suricata icon indicating copy to clipboard operation
suricata copied to clipboard

bittorrent-dht: add bittorrent-dht app-layer parser - v9

Open jasonish opened this issue 2 years ago • 7 comments

Parses and logs the bittorrent-dht protocol.

Feature: https://redmine.openinfosecfoundation.org/issues/3086

Previous PR: https://github.com/OISF/suricata/pull/7731

Changes since last PR:

  • parse value lists into a list of peer data structures
  • add nodes6 parsing for lists of ipv6 nodes
  • log nodes and peers more like wireshark

Reference BitTorrent DHT specification: https://www.bittorrent.org/beps/bep_0005.html

TODO:

  • Revisit documentation

suricata-verify-pr: 930

jasonish avatar Sep 08 '22 18:09 jasonish

Codecov Report

Merging #7838 (06a4473) into master (bb2e111) will decrease coverage by 0.25%. The diff coverage is 63.95%.

@@            Coverage Diff             @@
##           master    #7838      +/-   ##
==========================================
- Coverage   76.10%   75.84%   -0.26%     
==========================================
  Files         663      666       +3     
  Lines      185889   186047     +158     
==========================================
- Hits       141467   141111     -356     
- Misses      44422    44936     +514     
Flag Coverage Δ
fuzzcorpus 60.47% <9.09%> (-0.54%) :arrow_down:
suricata-verify 52.59% <66.26%> (-0.01%) :arrow_down:
unittests 60.67% <8.97%> (-0.03%) :arrow_down:

Flags with carried forward coverage won't be shown. Click here to find out more.

codecov[bot] avatar Sep 08 '22 18:09 codecov[bot]

ERROR:

ERROR: QA failed on report_failure.

ERROR: QA failed on tlpr1_asan_suri.

Pipeline 9050

suricata-qa avatar Sep 08 '22 18:09 suricata-qa

ERROR:

ERROR: QA failed on report_failure.

ERROR: QA failed on tlpr1_asan_suri.

Pipeline 9051

suricata-qa avatar Sep 08 '22 19:09 suricata-qa

I noticed that the newly added files have the copyright year as 2021, though...

Yeah, the PR is from 2021, its been in review for a long time.

jasonish avatar Sep 08 '22 21:09 jasonish

I noticed that the newly added files have the copyright year as 2021, though...

Yeah, the PR is from 2021, its been in review for a long time.

missed that bit, sorry 😅

jufajardini avatar Sep 08 '22 21:09 jufajardini

CIFuzz found ways to panic the rust code.

victorjulien avatar Sep 09 '22 07:09 victorjulien

WARNING:

field baseline test %
tlpw1_stats_chk
.tcp.rst 103033 125984 122.28%

Pipeline 9100

suricata-qa avatar Sep 10 '22 04:09 suricata-qa

Rebased: https://github.com/OISF/suricata/pull/8102

jasonish avatar Oct 27 '22 21:10 jasonish