Project

General

Profile

Actions

Bug #4744

closed

Warn if Absent app-layer protocol is always enabled by default

Added by Jeff Lucovsky 12 months ago. Updated 8 months ago.

Status:
Closed
Priority:
Normal
Target version:
Affected Versions:
Effort:
Difficulty:
Label:

Description

If an applayer protocol's section is unavailable in suricata.yaml, it will get auto enabled.
e.g. say the following section for dnp3 was missing from the configuration file, it will still get auto enabled.

app-layer:
  protocols:
    # DNP3                                                                                                    
    dnp3:
      enabled: no
      detection-ports:
        dp: 20000

But, this is not the desired behavior. To fix this, we explicitly demand a protocol defined in suricata.yaml if it is to be enabled in Suricata 7. See ticket https://redmine.openinfosecfoundation.org/issues/4739 and the linked PR.

However, since this may be too big of a behavioral change for the existing setups running Suricata versions up to 6.0.x, we set a warning that we are enabling the protocol despite it being absent in suricata.yaml and this must be changed to avoid issues with the latest versions.

NOTE: In order to avoid this warning, simply, add the protocol section to suricata.yaml


Related issues 1 (0 open1 closed)

Copied from Bug #4739: Absent app-layer protocol is always enabled by defaultClosedPhilippe AntoineActions
Actions #1

Updated by Jeff Lucovsky 12 months ago

  • Copied from Bug #4739: Absent app-layer protocol is always enabled by default added
Actions #2

Updated by Jeff Lucovsky 12 months ago

  • Label deleted (Needs backport)
Actions #3

Updated by Victor Julien 11 months ago

  • Target version changed from 6.0.4 to 6.0.5
Actions #4

Updated by Shivani Bhardwaj 9 months ago

  • Status changed from Assigned to In Progress
Actions #5

Updated by Shivani Bhardwaj 9 months ago

  • Status changed from In Progress to In Review
Actions #6

Updated by Shivani Bhardwaj 9 months ago

  • Subject changed from Absent app-layer protocol is always enabled by default to Warn if Absent app-layer protocol is always enabled by default
Actions #7

Updated by Shivani Bhardwaj 9 months ago

  • Description updated (diff)
Actions #8

Updated by Shivani Bhardwaj 9 months ago

  • Description updated (diff)
Actions #9

Updated by Shivani Bhardwaj 8 months ago

  • Status changed from In Review to Closed
Actions

Also available in: Atom PDF