<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=Windows-1252">
<style type="text/css" style="display:none;"> P {margin-top:0;margin-bottom:0;} </style>
</head>
<body dir="ltr">
<div style="font-family: Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<span> <br>
</span>
<div>Hello, oisf, could use your input on problem.</div>
<div><br>
</div>
<div>In Suricata 4.1.0 we noticed that under certain conditions false positive alerts are firing that should not be. In short rules looking for HTTP packets are firing on ICMP data. It appears that the issue occurs on rules with http content modifiers where
another rule in the ruleset uses an alert ip prefix and any content match. The packets must include an HTTP session followed by ICMP type packets (not that the rule should not match on the http session as the pcre does not match). I’ve also tested on suricata
4.1.2 and found that this issue is there as well. I’m not sure when the issue was introduced.<br>
</div>
<div><br>
</div>
<div>Rules in my local.rules:<br>
</div>
<div><br>
</div>
<div>alert ip any any -> any any (msg:"IP Any With Content"; content:"blahblah"; classtype:bad-unknown; priority:102; sid:5002203; rev:10;)<br>
</div>
<div><br>
</div>
<div>alert http $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"Test Rule no http"; flow:to_server,established; content:"POST"; http_method; pcre:"/\/.+\/[a-zA_Z0-9]{4}\_confirm\.php/"; classtype:bad-unknown; priority:102; sid:9999991; rev:1;)<br>
</div>
<div><br>
</div>
<div>Test output:<br>
</div>
<div><br>
</div>
<div>#> docker run -it --rm --volume $PWD/data:/data sensor -c /data/suricata.yaml -r ./data/out.pcap<br>
</div>
<div>7/1/2019 -- 15:25:55 - <Notice> - This is Suricata version 4.1.0 RELEASE<br>
</div>
<div>7/1/2019 -- 15:25:55 - <Notice> - using flow hash instead of active packets<br>
</div>
<div>7/1/2019 -- 15:25:55 - <Warning> - [ERRCODE: SC_ERR_DEPRECATED_CONF(274)] - deprecated 'force-md5' option found. Please use 'force-hash: [md5]' instead<br>
</div>
<div>7/1/2019 -- 15:25:55 - <Warning> - [ERRCODE: SC_ERR_EVENT_ENGINE(210)] - can't suppress sid 2015985, gid 1: unknown rule<br>
</div>
<div>7/1/2019 -- 15:25:55 - <Notice> - all 7 packet processing threads, 4 management threads initialized, engine started.<br>
</div>
<div>7/1/2019 -- 15:25:55 - <Notice> - Signal Received. Stopping engine.<br>
</div>
<div>7/1/2019 -- 15:25:55 - <Notice> - Pcap-file module read 1 files, 72 packets, 10078 bytes<br>
</div>
<div>#> cat ./data/fast.log <br>
</div>
<div><br>
</div>
<div>01/02/2019-17:57:19.054415 [**] [1:9999991:1] Test Rule no http [**] [Classification: Potentially Bad Traffic] [Priority: 102] {ICMP} 3.20.244.244:2563 -> 10.228.203.106:0<br>
</div>
<div><br>
</div>
<div>Note that the rule which his supposed ot match on an HTTP session is alerting on an ICMP packet.<br>
</div>
<div><br>
</div>
<div>Eve.json alert also has http data for an icmp protocol:<br>
</div>
<div><br>
</div>
<div>{<br>
</div>
<div> "timestamp": "2019-01-02T17:57:19.054415+0000",<br>
</div>
<div> "flow_id": 1426130925450708,<br>
</div>
<div> "pcap_cnt": 22,<br>
</div>
<div> "event_type": "alert",<br>
</div>
<div> "src_ip": "<redacted>",<br>
</div>
<div> "dest_ip": "<redacted>",<br>
</div>
<div> "proto": "ICMP",<br>
</div>
<div> "icmp_type": 3,<br>
</div>
<div> "icmp_code": 10,<br>
</div>
<div> "tx_id": 0,<br>
</div>
<div> "alert": {<br>
</div>
<div> "action": "allowed",<br>
</div>
<div> "gid": 1,<br>
</div>
<div> "signature_id": 9999991,<br>
</div>
<div> "rev": 1,<br>
</div>
<div> "signature": "Test Rule no http",<br>
</div>
<div> "category": "Potentially Bad Traffic",<br>
</div>
<div> "severity": 102<br>
</div>
<div> },<br>
</div>
<div> "http": {<br>
</div>
<div> "hostname": "<redacted>",<br>
</div>
<div> "url": "/em/event",<br>
</div>
<div> "http_user_agent": "Wget/1.11.4 Red Hat modified",<br>
</div>
<div> "http_method": "POST",<br>
</div>
<div> "protocol": "HTTP/1.0",<br>
</div>
<div> "length": 0<br>
</div>
<div> },<br>
</div>
<div> "app_proto": "http",<br>
</div>
<div> "flow": {<br>
</div>
<div> "pkts_toserver": 4,<br>
</div>
<div> "pkts_toclient": 0,<br>
</div>
<div> "bytes_toserver": 598,<br>
</div>
<div> "bytes_toclient": 0,<br>
</div>
<div> "start": "2019-01-02T17:56:06.194004+0000"<br>
</div>
<div> },<br>
</div>
<div> "payload": "<redacted>",==",<br>
</div>
<div> "payload_printable": "<redacted>",<br>
</div>
<div> "stream": 0<br>
</div>
<div>}<br>
</div>
<div><br>
</div>
<div><br>
</div>
<div>This may be helpful:<br>
</div>
<div><br>
</div>
<div>suricata version:<br>
</div>
<div>suricata-4.1.0-ESG_1.el7.centos.x86_64<br>
</div>
<div>suricata-debuginfo-4.1.0-ESG_1.el7.centos.x86_64<br>
</div>
<div><br>
</div>
<div>pcre version:<br>
</div>
<div>pcre-devel-8.32-17.el7.x86_64<br>
</div>
<div>pcre-8.32-17.el7.x86_64<br>
</div>
<div> <br>
</div>
<div>lua version:<br>
</div>
<div>lua-date-2.1.2-2.el7.centos.x86_64<br>
</div>
<div>lua-5.1.4-15.el7.x86_64<br>
</div>
<div>lua-cjson-2.1.0-1.el7.centos.x86_64<br>
</div>
<div><br>
</div>
<div><br>
</div>
<div>suricata alerts are written to a file /../....../json_out.txt and passed on to splunk<br>
</div>
<span></span><br>
</div>
<div style="font-family: Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<br>
</div>
<div style="font-family: Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
Thanks for your input....you're always a big help!</div>
<div style="font-family: Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<br>
</div>
<div style="font-family: Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<br>
</div>
</body>
</html>