Project

General

Profile

Actions

Bug #3240

closed

Dataset hash-size or prealloc invalid value logging

Added by Jason Taylor almost 2 years ago. Updated over 1 year ago.

Status:
Closed
Priority:
Normal
Assignee:
Target version:
Affected Versions:
Effort:
Difficulty:
Label:

Description

A configuration with
datasets:
dns-ioc:
type: sha256
state: /home/ea/suri/lists/domainioc.lst
hash:
memcap: 256mb
hash-size: 256mb
prealloc: 256mb

These setting should log a warning/error since hash-size amd prealloc are integers.

from conversation with Victor, hash-size:
"This should be a integer instead. It is used to control how many rows
the hash table has. Default is 65536."

prealloc:
"This is also just an integer, its used to 'preallocate' dataset data
structures. Really only useful for when you dynamically add them at high
volume."

Actions #1

Updated by Victor Julien almost 2 years ago

  • Target version set to 5.0.1
Actions #2

Updated by Jason Taylor almost 2 years ago

Would something like this be acceptable as a fix in util-thash.c:

@ -230,6 +230,15 @@ static void THashInitConfig(THashTableContext *ctx, const char *cnf_prefix)
     GET_VAR(cnf_prefix, "hash-size");
     if ((ConfGet(varname, &conf_val)) == 1)
     {
+        int varlen = strlen(conf_val);
+        for (int i=0; i<varlen; i++)
+          if (!isdigit(conf_val[i]))
+          {
+            SCLogError(SC_ERR_SIZE_PARSE, "Error parsing %s in %s" 
+                       "from conf file - %s. Killing engine",
+                       varname, cnf_prefix, conf_val);
+            exit(EXIT_FAILURE);
+          }

with a suricata.yaml hash-size value of 256mb we now see:
35360] 16/10/2019 -- 16:23:23 - (datasets.c:417) <Notice> (DatasetGet) -- dataset and datarep features are experimental and subject to change
[35360] 16/10/2019 -- 16:23:23 - (util-thash.c:237) <Error> (THashInitConfig) -- [ERRCODE: SC_ERR_SIZE_PARSE(198)] - Error parsing datasets.dns-ioc.hash.hash-size in datasets.dns-ioc.hashfrom conf file - 256mb. Killing engine

if the value is just a number the yaml appears to be parsed properly and the dataset initialized as expected.

Actions #3

Updated by Andreas Herz almost 2 years ago

  • Assignee set to Jason Taylor

IMHO send a PR for it :)

Actions #4

Updated by Jason Taylor almost 2 years ago

Hi Andreas!

I did end up sending a PR, in discussions on GH it looks related maybe to something Shivani is working on with atoi updates. Work she is doing there may apply/address this issue as well. Perhaps, if it can wait we can discuss more at Suricon?

Actions #5

Updated by Victor Julien almost 2 years ago

  • Target version changed from 5.0.1 to 5.0.2
Actions #6

Updated by Victor Julien over 1 year ago

  • Target version changed from 5.0.2 to 5.0.3
Actions #7

Updated by Victor Julien over 1 year ago

  • Status changed from New to Closed
Actions

Also available in: Atom PDF