Suricata 6.0.3_3 pass list missing all single IPs (alias, DNS)
-
@bmeeks Even going down to one IP in the alias, it does not show when I click View List. I tried 207.229.162.105, our office alias, and our office IP directly. I even restarted Suricata once.
Log:
18/10/2021 -- 16:31:08 - <Info> -- alert-pf -> Creating automatic firewall interface IP address Pass List.
18/10/2021 -- 16:31:08 - <Info> -- alert-pf -> adding firewall interface mvneta1 IPv6 address fe80:0000:0000:0000:0208:a2ff:fe0d:2cbc to automatic interface IP Pass List.
18/10/2021 -- 16:31:08 - <Info> -- alert-pf -> adding firewall interface mvneta1 IPv4 address 192.168.16.1 to automatic interface IP Pass List.
18/10/2021 -- 16:31:08 - <Info> -- alert-pf -> adding firewall interface mvneta2 IPv6 address fe80:0000:0000:0000:0208:a2ff:fe0d:2cbd to automatic interface IP Pass List.
18/10/2021 -- 16:31:08 - <Info> -- alert-pf -> adding firewall interface mvneta2 IPv4 address wan.ip.v.4 to automatic interface IP Pass List.
18/10/2021 -- 16:31:08 - <Info> -- alert-pf -> adding firewall interface lo0 IPv6 address 0000:0000:0000:0000:0000:0000:0000:0001 to automatic interface IP Pass List.
18/10/2021 -- 16:31:08 - <Info> -- alert-pf -> adding firewall interface lo0 IPv6 address fe80:0000:0000:0000:0000:0000:0000:0001 to automatic interface IP Pass List.
18/10/2021 -- 16:31:08 - <Info> -- alert-pf -> adding firewall interface lo0 IPv4 address 127.0.0.1 to automatic interface IP Pass List.
18/10/2021 -- 16:31:08 - <Info> -- alert-pf output device (regular) initialized: block.log
18/10/2021 -- 16:31:08 - <Info> -- alert-pf -> Added IPv4 address 127.0.0.1/32 from assigned Pass List.
18/10/2021 -- 16:31:08 - <Info> -- alert-pf -> Added IPv4 address 192.168.16.0/24 from assigned Pass List.
18/10/2021 -- 16:31:08 - <Info> -- alert-pf -> Added IPv4 address wan.gateway.v.4/32 from assigned Pass List.
18/10/2021 -- 16:31:08 - <Info> -- alert-pf -> Added IPv4 address wan.ip.v.4/32 from assigned Pass List.
18/10/2021 -- 16:31:08 - <Info> -- alert-pf -> Added IPv6 address ::1/128 from assigned Pass List.
18/10/2021 -- 16:31:08 - <Info> -- alert-pf -> Added IPv6 address fe80::208:a2ff:fe0d:2cbc/128 from assigned Pass List.
18/10/2021 -- 16:31:08 - <Info> -- alert-pf -> Added IPv6 address fe80::208:a2ff:fe0d:2cbd/128 from assigned Pass List.
18/10/2021 -- 16:31:08 - <Info> -- alert-pf -> Pass List /usr/local/etc/suricata/suricata_52857_mvneta1/passlist parsed: 7 IP addresses loaded./usr/local/etc/suricata/suricata_52857_mvneta1/passlist does contain only the ones shown:
127.0.0.1/32
192.168.16.0/24
wan.gateway.v.4/32
wan.ip.v.4/32
::1/128
fe80::208:a2ff:fe0d:2cbc/128
fe80::208:a2ff:fe0d:2cbd/128I created alias SuricataTrustedHosts without the _, assigned it to the pass list, restarted Suricata, still not in the pass list table.
There is only one Suricata process running.
٩(͡๏̯͡๏)۶
(not at you, just confused) -
@bmeeks If I change the alias to be type Network(s) and set OurIP/32, it immediately shows under View List. It was type Host(s).
Edit: pfSense lets me enter the ITS_Office alias there, but doesn't autocomplete it...it is autocompleting only the networks alias. Makes sense, just noting it. Have to enter IP/32 and have two places to change it.
Edit 2: Note the ITSMailGuard alias was type Network(s), which is consistent with that working.
-
I pulled up routers using 21.05 and 2.5.2 with Suricata 6.0.0_14 which has the Suricata_Trusted_Hosts alias set to Hosts(s) and working for IPs there.
-
I pulled up a 21.05 with Snort 4.1.4_3 and it is OK with IPs.
-
I suspect it is somehow related to the bugfix I linked, but I can't say with absolute certainty. I did not author that particular code fix. It was done by a Netgate staff developer. It's also possible, but not as likely, that something in pfSense 21.05.1 with respect to alias resolution changed.
-
@bmeeks said in Suricata pass list missing some IPs:
possible, but not as likely, that something in pfSense 21.05.1 with respect to alias resolution changed.
Using just one IP didn’t work so that’s not related to an alias.
I can try upgrading other Suricata installs maybe tonight or tomorrow night but it should be easy to replicate if someone can:
- create alias, type Host
- add one ip to alias
- apply alias change
(- assign alias to pass list and restart Suricata) - click View List
-
@bmeeks I duplicated the behavior this morning on our internal 2.5.2 router simply by upgrading pfSense-pkg-suricata from 6.0.0_14 to 6.0.3_3. Notably it omits DNS, gateway, etc. ... anything that is configured or detected as an IP and not a /32. Changing aliases one at a time from Host(s) to Network(s) adds each to the pass list.
-
@steveits said in Suricata pass list missing some IPs:
@bmeeks I duplicated the behavior this morning on our internal 2.5.2 router simply by upgrading pfSense-pkg-suricata from 6.0.0_14 to 6.0.3_3. Notably it omits DNS, gateway, etc. ... anything that is configured or detected as an IP and not a /32. Changing aliases one at a time from Host(s) to Network(s) adds each to the pass list.
I will take a look at this. I'm still guessing it is an unintended consequence of fixing an earlier bug where some aliases resulted in an empty array() variable getting written to the HOME_NET variable.
-
The Netgate developer team beat me fixing this bug. A pull request to address this problem has been posted here: https://github.com/pfsense/FreeBSD-ports/pull/1117. Look for the fix to get merged into the production package in the near future.
In the meantime, if you can read and understand GitHub diff files, you can make the simple edit yourself on your firewalls.
-
Thank you both. Seems good to me, changed the aliases back and the list looks like my original.
-
Great! The change should make it into a formal package update soon.
Thanks to @viktor_g for the quick fix. He knew right where to look. It would have taken me a bit longer to dig around in the function code and find the issue.
