Project

General

Profile

Actions

Documentation #7298

open
JF CT

Documentation #6478: schema: add missing fields

schema/netflow: add missing field

Documentation #7298: schema/netflow: add missing field

Added by Juliana Fajardini Reichow almost 2 years ago. Updated 14 days ago.

Status:
Triaged
Priority:
Normal
Target version:
Affected Versions:
Effort:
Difficulty:
Label:
Beginner, Good First Issue, Outreachy

Description

Running

git grep 'js, "' src/output-json-netflow.c | cut -d'"' -f2 | sort | uniq | while read i; do echo -n $i " "; git grep $i etc/schema.json | wc -l; done

Will show that sesnsor_id comes with a 0, meaning we are missing this field in our json schema.

https://github.com/OISF/suricata/pull/11844 showcases how a similar issue (#7287) was fixed.

PA Updated by Philippe Antoine almost 2 years ago Actions #1

I see three fields missing besides DNP3 :

git grep 'js, "' src/output-json-*.c | grep -v dnp3 | cut -d'"' -f2 | sort | uniq | while read i; do echo -n $i; git grep $i etc/schema.json | wc -l; done | awk '$2 == 0'
payload_hex       0
sensor_id       0
tenant_id       0

PA Updated by Philippe Antoine about 1 month ago Actions #2

  • Status changed from New to Triaged

OM Updated by Omar Merroun 15 days ago ยท Edited Actions #3

The grep-based schema check produces a false positive on sensor_id because the emitting code is behind #if 0 // TODO and has been since 2014 (present in both output-json-flow.c and output-json-netflow.c).

running:
git grep 'js, "' src/output-json-*.c | cut -d'"' -f2 | sort | uniq | while read i; do echo -n $i " "; git grep $i etc/schema.json | wc -l; done
exposes tens of fields with 0. So I'd suggest opening another ticket to fully investigate them.

JF Updated by Juliana Fajardini Reichow 14 days ago Actions #4

Omar Merroun wrote in #note-3:

s a false positive on sensor_id because the emitting code is behind #if 0 /

Wouldn't this suffice, for tracking them? https://redmine.openinfosecfoundation.org/issues/6478

OM Updated by Omar Merroun 14 days ago Actions #5

Yeah you're right, it works as a tracker, it would be great if sub-tickets are created to divide output files. Or maybe it could be done in one go

Actions

Also available in: PDF Atom