Project

General

Profile

Actions

Bug #4330

open

file hash parameter in yaml accepts non valid values

Added by Peter Manev over 4 years ago. Updated 8 days ago.

Status:
In Review
Priority:
Normal
Assignee:
Target version:
Affected Versions:
Effort:
Difficulty:
Label:
Beginner, C, Good First Issue

Description

/opt/suritest/bin/suricata --dump-config |grep shanani
outputs.1.eve-log.types.4.files.force-hash.0 = shananigans

/opt/suritest/bin/suricata -S /dev/null  -l logs/  --runmode=autofp  -T
[2744673] 16/2/2021 -- 11:33:21 - (suricata.c:1616) <Info> (ParseCommandLine) -- Running suricata under test mode
[2744673] 16/2/2021 -- 11:33:21 - (suricata.c:1060) <Notice> (LogVersion) -- This is Suricata version 7.0.0-dev (6bfc5afa2 2021-02-13) running in SYSTEM mode
[2744673] 16/2/2021 -- 11:33:21 - (decode-erspan.c:55) <Warning> (DecodeERSPANConfig) -- [ERRCODE: SC_WARN_ERSPAN_CONFIG(329)] - ERSPAN Type I is no longer configurable and it is always enabled; ignoring configuration setting.
[2744673] 16/2/2021 -- 11:33:21 - (suricata.c:2775) <Notice> (SuricataMain) -- Configuration provided was successfully loaded. Exiting.

Note that this is likely not an issue in the --dump-config command, but rather that the file logger force-hash configuration accepts unknown values, for example:

        - files:
            force-magic: no   # force logging magic on all logged files
            # force logging of checksums, available hash functions are md5,
            # sha1 and sha256
            force-hash: [shanani]

does not result in a startup error with suricata -c /my/suricata.yaml -T.


Related issues 1 (1 open0 closed)

Related to Suricata - Bug #2091: nonexistent/misspelled custom fields accepted during parsing of suricata.yamlNewCommunity TicketActions
Actions #1

Updated by Jeff Lucovsky over 4 years ago

There should be a call to `ConfNodeIsSequence` when a yaml sequence is expected.

Actions #2

Updated by Philippe Antoine over 1 year ago

  • Assignee set to Community Ticket
  • Target version set to TBD
  • Label Beginner, C, Good First Issue added

Indeed
FileForceHashParseCfg. should do else if and end with else fail on unknown value

Actions #3

Updated by Pooja Gadige about 1 year ago

Philippe Antoine wrote in #note-2:

Indeed
FileForceHashParseCfg. should do else if and end with else fail on unknown value

May I please claim this ticket and work on it?

Actions #4

Updated by Shivani Bhardwaj about 1 year ago

May I please claim this ticket and work on it?

yes please. Set the Assignee to yourself and get started. :)

Actions #5

Updated by Pooja Gadige about 1 year ago

  • Assignee changed from Community Ticket to Pooja Gadige
Actions #6

Updated by Pooja Gadige about 1 year ago

Shivani Bhardwaj wrote in #note-4:

May I please claim this ticket and work on it?

yes please. Set the Assignee to yourself and get started. :)

Thank you, Shivani!

Actions #7

Updated by Philippe Antoine 4 months ago

  • Related to Bug #2091: nonexistent/misspelled custom fields accepted during parsing of suricata.yaml added
Actions #8

Updated by Philippe Antoine 4 months ago

  • Affected Versions 8.0.0 added
Actions #9

Updated by Philippe Antoine 4 months ago

  • Affected Versions deleted (git main)
Actions #10

Updated by Juliana Fajardini Reichow 10 days ago

  • Assignee changed from Pooja Gadige to Community Ticket

Pooja Gadige wrote in #note-6:

Shivani Bhardwaj wrote in #note-4:

May I please claim this ticket and work on it?

yes please. Set the Assignee to yourself and get started. :)

Thank you, Shivani!

Hello, considering our indications for stale tickets, I'm unclaiming this one. If you have time in the future and would like to contribute to Suricata, please check our available tasks at the time.

Actions #11

Updated by James Kaddu 9 days ago

  • Status changed from New to In Progress
  • Assignee changed from Community Ticket to James Kaddu

Hello, working on this bug currently.

Actions #12

Updated by Jason Ish 9 days ago

  • Description updated (diff)
Actions #13

Updated by Jason Ish 9 days ago

Updated the description with more details.

Actions #14

Updated by James Kaddu 8 days ago ยท Edited

  • Status changed from In Progress to In Review
Actions

Also available in: Atom PDF