Open Information Security Foundation

09/29/2021

09:21 AM Suricata Bug #4273: protodetect: SEGV due to NULL ptr deref

Seems the fix in
https://github.com/catenacyber/suricata/tree/protodetect-midstream-gap-4273-v2
fixes the issues ,... Peter Manev

08/27/2021

12:38 PM Suricata Bug #4655 (New): Dataset dumping to disk seems limited to 1000

If a dataset needs to be dumped/saved it seems there is some sort of cap to 1000 entrees being written on disk. Peter Manev

12:34 PM Suricata Bug #4654 (New): insert_data_normal_fail can hit without triggering memcap in counters

(originally reported y Eric Leblond)
It seems it is failing only on memory issue but we don't see memcap firing... Peter Manev

12:33 PM Suricata Optimization #4653 (New): Flow cleaning with chunked approach is memory hungry

(originally reported y Eric Leblond)
Disabling the chunk approach results in a faster convergence of flow and me... Peter Manev

12:31 PM Suricata Optimization #4652 (New): GAP handling improvements seem expensive

(originally reported y Eric Leblond)
We got a big performance increase with disabling the GAP handling (GAP handli... Peter Manev

12:29 PM Suricata Optimization #4651 (New): malloc / memory handling improvement

Using tcmalloc/jmalloc for example is improving packet drop a lot on busy systems which suggest potential malloc/memo... Peter Manev

12:26 PM Suricata Bug #4650 (New): Stream TCP raw reassembly is leaking

(originally reported y Eric Leblond)
It seems we have a leak in memory when TCP raw reassembly is enabled. Raw r... Peter Manev

08/24/2021

01:01 PM Suricata Bug #4621 (Closed): rust panic: when using smb stream-depth

Using master 7.0.0-dev
And enabling in either kb or mb a smb stream depth, results in core dump... Peter Manev

08/23/2021

08:56 AM Suricata Feature #4617 (New): Add ThreatFox (by Abuse.ch) to suricata ruleset index

Add
https://threatfox.abuse.ch/export/#suricata
to
https://www.openinfosecfoundation.org/rules/index.yaml Peter Manev

08/19/2021

01:33 PM Suricata Bug #4588 (New): Out of memory: Kill process

I am noticing multiple different reports/runs with Suricata 6.0.2 and 6.0.3 of OOM... Peter Manev