Project

General

Profile

Actions

Bug #5467

closed

rules: more graceful handling of anomalies for stable versions

Added by Victor Julien over 1 year ago. Updated over 1 year ago.

Status:
Closed
Priority:
Normal
Assignee:
Target version:
Affected Versions:
Effort:
Difficulty:
Label:

Description

Recent content hex notation fixes and xbits noalert fixes are causing upgrade issues for MSSPs that allow ppl to bring their own rules. In these cases the rules suddenly fail to load after Suricata has been upgraded, leading to confusion.

The fixes themselves were correct, perhaps we can default to a more graceful way of handling them, like with our classtype keyword.

This will need subtickets for the xbits and content cases when we agree on an approach


Subtasks 2 (0 open2 closed)

Bug #5546: rules: don't error on bad hex in contentClosedJason IshActions
Bug #5547: rules: less strict parsing of unexpected flowbit optionsClosedVictor JulienActions
Actions #1

Updated by Victor Julien over 1 year ago

  • Priority changed from Normal to High
Actions #2

Updated by Victor Julien over 1 year ago

  • Subtask #5546 added
Actions #3

Updated by Victor Julien over 1 year ago

  • Subtask #5547 added
Actions #4

Updated by Victor Julien over 1 year ago

  • Status changed from Assigned to In Review
Actions #5

Updated by Victor Julien over 1 year ago

  • Status changed from In Review to Closed
Actions

Also available in: Atom PDF