6.0.x: content: don't error out on incomplete hex - v2 #7887
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Add a new setup return code, -4 which will print the error, but not error out in test mode. This is to support allowing incomplete hex, as there is no context as to which rule had the issue. For context: - -3: error ok, no message - -2: error not ok, no message - -4: error ok, message
Before 6.0.6 if hex content was incomplete, Suricata didn't error out. With 6.0.6 incomplete hex was detected and errored on which is a breaking change in a release branch. Instead, only emit a warning unless strict content checking has been requested. To enable strict behaviour on incomplete content hex in a rule, "--strict-rule-keywords=content" can be used on the command line. Issue: OISF#5546
|
Information: QA ran without warnings. Pipeline 9372 |
Closed
Merged
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Before 6.0.6 if hex content was incomplete, Suricata didn't error out.
With 6.0.6 incomplete hex was detected and errored on which is a
breaking change in a release branch. Instead, only emit a warning
unless strict content checking has been requested.
To enable strict behaviour on incomplete content hex in a rule,
"--strict-rule-keywords=content" can be used on the command line.
Issue: https://redmine.openinfosecfoundation.org/issues/5546
For now there is no accompanying master commit, as the change in
behaviour for a major version is OK.
Previous PR: #7885
Changes from last PR:
be displayed, but not result in a test failure unless strict mode is
requested.
suricata-verify-pr: 946