Bug #288: Config "outputs" boolean parsing issue - Suricata - Open Information Security Foundation

Actions

Copy link

Bug #288

closed

Config "outputs" boolean parsing issue

Added by James Pleger over 13 years ago. Updated about 13 years ago.

Status:

Closed

Priority:

Normal

Assignee:

Eileen Donlon

Target version:

1.1beta3

Affected Versions:

Effort:

Difficulty:

Label:

Description

I have a bug where if a boolean is set in the outputs configuration that isn't yes it sets to false.

This works(in config),
outputs:
- fast: {enabled: yes, filename: fast.log}

but this doesn't:
outputs:
- fast: {enabled: false, filename: fast.log}

I believe part of the problem exists on line 110 of runmodes.c in version 1.0.3

/** * Initialize the output modules.
*/
void RunModeInitializeOutputs(void) {
...
if (enabled != NULL && strcasecmp(enabled, "yes") == 0) {
To reproduce, change all the options in the outputs from "yes" to true.

Error:
[20946] 24/5/2011 -- 19:55:34 - (tm-threads.c:1416) <Error> (TmThreadWaitOnThreadInit) -- [ERRCODE: SC_ERR_THREAD_INIT(49)] - thread "Outputs" closed on initialization.
[20946] 24/5/2011 -- 19:55:34 - (suricata.c:1141) <Error> (main) -- [ERRCODE: SC_ERR_INITIALIZATION(45)] - Engine initialization failed, aborting...

Files

0001-Fix-bug-288-accept-true-in-output-configuration.patch (2.81 KB) 0001-Fix-bug-288-accept-true-in-output-configuration.patch

Jason Ish, 05/27/2011 12:06 AM

Actions

Copy link

Updated by James Pleger over 13 years ago

Mean to say that config:
outputs:
- fast: {enabled: true, filename: fast.log}

Wouldn't work.

Actions

Copy link

Updated by Jason Ish over 13 years ago

File 0001-Fix-bug-288-accept-true-in-output-configuration.patch 0001-Fix-bug-288-accept-true-in-output-configuration.patch added

This patch should fix the issue. Valid values for truth should be yes, 1, on and true.

Actions

Copy link

Updated by James Pleger over 13 years ago

Just tested and this indeed fixes the issue.

Thanks for the quick turn around,
James

Actions

Copy link

Updated by Victor Julien over 13 years ago

Due date set to 06/03/2011
Assignee set to Gerado Iglesias Galvan
Target version set to 1.1beta3
% Done changed from 0 to 20
Estimated time set to 3.00 h

Gerardo, can you scan through the code base to see if we have the same problem elsewhere?

Actions

Copy link

Updated by Victor Julien over 13 years ago

I applied Jason's patch btw, it's in the current master.

Actions

Copy link

Updated by James Pleger over 13 years ago

These are the instances that I found, there may be more...

Line 1158 of util-debug.c:
const char *enabled = ConfNodeLookupChildValue(output, "enabled");
if (enabled != NULL && strcmp(enabled, "no") 0)
continue;

Line 855 in alert-prelude.c:
if (log_packet_content && strcmp(log_packet_content,"yes")0)
ctx->log_packet_content = 1;
if (log_packet_header && strcmp(log_packet_header,"yes")!=0)
ctx->log_packet_header = 0;

Line 395 in stream-tcp.c should probably use the ConfGetBool function instead:
if ((ConfGet("stream.checksum_validation", &csum)) 1) {
if (strcmp(csum, "yes") 0) {
stream_config.flags |= STREAMTCP_INIT_FLAG_CHECKSUM_VALIDATION;
}

Actions

Copy link