Batch backports to master-5.0.x

scripts/dnp3-gen/dnp3-gen.py

@@ -175,7 +175,7 @@
             json_object_set_new(js, "{{field.name}}",
                 json_real(data->{{field.name}}));
 {% elif field.type == "bytearray" %}
-            unsigned long {{field.name}}_b64_len = data->{{field.len_field}} * 2;
+            unsigned long {{field.name}}_b64_len = BASE64_BUFFER_SIZE(data->{{field.len_field}});
             uint8_t {{field.name}}_b64[{{field.name}}_b64_len];
             Base64Encode(data->{{field.name}}, data->{{field.len_field}},
                 {{field.name}}_b64, &{{field.name}}_b64_len);
@@ -524,6 +524,9 @@ def gen_object_decoders(context):
         }
 {% elif field.type == "chararray" %}
 {% if field.len_from_prefix %}
+        if (prefix - (offset - *len) >= {{field.size}}) {
+            goto error;
+        }
         object->{{field.len_field}} = prefix - (offset - *len);
 {% endif %}
         if (object->{{field.len_field}} > 0) {

src/app-layer-dnp3-objects.c

@@ -7153,6 +7153,9 @@ static int DNP3DecodeObjectG70V4(const uint8_t **buf, uint32_t *len,
         if (!DNP3ReadUint8(buf, len, &object->status_code)) {
             goto error;
         }
+        if (prefix - (offset - *len) >= 255) {
+          goto error;
+        }
         object->optional_text_len = prefix - (offset - *len);
         if (object->optional_text_len > 0) {
             if (*len < object->optional_text_len) {
@@ -7217,6 +7220,9 @@ static int DNP3DecodeObjectG70V5(const uint8_t **buf, uint32_t *len,
         if (!DNP3ReadUint32(buf, len, &object->block_number)) {
             goto error;
         }
+        if (prefix - (offset - *len) >= 255) {
+          goto error;
+        }
         object->file_data_len = prefix - (offset - *len);
         if (object->file_data_len > 0) {
             if (*len < object->file_data_len) {
@@ -7284,6 +7290,9 @@ static int DNP3DecodeObjectG70V6(const uint8_t **buf, uint32_t *len,
         if (!DNP3ReadUint8(buf, len, &object->status_code)) {
             goto error;
         }
+        if (prefix - (offset - *len) >= 255) {
+          goto error;
+        }
         object->optional_text_len = prefix - (offset - *len);
         if (object->optional_text_len > 0) {
             if (*len < object->optional_text_len) {
@@ -7413,6 +7422,9 @@ static int DNP3DecodeObjectG70V8(const uint8_t **buf, uint32_t *len,
 
         offset = *len;
 
+        if (prefix - (offset - *len) >= 65535) {
+          goto error;
+        }
         object->file_specification_len = prefix - (offset - *len);
         if (object->file_specification_len > 0) {
             if (*len < object->file_specification_len) {
@@ -8158,6 +8170,9 @@ static int DNP3DecodeObjectG120V7(const uint8_t **buf, uint32_t *len,
         if (!DNP3ReadUint48(buf, len, &object->time_of_error)) {
             goto error;
         }
+        if (prefix - (offset - *len) >= 65535) {
+          goto error;
+        }
         object->error_text_len = prefix - (offset - *len);
         if (object->error_text_len > 0) {
             if (*len < object->error_text_len) {

src/app-layer.c

@@ -1,4 +1,4 @@
-/* Copyright (C) 2007-2011 Open Information Security Foundation
+/* Copyright (C) 2007-2021 Open Information Security Foundation
  *
  * You can copy, redistribute or modify this Program under the terms of
  * the GNU General Public License version 2 as published by the Free
@@ -204,68 +204,64 @@ static void TCPProtoDetectCheckBailConditions(ThreadVars *tv,
         return;
     }
 
-    uint32_t size_ts = ssn->client.last_ack - ssn->client.isn - 1;
-    uint32_t size_tc = ssn->server.last_ack - ssn->server.isn - 1;
-    SCLogDebug("size_ts %u, size_tc %u", size_ts, size_tc);
+    const uint32_t size_ts = StreamDataAvailableForProtoDetect(&ssn->client);
+    const uint32_t size_tc = StreamDataAvailableForProtoDetect(&ssn->server);
+    SCLogDebug("size_ts %" PRIu32 ", size_tc %" PRIu32, size_ts, size_tc);
 
