Next/20201230/v10 #5693
Merged
Next/20201230/v10 #5693
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Support for EtherType 0x894F and basic header
Useful for those that want to do custom logging from lua
Add tests to parse_nbss_record and parse_nbss_record_partial
Compilation of xdp_lb.c was failing in some case with the following error: /usr/include/x86_64-linux-gnu/gnu/stubs.h:7:11: fatal error: 'gnu/stubs-32.h' file not found This patch add some define to be able to skip recursive inclusion of header files leading to the problem.
Also update the erroneous comment about it.
Without this, a simple typo between : and ; is able to hide actual bugs in rules. I discovered 2 bugs in ET open ruleset this way.
victorjulien
requested review from
jasonish,
norg,
regit and
a team
as code owners
This was referenced Dec 31, 2020
Closed
lukashino
pushed a commit
to lukashino/suricata
that referenced
this pull request
Nov 18, 2022
If the original packet is shorter than Ethernet's minimal transmission unit (64B), the transmitting device pads packet to the given size. Padding is added to the IP layer but UDP layer remaing unaffected. As a result, UDP header length does not reach end of the packet as there is still padding after the UDP layer. Redmine ticket: OISF#5693
lukashino
pushed a commit
to lukashino/suricata
that referenced
this pull request
Nov 18, 2022
If the original packet is shorter than Ethernet's minimal transmission unit (64B), the transmitting device pads the packet to the given size. Padding is added to the IP layer but the UDP layer remains unaffected. As a result, the UDP header length does not reach the end of the packet as there is still padding after the UDP layer. Redmine ticket: OISF#5693
lukashino
pushed a commit
to lukashino/suricata
that referenced
this pull request
Nov 25, 2022
…d length If the packet is shorter than IP payload length we no longer flag it as an invalid UDP packet. UDP packet can be therefore shorter than IP payload. Redmine ticket: OISF#5693
lukashino
pushed a commit
to lukashino/suricata
that referenced
this pull request
Nov 25, 2022
If the packet is shorter than IP payload length we no longer flag it as an invalid UDP packet. UDP packet can be therefore shorter than IP payload. Redmine ticket: OISF#5693
lukashino
pushed a commit
to lukashino/suricata
that referenced
this pull request
Nov 25, 2022
If the packet is shorter than IP payload length we no longer flag it as an invalid UDP packet. UDP packet can be therefore shorter than IP payload. Redmine ticket: OISF#5693
lukashino
pushed a commit
to lukashino/suricata
that referenced
this pull request
Nov 26, 2022
If the packet is shorter than IP payload length we no longer flag it as an invalid UDP packet. UDP packet can be therefore shorter than IP payload. Redmine ticket: OISF#5693
lukashino
pushed a commit
to lukashino/suricata
that referenced
this pull request
Nov 26, 2022
If the packet is shorter than IP payload length we no longer flag it as an invalid UDP packet. UDP packet can be therefore shorter than IP payload. Redmine ticket: OISF#5693
lukashino
pushed a commit
to lukashino/suricata
that referenced
this pull request
Jan 4, 2023
If the packet is shorter than IP payload length we no longer flag it as an invalid UDP packet. UDP packet can be therefore shorter than IP payload. Redmine ticket: OISF#5693
inashivb
pushed a commit
to inashivb/suricata
that referenced
this pull request
Jan 18, 2023
If the packet is shorter than IP payload length we no longer flag it as an invalid UDP packet. UDP packet can be therefore shorter than IP payload. Redmine ticket: OISF#5693
lukashino
pushed a commit
to lukashino/suricata
that referenced
this pull request
Jan 19, 2023
If the packet is shorter than IP payload length we no longer flag it as an invalid UDP packet. UDP packet can be therefore shorter than IP payload. Keyword "udp.hlen_invalid" became outdated as we no longer flag short UDP packets as invalid. Redmine ticket: OISF#5693
inashivb
pushed a commit
to inashivb/suricata
that referenced
this pull request
Jan 20, 2023
If the packet is shorter than IP payload length we no longer flag it as an invalid UDP packet. UDP packet can be therefore shorter than IP payload. Redmine ticket: OISF#5693
inashivb
pushed a commit
to inashivb/suricata
that referenced
this pull request
Jan 25, 2023
If the packet is shorter than IP payload length we no longer flag it as an invalid UDP packet. UDP packet can be therefore shorter than IP payload. Keyword "udp.hlen_invalid" became outdated as we no longer flag short UDP packets as invalid. Redmine ticket: OISF#5693
victorjulien
pushed a commit
to victorjulien/suricata
that referenced
this pull request
Jan 26, 2023
If the packet is shorter than IP payload length we no longer flag it as an invalid UDP packet. UDP packet can be therefore shorter than IP payload. Keyword "udp.hlen_invalid" became outdated as we no longer flag short UDP packets as invalid. Redmine ticket: OISF#5693
lukashino
added a commit
to lukashino/suricata
that referenced
this pull request
Jan 27, 2023
If the packet is shorter than IP payload length we no longer flag it as an invalid UDP packet. UDP packet can be therefore shorter than IP payload. Keyword "udp.hlen_invalid" became outdated as we no longer flag short UDP packets as invalid. The keyword's evaluation remains the same. Inspired by commit: d18e52e Redmine ticket: OISF#5693
lukashino
pushed a commit
to lukashino/suricata
that referenced
this pull request
Jan 27, 2023
If the packet is shorter than IP payload length we no longer flag it as an invalid UDP packet. UDP packet can be therefore shorter than IP payload. Keyword "udp.hlen_invalid" became outdated as we no longer flag short UDP packets as invalid. The keyword's evaluation remains the same. Inspired by commit: d18e52e Redmine ticket: OISF#5693
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
#5309 #5300 by @carlgsmith
#5243 by @JoshuaLumb
#4941 by @internetionals
#5692 by @jufajardini
cherry-pick 6a3715d by @regit
#5687 by @regit
#5661 by @giannitedesco
#5651 by @satta
stream fixes