Open Information Security Foundation

09/12/2023

01:30 PM Suricata Bug #6307 (New): Packet loss or client connection drop causes delayed detection on HTTP rules

If TCP stream is dropped deliberately by the client or by packet loss in a HTTP connection after getting server respo... Antti Tönkyrä

11:59 AM Suricata Bug #3354: eve-log dns (possibly others) alerts miss metadata for all but first packet

I think based on the discussion in the verify PR and related issue we can close this one for now. Sorry for not getti... Antti Tönkyrä

11:57 AM Suricata Bug #4063: rdata field not included in DNS log for NS rrtype

Since the PR was merged and works for me I think we can close this one. Sorry for not doing it here sooner (looks lik... Antti Tönkyrä

11:47 AM Suricata Bug #4063 (Resolved): rdata field not included in DNS log for NS rrtype

Antti Tönkyrä

10/08/2020

10:19 AM Suricata Bug #4063: rdata field not included in DNS log for NS rrtype

PR @ https://github.com/OISF/suricata/pull/5478 Antti Tönkyrä

10:16 AM Suricata Bug #4063 (Resolved): rdata field not included in DNS log for NS rrtype

I believe this is a regression that was introduced at some point (possibly when DNS parsing moved to rust). Current c... Antti Tönkyrä

06/26/2020

10:45 AM Suricata Bug #3783 (Closed): Stack overflow in DetectFlowbitsAnalyze

When doing torture tests, I discovered a stack overflow in DetectFlowbitsAnalyze. I have made a PR to github @ https:... Antti Tönkyrä

06/23/2020

05:01 PM Suricata Bug #3771: Extreme performance degradation when doing IP-only rules with flow-keyword

My observations (which can be false, please double-check; I'm not really an expert on detect code :)
With "almost ... Antti Tönkyrä

06/15/2020

03:32 PM Suricata Bug #3771 (New): Extreme performance degradation when doing IP-only rules with flow-keyword

I did a brief test and found out an issue when doing large sets of IP-only rules.
Following IP-only rules seem to... Antti Tönkyrä

12/18/2019

02:00 PM Suricata Bug #3354: eve-log dns (possibly others) alerts miss metadata for all but first packet

I'm not sure if the correct fix would be to add looking up TX like we do in stateless sigs at https://github.com/OISF... Antti Tönkyrä