Project

General

Profile

Actions

Bug #7724

open

detect: wrong detect behavior for stream keywords no_stream and only_stream

Added by Lukas Sismis 2 months ago. Updated 14 days ago.

Status:
Feedback
Priority:
Normal
Assignee:
Target version:
Affected Versions:
Effort:
Difficulty:
Label:
Needs Suricata-Verify test

Description

When running through a basic pcap (attached) and using basic rules, I do not get the expected outcome.

Test A:
For a ruleset containing:

alert tcp any any -> any any (msg: "tcp toserver no_stream"; flow:to_server, no_stream; sid:1;)
alert tcp any any -> any any (msg: "tcp toserver stream"; flow:to_server, only_stream; sid:2;)
alert tcp any any -> any any (msg: "tcp toclient no_stream"; flow:to_client, no_stream; sid:3;)
alert tcp any any -> any any (msg: "tcp toclient stream"; flow:to_client, only_stream; sid:4;)

I get 80 alerts, where no_stream and only_stream keywords seem not honored and the alerts are doubled. I would expect 40 alerts.

Test B:
With the ruleset:

alert tcp any any -> any any (msg: "tcp toserver no_stream"; flow: no_stream; sid:1;)
alert tcp any any -> any any (msg: "tcp toserver stream"; flow:only_stream; sid:2;)

I get only 4 alerts, where again I would expect 40 alerts.

Possibly needed to be evaluated for Suri 7 if considered as a bug.


Files

HTTP.cap (24.9 KB) HTTP.cap Lukas Sismis, 05/29/2025 02:32 PM
Actions #1

Updated by Lukas Sismis 2 months ago

Note - it was specifically tried on my branch https://github.com/OISF/suricata/pull/13333
But the last commit hash on master branch is: 404bb53ce96564cbf964bb1e513a6107b7f744dc

Actions #3

Updated by Victor Julien 2 months ago

Can you create some SV tests to show the issue?

Actions #4

Updated by Victor Julien about 2 months ago

  • Target version changed from 8.0.0-rc1 to 9.0.0-beta1
Actions #5

Updated by Philippe Antoine 15 days ago

  • Status changed from New to Feedback
  • Label Needs Suricata-Verify test added
Actions #6

Updated by Philippe Antoine 14 days ago

I get only 4 alerts, where again I would expect 40 alerts.

4 means one time for each signature for each direction.
This looks the expected case for ip-only rules cc @Juliana Fajardini Reichow

What are you trying to do ? Is there a purpose of using no_stream without a content ?

Actions

Also available in: Atom PDF