both instances have two test rules like:
pass tcp 172.17.1.0/24 any → any 225 (msg:“PASS LOCAL NET Port 225::no flags::flow to_server::no thresholds”; flow:to_server; classtype:misc-activity; sid:1000100; rev:1; metadata:created_at 2023_02_07, updated_at 2023_02_07;)
and
drop tcp 172.17.1.0/24 any → any 225 (msg:“DROP LOCAL NET Port 225::A12flags::flow established: to_server::no thresholds”; flow:to_server,established; flags: A,12; classtype:misc-activity; sid:1000103; rev:1; metadata:created_at 2023_02_07, updated_at 2023_02_07;)
both instances have test smtp server listening on tcp 225
smtp session works on both instances. but…on 6.0.9 it produces “drop” event_type records in eve-log for sid:1000103.
To complement my answer: I wouldn’t expect the issue to be in setting the drop action in the AlertQueueAppend() function, because that’s called after Suri has decided the signature alerted, already…
Hi!
Thanks for the quick response!
packets not actually dropped - just reported as dropped in drop log.
To make the example more clear, I changed the drop rule. so now the rules look like this:
pass tcp 172.17.1.0/24 any → any 225 (msg:“PASS LOCAL NET Port 225::no flags::flow to_server::no thresholds”; flow:to_server; classtype:misc-activity; sid:1000100; rev:1; metadata:created_at 2023_02_07, updated_at 2023_02_07;)
and
drop tcp 172.17.1.0/24 any → any 225 (msg:“DROP LOCAL NET Port 225::no flags::flow established to_server::no thresholds”; flow:to_server,established; classtype:misc-activity; sid:1000101; rev:1; metadata:created_at 2023_02_07, updated_at 2023_02_07;)
drop_only.zip (2.2 KB) pass_and_drop.zip (16.3 KB)
I attach two pcap files: the first for the case when only the drop rule is enabled (no complaints here. The smtp session hangs after receiving the server header. all as expected), the second - when both rules are enabled (the smtp session runs without problems, but messages about packet drops appear in the log)
messages in eve-log looks like:
{“timestamp”:“2023-02-15T18:49:10.169185+0000”,“flow_id”:662827960784155,“in_iface”:“hn0”,“event_type”:“drop”,“src_ip”:“172.17.1.80”,“src_port”:1709,“dest_ip”:“172.17.1.105”,“dest_port”:225,“proto”:“TCP”,“drop”:{“len”:40,“tos”:0,“ttl”:127,“ipid”:27476,“tcpseq”:1500042227,“tcpack”:1787298342,“tcpwin”:65252,“syn”:false,“ack”:true,“psh”:false,“rst”:false,“urg”:false,“fin”:false,“tcpres”:0,“tcpurgp”:0},“alert”:{“action”:“blocked”,“gid”:1,“signature_id”:1000101,“rev”:1,“signature”:“DROP LOCAL NET Port 225::no flags::flow established to_server::no thresholds”,“category”:“Misc activity”,“severity”:3}}.
