Project

General

Profile

Actions
Copy link

Task #7627

open
JF JI

events/rules: prevent ruleset loading blocks from name fixes

Task #7627: events/rules: prevent ruleset loading blocks from name fixes

Added by Juliana Fajardini Reichow about 1 year ago. Updated 22 days ago.

Status:
New
Priority:
Normal
Assignee:
Jason Ish
Target version:
9.0.0-beta1
Effort:
Difficulty:
Label:

Description

#7361 had an unexpected effect of blocking the load of rule sets that used rules that previously would just silently fail if they used unknown events.

For dot releases, we want to avoid that. We also want to fix the rule set blocking outcome, for 7.

Subtasks 1 (0 open — 1 closed)

Task #7660: events/rules: prevent ruleset loading blocks from name fixes (7.0.x backport)RejectedJason IshActions

Related issues 1 (1 open — 0 closed)

Related to Suricata - Task #7626: tests: test rules shipped w/ Suricata for each releaseNewOISF DevActions

JF Updated by Juliana Fajardini Reichow about 1 year ago Actions
Copy link
 #1

  • Related to Task #7626: tests: test rules shipped w/ Suricata for each release added

JF Updated by Juliana Fajardini Reichow about 1 year ago Actions
Copy link
 #2

  • Label Needs backport to 7.0 added

OT Updated by OISF Ticketbot 12 months ago Actions
Copy link
 #3

  • Subtask #7660 added

OT Updated by OISF Ticketbot 12 months ago Actions
Copy link
 #4

  • Label deleted (Needs backport to 7.0)

VJ Updated by Victor Julien 10 months ago Actions
Copy link
 #5

  • Target version changed from 8.0.0-rc1 to 9.0.0-beta1

VJ Updated by Victor Julien 5 months ago Actions
Copy link
 #6

It's unclear if there is anything we want to change here. Invalid rules should be flagged, and we have strict mode to handle the subtleties.

JI Updated by Jason Ish 22 days ago Actions
Copy link
 #7

I've rejected this for 7.0, I think we work as designed. We have no 8.0 backport ticket. But I think we still work as designed, and we should probably reject this as well.

Actions
Copy link

Also available in: PDF Atom