suricata complains about NFQUEUE in newer kernels
Affects | Status | Importance | Assigned to | Milestone | |
---|---|---|---|---|---|
suricata (Ubuntu) |
Fix Released
|
Medium
|
Unassigned | ||
Precise |
Fix Released
|
Medium
|
Unassigned | ||
Saucy |
Fix Released
|
Medium
|
Unassigned | ||
Trusty |
Fix Released
|
Medium
|
Unassigned | ||
Utopic |
Won't Fix
|
Medium
|
Unassigned | ||
Vivid |
Won't Fix
|
Undecided
|
Unassigned | ||
Wily |
Fix Released
|
Medium
|
Unassigned |
Bug Description
[Impact]
* Suricata is not able to start without changes on config files.
When starting the daemon, it tries to detect NLQUEUE support
checking existence of wrong procfs file.
* On precise it is not able to start out-of-the-box after the
change above. Suricata-
reference.
* This change fixes LP #1250439.
[Test Case]
* Steps
Install "suricata" package with apt-get.
Set RUN to yes on /etc/default/
Make sure nfnetlink_queue and nfnetlink modules are not loaded.
Try to start suricata service and it will complain about no NFQUEUE.
Modprobe nfnetlink_queue and try to start suricata again.
You cannot because file being checked is /proc/net/
* On precise:
Wrong auto-generated reference on /etc/suricata/
Package silently refuses to start even after fixing service init script.
[Regression Potential]
* Since this problem exists on upstream and on all Ubuntu versions, it
is most likely that customers using this package have already fixed
init script.
* Since customers tend to write their own suricata rules, it is most
likely that cutomers have already fixed default rules file.
* Regression would make suricata daemon not to start (just like now).
[Other Info]
Suricata in newer kernels (3.5 and upper) will complain like this:
* NFQUEUE support not found !
* Please ensure the nfnetlink_queue module is loaded or built in kernel
although nfnetlink_queue is loaded:
lsmod | grep nfnetlink_queue
nfnetlink_queue 17557 3
nfnetlink 13983 5 nf_conntrack_
This happens because /etc/init.
check_nfqueue() {
if [ ! -e /proc/net/
log_failure_msg "NFQUEUE support not found !"
log_failure_msg "Please ensure the nfnetlink_queue module is loaded or built in kernel"
exit 5
fi
}
Nevertheless this only works in pre3.5 kernels as newer kernels have supressed ip_queue , in benefit of libnetfilter_queue.
Thus the script should check that nor /proc/net/
Changed in suricata (Ubuntu): | |
status: | Confirmed → In Progress |
assignee: | nobody → Rafael David Tinoco (inaddy) |
Changed in suricata (Ubuntu Trusty): | |
assignee: | nobody → Rafael David Tinoco (inaddy) |
Changed in suricata (Ubuntu Saucy): | |
assignee: | nobody → Rafael David Tinoco (inaddy) |
Changed in suricata (Ubuntu Precise): | |
assignee: | nobody → Rafael David Tinoco (inaddy) |
Changed in suricata (Ubuntu Trusty): | |
status: | New → In Progress |
Changed in suricata (Ubuntu Saucy): | |
status: | New → In Progress |
Changed in suricata (Ubuntu Precise): | |
status: | New → In Progress |
importance: | Undecided → Medium |
Changed in suricata (Ubuntu Trusty): | |
importance: | Undecided → Medium |
Changed in suricata (Ubuntu Saucy): | |
importance: | Undecided → Medium |
Changed in suricata (Ubuntu Utopic): | |
importance: | Undecided → Medium |
description: | updated |
description: | updated |
description: | updated |
Changed in suricata (Ubuntu): | |
assignee: | Rafael David Tinoco (inaddy) → nobody |
Changed in suricata (Ubuntu Precise): | |
assignee: | Rafael David Tinoco (inaddy) → nobody |
Changed in suricata (Ubuntu Saucy): | |
assignee: | Rafael David Tinoco (inaddy) → nobody |
Changed in suricata (Ubuntu Trusty): | |
assignee: | Rafael David Tinoco (inaddy) → nobody |
Changed in suricata (Ubuntu Utopic): | |
assignee: | Rafael David Tinoco (inaddy) → nobody |
Changed in suricata (Ubuntu Utopic): | |
status: | Triaged → Won't Fix |
Changed in suricata (Ubuntu Vivid): | |
status: | Triaged → Won't Fix |
The attachment "suricata. init.patch" seems to be a patch. If it isn't, please remove the "patch" flag from the attachment, remove the "patch" tag, and if you are a member of the ~ubuntu-reviewers, unsubscribe the team.
[This is an automated message performed by a Launchpad user owned by ~brian-murray, for any issues please contact him.]