Project

General

Profile

Actions

Bug #2552

closed

"Drop" action is logged as "allowed" in af_packet and netmap modes

Added by Alexander Gozman about 3 years ago. Updated about 3 years ago.

Status:
Closed
Priority:
Normal
Assignee:
Target version:
Affected Versions:
Effort:
Difficulty:
Label:

Description

Version: current git master.

It seems that commit 4474889667d664a66c1c123f4f7d2756e8a7fbb9 has broken AFPRunModeIsIPS() and NetmapRunModeIsIPS(). These functions are called from ParseInterfacesList() and work with 'real' live devices list. However, when ParseInterfacesList() is called, the list is empty because LiveDeviceFinalize() was not called yet. As a result, EngineModeSetIPS() is not called and this obviously breaks logging and, probably, some other things.

Currently I have no idea how to do things right (in other words, correct and good looking). Probably we need to move some blocks from ParseInterfacesList() to somewhere else, after LiveDeviceFinalize().

Actions #1

Updated by Eric Leblond about 3 years ago

  • Assignee set to Eric Leblond
Actions #2

Updated by Eric Leblond about 3 years ago

Thanks Alexander for the very detailed report. I have implemented your suggestion.

Could you try the following branch: https://github.com/regit/suricata/tree/bug-2552 ?

Actions #3

Updated by Alexander Gozman about 3 years ago

Eric Leblond wrote:

Thanks Alexander for the very detailed report. I have implemented your suggestion.

Could you try the following branch: https://github.com/regit/suricata/tree/bug-2552 ?

Eric, thank you for the quick feedback. Tried the patch, everything works fine (logged action is "blocked").

Actions #4

Updated by Victor Julien about 3 years ago

  • Status changed from New to Closed
  • Target version set to 4.1rc2
Actions #5

Updated by Victor Julien about 3 years ago

Does this affect 4.0.x?

Actions #6

Updated by Alexander Gozman about 3 years ago

Victor Julien wrote:

Does this affect 4.0.x?

IMHO no, because 4.0.x handles "live devices" in an old way. There's no LiveDeviceFinalize() there.

Actions

Also available in: Atom PDF