Project

General

Profile

Actions

Bug #780

closed

Suricata fails to load any of threshold rules if at least one of them is not parseable

Added by Premysl Hruby about 11 years ago. Updated about 11 years ago.

Status:
Closed
Priority:
Normal
Assignee:
Target version:
-
Affected Versions:
Effort:
Difficulty:
Label:

Description

It seems that if one of the threshold rules contains type and Suricata is unable to parse it, none of the threshold rules is loaded (my peek into sourcecode seems to confirm this). Things are especially confusing if the typo is in the last rule, since Suricata is logging number of rules processed (including the failed one).

Example (failed! note the by_stc in the second line):
suppress gen_id 1, sig_id 2200029, track by_dst, ip fe80::/16
suppress gen_id 1, sig_id 2200029, track by_stc, ip fe80::/16

Expected outcome:
Suricata will still use correctly parsed threshold rules even in case the later one fails to parse. Possibly even skipping the offended rule and continue with the parsing with next line.

Actions

Also available in: Atom PDF