Conversation
inashivb
left a comment
inashivb
left a comment
There was a problem hiding this comment.
Really nice work, @hsadia538 ! :)
Some questions and nits inline. Thank you for your work!
| alert mqtt any any -> any any (msg:"mqtt truncated Frame 7"; frame:data; content:"|0a|"; sid:7;) | ||
|
|
||
| # At boundary test for truncated data | ||
| alert mqtt any any -> any any (msg:"mqtt truncated Frame 8"; frame:data; content:"|51|"; sid:8;) |
There was a problem hiding this comment.
Could we add a few more bytes to ensure it is the truncated data that we want to be looking at. Unless 51 is a very unique character that only happens once at the boundary for MQTT?
There was a problem hiding this comment.
I am not sure what do you mean by adding more bytes. For this purpose of this rule, I counted the bytes up till a point where there is a boundary. Since after last update to frames, we are no longer making frames for truncated data so after this specific byte we don't get a match
There was a problem hiding this comment.
It looks like we get a match even after this specific byte cf #1365
There was a problem hiding this comment.
yep. did think that might happen. Thanks for picking this up! :)
| alert mqtt any any -> any any (msg:"mqtt truncated Frame 8"; frame:data; content:"|51|"; sid:8;) | ||
|
|
||
| # post-boundary test for truncated data | ||
| alert mqtt any any -> any any (msg:"mqtt truncated Frame 9"; frame:data; content:"|5b|"; sid:9;) No newline at end of file |
There was a problem hiding this comment.
I can add more bytes to the post boundary test
| @@ -0,0 +1,17 @@ | |||
| alert mqtt any any -> any any (msg:"mqtt truncated Frame 1"; frame:pdu; content:"|10 1c|"; startswith; sid:1;) | |||
There was a problem hiding this comment.
nit: msg indicates all these are truncated frames which from the matches does not seem to be true?
| min-version: 7 | ||
|
|
||
| args: | ||
| - -k none |
There was a problem hiding this comment.
nit: README mentions the pcap already exists. Can we try to deduplicate it w the pcap key here?
|
followed by #1177 |
3 participants
Ticket: https://redmine.openinfosecfoundation.org/issues/5731
Previous PR: #1123
Describe changes:
trunc.dataframes for truncated messagesRequires: OISF/suricata#8730