Actions
Optimization #569
opendisplay syntax requirement on keyword parsing error
Effort:
high
Difficulty:
low
Label:
Description
Currently if the syntax of a rule keyword is wrong we print just a pcre error most of the times.
It would be good to have a string per keyword that is displayed on error.
Format:
threshold: type <threshold|limit|both>, track <by_src|by_dst>, count <N>, seconds <T>
Updated by Victor Julien almost 12 years ago
- Target version changed from 1.4beta3 to 1.4rc1
Updated by Victor Julien almost 12 years ago
- Target version changed from 1.4rc1 to 2.0rc2
Updated by Victor Julien almost 11 years ago
- Target version changed from 2.0rc2 to 3.0RC2
Updated by Victor Julien over 9 years ago
- Target version changed from 3.0RC2 to 70
Updated by Victor Julien almost 9 years ago
- Priority changed from Low to Normal
- Target version changed from 70 to TBD
Updated by Victor Julien over 6 years ago
- Assignee changed from OISF Dev to Anonymous
- Effort set to high
- Difficulty set to low
Updated by Jason Taylor about 5 years ago
- Assignee changed from Community Ticket to Jason Taylor
Updated by Jason Taylor almost 3 years ago
It looks like the last discussion that was had around this was in https://github.com/OISF/suricata/pull/4251. Are there any update thoughts or ideas around this? I was going to take another look at this but wanted to see if anyone else had or was.
Updated by Jason Taylor over 2 years ago
- Assignee changed from Jason Taylor to Community Ticket
Updated by Philippe Antoine over 1 year ago
Side-note: We want to move away from pcre for keywords, and we still need meaningful error messages
Updated by Philippe Antoine over 1 year ago
- Tracker changed from Bug to Optimization
Actions