Next/60x/20221125/v7#8212
Merged
victorjulien merged 15 commits intoOISF:master-6.0.xfrom Nov 26, 2022
Merged
Conversation
Suricata already logs if AF_PACKET or Netmap are running in a mixed IPS and IDS/TAP mode. As the behavior is undefined when these modes are mixed, it is best to deprecate and to not allow this behavior. For now warn that it will be unsupported and fail in Suricata 8. Ticket: 5587 (cherry picked from commit 0c00f28)
If a protocol change was requested, the target did not handle it as Suricata, as the target is meant to handle only one app-layer protocol. (cherry picked from commit ca054f7)
Fix PASS handling by setting and checking in the correct packet. There are 3 types of packets: 1. tunnel packets (inner layer of encapsulation) 2. "root" packets (outmost layer of encapsulated packet) 3. normal packets (no encapsulation) Tunnel packet have a pointer to their "root". The "root" is the packet that is ultimately used by the capture method to issue a verdict: DROP or ACCEPT (forward). For tunnels: DROP actions are always issued on the root packet. The PASS action is issued on the packet currently in the detection engine. Non-tunnels: DROP and PASS are both set in the current packet. Bug: OISF#5697.
(cherry picked from commit ad869e1)
(cherry picked from commit cade604)
(cherry picked from commit 9f4dd4f)
As an SMB2 async response does not have a tree id, even if the request has it. Per spec, MessageId should be enough to identifiy a message request and response uniquely across all messages that are sent on the same SMB2 Protocol transport connection. So, the tree id is redundant anyways. Ticket: OISF#5508 (cherry picked from commit e94920b)
|
Information: QA ran without warnings. Pipeline 10940 |
This was referenced Nov 26, 2022
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
4 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Staging:
suricata-verify-pr: 1018