Project

General

Profile

Actions
Copy link

Bug #4688

closed

detect: too many prefilter engines lead to FNs

Added by Jeff Lucovsky about 3 years ago. Updated almost 3 years ago.

Status:
Closed
Priority:
Normal
Assignee:
Victor Julien
Target version:
5.0.8
Affected Versions:
Effort:
Difficulty:
Label:

Description

Fix for QA ticket #4672

Bad int handling leads to missed inspection when prefilter engine list gets too long. In addition to this there is a logic issue that leads to the available bit-space for tracking prefilter engines to overflow. The fix for this is more intrusive, and is not backported to Suricata 5.0. Suricata 5.0 does detect this condition and will issue a warning by default, or an error with -T.

If you encounter this warning the fix is to upgrade to 6.0.4+.

The warning is

<Warning> - [ERRCODE: SC_ERR_DETECT_PREPARE(173)] - max number of prefilter engines exceeded (100 >= 62). Risk of False Negatives. See ticket #4688.

The (fatal) error in case of -T is
<Error> - [ERRCODE: SC_ERR_DETECT_PREPARE(173)] - max number of prefilter engines exceeded (100 >= 62). Risk of False Negatives. See ticket #4688.

Files

test.rules (9.93 KB) test.rules Victor Julien, 09/15/2021 08:14 AM

Related issues 1 (0 open — 1 closed)

Copied from Suricata - Bug #4685: detect: too many prefilter engines lead to FNsClosedVictor JulienActions
Actions
Copy link
 #1

Updated by Jeff Lucovsky about 3 years ago

  • Copied from Bug #4685: detect: too many prefilter engines lead to FNs added
Actions
Copy link
 #2

Updated by Victor Julien about 3 years ago

  • Assignee changed from Jeff Lucovsky to Victor Julien
Actions
Copy link
 #3

Updated by Victor Julien about 3 years ago

  • Description updated (diff)
  • Status changed from Assigned to In Progress
Actions
Copy link
 #5

Updated by Victor Julien about 3 years ago

  • Status changed from In Progress to Closed
Actions
Copy link
 #6

Updated by Victor Julien almost 3 years ago

  • Private changed from Yes to No
Actions
Copy link

Also available in: Atom PDF