Project

General

Profile

Actions

Bug #6864

closed

Detect: ipopts keyword misfires

Added by Jeff Lucovsky 2 months ago. Updated about 1 month ago.

Status:
Closed
Priority:
Normal
Assignee:
Target version:
Affected Versions:
Effort:
Difficulty:
Label:

Description

The ipopts keyword may be misfiring.

https://forum.suricata.io/t/suricata-cant-define-ip-options/4494/7 describes a situation where the OP requested an alert when strict source route occurs but found that the rule was creating an alert with a packet having the stream id IP option.

The rule used by the OP:

alert ip any any -> any any (ipopts: ssrr; msg: "issue"; rev: 1; sid:1;)


Files

84b58b808f9f81c09728cb923a2c0eb0.pcap (730 Bytes) 84b58b808f9f81c09728cb923a2c0eb0.pcap Jeff Lucovsky, 03/18/2024 12:50 PM

Subtasks 1 (0 open1 closed)

Bug #6882: Detect: ipopts keyword misfires (7.0.x backport)ClosedJeff LucovskyActions
Actions #1

Updated by Jeff Lucovsky 2 months ago

The misfiring is occurring because
- When the ipopts keyword is parsed, an enum value is added to the detection context
- When looking for a match, the match logic treats the detection context value as a bit field
- False alerts occur because the check uses a bit field and an enum value. The bit field is from the packet

Actions #2

Updated by Jeff Lucovsky 2 months ago

  • Status changed from New to In Review
  • Assignee changed from OISF Dev to Jeff Lucovsky
Actions #3

Updated by Philippe Antoine 2 months ago

  • Label Needs backport to 7.0 added
Actions #4

Updated by OISF Ticketbot 2 months ago

  • Subtask #6882 added
Actions #5

Updated by OISF Ticketbot 2 months ago

  • Label deleted (Needs backport to 7.0)
Actions #6

Updated by Jeff Lucovsky about 1 month ago

  • Label Needs backport to 7.0 added
Actions #7

Updated by OISF Ticketbot about 1 month ago

  • Label deleted (Needs backport to 7.0)
Actions #8

Updated by Jeff Lucovsky about 1 month ago

  • Status changed from In Review to Resolved
  • Label Needs backport to 7.0 added
Actions #9

Updated by OISF Ticketbot about 1 month ago

  • Label deleted (Needs backport to 7.0)
Actions #10

Updated by Philippe Antoine about 1 month ago

  • Status changed from Resolved to Closed
Actions

Also available in: Atom PDF