-#ifdef DEBUG_VALIDATION
-    if (!(ssn->client.flags & STREAMTCP_STREAM_FLAG_GAP))
-        BUG_ON(size_ts > 1000000UL);
-    if (!(ssn->server.flags & STREAMTCP_STREAM_FLAG_GAP))
-        BUG_ON(size_tc > 1000000UL);
-#endif /* DEBUG_VALIDATION */
+    /* at least 100000 whatever the conditions
+     * and can be more if window is bigger and if configuration allows it */
+    const uint32_t size_tc_limit =
+        MAX(100000, MIN(ssn->client.window, stream_config.reassembly_depth));
+    const uint32_t size_ts_limit =
+        MAX(100000, MIN(ssn->server.window, stream_config.reassembly_depth));
 
     if (ProtoDetectDone(f, ssn, STREAM_TOSERVER) &&
         ProtoDetectDone(f, ssn, STREAM_TOCLIENT))
     {
         goto failure;
 
-    } else if (FLOW_IS_PM_DONE(f, STREAM_TOSERVER) && FLOW_IS_PP_DONE(f, STREAM_TOSERVER) &&
-            size_ts > 100000 && size_tc == 0)
-    {
-        AppLayerDecoderEventsSetEventRaw(&p->app_layer_events,
-                APPLAYER_PROTO_DETECTION_SKIPPED);
-        goto failure;
-
-    } else if (FLOW_IS_PM_DONE(f, STREAM_TOCLIENT) && FLOW_IS_PP_DONE(f, STREAM_TOCLIENT) &&
-            size_tc > 100000 && size_ts == 0)
-    {
-        AppLayerDecoderEventsSetEventRaw(&p->app_layer_events,
-                APPLAYER_PROTO_DETECTION_SKIPPED);
-        goto failure;
-
-    /* little data in ts direction, pp done, pm not done (max
-     * depth not reached), ts direction done, lots of data in
-     * tc direction. */
-    } else if (size_tc > 100000 &&
-            FLOW_IS_PP_DONE(f, STREAM_TOSERVER) && !(FLOW_IS_PM_DONE(f, STREAM_TOSERVER)) &&
-            FLOW_IS_PM_DONE(f, STREAM_TOCLIENT) && FLOW_IS_PP_DONE(f, STREAM_TOCLIENT))
-    {
-        AppLayerDecoderEventsSetEventRaw(&p->app_layer_events,
-                APPLAYER_PROTO_DETECTION_SKIPPED);
-        goto failure;
-
-    /* little data in tc direction, pp done, pm not done (max
-     * depth not reached), tc direction done, lots of data in
-     * ts direction. */
-    } else if (size_ts > 100000 &&
-            FLOW_IS_PP_DONE(f, STREAM_TOCLIENT) && !(FLOW_IS_PM_DONE(f, STREAM_TOCLIENT)) &&
-            FLOW_IS_PM_DONE(f, STREAM_TOSERVER) && FLOW_IS_PP_DONE(f, STREAM_TOSERVER))
-    {
-        AppLayerDecoderEventsSetEventRaw(&p->app_layer_events,
-                APPLAYER_PROTO_DETECTION_SKIPPED);
-        goto failure;
-
-    /* in case of really low TS data (e.g. 4 bytes) we can have
-     * the PP complete, PM not complete (depth not reached) and
-     * the TC side also not recognized (proto unknown) */
-    } else if (size_tc > 100000 &&
-            FLOW_IS_PP_DONE(f, STREAM_TOSERVER) && !(FLOW_IS_PM_DONE(f, STREAM_TOSERVER)) &&
-            (!FLOW_IS_PM_DONE(f, STREAM_TOCLIENT) && !FLOW_IS_PP_DONE(f, STREAM_TOCLIENT)))
-    {
-        AppLayerDecoderEventsSetEventRaw(&p->app_layer_events,
-                APPLAYER_PROTO_DETECTION_SKIPPED);
-        goto failure;
+        /* we bail out whatever the pp and pm states if
+         * we received too much data */
+    } else if (size_tc > 2 * size_tc_limit || size_ts > 2 * size_ts_limit) {
+      AppLayerDecoderEventsSetEventRaw(&p->app_layer_events,
+                                       APPLAYER_PROTO_DETECTION_SKIPPED);
+      goto failure;
+
+    } else if (FLOW_IS_PM_DONE(f, STREAM_TOSERVER) &&
+               FLOW_IS_PP_DONE(f, STREAM_TOSERVER) && size_ts > size_ts_limit &&
+               size_tc == 0) {
+      AppLayerDecoderEventsSetEventRaw(&p->app_layer_events,
+                                       APPLAYER_PROTO_DETECTION_SKIPPED);
+      goto failure;
+
+    } else if (FLOW_IS_PM_DONE(f, STREAM_TOCLIENT) &&
+               FLOW_IS_PP_DONE(f, STREAM_TOCLIENT) && size_tc > size_tc_limit &&
+               size_ts == 0) {
+      AppLayerDecoderEventsSetEventRaw(&p->app_layer_events,
+                                       APPLAYER_PROTO_DETECTION_SKIPPED);
+      goto failure;
+
+      /* little data in ts direction, pp done, pm not done (max
+       * depth not reached), ts direction done, lots of data in
+       * tc direction. */
+    } else if (size_tc > size_tc_limit && FLOW_IS_PP_DONE(f, STREAM_TOSERVER) &&
+               !(FLOW_IS_PM_DONE(f, STREAM_TOSERVER)) &&
+               FLOW_IS_PM_DONE(f, STREAM_TOCLIENT) &&
+               FLOW_IS_PP_DONE(f, STREAM_TOCLIENT)) {
+      AppLayerDecoderEventsSetEventRaw(&p->app_layer_events,
+                                       APPLAYER_PROTO_DETECTION_SKIPPED);
+      goto failure;
+
+      /* little data in tc direction, pp done, pm not done (max
+       * depth not reached), tc direction done, lots of data in
+       * ts direction. */
+    } else if (size_ts > size_ts_limit && FLOW_IS_PP_DONE(f, STREAM_TOCLIENT) &&
+               !(FLOW_IS_PM_DONE(f, STREAM_TOCLIENT)) &&
+               FLOW_IS_PM_DONE(f, STREAM_TOSERVER) &&
+               FLOW_IS_PP_DONE(f, STREAM_TOSERVER)) {
+      AppLayerDecoderEventsSetEventRaw(&p->app_layer_events,
+                                       APPLAYER_PROTO_DETECTION_SKIPPED);
+      goto failure;
     }
     return;
 

