Unable to load Rules page if no Category is selected.

michmoor

@bmeeks
Before i enter a redmine i wanted to run by an issue.
When i create a custom rule and have NO OTHER categories selected (i unselect everything) , i am unable to access the rules page for the interface. It loads a white background. To get it working again i just have to select any ruleset in categories and the rules page load.

Can we get the Rules page to load even though no category is selected? I just want to load my custom rules.

pfsense 23.09.1

update: i have something in the crash reporter

Crash report begins.  Anonymous machine information:

amd64
14.0-CURRENT
FreeBSD 14.0-CURRENT amd64 1400094 #1 plus-RELENG_23_09_1-n256200-3de1e293f3a: Wed Dec  6 21:00:32 UTC 2023     root@freebsd:/var/jenkins/workspace/pfSense-Plus-snapshots-23_09_1-main/obj/amd64/Obhu6gXB/var/jenkins/workspace/pfSense-Plus-snapshots-23_09_1

Crash report details:

PHP Errors:
[04-Mar-2024 20:34:34 US/Eastern] PHP Fatal error:  PHP Request Shutdown: Cannot use output buffering in output buffering display handlers in Unknown on line 0
[04-Mar-2024 20:34:50 US/Eastern] PHP Fatal error:  PHP Request Shutdown: Cannot use output buffering in output buffering display handlers in Unknown on line 0
[04-Mar-2024 20:35:02 US/Eastern] PHP Fatal error:  PHP Request Shutdown: Cannot use output buffering in output buffering display handlers in Unknown on line 0
[04-Mar-2024 20:35:33 US/Eastern] PHP Fatal error:  PHP Request Shutdown: Cannot use output buffering in output buffering display handlers in Unknown on line 0
[04-Mar-2024 21:04:38 US/Eastern] PHP Fatal error:  PHP Request Shutdown: Cannot use output buffering in output buffering display handlers in Unknown on line 0



No FreeBSD crash data found.

bmeeks

This is a bug, but I am not sure exactly why. Will need to dig around in the PHP code a bit to see what's up.

I can easily reproduce the issue.

michmoor

@bmeeks
You want me to submit a redmine for tracking?

bmeeks

@michmoor said in Unable to load Rules page if no Category is selected.:

@bmeeks
You want me to submit a redmine for tracking?

Please. The Netgate crew likes to see a Redmine ticket attached to each submitted pull request.

michmoor

@bmeeks said in Unable to load Rules page if no Category is selected.:

Reply Quote 0

No worries. Issue #15312 created

bmeeks

@michmoor said in Unable to load Rules page if no Category is selected.:

@bmeeks said in Unable to load Rules page if no Category is selected.:

Reply Quote 0

No worries. Issue #15312 created

The fix turned out to be very easy. I've posted a pull request for the Netgate team to review and merge here: https://github.com/pfsense/FreeBSD-ports/pull/1349.

Once they do that, a new 7.0.3_1 Suricata package version will appear in the Package Manager.

michmoor

@bmeeks
nice work. Thank you sir

michmoor

@bmeeks
Tested and working wonderfully.

Another question :)
I understand that a pkg update is re-installing the package essentially but certain parts of the config arent sticking. For example, the categories I select are still selected but so are the 'default' ones as well. I have to uncheck each update.

michmoor

@bmeeks

Found another issue :(

When your custom rule does fire off an alert and you go to review the alert and view the signature text, there is an empty box..

Example Rule:

Example Alert:

bmeeks

@michmoor said in Unable to load Rules page if no Category is selected.:

but so are the 'default' ones as well. I have to uncheck each update.

This is normal. There is a package of default rules distributed with the Suricata binary, and those get installed (and sometimes updated) with each release. To be sure the user has them available, they are reinstalled and enabled as part of each update.

If you want changes to the default rules to "stick", you can put their category file names in a disablesid.conf file and use the SID MGMT feature to prevent them from loading.

bmeeks

@michmoor said in Unable to load Rules page if no Category is selected.:

@bmeeks

Found another issue :(

When your custom rule does fire off an alert and you go to review the alert and view the signature text, there is an empty box..

Example Rule:

Example Alert:

Your custom rule is missing the GID (generator ID). Provide that in the rule text and see if the lookup succeeds then. All the rules are loaded into an array where the GID:SID values are the multidimenional array keys. The default GID is "1".

michmoor

@bmeeks
The disabled SID worked, thank you for that.

Regarding the custom rule alert issue above. Suricata is not parsing the rule when I add GID

[130204 - Suricata-Main] 2024-03-06 12:48:30 Error: detect: error parsing signature "alert tls any any -> 192.168.50.240 any (msg:"TLS 1.2 Traffic Detected"; tls.version: 0x0303; sid 1:1000002; rev:1;)" from file /usr/local/etc/suricata/suricata_38311_igc0/rules/custom.rules at line 1

bmeeks

@michmoor said in Unable to load Rules page if no Category is selected.:

Regarding the custom rule alert issue above. Suricata is not parsing the rule when I add GID

That's not the correct syntax for a GID. It is a separate field like this:

alert tls any any -> 192.168.50.240 any (msg:"TLS 1.2 Traffic Detected"; tls.version: 0x0303; gid: 1 sid: 1000002; rev:1;)

GID comes from Snort and is required there as it designates which rules are coming from preprocessors and which are general text rules. GID 1 is the general text rule generator ID.

Suricata does not explicitly require a GID because it does not have preprocessors as does Snort. But it will digest GID in the rule signature. Because the logic for in-memory rule array management is the same in the Suricata and Snort GUI code, the GID is necessary on the Suricata side.

I did take a look into the code last night to check, and the Suricata GUI code should be providing a default GID of "1" when one is not explicitly present in a rule. So, it will be interesting to see if the behavior changes when a GID is explicitly added to your custom rule.

michmoor

@bmeeks
Ive had that syntax as well but had the same error.
Using your syntax

[130204 - Suricata-Main] 2024-03-06 12:55:15 Error: detect: error parsing signature "alert tls any any -> 192.168.50.240 any (msg:"TLS 1.2 Traffic Detected"; tls.version: 0x0303; gid: 1 sid: 1000002; rev:1;)" from file /usr/local/etc/suricata/suricata_38311_igc0/rules/custom.rules at line 1

bmeeks

@michmoor said in Unable to load Rules page if no Category is selected.:

@bmeeks
Ive had that syntax as well but had the same error.
Using your syntax

[130204 - Suricata-Main] 2024-03-06 12:55:15 Error: detect: error parsing signature "alert tls any any -> 192.168.50.240 any (msg:"TLS 1.2 Traffic Detected"; tls.version: 0x0303; gid: 1 sid: 1000002; rev:1;)" from file /usr/local/etc/suricata/suricata_38311_igc0/rules/custom.rules at line 1

Interesting, I thought from past experience Suricata would take the GID and really just skip it. Don't recall it complaining about it, but then when I wrote all this code it was way back when Suricata was at the version 2.x stage from upstream.