Open Information Security Foundation

08/29/2018

03:31 PM Suricata Bug #2607 (Assigned): File descriptor leak in af-packet mode (4.0.x)

2 file descriptors leak could lead to a file descriptor exhaustion when using AF_PACKET.

10:20 AM Suricata Revision fcd5e138: af-packet: close the socket in case of early fail

10:20 AM Suricata Revision 7e8a7492: log-filestore: fix file descriptor leak

In the case we exceed the number of simultaneously open
file we can reach a state were we will not close the file
aft...

08/28/2018

08:59 PM Suricata Bug #2606 (Closed): File descriptor leak in af-packet mode

It seems that after a long run some users do experiment file descriptors leaking leading to a af-packet breakage: htt...

08/20/2018

09:03 AM Suricata Revision 173e5a1c: doc: iprep supports CIDR networks

09:03 AM Suricata Revision c9b9f7fd: util-unittest: fix typo

08/08/2018

09:21 PM Suricata Bug #1778: af_packet: IPS and defrag

Cluster ebpf with ippair implementation should fix that. XDP CPU redirect will do too.

09:14 PM Suricata Bug #2289: af-packet bpf filtering failed to select multiple vlan

Should we consider it as done as eBPF vlan_filter is in 4.1 and providing the feature ?

08/07/2018

11:49 AM Suricata Revision d38e7d94: stream-tcp: fix typo in debug message

06:23 AM Suricata Bug #2502: suricata.c ConfigGetCaptureValue - PCAP/AFP fallthrough to strip_trailing_plus

Yes, correct, there is no special meaning of + in pcap or AFP. Proposed solution seems to be correct.