Suricata 2.0.3 Package Preview
-
The new Suricata package update has been posted for the pfSense developers to review. You can follow the request here:
https://github.com/pfsense/pfsense-packages/pull/696
The notes at the top of the Pull Request show the changes.
One thing I suggest you do to get ready for the auto-SID management feature is to thoroughly review the documentation associated with the enablesid.conf, disablesid.conf and modifysid.conf files you can use with PulledPork or Oinkmaster. A little Google research should turn up several links and examples. Some kind users here on the forum may also be willing to share their files as examples. With the ability to upload these files to the firewall, it will also be possible for experienced users to share their SID management conf files with novices to help reduce the number of false positives and other issues less experienced users sometimes face with a powerful tool such as Suricata. Note that the new auto-SID management feature is disabled by default. You can enable the feature and upload or create the necessary conf files on the new SID MGMT tab.
Bill
-
I bow deeply for you, Lord Bill ;D
-
The new Suricata package update has been posted for the pfSense developers to review. You can follow the request here:
So everyone is aware, Bill thinks he's found a bug, and has asked us to hold off.
-
I can confirm the bug. My recommendation (if Bill agrees) is to go ahead and release the package, since the bug is there in the existing package anyway (and by the looks of it, it's upstream).
Just to be clear, the bug affect IPv6 deployments. There are workarounds, but no need to go through that if the fix is just round the corner. If the fix isn't around the corner though, having the new package is better than waiting for the fix, since the fix is unlikely to be backported to the old (current) package.
As i said, my recommendation is to go ahead with the package and just issue the warning for a known bug and the workarounds. One of the workarounds can be implemented using modifysid for example. My $0.02.
-
@jflsakfja:
I can confirm the bug. My recommendation (if Bill agrees) is to go ahead and release the package, since the bug is there in the existing package anyway (and by the looks of it, it's upstream).
Just to be clear, the bug affect IPv6 deployments. There are workarounds, but no need to go through that if the fix is just round the corner. If the fix isn't around the corner though, having the new package is better than waiting for the fix, since the fix is unlikely to be backported to the old (current) package.
As i said, my recommendation is to go ahead with the package and just issue the warning for a known bug and the workarounds. One of the workarounds can be implemented using modifysid for example. My $0.02.
Yes, the bug is in the IPv6 address parsing logic. It is present upstream and comes into play if you set $EXTERNAL_NET to the standard value of !$HOME_NET. It only impacts IPv6 traffic, but the impact is you don't get IPv6 alerts from rules where source or destination is $EXTERNAL_NET. A good many rules use this qualifier.
The Suricata source code around this functionality is quite complicated and IMHO not well commented. I have thus far been unable to locate the source of the problem. I think the best I can do is report this upstream. I want to conduct a little more testing, and then I will release the Pull Request for further review by the pfSense developers.
Bill
-
Oh c'mon people. We are crying where and you said hold off?? you are kidding right? Bill :P
-
@mais_um:
Oh c'mon people. We are crying where and you said hold off?? you are kidding right? Bill :P
Not kidding about the bug in IPv6 addresses when $EXTERNAL_NET is set to !$HOME_NET. If you set $EXTERNAL_NET to "any", then no problem except that causes a ton more alerts that are mostly false positives. This is because many rules are written to discriminate traffic based on $HOME_NET and $EXTERNAL_NET reflecting your true setup (where $HOME_NET represents only the networks your protecting, and $EXTERNAL_NET is everything else). If $EXTERNAL_NET is set to "any", then this rule paradigm is not true.
The Suricata and Snort packages have always used "$EXTERNAL_NET = !$HOME_NET" on pfSense as the defaults. So I have decided for now to not change those defaults and instead post a warning that IPv6 traffic will not always be correctly alerted on in Suricata until either I or the upstream Suricata guys can find out what's wrong in the binary.
