Bug #2169: dns/tcp: reponse traffic leads to 'app_proto_tc: failed' - Suricata - Open Information Security Foundation

Actions

Copy link

Bug #2169

closed

dns/tcp: reponse traffic leads to 'app_proto_tc: failed'

Added by Victor Julien over 7 years ago. Updated over 7 years ago.

Status:

Closed

Priority:

Normal

Assignee:

Jason Ish

Target version:

4.0.0

Affected Versions:

Effort:

Difficulty:

Label:

Description

Triggers "SURICATA Applayer Mismatch protocol both directions"

Tested with Rust, can provide pcap offline.

Actions

Copy link

Updated by Victor Julien over 7 years ago

Only happens with Rust it seems.

Actions

Copy link

Updated by Jason Ish over 7 years ago

This occurs when the probe function is called without all the data for the request or response. For TCP, the probe will fail if the amount of data is less than the length specified in the header.

The fix is to just remove this check. Strip the length, and if data is left pass to the normal probe function that will fail if there is not enough data to complete the probe.

Actions

Copy link