Project

General

Profile

Actions

Bug #180

closed

no alert with ip proto GRE on suricata today git and v0.9.1

Added by rmkml rmkml over 11 years ago. Updated about 11 years ago.

Status:
Closed
Priority:
Normal
Assignee:
Target version:
Affected Versions:
Effort:
Difficulty:
Label:

Description

Hi,
On suricata today git (ca7f54de2596f24663f18d079681d8cfa25fe81f) and v0.9.1, I don't have
alert with joigned pcap file.
I have added this simple example sig:
alert ip any any -> any any (msg:"GRE suricata test"; ip_proto:47; classtype:attempted-admin; sid:9431292; rev:1; )
and alert fire of course with snort.
No other sig on my test, no error on suricata.log.
Regards
Rmkml


Files

suricataFNipprotogre18jun2010.pcap (91 Bytes) suricataFNipprotogre18jun2010.pcap rmkml rmkml, 06/18/2010 07:38 AM
0001-Fix-for-bug-180-check-proto-specified-at-the-IP-hdr.patch (3.14 KB) 0001-Fix-for-bug-180-check-proto-specified-at-the-IP-hdr.patch This patch should fix the issue to be compat, checking the proto at the ip hdr instead of p->proto (that is not set on invalid packets). Pablo Rincon, 07/23/2010 10:20 AM
Actions #1

Updated by Victor Julien over 11 years ago

  • Due date set to 06/22/2010
  • Assignee set to OISF Dev
  • Target version set to 0.9.3
  • Estimated time set to 2.50 h
Actions #2

Updated by Victor Julien about 11 years ago

  • Due date changed from 06/22/2010 to 06/28/2010
  • Assignee changed from OISF Dev to Pablo Rincon
  • Target version changed from 0.9.3 to 1.0.0
Actions #3

Updated by Victor Julien about 11 years ago

  • Due date changed from 06/28/2010 to 07/06/2010
  • Target version changed from 1.0.0 to 1.0.1
Actions #4

Updated by rmkml rmkml about 11 years ago

Hi,
I have tested with git today and same no alert,
But I have a decode-event alert: gre.wrong_version.
It's true on joigned pcap file, but why no alert on simply sigs please?
Regards
Rmkml

Actions #5

Updated by Victor Julien about 11 years ago

It seems the issue is that we set the protocol only for valid packets, while here the gre part of the packet seems invalid. This behavior seems incompatible with Snort.

Actions #6

Updated by Pablo Rincon about 11 years ago

This patch should fix the issue to be compat, checking the proto at the ip hdr instead of p->proto (that is not set on invalid packets).

Actions #7

Updated by Victor Julien about 11 years ago

  • Status changed from New to Closed
  • % Done changed from 0 to 100

Patch applied, thanks Pablo. Commit 70bda6506db84ff33e51520f09b956c3cd648cc1

Fixed the unittests that were broken after this to use the unittest helper functions.

Actions

Also available in: Atom PDF