-
Notifications
You must be signed in to change notification settings - Fork 117
Decompress end v5 #447
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Decompress end v5 #447
Conversation
When a response ends in the middle of a chunk, signal it to the decompressors to let them finalize the data they got so far, as is done with content-length. Do this for all states of chunked content.
If a chunk length line was split in two packets, we buffered the end of the first packet/beginning of the line, and checked its validity. So, do not check further on second packet.
Passing a gap to a decompressor closes it, but if we also finish known content-length, we try to reclose decompressor and fail
I do not think there should be a libhtp release for 7.0.9 Should we have tickets for these + SV tests ? Fixing this means a bigger QA change (see #442 ) |
Passes UT + SV |
Information: ERROR: QA failed on SURI_TLPW1_files_sha256.
Pipeline 25103 |
Decrease in |
TL;DR LGTM sha files diff look good with same behavior as old OISF/suricata#12765 except for |
I confirm it is good QA result for OISF/suricata#12767 show same hashes |
Staging is running. |
Merged. Thanks! |
#446 with additional commit.
Waiting for QA, but looks good locally (sames hashes than libhtp.rs)
Reasons for patching libhtp.c for each commit :
decompressors: do not take data after end :
flate2.rs does not accept data after end cf https://docs.rs/flate2/latest/flate2/write/struct.DeflateDecoder.html#method.try_finish for instance and this seems right. libhtp.c used to restart new, fail, and switch to passthrough.
Cases happen because of (not perfectly handled) gaps
response: end decompressors in chunked content
libhtp.rs (by rust chained decoder construction) does not do the buffering up to 8192 bytes before flushing to C caller.
libhtp.c failed to flush some (gzipped) data in these cases (end of stream before file was complete)
chunks: abort asap on invalid chunk length and chunks: probe validity if data was not buffered
libhtp.rs looks more sane :
Cases happen because of (not perfectly handled) gaps
There may be more to do here in C but it looks minimal change to get same behavior for QA
libhtp.rs is just right doing in
response_body_data
the followingso I changed libhtp.c. To change libhtp.rs behavior instead, just remove the mentioned code and let it go through
let mut decompressor = resp.response_decompressor.take().ok_or(HtpStatus::ERROR)?;