Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

6.0.x: issue 5868: file_data fix for http1 response files - v4 #9140

Closed
wants to merge 1 commit into from
Closed

6.0.x: issue 5868: file_data fix for http1 response files - v4 #9140

wants to merge 1 commit into from

Conversation

jasonish
Copy link
Member

@jasonish jasonish commented Jul 3, 2023

@jasonish
http(1): depend on detection engine for file pruning
c2059f6 
Enables the pruning logic allowing for file_data to work on http1
response bodies.

Ticket: OISF#5868
@jasonish jasonish requested a review from a team as a code owner July 3, 2023 19:05
@jasonish jasonish mentioned this pull request Jul 3, 2023
Closed
victorjulien
victorjulien requested changes Jul 3, 2023
View reviewed changes
Copy link
Member

@victorjulien victorjulien left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This is not the correct approach.

Can't just set this flag and expect things to work.

@victorjulien
Copy link
Member

Also still missing a full analysis of the problem.

@jasonish
Copy link
Member Author

jasonish commented Jul 3, 2023

My analysis hasn't really changed. Given a rule like:

alert http any any -> any any (msg:"PDF LOGO"; flow:established,to_client; file_data; content:"PDF"; filestore; classtype:policy-violation; sid:9000000; rev:1;)

the file is stored, but 0 size, due to the pruning logic at https://github.com/OISF/suricata/blob/master-6.0.x/src/util-file.c#L382. Applying the pruning logic when FILE_USE_DETECT is set (https://github.com/OISF/suricata/blob/master-6.0.x/src/util-file.c#L358), does fix this as shown by the S-V test.

No new information here. I've asked for help/pointers to take this further given it fixes that failing test case.

@victorjulien
Copy link
Member

Analysis needs to go into the commit and needs to go deeper than describing that something doesn't work. See #9063 (comment) for a start.

On the flag, it will have side effects that need to be described (e.g. different mechanics used for tracking progress). The fact that all of these things are missing suggest to me that this is more of a hack than a properly researched solution.

@jasonish
Copy link
Member Author

jasonish commented Jul 4, 2023

Ok, I agree, further analysis in the bug. But due to the limited use FILE_USE_DETECT, side affects seem limited to changed the pruning logic.

But as this is the wrong approach, this is where I'm asking for help. I don't know what I don't know here to approach it from a different angle. #9063 (comment) suggests a different approach applicable to 7, but not in 6.

Note: Also appears to fix https://redmine.openinfosecfoundation.org/issues/6170

@jasonish jasonish closed this Jul 4, 2023
@jasonish jasonish deleted the 6.0.x-issue-5868-filestore-zero-size/v4 branch February 8, 2024 15:59
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers

@victorjulien victorjulien victorjulien requested changes

Assignees
No one assigned
Labels
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.
2 participants
@jasonish @victorjulien