Bug #6921
Updated by Simen Lybekk 9 months ago
Flagging as a bug, although could be argued that it's not. The JSON builder has two methods for handling floats: * append_float - https://github.com/OISF/suricata/blob/master/rust/src/jsonbuilder.rs#L425 * set_float - https://github.com/OISF/suricata/blob/master/rust/src/jsonbuilder.rs#L637 These do not check whether the float value is NaN (https://doc.rust-lang.org/std/primitive.f64.html#method.is_nan), and may as such serialize a float as the literal keyword "NaN". Some Most JSON parsers parsers, like Python's or serde-rs will not accept this as valid JSON. serde-rs writes a bit more about this here: https://github.com/serde-rs/json/issues/879 We decided to patch this to a string "NaN" as this is good enough for our use, patch attached. Doing this does mean that all the JSON Schemas for EVE logs needs to be updated.