Pr 8341 and payload len fix/v3

etc/schema.json

@@ -4710,6 +4710,9 @@
                                         },
                                         "pkt_too_small": {
                                             "type": "integer"
+                                        },
+                                        "len_invalid": {
+                                            "type": "integer"
                                         }
                                     },
                                     "additionalProperties": false

rules/decoder-events.rules

@@ -68,6 +68,7 @@ alert pkthdr any any -> any any (msg:"SURICATA TCP duplicated option"; decode-ev
 alert pkthdr any any -> any any (msg:"SURICATA UDP packet too small"; decode-event:udp.pkt_too_small; classtype:protocol-command-decode; sid:2200038; rev:2;)
 alert pkthdr any any -> any any (msg:"SURICATA UDP header length too small"; decode-event:udp.hlen_too_small; classtype:protocol-command-decode; sid:2200039; rev:2;)
 alert pkthdr any any -> any any (msg:"SURICATA UDP invalid header length"; decode-event:udp.hlen_invalid; classtype:protocol-command-decode; sid:2200040; rev:2;)
+alert pkthdr any any -> any any (msg:"SURICATA UDP invalid length field in the header"; decode-event:udp.len_invalid; classtype:protocol-command-decode; sid:2200220; rev:2;)
 alert pkthdr any any -> any any (msg:"SURICATA SLL packet too small"; decode-event:sll.pkt_too_small; classtype:protocol-command-decode; sid:2200041; rev:2;)
 alert pkthdr any any -> any any (msg:"SURICATA Ethernet packet too small"; decode-event:ethernet.pkt_too_small; classtype:protocol-command-decode; sid:2200042; rev:2;)
 alert pkthdr any any -> any any (msg:"SURICATA PPP packet too small"; decode-event:ppp.pkt_too_small; classtype:protocol-command-decode; sid:2200043; rev:2;)

src/decode-events.c

@@ -270,6 +270,10 @@ const struct DecodeEvents_ DEvents[] = {
             "decoder.udp.hlen_invalid",
             UDP_HLEN_INVALID,
     },
+    {
+            "decoder.udp.len_invalid",
+            UDP_LEN_INVALID,
+    },
 
     /* SLL EVENTS */
     {

src/decode-events.h

@@ -103,6 +103,7 @@ enum {
     UDP_PKT_TOO_SMALL,  /**< udp packet smaller than minimum size */
     UDP_HLEN_TOO_SMALL, /**< udp header smaller than minimum size */
     UDP_HLEN_INVALID,   /**< invalid len of upd header */
+    UDP_LEN_INVALID,    /**< packet len in header is invalid */
 
     /* SLL EVENTS */
     SLL_PKT_TOO_SMALL, /**< sll packet smaller than minimum size */

src/decode-udp.c

@@ -56,16 +56,16 @@ static int DecodeUDPPacket(ThreadVars *t, Packet *p, const uint8_t *pkt, uint16_
         return -1;
     }
 
-    if (unlikely(len != UDP_GET_LEN(p))) {
-        ENGINE_SET_INVALID_EVENT(p, UDP_HLEN_INVALID);
+    if (unlikely(UDP_GET_LEN(p) < UDP_HEADER_LEN)) {
+        ENGINE_SET_INVALID_EVENT(p, UDP_LEN_INVALID);
         return -1;
     }
 
     SET_UDP_SRC_PORT(p,&p->sp);
     SET_UDP_DST_PORT(p,&p->dp);
 
     p->payload = (uint8_t *)pkt + UDP_HEADER_LEN;
-    p->payload_len = len - UDP_HEADER_LEN;
+    p->payload_len = UDP_GET_LEN(p) - UDP_HEADER_LEN;
 
     p->proto = IPPROTO_UDP;
 

src/detect-engine-event.c

@@ -160,6 +160,9 @@ static DetectEngineEventData *DetectEngineEventParse (const char *rawstr)
 
     if (de->event == STREAM_REASSEMBLY_OVERLAP_DIFFERENT_DATA) {
         StreamTcpReassembleConfigEnableOverlapCheck();
+    } else if (de->event == UDP_HLEN_INVALID) {
+        SCLogWarning("Rule uses decode-event \"udp.hlen_invalid\" which will be deprecated in "
+                     "Suricata 8.0");
     }
     return de;