Actions
Bug #6423
closeddetect-filesize no longer supports units in value
Affected Versions:
Effort:
Difficulty:
Label:
Description
We're upgrading our server from 6 to 7, and discovered that some rules now fail to load.
We narrowed it down to the ones with filesize keyword.
It seems the pre-7 suricata supports syntax like filesize:>1MB, and now it fails silently. Further debugging has shown `DetectU64Parse` in `DetectFilesizeSetup` thinks the value is not a valid number.
We should either update documentation to deprecate the support of units, as it is a broken change, or fix this issue in 7.
Actions