src/counters.c

@@ -837,6 +837,9 @@ TmEcode StatsOutputCounterSocket(json_t *cmd,
 
 static void StatsLogSummary(void)
 {
+  if (!stats_enabled) {
+    return;
+  }
     uint64_t alerts = 0;
     SCMutexLock(&stats_table_mutex);
     if (stats_table.start_time != 0) {

src/stream-tcp-reassemble.c

@@ -580,6 +580,19 @@ static uint32_t StreamTcpReassembleCheckDepth(TcpSession *ssn, TcpStream *stream
     SCReturnUInt(0);
 }
 
+uint32_t StreamDataAvailableForProtoDetect(TcpStream *stream) {
+  if (RB_EMPTY(&stream->sb.sbb_tree)) {
+    if (stream->sb.stream_offset != 0)
+      return 0;
+
+    return stream->sb.buf_offset;
+  } else {
+    DEBUG_VALIDATE_BUG_ON(stream->sb.head == NULL);
+    DEBUG_VALIDATE_BUG_ON(stream->sb.sbb_size == 0);
+    return stream->sb.sbb_size;
+  }
+}
+
 /**
  *  \brief Insert a packets TCP data into the stream reassembly engine.
  *

src/stream-tcp-reassemble.h

@@ -140,5 +140,7 @@ static inline bool STREAM_LASTACK_GT_BASESEQ(const TcpStream *stream)
     return false;
 }
 
+uint32_t StreamDataAvailableForProtoDetect(TcpStream *stream);
+
 #endif /* __STREAM_TCP_REASSEMBLE_H__ */
 

src/stream-tcp.c

@@ -80,8 +80,8 @@
 //#define DEBUG
 
 #define STREAMTCP_DEFAULT_PREALLOC              2048
-#define STREAMTCP_DEFAULT_MEMCAP                (32 * 1024 * 1024) /* 32mb */
-#define STREAMTCP_DEFAULT_REASSEMBLY_MEMCAP     (64 * 1024 * 1024) /* 64mb */
+#define STREAMTCP_DEFAULT_MEMCAP (64 * 1024 * 1024)             /* 64mb */
+#define STREAMTCP_DEFAULT_REASSEMBLY_MEMCAP (256 * 1024 * 1024) /* 256mb */
 #define STREAMTCP_DEFAULT_TOSERVER_CHUNK_SIZE   2560
 #define STREAMTCP_DEFAULT_TOCLIENT_CHUNK_SIZE   2560
 #define STREAMTCP_DEFAULT_MAX_SYNACK_QUEUED     5