Suricata passlist clarification

Troutpocket

Pfsense CE 2.5.2-RELEASE (amd64)
Suricata 6.0.3_3

My expectation was that IP addresses added in the Firewall/Aliases section could be included in the Pass_List on the interface. Suricata lets me create a passlist with the alias, but never added the contents (IP Addresses) if they were single host. I had to choose the "Network" option in Firewall/Aliases which includes the mask option on the line (11.22.33.44/32) and then it was added to the passlist.

In the post referrenced, the author states "The IP addresses can be for individual hosts, or entire CIDR blocks". Unfortunately, my experience is that it can only be added with CIDR notation - which can still be a single host, but requires adding as a "Network". I'm not sure if that's by design and not specified in the documentation, or a bug.

SteveITS

@troutpocket There's a bug in 6.0.3_3, see https://redmine.pfsense.org/issues/12476. If you click through to the code commit, change file /usr/local/pkg/suricata/suricata.inc

line 579
from
if (empty($vald) || !is_subnet($vald)) {
to:
if (empty($vald) || (!is_subnet($vald) && !is_ipaddr($vald))) {

you can edit a file from the Diagnostics menu.

bmeeks

Yeah, this bug is fixed in the DEVEL snapshot branch. To be honest I was thinking that fixed version had been merged over to RELEASE, but it has not.

I will ask the Netgate team to merge the new Suricata package over into RELEASE. In the meantime, making the edit suggested by @SteveITS will correct the issue.