Dear Maintainer,

 What led up to the situation?
Followed the instructions from suricata.readthedocs.io to add rules for the IDS

What exactly did you do (or not do) that was effective (or
     ineffective)?
Ran the commands suricata-update enable-source <package name>

What was the outcome of this action?
Received these errors:
9/5/2022 -- 14:20:21 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] -
Complete IP space negated. Rule address range is NIL. Probably have a !any or
an address range that supplies a NULL address range
9/5/2022 -- 14:20:21 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] -
error parsing signature "alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any ->
$DNS_SERVERS 53 (msg:"ET DNS DNS Lookup for localhost.DOMAIN.TLD";
content:"|01|"; offset:2; depth:1; content:"|00 01 00 00 00 00 00|";
distance:1; within:7; content:"|09|localhost"; fast_pattern; nocase;
classtype:bad-unknown; sid:2011802; rev:6; metadata:created_at 2010_10_13,
updated_at 2019_09_03;)" from file /var/lib/suricata/rules/suricata.rules at
line 3806
9/5/2022 -- 14:20:29 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] -
Complete IP space negated. Rule address range is NIL. Probably have a !any or
an address range that supplies a NULL address range
9/5/2022 -- 14:20:29 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] -
error parsing signature "alert tcp !$SMTP_SERVERS any -> !$HOME_NET 25 (msg:"ET
POLICY Outbound Multiple Non-SMTP Server Emails"; flow:established;
content:"mail from|3a|"; nocase; threshold: type threshold, track by_src, count
10, seconds 120; reference:url,doc.emergingthreats.net/2000328; classtype:misc-
activity; sid:2000328; rev:12; metadata:created_at 2010_07_30, updated_at
2010_07_30;)" from file /var/lib/suricata/rules/suricata.rules at line 23564
9/5/2022 -- 14:20:29 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] -
Complete IP space negated. Rule address range is NIL. Probably have a !any or
an address range that supplies a NULL address range
9/5/2022 -- 14:20:29 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] -
error parsing signature "alert tcp !$HOME_NET any -> $HOME_NET 25 (msg:"ET
POLICY Inbound Frequent Emails - Possible Spambot Inbound"; flow:established;
content:"mail from|3a|"; nocase; threshold: type threshold, track by_src, count
10, seconds 60; reference:url,doc.emergingthreats.net/2002087; classtype:misc-
activity; sid:2002087; rev:10; metadata:created_at 2010_07_30, updated_at
2010_07_30;)" from file /var/lib/suricata/rules/suricata.rules at line 23565
9/5/2022 -- 14:20:35 - <Error> -- [ERRCODE: SC_ERR_NO_RULES_LOADED(43)] -
Loading signatures failed.
9/5/2022 -- 14:20:36 - <Error> -- Suricata test failed, aborting.
9/5/2022 -- 14:20:36 - <Error> -- Restoring previous rules

What outcome did you expect instead?
To be able to run the rules

Hi,

[...]

This seems to indicate that in the rule below, the expression
![$SMTP_SERVERS,$DNS_SERVERS] (most likely) negates the whole IP space.
So this depends on what was set in these variables in your
suricata.conf. How did you configure those? For example, when at least
one of these is set to "any" then this situation will occur.

Please note that Suricata is unlikely to work "out of the box" without
any additional configuration that tailors the installation to your
system (e.g. at least setting monitoring interfaces, etc.) which is
_not_ done when installing the Debian package.

Best regards
Sascha

severity 1010771 normal
thanks

Hi Tim,

I just noticed you also included your suricata.yaml configuration file
in your bug report. I think I found the cause of your problem.

Let's take a look at a problematic rule:

So this rule alerts if the content patterns are found in traffic from
source addresses that are _not_ in the ranges configured for SMTP and
DNS servers (![$SMTP_SERVERS,$DNS_SERVERS]). These variables are
referenced in the rule but -- since the rule author does not know what
the IP addresses of these servers are in your network -- need to be
configured elsewhere, namely in your suricata.conf. Here's the relevant
snippet from yours:

[...]> %YAML 1.1

So you are setting both SMTP_SERVERS and DNS_SERVERS to the same value
as your HOME_NET, which here effectively is "any", i.e. any possible IP
address. Note that each of these assignments of HOME_NET overwrites the
previous setting, so the last one here counts.
Now, evaluating that configuration, the rule above is now requiring the
source address to be _not_ any possible IP address, which is obviously a
problem which leads to an error being reported:
The solution is easy. Please set only one value for HOME_NET which
correctly reflects your internal IP addresses and make sure that
DNS_SERVERS and the others are also set accordingly. Did you just
comment in all the examples [1] in the stock suricata.yaml file? These
are just examples -- keeping the first one with the RFC1918 addresses is
usually sufficient. Otherwise, setting these values is a typical step in
Suricata initial configuration and baselining.

Note that the same applies to EXTERNAL_NET.

Please let me know if you have any more questions. Lowering the severity
here since from what I can see this is not an issue with Suricata per se
but rather related to configuration.

Best regards
Sascha


[1] https://github.com/OISF/suricata/blob/master/suricata.yaml.in#L19

Closing this since the issue does not appear to be related to the package.

Please feel free to reopen this issue if the problem persists even after
changing the variable settings as suggested.

Cheers
Sascha