Fix dns in tcp flow not detected

[zagge-cgeo]

This fixes issue 4759. The problem is, that when tcp rules are active in case of a tcp dns connection first the server to client is inspected and nothing found. Afterwards the full flow is marked as processed and therefore the dns query in TCP is not found.

Fixed problems found by fuzzing. Thanks to Jason Ish for the help.

Make sure these boxes are signed before submitting your Pull Request -- thank you.

• [ x] I have read the contributing guide lines at https://redmine.openinfosecfoundation.org/projects/suricata/wiki/Contributing
• [ x] I have signed the Open Information Security Foundation contribution agreement at https://suricata.io/about/contribution-agreement/

Link to redmine ticket: https://redmine.openinfosecfoundation.org/issues/4759

Describe changes: Fixed problems found by fuzzing.

This replaces https://github.com/OISF/suricata/pull/7693

[codecov[bot]]

Codecov Report

Merging #7835 (aacaa55) into master (bb2e111) will decrease coverage by 0.12%. The diff coverage is n/a.

@@            Coverage Diff             @@
##           master    #7835      +/-   ##
==========================================
- Coverage   76.10%   75.97%   -0.13%     
==========================================
  Files         663      663              
  Lines      185889   185887       -2     
==========================================
- Hits       141467   141231     -236     
- Misses      44422    44656     +234     

Flag	Coverage Δ
fuzzcorpus	60.79% <ø> (-0.23%)	:arrow_down:
suricata-verify	52.51% <ø> (-0.08%)	:arrow_down:
unittests	60.70% <ø> (+<0.01%)	:arrow_up:

Flags with carried forward coverage won't be shown. Click here to find out more.

[zagge-cgeo]

What is the status with this pull request? Any change to get it merged?

[jufajardini]

What is the status with this pull request? Any change to get it merged?

Hi! From the label added by Victor, I assume he would like to have a suricata-verify test to go with this. :)

[zagge-cgeo]

I have created a test for suricata-verify that fails without the patch. What is the way to go forward with the patch?

[zagge-cgeo]

@zagge-cgeo thanks for your first contribution to our project! :) I asked for some minor changes.

I could not find the suricata-verify test you created for this in https://github.com/OISF/suricata-verify/pulls Could you please make sure the PR is there and add that PR number to the suricata PR description? e.g. #8042 See suricata-verify-pr: ...

As I did not know how this is handled I had not created the PR yet. This is now done you can find it here:

suricata-verify-pr: https://github.com/OISF/suricata-verify/pull/967

I will work on the thing you pointed out and create a new PR.

Thanks for you help.

[jufajardini]

Replaced by: https://github.com/OISF/suricata/pull/8056