Project

General

Profile

Actions
Copy link

Bug #3182

closed
PM

parsing: warn user on wildcard usage without quotes with -S

Bug #3182: parsing: warn user on wildcard usage without quotes with -S

Added by Peter Manev almost 7 years ago. Updated 12 months ago.

Status:
Rejected
Priority:
Normal
Assignee:
-
Target version:
-
Affected Versions:
Effort:
Difficulty:
Label:

Description

It would be helpful if Suricata warns on wildcard use without quotation marks for command line parameter override.

Example.
It seems that when wildcard rules are passed on the command line without being surrounded with quotes Suricata does not complain and it only loads the first rulefile available.

:~/Work/Suricata/tests/tmp$ sudo /opt/suritest/bin/suricata -c /opt/suritest/etc/suricata/suricata.yaml -S rules/*.rules -T
[19161] 19/9/2019 -- 14:33:15 - (suricata.c:1884) <Info> (ParseCommandLine) -- Running suricata under test mode
[19161] 19/9/2019 -- 14:33:15 - (suricata.c:1075) <Notice> (LogVersion) -- This is Suricata version 5.0.0-dev (d4bc46038 2019-09-17) running in SYSTEM mode
[19161] 19/9/2019 -- 14:33:17 - (suricata.c:3023) <Notice> (main) -- Configuration provided was successfully loaded. Exiting.

loads only activex.rules from the ETOpen/Pro ruleset in the rules folder.

In the case where the wildcard is passed the full set is loaded.

:~/Work/Suricata/tests/tmp$ sudo /opt/suritest/bin/suricata -c /opt/suritest/etc/suricata/suricata.yaml -S "rules/*.rules" -T
[19169] 19/9/2019 -- 14:33:19 - (suricata.c:1884) <Info> (ParseCommandLine) -- Running suricata under test mode
[19169] 19/9/2019 -- 14:33:19 - (suricata.c:1075) <Notice> (LogVersion) -- This is Suricata version 5.0.0-dev (d4bc46038 2019-09-17) running in SYSTEM mode
[19169] 19/9/2019 -- 14:36:50 - (suricata.c:3023) <Notice> (main) -- Configuration provided was successfully loaded. Exiting.

Without passing the quotes it does not load all rules but does not complain either.

AH Updated by Andreas Herz almost 7 years ago Actions
Copy link
 #1

  • Assignee set to OISF Dev
  • Target version set to TBD

JF Updated by Juliana Fajardini Reichow almost 3 years ago Actions
Copy link
 #2

  • Target version changed from TBD to 8.0.0-beta1

VJ Updated by Victor Julien over 1 year ago Actions
Copy link
 #3

  • Target version changed from 8.0.0-beta1 to 8.0.0-rc1

SB Updated by Shivani Bhardwaj over 1 year ago Actions
Copy link
 #4

  • Subject changed from warn user on wildcard usage without quotes to parsing: warn user on wildcard usage without quotes with -S

PA Updated by Philippe Antoine over 1 year ago Actions
Copy link
 #5

For me, this looks like a bash usage, Suricata does not know what was typed in bash exactly...

I would reject this

VJ Updated by Victor Julien about 1 year ago Actions
Copy link
 #6

  • Target version changed from 8.0.0-rc1 to 9.0.0-beta1

PA Updated by Philippe Antoine about 1 year ago Actions
Copy link
 #7

  • Status changed from New to Rejected

As mentioned above

VJ Updated by Victor Julien 12 months ago Actions
Copy link
 #8

  • Assignee deleted (OISF Dev)
  • Target version deleted (9.0.0-beta1)
Actions
Copy link

Also available in: PDF Atom