Merged
Conversation
alert_queue_overflow and alerts_suppressed were not being reinitialized when there was a reload of Suricata rules, leading to non-valid stats counters if that happened. Bug OISF#5457
As reported by Shchelk
Bumps [actions/cache](https://github.com/actions/cache) from 3.0.4 to 3.0.5. - [Release notes](https://github.com/actions/cache/releases) - [Changelog](https://github.com/actions/cache/blob/main/RELEASES.md) - [Commits](actions/cache@c3f1317...0865c47) --- updated-dependencies: - dependency-name: actions/cache dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com>
The image describing Suricata's sliding window had two of the "packets" with the same text. Now they actually give the sense of a sliding window. This was found by Zhiyuan-liao.
victorjulien
requested review from
catenacyber,
jasonish and
jufajardini
as code owners
Codecov Report
@@ Coverage Diff @@
## master #7653 +/- ##
=======================================
Coverage 75.75% 75.76%
=======================================
Files 659 659
Lines 185743 185748 +5
=======================================
+ Hits 140713 140726 +13
+ Misses 45030 45022 -8
Flags with carried forward coverage won't be shown. Click here to find out more. |
|
Information: QA ran without warnings. Pipeline 8368 |
This was referenced Jul 28, 2022
Closed
This was referenced Jul 28, 2022
victorjulien
added a commit
to victorjulien/suricata
that referenced
this pull request
Apr 11, 2025
If for the same a packet a drop rule and a pass rule would match, the applying of actions could be contradictionary: - the drop would be applied to the packet - the pass rule would also be considered, not overriding the drop, but still setting the flow pass flag. This would lead to the packet being dropped, but the rest of the flow getting passed, including retransmissions of the dropped packet. This patch only sets drop/pass actions if no conflicting action has been set on the packet before. It respects the action-order. Bug: OISF#7653.
victorjulien
added a commit
to victorjulien/suricata
that referenced
this pull request
Apr 17, 2025
If for the same a packet a drop rule and a pass rule would match, the applying of actions could be contradictionary: - the drop would be applied to the packet - the pass rule would also be considered, not overriding the drop, but still setting the flow pass flag. This would lead to the packet being dropped, but the rest of the flow getting passed, including retransmissions of the dropped packet. This patch only sets drop/pass actions if no conflicting action has been set on the packet before. It respects the action-order. Bug: OISF#7653.
victorjulien
added a commit
to victorjulien/suricata
that referenced
this pull request
May 13, 2025
If for the same a packet a drop rule and a pass rule would match, the applying of actions could be contradictionary: - the drop would be applied to the packet - the pass rule would also be considered, not overriding the drop, but still setting the flow pass flag. This would lead to the packet being dropped, but the rest of the flow getting passed, including retransmissions of the dropped packet. This patch only sets drop/pass actions if no conflicting action has been set on the packet before. It respects the action-order. Bug: OISF#7653. Fix based on: 57b17fb ("detect: don't set conflicting packet/flow actions")
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
4 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Staging:
replaces #7650
suricata-verify-pr: 894
replaces #7652, fixing a newly introduced include issue