Suricata error after 24.1.2 update

[mvmazijk]

Important notices

Before you add a new report, we ask you kindly to acknowledge the following:

• I have read the contributing guide lines at https://github.com/opnsense/core/blob/master/CONTRIBUTING.md
• I am convinced that my issue is new after having checked both open and closed issues at https://github.com/opnsense/core/issues?q=is%3Aissue

Describe the bug

After upgrading OPNsense to version 24.1.2 I'm getting the following errors in Suricata. There errors weren't present prior to the update (version 24.1.1 running Suricata 6)

2024-02-20T23:49:30 | Error | suricata | [100539] -- failed to obtain number of NUMA nodes in the system
2024-02-20T23:49:30 | Error | suricata | [100539] -- unable to open /sys/devices/system/node
2024-02-20T23:49:30 | Error | suricata | [100539] -- failed to obtain number of NUMA nodes in the system
2024-02-20T23:49:30 | Error | suricata | [100539] -- unable to open /sys/devices/system/node

To Reproduce

Enable Suricata with a ruleset

Expected behavior

Quite obvious, but not showing the errors.

Describe alternatives you considered

I found a similar issue on Reddit (https://www.reddit.com/r/opnsense/comments/1avj9md/opnsense_2412_released/)
There a microcode update was suggested, however as I'm running OPNsense as a VM on Proxmox a microcode update isn't applicable in this case.

Screenshots

N/A

Relevant log files

N/A

Additional context

Looking at the error, it seems Suricata is looking the for the number of NUMA nodes in /sys/devices/system/node.
This location isn't present in OPNsense. This looks more of a location you would expect on a Linux machine.
Perhaps a forgotten line to adjust for the FreeBSD version?

Environment

OPNsense 24.1.2 (running on Proxmox).
Intel(R) Xeon(R) CPU E3-1265L V2

[mvmazijk]

It seems this issue is already known and reported:
https://redmine.openinfosecfoundation.org/issues/6762

[fichtner]

Yea, was reported on Reddit also.

[LPJon]

I am having this exact same issue with the WAN flapping as a result. I have updated to the latest 24.1.2_1 and Suricata is still showing this same error message in logs. Any suggestions?

[LPJon]

Also, I am unable to use opnsense-revert -r 24.1.1 suricata to revert to the previous version of it. What is going on? No way forward....no way back.....this is a MAJOR pain in the A#$.

EDIT: The output of the above command is:
Fetching suricata.pkg: ..[fetch: https://mirror.wdc1.us.leaseweb.net/opnsense/FreeBSD:13:amd64/24.1/MINT/24.1.1/latest/Latest/suricata.pkg.sig: Not Found] failed

EDIT: Okay...and now I see why. Only minor version reversions are allowed. You have to revert to the closest major version first.
SOURCE: https://docs.opnsense.org/manual/opnsense_tools.html

[LPJon]

@mvmazijk For anyone else looking for something that actually works while not disabling Suricata and killing their network security. Here is what I have tested and seems to work.

The forum links to support this comment are:
https://forum.opnsense.org/index.php?topic=38989.0
https://forum.suricata.io/t/my-traffic-gets-blocked-after-upgrading-to-suricata-7/3745

The links above describe that Suricata 7 has moved for a default of "drop(Close)" instead of "ignore(Open)". This causes exceptions in Suricata causing the packets to be dropped.

What worked for me was editing the file shown at the path below with the code following that. Be sure to have Suricata disabled in the WebUI before applying this fix. Once the file has been edited then re-enable Suricata in the WebUI and test the network. The logs will show the same NUMA errors so that is useless. OISF stated that they are moving the NUMA messages to the infromational channel in logging as it's not supposed to affect functionality.

IMPORTANT: According to the documentation this effectively turns the "applayer" into IDS mode (Off) in the cases of exceptions. They also discuss more about how Suricata will act more like a firewall in this way from version 7 on. More information about this can be found here.

File to edit:
/usr/local/opnsense/service/templates/OPNsense/IDS/custom.yaml

Code to add at the end of the file:

# Uncomment line below to ignore all exceptions (Suricata 6.0.15 Behavier) - You should not need this but use it if the app-layer code does not work
#exception-policy: ignore
app-layer:
  error-policy: ignore

[mvmazijk]

Issue is resolved with Suricata version 7.0.4 / OPNsense version 24.1.4.