Open Information Security Foundation

09/09/2019

06:40 PM Suricata Support #3126: Suricata can't drop privilages on Debian 10

PR: https://github.com/OISF/suricata/pull/4183
Alexander Gozman

09/04/2019

12:13 PM Suricata Support #3126: Suricata can't drop privilages on Debian 10

CAP_DAC_OVERRIDE (or smth like this) is missing. Unfortunately, the way suricata deals with capabilities is not conve... Alexander Gozman

09/03/2019

07:47 PM Suricata Bug #3120: nfq_handle_packet error -1 Resource temporarily unavailable warnings

Victor Julien wrote:
> @GOzzy are you interested in doing a PR?
I can do one, but the problem is that I can not c... Alexander Gozman

08/22/2019

10:13 AM Suricata Bug #3120: nfq_handle_packet error -1 Resource temporarily unavailable warnings

I suppose that it could be fixed by checking EAGAIN after recv() in addition to EINTR and EWOULDBLOCK. Alexander Gozman

05/08/2019

08:46 AM Suricata Support #2972: How can I get the mac at the NFQ mode

John Smith wrote:
> When I start suricata as NFQ mode,as suricata -c /etc/suricata/suricata.yaml -q 0 -q 1. I can't... Alexander Gozman

05/06/2019

04:55 PM Suricata Bug #2965: Version 5 Beta1 - Multiple NFQUEUE failed

Done, PR: https://github.com/OISF/suricata/pull/3834 Alexander Gozman

06:06 AM Suricata Bug #2965: Version 5 Beta1 - Multiple NFQUEUE failed

Victor Julien wrote:
> Alex, can you check this? We're not meant to break backwards compatibility.
Ok, I'll look ... Alexander Gozman

04/04/2019

11:36 AM Suricata Bug #2918: Unable to mmap, error Resource temporarily unavailable - err seems OS specific

Probably this is due to missing CAP_IPC_LOCK. Alexander Gozman

03/03/2019

10:42 AM Suricata Bug #2857 (Resolved): nfq asan heap-use-after-free error

https://github.com/OISF/suricata/pull/3694
Sorry for the late response. I have recently changed my job and haven't... Alexander Gozman

08/04/2018

10:28 AM Suricata Bug #2552: "Drop" action is logged as "allowed" in af_packet and netmap modes

Victor Julien wrote:
> Does this affect 4.0.x?
IMHO no, because 4.0.x handles "live devices" in an old way. There... Alexander Gozman