Suricata

Can someone turn the tests into a SV test?

https://github.com/OISF/suricata-verify/pull/137

I think its going to hard to change this. I've done a test and it leads to multiple failures in matching rules against test pcaps. On inspection it turns out there are a couple of cases where we do match on traffic, even though the tcp state < established.

1. during startup, while we still try to determine if csum offloading is in use, and it is (this mostly applies to pcaps). In this case the 'flow' is established, but the tcp state isn't because of the bad csums
2. in cases of packet loss, where the tcp state tracking may get disrupted. Here a loose concept of 'established' helps with avoiding missed detection

I wonder if we could create specific support for the case in the attached pcap. Perhaps it makes sense to not set the 'flow' state to established if one side only sends error packets, like TCP RST in this case

I checked the Snort manual, and it seems

But in Suricata Manual (https://suricata.readthedocs.io/en/suricata-4.1.5/rules/flow-keywords.html#flow) it's also stated:

The determination of established depends on the protocol:For TCP a connection will be established after a three way handshake.

during startup, while we still try to determine if csum offloading is in use, and it is (this mostly applies to pcaps). In this case the 'flow' is established, but the tcp state isn't because of the bad csums

I believe this type of problems reside to tcp checksum-check option.

in cases of packet loss, where the tcp state tracking may get disrupted. Here a loose concept of 'established' helps with avoiding missed detection

There is separate midstream option defined in documentation which handles those cases.
Maybe one of ways is to change default values for midstream setting for sake of backward compatibility, but introduce option of 3whs strict check for tcp session.

FWIW suricata 4.1.5 and 5.0.2 also affected.