Project

General

Profile

Actions
Copy link

Bug #5802

closed

ips: txs still logged for dropped flow

Added by Juliana Fajardini Reichow almost 2 years ago. Updated over 1 year ago.

Status:
Closed
Priority:
Normal
Assignee:
Victor Julien
Target version:
7.0.0-rc2
Affected Versions:
Effort:
Difficulty:
Label:

Description

This is likely an issue just with UDP traffic.

If a flow is dropped, we still see app-layer output associated with that flow.

There are still some unknowns/ aspects to confirm - could this happen with TCP? Is this just an output issue, or are we actually not totally dropping the flow?

Expected behavior:
If Suri drops an entire flow, we want the engine to:
- mark all associated transactions for that flow as completed
- log, in the respective drop event, the relevant info for the associated transaction
- stop detection and inspection work on that flow, once the drop(s) is processed.

Subtasks 1 (0 open — 1 closed)

Bug #6113: ips: txs still logged for dropped flow (6.0.x backport)ClosedVictor JulienActions

Related issues 2 (0 open — 2 closed)

Related to Suricata - Task #5510: stream (midstream): investigate - Suri drops flow but still logs second packet of the flowClosedOISF DevActions
Related to Suricata - Task #5807: detect: convert suitable tests to suricata-verify onesClosedJuliana Fajardini ReichowActions
Actions
Copy link
 #1

Updated by Juliana Fajardini Reichow almost 2 years ago

  • Related to Task #5510: stream (midstream): investigate - Suri drops flow but still logs second packet of the flow added
Actions
Copy link
 #2

Updated by Juliana Fajardini Reichow almost 2 years ago

#5510 may or may not be related, also something to better investigate.

Actions
Copy link
 #3

Updated by Juliana Fajardini Reichow almost 2 years ago

  • Subject changed from Suricata keeps logging app-layer events after flow is dropped to ips: txs still logged for dropped flow
Actions
Copy link
 #4

Updated by Juliana Fajardini Reichow almost 2 years ago

  • Target version changed from 7.0.0-rc1 to 7.0.0-rc2
Actions
Copy link
 #5

Updated by Juliana Fajardini Reichow almost 2 years ago

  • Status changed from New to In Progress
Actions
Copy link
 #6

Updated by Juliana Fajardini Reichow almost 2 years ago

  • Subtask #5807 added
Actions
Copy link
 #7

Updated by Juliana Fajardini Reichow over 1 year ago

Currently stale, but first draft PR: https://github.com/OISF/suricata/pull/8391

Actions
Copy link
 #8

Updated by Victor Julien over 1 year ago

  • Status changed from In Progress to Assigned
  • Assignee changed from Juliana Fajardini Reichow to Victor Julien
Actions
Copy link
 #9

Updated by Victor Julien over 1 year ago

  • Subtask deleted (#5807)
Actions
Copy link
 #10

Updated by Victor Julien over 1 year ago

  • Related to Task #5807: detect: convert suitable tests to suricata-verify ones added
Actions
Copy link
 #11

Updated by Victor Julien over 1 year ago

  • Priority changed from Normal to High
Actions
Copy link
 #12

Updated by Victor Julien over 1 year ago

  • Status changed from Assigned to In Progress
Actions
Copy link
 #13

Updated by Victor Julien over 1 year ago

  • Status changed from In Progress to In Review
  • Label Needs backport to 6.0 added
Actions
Copy link
 #14

Updated by OISF Ticketbot over 1 year ago

  • Subtask #6113 added
Actions
Copy link
 #15

Updated by OISF Ticketbot over 1 year ago

  • Label deleted (Needs backport to 6.0)
Actions
Copy link
 #16

Updated by Victor Julien over 1 year ago

  • Status changed from In Review to Resolved
Actions
Copy link
 #17

Updated by Victor Julien over 1 year ago

  • Status changed from Resolved to Closed
Actions
Copy link

Also available in: Atom PDF