Bug #13806
closed
Suricata interface rules cannot be viewed.
Added by Marcos M over 2 years ago.
Updated over 2 years ago.
Description
Tested on the latest version on the dev branch.
No matter which rule is selected in the drop-down, the custom rules always gets loaded - see attached.
Files
Can you post additional details? I cannot reproduce this issue on my test virtual machine. Do you show any rule categories selected on the CATEGORIES tab? The Suricata built-in rules are always selected by default and should be showing, although those can be disabled by the user and then would not show.
Was this from an existing Suricata install that was upgraded, or is this a green-field install on a freshly imaged machine?
Attached is a screenshot from my test machine showing the Emerging-Scan rules selected and displayed on the RULES tab. I can also select and display any other rule category from the drop-down selector.
It's a fresh install and configuration. All categories do show correctly (see attached) - they are currently being managed by the enable/disable SID files.
Marcos M wrote in #note-2:
It's a fresh install and configuration. All categories do show correctly (see attached) - they are currently being managed by the enable/disable SID files.
Hmm...that may be the key (using SID MGMT files only to control selection). Let me see if the RULES tab code is properly processing the SID MGMT lists when populating the drop-down.
Probably another consequence of the PHP 8.1 changes is my first guess.
Still working for me in an existing installation. I just went to the SID MGMT tab, created an enablesid.conf file, and put the "emerging-dns" rules category in it, assigned it to the WAN interface instance, and saved (with the rebuild rules option checked at the bottom of the SID MGMT tab when saving). Then went direct to the CATEGORIES tab to verify the "Emerging-DNS" rules were auto-enabled (see the green "A" symbol in the screenshot), then went to the RULES tab and verified they were listed in the drop-down selector and could be loaded and viewed. See the attached two screenshots. Previously, on this WAN instance, that category was not enabled.
Give me a bit and I will wipe out this Suricata installation completely and install a new greenfield setup from scratch and try to reproduce what you are seeing.
A fresh greenfield install still works for me, showing the rule categories auto-enabled on the CATEGORIES tab (green "A" icon beside the name), and then showing the correct category names in the drop-down selector on the RULES tab. I just updated my VM to the latest December 26 DEVEL snapshot and installed the Suricata-6.0.8_3 GUI package.
Prior to this I had completely wiped the existing Suricata config by selecting the option to "not save config when de-installing", and then removed the package and all the previous setup's log files. So I started with a totally empty Suricata setup.
The only difference I see in my current test configuration is that I have not auto-disabled the built-in "events" rules that ship with Suricata. I see in your screenshot that those are apparently auto-disabled via SID MGMT (as they appear to have a red "A" beside the names). I will try that next to see if that might have a bearing on the outcome.
Okay, was able to reproduce the condition when using SID MGMT to auto-disable rules. Will dig into the processing to see what's happening and then get a fix submitted.
- Status changed from New to Resolved
- % Done changed from 0 to 100
Also available in: Atom
PDF
Updated by 
Updated by 
Updated by 
