Project

General

Profile

Actions

Bug #5299

closed

YAML warning from default config on 6.0.5

Added by vinjar hillestad over 2 years ago. Updated almost 2 years ago.

Status:
Closed
Priority:
Normal
Assignee:
Target version:
Affected Versions:
Effort:
low
Difficulty:
low
Label:
Beginner, Good First Issue

Description

Seems like stricter validation of the yaml config causing the default config to print warnings.
This might not actually be a bug, but the default config should IMO validate without warnings or errors.

Proposed solution is to explicitly enable sip, mqtt and rdp.
I will likely make a pull request myself.

Hope this will be changed for next point release.


$ docker run --rm -it jasonish/suricata:6.0.5 bash
Unable to find image 'jasonish/suricata:6.0.5' locally
6.0.5: Pulling from jasonish/suricata
605f3ebec62e: Pull complete 
5e964a6efba0: Pull complete 
9fc56ce92fcb: Pull complete 
c5c4e664c71a: Pull complete 
a897beb28ba8: Pull complete 
7b4de5f3e1e0: Pull complete 
55c9832284f6: Pull complete 
0f560ee38a5a: Pull complete 
fdc30a5ce2d5: Pull complete 
Digest: sha256:f7307799c1d36aa08689d4dde4f3947cc68b0a2ea322909ba2796b8b6aa7c791
Status: Downloaded newer image for jasonish/suricata:6.0.5
[root@7f6e212d1c10 /]# suricata -c /etc/suricata/suricata.yaml -T
27/4/2022 -- 15:48:40 - <Info> - Running suricata under test mode
27/4/2022 -- 15:48:40 - <Notice> - This is Suricata version 6.0.5 RELEASE running in SYSTEM mode
27/4/2022 -- 15:48:40 - <Warning> - [ERRCODE: SC_ERR_CONF_YAML_ERROR(242)] - App-Layer protocol sip enable status not set, so enabling by default. This behavior will change in Suricata 7, so please update your config. See ticket #4744 for more details.
27/4/2022 -- 15:48:40 - <Warning> - [ERRCODE: SC_ERR_CONF_YAML_ERROR(242)] - App-Layer protocol mqtt enable status not set, so enabling by default. This behavior will change in Suricata 7, so please update your config. See ticket #4744 for more details.
27/4/2022 -- 15:48:40 - <Warning> - [ERRCODE: SC_ERR_CONF_YAML_ERROR(242)] - App-Layer protocol rdp enable status not set, so enabling by default. This behavior will change in Suricata 7, so please update your config. See ticket #4744 for more details.
27/4/2022 -- 15:49:20 - <Notice> - Configuration provided was successfully loaded. Exiting.
[root@7f6e212d1c10 /]# 
Actions #1

Updated by Philippe Antoine almost 2 years ago

  • Target version changed from TBD to 6.0.10
Actions #2

Updated by Philippe Antoine almost 2 years ago

  • Affected Versions 6.0.5 added
Actions #4

Updated by Victor Julien almost 2 years ago

  • Status changed from New to In Progress
  • Assignee changed from vinjar hillestad to Victor Julien
Actions #5

Updated by Victor Julien almost 2 years ago

  • Status changed from In Progress to In Review
Actions #6

Updated by Victor Julien almost 2 years ago

  • Status changed from In Review to Closed
Actions

Also available in: Atom PDF