Project

General

Profile

Actions

Security #5571

closed

ips: encapsulated packet logged as dropped, but not actually dropped

Added by Jean-Baptiste Laplace 4 months ago. Updated 2 months ago.

Status:
Closed
Priority:
Normal
Assignee:
Target version:
Affected Versions:
Label:
CVE:
Git IDs:
Severity:
HIGH

Description

We just upgraded from Suricata 6.0.6 setup in IPS with NFQUEUE to Suricata 6.0.8 with the same setup.

We have a drop rule in place (same rule since 6.0.6).

When we initiate traffic from the Suricata instance itself to the site that match the drop rule we get the following (correct) behavior:
  1. fast.log logs the drop entry
  2. The traffic is actually dropped
When we initiate traffic from outside the Suricata (and traffic flows through the Suricata) we see the following behavior:
  1. fast.log logs the drop entry
  2. The traffic is NOT dropped

Subtasks 1 (0 open1 closed)

Security #5600: ips: encapsulated packet logged as dropped, but not actually dropped (6.0.x backport)ClosedVictor JulienActions

Related issues 1 (0 open1 closed)

Related to Bug #5633: Pass rules on 6.0.8 are generating alert events when passing tunneled trafficClosedVictor JulienActions
Actions #1

Updated by Jean-Baptiste Laplace 4 months ago

I wanted to mention that when the traffic is initiated from outside the Suricata; we use geneve encapsulation.
This is on ubuntu 20.04.

After reverting back to 6.0.6, everything works again as expected.

Actions #2

Updated by Juliana Fajardini Reichow 4 months ago

  • Assignee changed from OISF Dev to Juliana Fajardini Reichow
Actions #3

Updated by Travers Carter 4 months ago

We are seeing the same thing on Amazon Linux 2, GENEVE encapsulated traffic from an AWS Gateway Load Balancer is not dropped even when matched/logged as such on v6.0.8, but it is after downgrading back to v6.0.6.

On v6.0.8 locally initiated traffic is dropped when it matches a drop rule, it's only the GENEVE traffic that isn't.

This is on Amazon Linux 2 using the RPM packages from https://copr.fedorainfracloud.org/coprs/g/oisf/suricata-latest/

Actions #4

Updated by Victor Julien 4 months ago

  • Status changed from New to Assigned
  • Priority changed from Normal to High
  • Target version changed from TBD to 6.0.9
Actions #5

Updated by Victor Julien 4 months ago

  • Status changed from Assigned to In Progress
  • Assignee changed from Juliana Fajardini Reichow to Victor Julien
  • Target version changed from 6.0.9 to 7.0.0-beta1
  • Label Needs backport to 6.0 added
Actions #6

Updated by Victor Julien 3 months ago

  • Subject changed from Suricata in IPS mode with NFQUEUE we can see the DROP in fast.log but the packet still goes through to ips: encapsulated packet logged as dropped, but not actually dropped
  • Status changed from In Progress to In Review
Actions #7

Updated by Victor Julien 3 months ago

  • Status changed from In Review to Resolved
Actions #8

Updated by Shivani Bhardwaj 3 months ago

  • Subtask #5600 added
Actions #9

Updated by Shivani Bhardwaj 3 months ago

  • Label deleted (Needs backport to 6.0)
Actions #10

Updated by Victor Julien 3 months ago

  • Related to Bug #5633: Pass rules on 6.0.8 are generating alert events when passing tunneled traffic added
Actions #11

Updated by Victor Julien 2 months ago

  • Status changed from Resolved to Closed
Actions #12

Updated by Victor Julien 2 months ago

  • Tracker changed from Bug to Security
  • Severity set to HIGH
Actions

Also available in: Atom PDF