Suricata

hello,

after upgrading Suricata-7.0.8 to 7.0.9 today from @oisf/suricata-7.0 repository (the OS platform is Rocky Linux 8 with latest patches installed), I noticed that Suricata-7.0.9 is no longer able to start due to a command line BPF filter parameter. Here is an example anonymized BPF filter I was using for testing this issue:

not ( host 192.168.1.1 or host 192.168.1.2 or (host 192.168.2.2 and tcp port 80) )

When this filter is supplied to Suricata-7.0.9 as a command line parameter, Suricata logs the following error messages to /var/log/suricata/suricata.log:

[8629 - W#01-eno1] 2025-03-23 13:37:21 Info: ioctl: eno1: MTU 1500
[8629 - W#01-eno1] 2025-03-23 13:37:21 Info: af-packet: eno1: using BPF 'not ( host 192.168.1.1 or host 192.168.1.2 or (host 192.168.2.2 and tcp port 80) )'
[8629 - W#01-eno1] 2025-03-23 13:37:21 Error: af-packet: eno1: failed to compile BPF "not ( host 192.168.1.1 or host 192.168.1.2 or (host 192.168.2.2 and tcp port 80) )": snaplen of 0 rejects all packets
[8629 - W#01-eno1] 2025-03-23 13:37:21 Error: af-packet: eno1: failed to init socket for interface
[8298 - Suricata-Main] 2025-03-23 13:37:21 Error: threads: thread "W#01-eno1" failed to start: flags 0423

When supplying this BPF filter with the 'bpf-filter' parameter to af-packet capturing method, Suricata-7.0.9 fails with the same error messages in /var/log/suricata/suricata.log. The same happens when providing the BPF filter through a file with the -F command line switch.

When downgrading Suricata from version 7.0.9 to 7.0.8, this example BPF filter (or any other BPF filter) works fine. The BPF filters also work fine with tcpdump, whereas that is not the case for Suricata-7.0.9.

Here is the output from suricata --build-info:

This is Suricata version 7.0.9 RELEASE
Features: NFQ PCAP_SET_BUFF AF_PACKET HAVE_PACKET_FANOUT LIBCAP_NG LIBNET1.1 HAVE_HTP_URI_NORMALIZE_HOOK PCRE_JIT HAVE_NSS HTTP2_DECOMPRESSION HAVE_LUA HAVE_JA3 HAVE_JA4 HAVE_LIBJANSSON TLS TLS_C11 MAGIC RUST POPCNT64
SIMD support: SSE_4_2 SSE_4_1 SSE_3 SSE_2
Atomic intrinsics: 1 2 4 8 16 byte(s)
64-bits, Little-endian architecture
GCC version 8.5.0 20210514 (Red Hat 8.5.0-24), C version 201112
compiled with _FORTIFY_SOURCE=2
L1 cache line size (CLS)=64
thread local storage method: _Thread_local
compiled with LibHTP v0.5.50, linked against LibHTP v0.5.50

Suricata Configuration:
AF_PACKET support: yes
AF_XDP support: no
DPDK support: yes
eBPF support: no
XDP support: no
PF_RING support: no
NFQueue support: yes
NFLOG support: no
IPFW support: no
Netmap support: no
DAG enabled: no
Napatech enabled: no
WinDivert enabled: no

Unix socket enabled:                     yes
  Detection enabled:                       yes

Libmagic support:                        yes
  libjansson support:                      yes
  hiredis support:                         yes
  hiredis async with libevent:             yes
  PCRE jit:                                yes
  LUA support:                             yes
  libluajit:                               no
  GeoIP2 support:                          yes
  JA3 support:                             yes
  JA4 support:                             yes
  Non-bundled htp:                         no
  Hyperscan support:                       yes
  Libnet support:                          yes
  liblz4 support:                          yes
  Landlock support:                        no

Rust support:                            yes
  Rust strict mode:                        no
  Rust compiler path:                      /usr/bin/rustc
  Rust compiler version:                   rustc 1.79.0 (129f3b996 2024-06-10) (Red Hat 1.79.0-3.module+el8.10.0+22631+033aed0e)
  Cargo path:                              /usr/bin/cargo
  Cargo version:                           cargo 1.79.0

Python support:                          yes
  Python path:                             /usr/bin/python3
  Install suricatactl:                     yes
  Install suricatasc:                      yes
  Install suricata-update:                 yes

Profiling enabled:                       no
  Profiling locks enabled:                 no
  Profiling rules enabled:                 no

Plugin support (experimental):           yes
  DPDK Bond PMD:                           no

Development settings:
Coccinelle / spatch: no
Unit tests enabled: no
Debug output enabled: no
Debug validation enabled: no
Fuzz targets enabled: no

Generic build parameters:
Installation prefix: /usr
Configuration directory: /etc/suricata/
Log directory: /var/log/suricata/

--prefix                                 /usr
  --sysconfdir                             /etc
  --localstatedir                          /var
  --datarootdir                            /usr/share

Host:                                    x86_64-redhat-linux-gnu
  Compiler:                                gcc (exec name) / g++ (real)
  GCC Protect enabled:                     yes
  GCC march native enabled:                no
  GCC Profile enabled:                     no
  Position Independent Executable enabled: yes
  CFLAGS                                   -O2 -g -pipe -Wall -Werror=format-security -Wp,-D_FORTIFY_SOURCE=2 -Wp,-D_GLIBCXX_ASSERTIONS -fexceptions -fstack-protector-strong -grecord-gcc-switches -specs=/usr/lib/rpm/redhat/redhat-hardened-cc1 -specs=/usr/lib/rpm/redhat/redhat-annobin-cc1 -m64 -mtune=generic -fasynchronous-unwind-tables -fstack-clash-protection -fcf-protection -fPIC -std=c11 -I/usr/include/dpdk -include rte_config.h -march=corei7 -mrtm  -I${srcdir}/../rust/gen -I${srcdir}/../rust/dist
  PCAP_CFLAGS                               
  SECCFLAGS                                -fstack-protector -D_FORTIFY_SOURCE=2 -Wformat -Wformat-security