Project

General

Profile

Actions
Copy link

Bug #2091

open

nonexistent/misspelled custom fields accepted during parsing of suricata.yaml

Added by Peter Manev over 8 years ago. Updated 1 day ago.

Status:
New
Priority:
Normal
Assignee:
OISF Dev
Target version:
TBD
Affected Versions:
8.0.0
Effort:
Difficulty:
Label:
Beginner, C, Good First Issue

Description

This is Suricata version 4.0dev (rev 9ff8882)

If there is misspelled or nonexistent custom field in eve.json's section Suricata would not error out/warn on start - example:


        - http:
            custom: [accept, accept-charset, accept-encoding, accept-language,
            proxy-authenticate, referrer, refresh, retry-after, server,
            set-cookie, trailer, transfer-encoding, upgrade, vary, warning,
            www-authenticate, mychemicalromance]
        - smtp:
            custom: [received, sensitivity, organization, content-md5, date, mychemicalromance]

Related issues 2 (1 open — 1 closed)

Related to Suricata - Optimization #7189: http/conf: warn or error on invalid value in custom headers loggingRejectedCommunity TicketActions
Related to Suricata - Bug #4330: file hash parameter in yaml accepts non valid valuesNewPooja GadigeActions
Actions
Copy link
 #1

Updated by Andreas Herz about 8 years ago

  • Assignee set to OISF Dev
  • Target version set to TBD
Actions
Copy link
 #2

Updated by Andreas Herz about 6 years ago

But it doesn't hurt either right?

Actions
Copy link
 #3

Updated by Jason Ish about 6 years ago

Andreas Herz wrote:

But it doesn't hurt either right?

Doesn't hurt, but may improve user experience. Just in case you entered "receved" by accident and can't figure out why you are not seeing that in the output.

Actions
Copy link
 #4

Updated by Peter Manev about 6 years ago

Also it may not err on a filed we don't parse or support yet and leave the user with the wrong impression that everything is ok and expecting to see those values.

Actions
Copy link
 #5

Updated by Philippe Antoine 7 days ago

  • Label Beginner, C, Good First Issue added
Actions
Copy link
 #6

Updated by Philippe Antoine 7 days ago

  • Related to Optimization #7189: http/conf: warn or error on invalid value in custom headers logging added
Actions
Copy link
 #7

Updated by Philippe Antoine 6 days ago

  • Related to Bug #4330: file hash parameter in yaml accepts non valid values added
Actions
Copy link
 #8

Updated by Philippe Antoine 1 day ago

  • Affected Versions 8.0.0 added
Actions
Copy link

Also available in: Atom PDF