ Misses      43474    43419      -55

Flag	Coverage Δ
fuzzcorpus	`60.44% <34.89%> (-0.03%)`	⬇️
livemode	`18.85% <31.90%> (+0.12%)`	⬆️
pcap	`44.04% <35.09%> (-0.05%)`	⬇️
suricata-verify	`62.18% <91.72%> (+0.18%)`	⬆️
unittests	`58.83% <35.24%> (-0.11%)`	⬇️

Flags with carried forward coverage won't be shown. Click here to find out more.

victorjulien · 2024-10-04T15:10:46Z

rust/src/sdp/detect.rs

+    };
+    if let Some(sdp) = sdp_message {
+        let session_name = &sdp.session_name;
+        if !session_name.is_empty() {


should we return an empty buffer so we can match on sdp.session_name; bsize:0;?

This field is mandatory, the parser will fail if it's not found. However, this approach might make sense for optional fields, such as session information.

I think this code should suggest it can be empty then.

Should a rule like sdp.session_info; bsize:0 trigger an alert if the session_info field is not present at all?

No, cf #11906 which adds absent keyword to match when the field is not present

glongo added 19 commits October 4, 2024 14:47

sdp: log media's encryption key

cbe2942

The encryption key subfield of the media description field is not logged when it should be. Ticket OISF#7305

sdp: add sdp.session_name sticky buffer

bc81645

This adds a sticky buffer to match the "Session name" field in both requests and responses. Ticket OISF#7291

sdp: add sdp.session_info sticky buffer

1d022e6

This adds a sticky buffer to match the "Session information" field in both requests and responses. Ticket OISF#7291

sdp: add sdp.origin sticky buffer

85e2291

This adds a sticky buffer to match the "Origin" field in both requests and responses. Ticket OISF#7291

sdp: add sdp.uri sticky buffer

7f8b708

This adds a sticky buffer to match the "Uri" field in both requests and responses. Ticket OISF#7291

sdp: add sdp.email sticky buffer

04a70b6

This adds a sticky buffer to match the "Email" field in both requests and responses. Ticket OISF#7291

sdp: add sdp.phone_number sticky buffer

393cf78

This adds a sticky buffer to match the "Phone number" field in both requests and responses. Ticket OISF#7291

sdp: add sdp.connection_data sticky buffer

1b2940c

This adds a sticky buffer to match the "Connection data" field in both requests and responses. Ticket OISF#7291

sdp: add sdp.bandwidth sticky buffer

7bf483f

This adds a sticky (multi) buffer to match the "Bandwidth" field in both requests and responses. Ticket OISF#7291

sdp: add sdp.time sticky buffer

038615d

This adds a sticky buffer to match the "Time" field in both requests and responses. Ticket OISF#7291

sdp: add sdp.repeat_time sticky buffer

22a2ee7

This adds a sticky buffer to match the "Repeat time" field in both requests and responses. Ticket OISF#7291

sdp: add sdp.timezone sticky buffer

af79058

This adds a sticky bufffer to match the "Timezone" field in both requests and responses. Ticket OISF#7291

sdp: add sdp.encryption_key sticky buffer

dcf92f9

This adds a sticky buffer to match the "Encryption key" field in both requests and responses. Ticket OISF#7291

sdp: add sdp.attribute sticky buffer

1c32f1b

This adds a sticky (multi) buffer to match the "Attribute" field in both requests and responses. Ticket OISF#7291

sdp: add sdp.media.media sticky buffer

f9a9ee7

This adds a sticky (multi) buffer to match the "Media" subfield of the "Media description" field in both requests and responses. Ticket OISF#7291

sdp: add sdp.media.media_info sticky buffer

adf25a8

This adds a stick (multi) buffer to match the "Session information" subfield of the "Media description" field in both requests and responses. Ticket OISF#7291

sdp: add sdp.media.connection_data sticky buffer

7513966

This adds a sticky (multi) buffer to match the "Connection data" subfield of the "Media description" field in both requests and responses. Ticket OISF#7291

sdp: add sdp.media.encryption_key sticky buffer

43dafab

This adds a sticky (multi) buffer to match the "Encryption key" subfield of the "Media description" field in both requests and responses. Ticket OISF#7291

glongo requested review from jasonish, jufajardini, victorjulien and a team as code owners October 4, 2024 13:38

victorjulien reviewed Oct 4, 2024

View reviewed changes

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

SDP: implements sticky buffers #11877

SDP: implements sticky buffers #11877

glongo commented Oct 4, 2024

codecov bot commented Oct 4, 2024 •

edited

Loading

victorjulien Oct 4, 2024

glongo Oct 4, 2024 •

edited

Loading

victorjulien Oct 4, 2024

glongo Oct 9, 2024

catenacyber Oct 9, 2024

SDP: implements sticky buffers #11877

Are you sure you want to change the base?

SDP: implements sticky buffers #11877

Conversation

glongo commented Oct 4, 2024

Contribution style:

Our Contribution agreements:

Changes (if applicable):

codecov bot commented Oct 4, 2024 • edited Loading

Codecov Report

victorjulien Oct 4, 2024

Choose a reason for hiding this comment

glongo Oct 4, 2024 • edited Loading

Choose a reason for hiding this comment

victorjulien Oct 4, 2024

Choose a reason for hiding this comment

glongo Oct 9, 2024

Choose a reason for hiding this comment

catenacyber Oct 9, 2024

Choose a reason for hiding this comment

codecov bot commented Oct 4, 2024 •

edited

Loading

glongo Oct 4, 2024 •

edited

Loading