Project

General

Profile

Actions

Optimization #569

open

display syntax requirement on keyword parsing error

Added by Victor Julien almost 12 years ago. Updated 12 months ago.

Status:
New
Priority:
Normal
Target version:
Effort:
high
Difficulty:
low
Label:

Description

Currently if the syntax of a rule keyword is wrong we print just a pcre error most of the times.

It would be good to have a string per keyword that is displayed on error.

Format:

threshold: type <threshold|limit|both>, track <by_src|by_dst>, count <N>, seconds <T>

Actions #1

Updated by Victor Julien over 11 years ago

  • Priority changed from Normal to Low
Actions #2

Updated by Victor Julien over 11 years ago

  • Target version changed from 1.4beta3 to 1.4rc1
Actions #3

Updated by Victor Julien over 11 years ago

  • Target version changed from 1.4rc1 to 2.0rc2
Actions #4

Updated by Victor Julien over 10 years ago

  • Target version changed from 2.0rc2 to 3.0RC2
Actions #5

Updated by Victor Julien about 9 years ago

  • Target version changed from 3.0RC2 to 70
Actions #6

Updated by Victor Julien over 8 years ago

  • Priority changed from Low to Normal
  • Target version changed from 70 to TBD
Actions #7

Updated by Victor Julien almost 6 years ago

  • Assignee changed from OISF Dev to Anonymous
  • Effort set to high
  • Difficulty set to low
Actions #8

Updated by Andreas Herz over 5 years ago

  • Assignee set to Community Ticket
Actions #9

Updated by Jason Taylor almost 5 years ago

  • Assignee changed from Community Ticket to Jason Taylor
Actions #10

Updated by Jason Taylor over 2 years ago

It looks like the last discussion that was had around this was in https://github.com/OISF/suricata/pull/4251. Are there any update thoughts or ideas around this? I was going to take another look at this but wanted to see if anyone else had or was.

Actions #11

Updated by Jason Taylor about 2 years ago

  • Assignee changed from Jason Taylor to Community Ticket
Actions #12

Updated by Philippe Antoine 12 months ago

Side-note: We want to move away from pcre for keywords, and we still need meaningful error messages

Actions #13

Updated by Philippe Antoine 12 months ago

  • Tracker changed from Bug to Optimization
Actions

Also available in: Atom PDF