Project

General

Profile

Actions
Copy link

Bug #293

closed

Some debug messages does not support filter

Added by Eric Leblond almost 13 years ago. Updated over 12 years ago.

Status:
Closed
Priority:
Low
Assignee:
Eric Leblond
Target version:
1.2rc1
Affected Versions:
Effort:
Difficulty:
Label:

Description

There is some debug messages that does not get filtered by SC_LOG_OP_FILTER.

For example, when suricata is launched with:

SC_LOG_LEVEL=debug SC_LOG_OP_FILTER="FIN packet received" /home/eric/builds/suricata/bin/suricata -c ~eric/builds/suricata/etc/suricata.yaml -r benches/nmap-fin.pcap

We see a lot of uri in the output:
.php?&&reader_version=
/download/Antivirus_
.exe

The code responsible for this output is in src/detect-uricontent.c at source:/src/detect-uricontent.c@047b19d2715f1cba98d8c5de8174466256bc7f64#L311. A printf is used where a filtered printf should be used.

Actions
Copy link

Also available in: Atom PDF