Core: SURICATA: bug when converting commented out alerts to "drop"

[Stephanowicz]

Hi,

the lists of emergingthreats often contain rules that are commented out

alert http $HOME_NET any -> $EXTERNAL_NET

when changing 'all alerts to drop actions' these will get converted to

drop t http ...

resulting in errormessages

- [ERRCODE: SC_ERR_UNKNOWN_PROTOCOL(124)] - protocol "t" cannot be used in a signature.

I don't know why these rules are commented out - but this case has to be taken care of when changing from alert to drop.

Thank You & cheers,

Stephan

[fichtner]

Hi Stephan,

Looks like it tries to remove "alert" as five characters from the beginning of the stream. Not sure where this is, somewhere in src/opnsense/scripts/suricata/ I think, so handing over to Ad for assessment as he wrote the code.

Cheers,
Franco

[AdSchellevis]

I can't check it right now, but the logic is here https://github.com/opnsense/core/blob/master/src/opnsense/scripts/suricata/lib/downloader.py#L62-L66

[fichtner]

https://github.com/opnsense/core/blob/master/src/opnsense/scripts/suricata/lib/downloader.py#L66

copy+paste issue, should probably be [6:]

[fichtner]

@Stephanowicz please try this:

# opnsense-patch 105fb5b

[Stephanowicz]

Perfect!

Thanks again ;)

[fichtner]

yay, thanks for confirming