Bill
-
You'll have to get Supermule to acknowledge that the bug isn't in pfSense, but is, rather, upstream. I don't want to have to hear his complaints.
-
I can also confirm this bug.. Hopefully it can be found but at least there is a workaround for now…
-
I can also confirm this bug.. Hopefully it can be found but at least there is a workaround for now…
I've sent a message to the Suricata team about it, but received no response yet. Also tagged onto a similar (if not possibly the same) issue posted on the Suricata Bug Tracker Redmine site.
I've released the package for review by the pfSense guys, but will continue looking for the bug in the binary. It's a complicated source code package, and it's a little tough to reverse engineer something in the first place, and as I mentioned previously, IMHO there is not a lot of commenting in the code explaining the functions or logic flow. So finding this bug is a challenge…but I do love a challenge... ;)
Bill
-
Thanks Bill! Looking forward to the new release
-
Thanks
I will test PPPoE support in my WAN interface, and other things.
-
Update on IPv6 bug progress –
I have received an acknowledgement from the Suricata project guys on the IPv6 bug. At least one of them was able to reproduce the issue with IPv6 addresses within rule variables not generating alerts even on a match where they should. Hopefully a fix from them will be forthcoming soon. In the meantime, I'm continuing to look for the bug on my own.
As mentioned in a post above, I released the package for review and merge by the pfSense team. If the binary fix for Suricata comes through before they complete the GUI package code review, I will try to get it included with the initial 2.0.3 binary and GUI v2.0 release. If not, then as soon as the binary fix becomes available, I will post an update to the update (that is, a v2.0.1 of the GUI package versus what will be v2.0 of the GUI package).
The bug only impacts IPv6 alerts, and only when rules contain RULE VARS. But since a ton of the rules do contain the RULE VARS $EXTERNAL_NET and $HOME_NET, then a lot of IPv6 alerts don't happen. However, IPv4 works just fine. So if you have an IPv4-only installation, you will have no issue. Only IPv6 setups will have some potential "no alerts" on IPv6 traffic until the bug in the binary is found and fixed.
Bill
-
How 'bout just merge it, call it "beta" and let us play with it already… I know, i know... I need a life... LOL! ;D
-
We need this package update as soon as possible. Suricata just doesn't stay running for me right now.
-
Is that REALLY the level that you are dragging everything down to??
Disgusted…
@gonzopancho:
You'll have to get Supermule to acknowledge that the bug isn't in pfSense, but is, rather, upstream. I don't want to have to hear his complaints.
-
Bump…
-
The IPv6 bug has been found :D :D :D
I have submitted the Pull Request to the Suricata Github site containing the fix. I will also soon be sending it to the pfSense team. Although it worked in all my testing, the pfSense team and I would still like to get confirmation of the fix from the Suricata developers. So give us another day or so.
Edit – updated URL to point to most recent request
If you are interested, here is the link to the Suricata Github pull request: https://github.com/inliniac/suricata/pull/1120Bill
-
The IPv6 bug has been found :D :D :D
I have submitted the Pull Request to the Suricata Github site containing the fix.
'
This line should have been written:
I have found The IPv6 bug :D :D :D
I have submitted the Pull Request to the Suricata Github site containing MY fix.
I love having a package maintainer who is an active contributor of the software he maintains. 8)
Great job as always Bill.
-
The IPv6 bug has been found :D :D :D
I have submitted the Pull Request to the Suricata Github site containing the fix.
'
This line should have been written:
I have found The IPv6 bug :D :D :D
I have submitted the Pull Request to the Suricata Github site containing MY fix.
I love having a package maintainer who is an active contributor of the software he maintains. 8)
Great job as always Bill.
Thanks… ;)
I spent many, many hours poring over the Suricata source code trying to find that bug. I first had to figure out how Suricata works internally, and after that start tracking down where and how some IPv6 address comparisons were failing. Finally found the problem last night and started working on a fix. My eyes are crossed and I tend to see everything as C source code now... ;D
Bill
