[Oisf-devel] UNIX domain socket in suricata

[安静]

I noticed that there is a potential bug in Unix-manager.c (suricata 3.0). Could you help to analyze it is a bug or not?


1) in UnixNew,
          this->socket = socket(AF_UNIX, SOCK_STREAM, 0); // a STREAM type unix domain socket is created
2) in UnixCommandRun
       char buffer[4096];
       ret = recv(client->fd, buffer, sizeof(buffer) - 1, 0); // receive command from client
3)in UnixCommandExecute
      the \0 terminated buffer is checked to figure out the command.


This socket is SOCK_STREAM type, no message boundary( just like TCP), the client may send 2 command by calling send twice,
but the server may get 2 command sticking together due to the "NO boundary problem" by just calling recv once.


Maybe there should have more code to figure out the message boundary by checking the VERSION magic?
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.openinfosecfoundation.org/pipermail/oisf-devel/attachments/20160805/3fe23e69/attachment.html>