dcerpc: mimic gap behavior for invalid data#14890
Closed
Conversation
If invalid data is sent to the parser then instead of rejecting it at the first few bytes that do not conform to the header standards, mimic gap behavior and try to skip a few bytes until a possibly good DCERPC record is found. Ticket: 7251
|
WARNING:
Pipeline = 29852 |
Contributor
|
The SV test shows we lack support for multi-PDU, not that we need to "mimic gap behavior for invalid data" More details :
Because we do not support multi PDU, we drop the first bytes of PDU B, and porcessing packet 68 like it were a fresh PDU, we fail |
Contributor
|
@inashivb do you agree after our call that we should first implement multi-PDU support to fix the SV test ? |
catenacyber
requested changes
Mar 5, 2026
Contributor
catenacyber
left a comment
catenacyber
left a comment
There was a problem hiding this comment.
Needs rebase after the revert was merged
Contributor
|
I think this can be ckosed in favor of #15023 |
Member
Author
|
Closing as per comments by Philippe. |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Previous PR: #14829
Changes since v6:
Link to ticket: https://redmine.openinfosecfoundation.org/issues/7251
SV_BRANCH=OISF/suricata-verify#2904
Note: QA deviations on dcerpc stats are expected. The pcaps I got from QA lab showed no errors and an increased number of txs looking like the corresponding s-v test that was updated.