Project

General

Profile

Actions
Copy link

Bug #7884

open
JF JF

exceptions: handle logging for per-packet policies

Bug #7884: exceptions: handle logging for per-packet policies

Added by Juliana Fajardini Reichow 7 months ago. Updated 4 months ago.

Status:
Assigned
Priority:
Normal
Assignee:
Juliana Fajardini Reichow
Target version:
9.0.0-beta1
Affected Versions:
7.0.12, 8.0.1
Effort:
Difficulty:
Label:

Description

When implementing #6215 the implications of flow.memcap and defrag.memcap affecting only packets weren't taken into consideration.
This means that Suricata is able to generate stats for when these are triggered, but can't actually log the triggered policy with a flow, as there isn't one associated when we apply the policies.

Subtasks 2 (2 open — 0 closed)

Bug #7909: exceptions: handle logging for per-packet policies (7.0.x backport)AssignedJuliana Fajardini ReichowActions
Bug #8160: exceptions: handle logging for per-packet policies (8.0.x backport)AssignedJuliana Fajardini ReichowActions

VJ Updated by Victor Julien 7 months ago Actions
Copy link
 #1

Wonder if we should make this a new subtype of the anomaly type

        - anomaly:
            enabled: yes
            types:
              # decode: no
              # stream: no
              # applayer: yes
              exception-policy: yes
            #packethdr: no

VJ Updated by Victor Julien 7 months ago Actions
Copy link
 #2

  • Target version changed from 8.0.2 to 9.0.0-beta1

OT Updated by OISF Ticketbot 7 months ago Actions
Copy link
 #3

  • Subtask #7909 added

OT Updated by OISF Ticketbot 7 months ago Actions
Copy link
 #4

  • Label deleted (Needs backport to 7.0)

JF Updated by Juliana Fajardini Reichow 5 months ago Actions
Copy link
 #5

  • Status changed from New to Assigned

JF Updated by Juliana Fajardini Reichow 4 months ago Actions
Copy link
 #6

  • Label Needs backport to 8.0 added

OT Updated by OISF Ticketbot 4 months ago Actions
Copy link
 #7

  • Subtask #8160 added

OT Updated by OISF Ticketbot 4 months ago Actions
Copy link
 #8

  • Label deleted (Needs backport to 8.0)
Actions
Copy link

Also available in: PDF Atom