Project

General

Profile

Actions

Bug #6423

closed

detect-filesize no longer supports units in value

Added by tug tugtug 7 months ago. Updated 6 months ago.

Status:
Closed
Priority:
Normal
Target version:
Affected Versions:
Effort:
Difficulty:
Label:

Description

We're upgrading our server from 6 to 7, and discovered that some rules now fail to load.
We narrowed it down to the ones with filesize keyword.
It seems the pre-7 suricata supports syntax like filesize:>1MB, and now it fails silently. Further debugging has shown `DetectU64Parse` in `DetectFilesizeSetup` thinks the value is not a valid number.
We should either update documentation to deprecate the support of units, as it is a broken change, or fix this issue in 7.

Actions

Also available in: Atom PDF