Project

General

Profile

Actions
Copy link

Bug #2372

closed
NP JI

Non-deterministic behavior when encountering duplicated SIDs

Bug #2372: Non-deterministic behavior when encountering duplicated SIDs

Added by Nick Price over 8 years ago. Updated over 6 years ago.

Status:
Closed
Priority:
Normal
Assignee:
Jason Ish
Target version:
1.1.0rc1
Affected Versions:
1.0.0b1
Effort:
Difficulty:
Label:

Description

Long story short, because suricata-update reads commented-out rules in addition to normal rules, things get really weird if you have one .rules file with a SID commented out and a separate .rules file without it commented out, and doubly so if you're trying to threshold those rules using threshold.in.

I was doing this as a way to enable rules that were commented-out by default in rulesets that I downloaded, rather than by modifying the files each time they were pulled down.

We should probably fire off a warning or something if suricata-update encounters a SID that it thinks it already knows about.

JI Updated by Jason Ish over 8 years ago Actions
Copy link
 #1

  • Status changed from New to Assigned
  • Priority changed from Normal to High
  • Target version set to 1.0.0b1

I plan to add preference to the rule with the highest revision and log an info or warning message when encountered. I’ll do this sooner than later to make it deterministic before the next release.

VJ Updated by Victor Julien over 7 years ago Actions
Copy link
 #2

  • Target version deleted (1.0.0b1)
  • Affected Versions 1.0.0b1 added

VJ Updated by Victor Julien over 7 years ago Actions
Copy link
 #3

  • Target version set to 1.0.0

Since you've mentioned you'd address this before the next release, I thought it'd be safe to assign it to 1.0.0.

JI Updated by Jason Ish over 7 years ago Actions
Copy link
 #4

  • Target version deleted (1.0.0)

JI Updated by Jason Ish about 7 years ago Actions
Copy link
 #5

  • Priority changed from High to Normal
  • Target version set to TBD

SB Updated by Shivani Bhardwaj almost 7 years ago Actions
Copy link
 #6

  • Status changed from Assigned to Closed

JI Updated by Jason Ish over 6 years ago Actions
Copy link
 #7

Shivani: I can't remember why this was closed. Do you?

SB Updated by Shivani Bhardwaj over 6 years ago Actions
Copy link
 #8

Jason Ish wrote:

I plan to add preference to the rule with the highest revision and log an info or warning message when encountered. I’ll do this sooner than later to make it deterministic before the next release.

Jason, maybe because this was done in https://github.com/OISF/suricata-update/commit/6c87a153bc1b011acdb16dbc17bd1fea07948220 ?

JI Updated by Jason Ish over 6 years ago Actions
Copy link
 #9

  • Target version changed from TBD to 1.1.0rc1

Shivani Bhardwaj wrote:

Jason Ish wrote:

I plan to add preference to the rule with the highest revision and log an info or warning message when encountered. I’ll do this sooner than later to make it deterministic before the next release.

Jason, maybe because this was done in https://github.com/OISF/suricata-update/commit/6c87a153bc1b011acdb16dbc17bd1fea07948220 ?

Ok. Works for me.

Actions
Copy link

Also available in: PDF Atom