Project

General

Profile

Bug #454

HOME and EXT net variables

Added by Peter Manev about 6 years ago. Updated about 6 years ago.

Status:
Closed
Priority:
Normal
Target version:
Affected Versions:

Description

imagine the following configuration in yaml:
""
HOME_NET: "any"

EXTERNAL_NET: "!$HOME_NET"

""

I think we should just ERR exit on that (with the latest git).
Instead Suricata loads and does not load all the rules (does not load all that use HOME_NET and EXT_NET variables in the rule, without a proper msg)

Thanks

History

#1 Updated by Anoop Saldanha about 6 years ago

  • File 0001-bug-454-Provide-better-error-message-when-the-user-s.patch added
  • Status changed from New to Resolved
  • Assignee set to Anoop Saldanha

patch attached.

#2 Updated by Victor Julien about 6 years ago

Maybe it's a good idea to have a global check at start up as well. Give a fatal error if EXTERNAL_NET is !HOME_NET and HOME_NET is any.

#3 Updated by Anoop Saldanha about 6 years ago

Victor Julien wrote:

Maybe it's a good idea to have a global check at start up as well. Give a fatal error if EXTERNAL_NET is !HOME_NET and HOME_NET is any.

If we are checking it shouldn't be just for HOME_NET or EXTERNAL_NET. WE will have to check every address specified in conf to see if they have a !any set amongst them.

Can do this. Np

#4 Updated by Victor Julien about 6 years ago

  • Target version set to 1.3beta2
  • % Done changed from 0 to 80

HOME_NET and EXTERNAL_NET are the most important I think, as that is a common mistake. But testing all is cool.

Applied the per rule error, thanks.

#5 Updated by Anoop Saldanha about 6 years ago

  • File 0001-bug-454-global-check-to-see-if-address-and-port-vars.patch added

Add a global check for both addresss and port address vars.

#6 Updated by Victor Julien about 6 years ago

Can you add some unittests as well:

port normal
port !any

address normal
address !any

The code SC_ERR_ADDRESS_ENGINE_GENERIC could be more specific I think. It's a configuration (thus user) error. Think the code should reflect that.

#7 Updated by Anoop Saldanha about 6 years ago

  • File deleted (0001-bug-454-Provide-better-error-message-when-the-user-s.patch)

#8 Updated by Anoop Saldanha about 6 years ago

  • File deleted (0001-bug-454-global-check-to-see-if-address-and-port-vars.patch)

#10 Updated by Victor Julien about 6 years ago

  • Status changed from Resolved to Closed

All applied, thanks Anoop!

Also available in: Atom PDF