Hello Suricata maintainers,
Following Shivani’s guidance on #9277, I’m moving the general discussion here. I have ten Redmine reports documenting repeatable detection-behavior observations from local, offline synthetic experiments. They are requests for triage/expected-behavior guidance, not claims of confirmed vulnerabilities or production impact.
The experiments used isolated local fixtures only; no live hosts, production deployments, or third-party traffic were involved. Each ticket contains its own scope and recorded reproduction materials. I’m linking the existing tickets rather than re-uploading PCAPs here. Some bundles have not been independently replayed from the assembled archive during this staging pass, as noted in the corresponding report.
Could you advise whether these should remain as separate triage items, and which observations are expected behavior versus candidates for a regression test?
Related reports:
- Bug #9270: Suricata: synthetic HTTP content direction conflicts with rule header direction (behavior question) - Suricata - Open Information Security Foundation
- Bug #9271: Suricata: rule direction conflicts with synthetic response content (SID 43750; behavior question) - Suricata - Open Information Security Foundation
- Bug #9272: Suricata: file_data section scheduling and empty-buffer predicate (SID 43541; behavior question) - Suricata - Open Information Security Foundation
- Bug #9273: Suricata: direction gate and file_data buffer activation interaction (SID 45012; behavior question) - Suricata - Open Information Security Foundation
- Bug #9274: Suricata: file_data byte_test reads beyond buffer bounds (SID 42935; behavior question) - Suricata - Open Information Security Foundation
- Bug #9275: Suricata: IPv4 address variables gate rule-header matching (behavior question) - Suricata - Open Information Security Foundation
- Bug #9276: Suricata: HTTP header normalization changes rule-matching representation (SID 36791; behavior question) - Suricata - Open Information Security Foundation
- Bug #9277: Suricata: PCRE2 match-call work-limit return code -47 (behavior question) - Suricata - Open Information Security Foundation
- Bug #9278: Suricata: interaction of source and destination address gates (behavior question) - Suricata - Open Information Security Foundation
- Bug #9279: Suricata: raw and normalized URI plus endpoint gates in rule matching (behavior question) - Suricata - Open Information Security Foundation
Thanks for pointing me to the right place!