Project

General

Profile

Actions

Bug #6423

closed

detect-filesize no longer supports units in value

Added by tug tugtug 6 months ago. Updated 6 months ago.

Status:
Closed
Priority:
Normal
Target version:
Affected Versions:
Effort:
Difficulty:
Label:

Description

We're upgrading our server from 6 to 7, and discovered that some rules now fail to load.
We narrowed it down to the ones with filesize keyword.
It seems the pre-7 suricata supports syntax like filesize:>1MB, and now it fails silently. Further debugging has shown `DetectU64Parse` in `DetectFilesizeSetup` thinks the value is not a valid number.
We should either update documentation to deprecate the support of units, as it is a broken change, or fix this issue in 7.

Actions #1

Updated by Victor Julien 6 months ago

  • Status changed from New to Assigned
  • Assignee changed from Victor Julien to Philippe Antoine
  • Target version changed from TBD to 7.0.3

Looks like 35b6dcec7e82fadb7077c6dc4c9382d080d9e771 broke this?

Actions #2

Updated by Philippe Antoine 6 months ago

  • Status changed from Assigned to In Review
Actions #3

Updated by Philippe Antoine 6 months ago

  • Status changed from In Review to Closed
Actions

Also available in: Atom PDF