Project

General

Profile

Actions
Copy link

Bug #3375

open

Tracking: file tracking/inspection performance issues

Added by Victor Julien almost 5 years ago. Updated about 1 year ago.

Status:
New
Priority:
Normal
Assignee:
Victor Julien
Target version:
8.0.0-beta1
Affected Versions:
4.1.5, 5.0.0
Effort:
Difficulty:
Label:

Description

In certain cases we can see the PrefilterTxFiledata at the top of perf measurements. This has uncovered various issues:

SMTP: tx id not set on files
SMTP: 'raw-message' as files support doesn't set files up properly
SMB: post-GAP we can have dangling txs that are neither updated nor closed

HTTP: pipelining requests can operate on wrong files (and set events in wrong tx)

Related issues 16 (1 open — 15 closed)

Related to Suricata - Bug #3376: http: pipelining tx id handling brokenClosedVictor JulienActions
Related to Suricata - Bug #3397: smtp: file tracking issues when more than one attachment in a txClosedVictor JulienActions
Related to Suricata - Bug #3398: smtp: 'raw-message' option file tracking issues with multi-txClosedVictor JulienActions
Related to Suricata - Bug #3399: smb: post-GAP some transactions never closeClosedVictor JulienActions
Related to Suricata - Bug #3400: smb: post-GAP file tx handlingClosedVictor JulienActions
Related to Suricata - Bug #3401: smb1: 'event only' transactions for bad requests never closeClosedVictor JulienActions
Related to Suricata - Bug #3393: http: pipelining tx id handling broken (4.1.x)ClosedVictor JulienActions
Related to Suricata - Bug #3404: smtp: file tracking issues when more than one attachment in a tx (4.1.x)ClosedVictor JulienActions
Related to Suricata - Bug #3403: smb1: 'event only' transactions for bad requests never close (4.1.x)ClosedVictor JulienActions
Related to Suricata - Bug #3402: smb: post-GAP some transactions never close (4.1.x)ClosedVictor JulienActions
Related to Suricata - Bug #3424: nfs: post-GAP some transactions never closeClosedVictor JulienActions
Related to Suricata - Bug #3425: nfs: post-GAP file tx handlingClosedVictor JulienActions
Related to Suricata - Bug #3699: smb: post-GAP file handlingClosedVictor JulienActions
Related to Suricata - Bug #3700: nfs: post-GAP file handlingClosedVictor JulienActions
Related to Suricata - Task #4444: files: store files in transactions instead of per flow stateClosedVictor JulienActions
Related to Suricata - Task #6217: research: increased tcp.overlap after file data changesNewVictor JulienActions
Actions
Copy link

Also available in: Atom PDF