Project

General

Profile

Actions

Bug #1472

closed

Should 'goodsigs' be 'goodtotal' when checking if signatures were loaded in detect.c?

Added by John Griffith over 7 years ago. Updated over 7 years ago.

Status:
Closed
Priority:
Normal
Target version:
Affected Versions:
Effort:
Difficulty:
Label:

Description

Around line 468 in detect.c, there is a check for goodsigs <=0...

...
/* now we should have signatures to work with */
if (goodsigs <= 0) {
if (cntf > 0) {
SCLogWarning(SC_ERR_NO_RULES_LOADED, "%d rule files specified, but no rule was loaded at all!", cntf);
...

Shouldn't this check be on goodtotal instead? Otherwise, the check only covers the number of rules loaded from the last rules file read, not all of them.

Actions #1

Updated by Victor Julien over 7 years ago

  • Assignee set to Alexander Gozman

Alexander could you check this one? You've been playing with this code so it should still be 'fresh' to you :) Thanks!

Actions #2

Updated by Alexander Gozman over 7 years ago

Victor Julien wrote:

Alexander could you check this one? You've been playing with this code so it should still be 'fresh' to you :) Thanks!

Ok, I'll take a look at it.

Actions #3

Updated by Alexander Gozman over 7 years ago

Victor Julien wrote:

Alexander could you check this one? You've been playing with this code so it should still be 'fresh' to you :) Thanks!

It seems that it's not a problem anymore, because there is a SigFileLoaderStat structure with 'total' counters:

typedef struct SigFileLoaderStat_ {
    int bad_files;
    int total_files;
    int good_sigs_total;
    int bad_sigs_total;
} SigFileLoaderStat;

So there should not be any misunderstandings as we have, for instance, good_sigs variable for a current file, and good_sigs_total as a summary.

Actions #4

Updated by Victor Julien over 7 years ago

  • Status changed from New to Closed
  • Target version set to 3.0RC1
  • % Done changed from 0 to 100

Thanks Alexander!

Actions

Also available in: Atom PDF