Project

General

Profile

Actions
Copy link

Bug #2091

open

nonexistent/misspelled custom fields accepted during parsing of suricata.yaml

Added by Peter Manev over 8 years ago. Updated 24 minutes ago.

Status:
New
Priority:
Normal
Assignee:
Olusegun Fajobi
Target version:
9.0.0-beta1
Affected Versions:
8.0.0
Effort:
Difficulty:
Label:
Beginner, C, Good First Issue

Description

This is Suricata version 4.0dev (rev 9ff8882)

If there is misspelled or nonexistent custom field in eve.json's section Suricata would not error out/warn on start - example:


        - http:
            custom: [accept, accept-charset, accept-encoding, accept-language,
            proxy-authenticate, referrer, refresh, retry-after, server,
            set-cookie, trailer, transfer-encoding, upgrade, vary, warning,
            www-authenticate, mychemicalromance]
        - smtp:
            custom: [received, sensitivity, organization, content-md5, date, mychemicalromance]

Related issues 2 (1 open — 1 closed)

Related to Suricata - Optimization #7189: http/conf: warn or error on invalid value in custom headers loggingRejectedCommunity TicketActions
Related to Suricata - Bug #4330: file hash parameter in yaml accepts non valid valuesNewPooja GadigeActions
Actions
Copy link
 #1

Updated by Andreas Herz over 8 years ago

  • Assignee set to OISF Dev
  • Target version set to TBD
Actions
Copy link
 #2

Updated by Andreas Herz over 6 years ago

But it doesn't hurt either right?

Actions
Copy link
 #3

Updated by Jason Ish about 6 years ago

Andreas Herz wrote:

But it doesn't hurt either right?

Doesn't hurt, but may improve user experience. Just in case you entered "receved" by accident and can't figure out why you are not seeing that in the output.

Actions
Copy link
 #4

Updated by Peter Manev about 6 years ago

Also it may not err on a filed we don't parse or support yet and leave the user with the wrong impression that everything is ok and expecting to see those values.

Actions
Copy link
 #5

Updated by Philippe Antoine 3 months ago

  • Label Beginner, C, Good First Issue added
Actions
Copy link
 #6

Updated by Philippe Antoine 3 months ago

  • Related to Optimization #7189: http/conf: warn or error on invalid value in custom headers logging added
Actions
Copy link
 #7

Updated by Philippe Antoine 3 months ago

  • Related to Bug #4330: file hash parameter in yaml accepts non valid values added
Actions
Copy link
 #8

Updated by Philippe Antoine 3 months ago

  • Affected Versions 8.0.0 added
Actions
Copy link
 #9

Updated by Jamie Lavigne 2 months ago

Erroring explicitly would definitely be a good thing for usability - if it's an invalid input then getting that feedback to the user early and obviously helps them find and correct the mistake with much less time & effort than having to discover that their inputs are being quietly ignored.

Actions
Copy link
 #10

Updated by Juliana Fajardini Reichow 15 days ago

  • Assignee changed from OISF Dev to Community Ticket
  • Target version changed from TBD to 9.0.0-beta1
Actions
Copy link
 #11

Updated by Olusegun Fajobi about 22 hours ago ยท Edited

I would like to work on this issue, can it be assigned to me??
And I would like to be granted a developer role as well.

Actions
Copy link
 #12

Updated by Juliana Fajardini Reichow about 20 hours ago

Olusegun Fajobi wrote in #note-11:

I would like to work on this issue, can it be assigned to me??
And I would like to be granted a developer role as well.

Hello! You should be able to claim the ticket, now. Thanks for your interest in our project, you can use the ticket or the discord chat to share your progress or if any questions! :)

Actions
Copy link
 #13

Updated by Olusegun Fajobi about 20 hours ago

Yes, I can now. Thank you.

Actions
Copy link
 #14

Updated by Olusegun Fajobi about 20 hours ago

  • Assignee changed from Community Ticket to Olusegun Fajobi
Actions
Copy link
 #15

Updated by Olusegun Fajobi 27 minutes ago

  • Assignee deleted (Olusegun Fajobi)
Actions
Copy link
 #16

Updated by Olusegun Fajobi 26 minutes ago

  • Assignee set to Community Ticket
Actions
Copy link
 #17

Updated by Olusegun Fajobi 24 minutes ago

  • Assignee changed from Community Ticket to Olusegun Fajobi
Actions
Copy link

Also available in: Atom PDF