mirror of https://github.com/OISF/suricata
You cannot select more than 25 topics
Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.
d727271202
Add a note to the pcre extraction section stating that a flow: capture
is dropped when the packet is inspected without a flow, and that such a
packet still alerts.
ICMPv4 error messages are one way to get such a packet: FlowCreateCheck
returns false for them, while DecodeICMPV4 has already set p->payload,
so they reach the detection engine with something to inspect and nowhere
to store a flow variable. A packet the flow engine could not give a flow
to once the memcap was reached and no used flow could be reclaimed is
the other.
The pkt: and alert: scopes described in the same section are unaffected,
because a packet variable is stored on the packet and an alert variable
on the alert.
Issue: 8862
(cherry picked from commit
|
2 months ago | |
|---|---|---|
| .. | ||
| doxygen | ||
| userguide | 2 months ago | |
| AUTHORS | 5 years ago | |
| Basic_Setup.txt | ||
| INSTALL | 1 year ago | |
| Makefile.am | 1 year ago | |
| NEWS | 5 years ago | |
| README | ||
| Setting_up_IPSinline_for_Linux.txt | 3 years ago | |
| TODO | 5 years ago | |
| Third_Party_Installation_Guides.txt | ||