suricata icon indicating copy to clipboard operation
suricata copied to clipboard

eve: revert ethernet addresses when needed

Open regit opened this issue 11 months ago • 3 comments

Update of #9651 fixing the formatting.

EVE logging has a direction parameter that can cause the logging of an application layer to be done in a direction that is not linked to the packet. As a result the source IP addres could be assigned the MAC address of the destination IP and reverse.

This patch addresses this by propagating the direction to the ethernet logging function and using it there to define the correct mapping.

Issue #6405

Make sure these boxes are signed before submitting your Pull Request -- thank you.

  • [x] I have read the contributing guide lines at https://docs.suricata.io/en/latest/devguide/contributing/contribution-process.html
  • [x] I have signed the Open Information Security Foundation contribution agreement at https://suricata.io/about/contribution-agreement/ (note: this is only required once)
  • [x] I have updated the user guide (in doc/userguide/) to reflect the changes made (if applicable)

Link to redmine ticket: https://redmine.openinfosecfoundation.org/issues/6405

Describe changes:

  • Fix formatting
  • Rebase on master

Provide values to any of the below to override the defaults.

SV_BRANCH=https://github.com/OISF/suricata-verify/pull/1667

regit avatar Feb 25 '24 20:02 regit

It looks like netflow events need a fix. Setting to draft for now.

regit avatar Feb 25 '24 20:02 regit

It looks like netflow events need a fix. Setting to draft for now.

Humm suricata-verify needs an update in fact.

regit avatar Feb 25 '24 20:02 regit

Information:

ERROR: QA failed on SURI_TLPW2_autofp_suri_time.

field baseline test %
SURI_TLPW2_autofp_stats_chk
.uptime 101 112 110.89%

Pipeline 18725

suricata-qa avatar Feb 25 '24 22:02 suricata-qa

Rebased in https://github.com/OISF/suricata/pull/11197

catenacyber avatar May 31 '24 13:05 catenacyber