Suricata

Bug #5864

Updated by Victor Julien 1 day ago

When I set host-os-policy like this, I get return -1 not OS_POLICY_WINDOWS of an ipv4 address. 
 @host-os-policy: 
     windows: ["0.0.0.0/0", "::/0"]@ 

 But if I changed the order, it worked. 
 @host-os-policy: 
     windows: ["::/0", "0.0.0.0/0"]@ 

 I think it has the same mistake in defrag module. 

 Here is the build-info 
 <pre> @ 
 This is Suricata version 7.0.0-rc1 RELEASE 
 Features: DEBUG PCAP_SET_BUFF AF_PACKET HAVE_PACKET_FANOUT LIBNET1.1 HAVE_HTP_URI_NORMALIZE_HOOK PCRE_JIT HAVE_NSS HTTP2_DECOMPRESSION HAVE_LIBJANSSON TLS TLS_C11 MAGIC RUST 
 SIMD support: SSE_4_2 SSE_4_1 SSE_3 
 Atomic intrinsics: 1 2 4 8 16 byte(s) 
 64-bits, Little-endian architecture 
 GCC version 7.5.0, C version 201112 
 compiled with _FORTIFY_SOURCE=2 
 L1 cache line size (CLS)=64 
 thread local storage method: _Thread_local 
 compiled with LibHTP v0.5.42, linked against LibHTP v0.5.42 

 Suricata Configuration: 
   AF_PACKET support:                         yes 
   AF_XDP support:                            no 
   DPDK support:                              no 
   eBPF support:                              no 
   XDP support:                               no 
   PF_RING support:                           no 
   NFQueue support:                           no 
   NFLOG support:                             no 
   IPFW support:                              no 
   Netmap support:                            no 
   DAG enabled:                               no 
   Napatech enabled:                          no 
   WinDivert enabled:                         no 

   Unix socket enabled:                       yes 
   Detection enabled:                         yes 

   Libmagic support:                          yes 
   libjansson support:                        yes 
   hiredis support:                           no 
   hiredis async with libevent:               no 
   PCRE jit:                                  yes 
   LUA support:                               no 
   libluajit:                                 no 
   GeoIP2 support:                            no 
   Non-bundled htp:                           yes 
   Hyperscan support:                         no 
   Libnet support:                            yes 
   liblz4 support:                            no 
   Landlock support:                          no 

   Rust support:                              yes 
   Rust strict mode:                          no 
   Rust compiler path:                        /root/.cargo/bin/rustc 
   Rust compiler version:                     rustc 1.66.0 (69f9c33d7 2022-12-12) 
   Cargo path:                                /root/.cargo/bin/cargo 
   Cargo version:                             cargo 1.66.0 (d65d197ad 2022-11-15) 

   Python support:                            yes 
   Python path:                               /usr/bin/python3 
   Install suricatactl:                       yes 
   Install suricatasc:                        yes 
   Install suricata-update:                   no, not bundled 

   Profiling enabled:                         no 
   Profiling locks enabled:                   no 

   Plugin support (experimental):             yes 

 Development settings: 
   Coccinelle / spatch:                       no 
   Unit tests enabled:                        no 
   Debug output enabled:                      yes 
   Debug validation enabled:                  no 
   Fuzz targets enabled:                      no 

 Generic build parameters: 
   Installation prefix:                       /usr/local 
   Configuration directory:                   /usr/local/etc/suricata/ 
   Log directory:                             /usr/local/var/log/suricata/ 

   --prefix                                   /usr/local 
   --sysconfdir                               /usr/local/etc 
   --localstatedir                            /usr/local/var 
   --datarootdir                              /usr/local/share 

   Host:                                      x86_64-pc-linux-gnu 
   Compiler:                                  gcc (exec name) / g++ (real) 
   GCC Protect enabled:                       no 
   GCC march native enabled:                  yes 
   GCC Profile enabled:                       no 
   Position Independent Executable enabled: no 
   CFLAGS                                     -g -O2 -fPIC -std=c11 -march=native -I${srcdir}/../rust/gen -I${srcdir}/../rust/dist 
   PCAP_CFLAGS                                 -I/usr/include 
   SECCFLAGS 
 </pre> @

Back