Project

General

Profile

Actions

Bug #3240

closed
JT JT

Dataset hash-size or prealloc invalid value logging

Bug #3240: Dataset hash-size or prealloc invalid value logging

Added by Jason Taylor over 6 years ago. Updated almost 6 years ago.

Status:
Closed
Priority:
Normal
Assignee:
Target version:
Affected Versions:
Effort:
Difficulty:
Label:

Description

A configuration with
datasets:
dns-ioc:
type: sha256
state: /home/ea/suri/lists/domainioc.lst
hash:
memcap: 256mb
hash-size: 256mb
prealloc: 256mb

These setting should log a warning/error since hash-size amd prealloc are integers.

from conversation with Victor, hash-size:
"This should be a integer instead. It is used to control how many rows
the hash table has. Default is 65536."

prealloc:
"This is also just an integer, its used to 'preallocate' dataset data
structures. Really only useful for when you dynamically add them at high
volume."

VJ Updated by Victor Julien over 6 years ago Actions #1

  • Target version set to 5.0.1

JT Updated by Jason Taylor over 6 years ago Actions #2

Would something like this be acceptable as a fix in util-thash.c:

@ -230,6 +230,15 @@ static void THashInitConfig(THashTableContext *ctx, const char *cnf_prefix)
     GET_VAR(cnf_prefix, "hash-size");
     if ((ConfGet(varname, &conf_val)) == 1)
     {
+        int varlen = strlen(conf_val);
+        for (int i=0; i<varlen; i++)
+          if (!isdigit(conf_val[i]))
+          {
+            SCLogError(SC_ERR_SIZE_PARSE, "Error parsing %s in %s" 
+                       "from conf file - %s. Killing engine",
+                       varname, cnf_prefix, conf_val);
+            exit(EXIT_FAILURE);
+          }

with a suricata.yaml hash-size value of 256mb we now see:
35360] 16/10/2019 -- 16:23:23 - (datasets.c:417) <Notice> (DatasetGet) -- dataset and datarep features are experimental and subject to change
[35360] 16/10/2019 -- 16:23:23 - (util-thash.c:237) <Error> (THashInitConfig) -- [ERRCODE: SC_ERR_SIZE_PARSE(198)] - Error parsing datasets.dns-ioc.hash.hash-size in datasets.dns-ioc.hashfrom conf file - 256mb. Killing engine

if the value is just a number the yaml appears to be parsed properly and the dataset initialized as expected.

AH Updated by Andreas Herz over 6 years ago Actions #3

  • Assignee set to Jason Taylor

IMHO send a PR for it :)

JT Updated by Jason Taylor over 6 years ago Actions #4

Hi Andreas!

I did end up sending a PR, in discussions on GH it looks related maybe to something Shivani is working on with atoi updates. Work she is doing there may apply/address this issue as well. Perhaps, if it can wait we can discuss more at Suricon?

VJ Updated by Victor Julien over 6 years ago Actions #5

  • Target version changed from 5.0.1 to 5.0.2

VJ Updated by Victor Julien about 6 years ago Actions #6

  • Target version changed from 5.0.2 to 5.0.3

VJ Updated by Victor Julien almost 6 years ago Actions #7

  • Status changed from New to Closed
Actions

Also available in: PDF Atom