Open Information Security Foundation

09/27/2019

07:04 PM Suricata Feature #2168: Rules files from Suricata sources (like decoder-events.rules) are packaged as config files and may not be updated on package update.

Victor Julien wrote:
> Is there still something to do for this ticket? Seems #3138 covers this?
Yep, I think movi... Pavel Selivanov

10/27/2017

10:09 AM Suricata Feature #2168: Rules files from Suricata sources (like decoder-events.rules) are packaged as config files and may not be updated on package update.

I like the suggested structure:
* sysconfdir/suricata/rules-local only for local rules
* datarootdir/suricata/rul... Pavel Selivanov

07/04/2017

05:22 PM Suricata Feature #2168: Rules files from Suricata sources (like decoder-events.rules) are packaged as config files and may not be updated on package update.

@Peter_Manev - of course I'll test new packages, I am interested to have Suricata updating smoothly. Pavel Selivanov

04:23 PM Suricata Feature #2168: Rules files from Suricata sources (like decoder-events.rules) are packaged as config files and may not be updated on package update.

I suppose, at least built-in rules should not be marked as config files in package, because they should always be upd... Pavel Selivanov

04:27 PM Suricata Bug #2134: Config test (suricata -T) return non-zero exit code if config is correct

Well, it may be worth fixing this in currently stable 3.2 branch. If you expect number of affected old version users ... Pavel Selivanov

06/28/2017

10:33 AM Suricata Feature #2168 (Closed): Rules files from Suricata sources (like decoder-events.rules) are packaged as config files and may not be updated on package update.

In many environments Suricata packages are updated automatically, with tools like ansible, puppet, etc. This tools us... Pavel Selivanov

09:43 AM Suricata Bug #2134: Config test (suricata -T) return non-zero exit code if config is correct

Here is much shorter suricata.yaml, that reproduces this problem with suricata 3.2.2
And here is emerging-icmp.rul... Pavel Selivanov

06/08/2017

05:03 AM Suricata Bug #2134: Config test (suricata -T) return non-zero exit code if config is correct

Here are strace and ltrace outputs. strace shows, that process end soon after opening @emerging-icmp.rules@:... Pavel Selivanov

06/07/2017

04:59 PM Suricata Bug #2134: Config test (suricata -T) return non-zero exit code if config is correct

Here it is. It's almost default. @default-rule-path@ is changed, because OSSEC generates alerts every time files is @... Pavel Selivanov

06:26 AM Suricata Bug #2134 (Closed): Config test (suricata -T) return non-zero exit code if config is correct

... Pavel Selivanov