metadata with no value is rejected but suricata accepts it
Maintainers usually reply within 1 day
Nobody has claimed this yet.
Assessment
- Difficulty
- 3/5
- Estimated time
- 1-2 days
- Newbie friendliness
- 56/100
Research direction
Start by reading the metadata parsing and stringification behavior linked in the issue, then compare it with the Suricata 8 example and the linked fork commit. Check how metadata entries without values are represented and whether they survive Metadatas.String() round trips. Done means deciding and documenting the intended compatibility behavior, with coverage for the example rule if acceptance is in scope.
Written by the indexing model from the issue text.
Description
Suricata 8 accepts metadata with no value like variant in this rule:
alert udp $HOME_NET any -> $EXTERNAL_NET any (msg:"foo"; content:"AA"; metadata: deployment Datacenter, variant; sid:1337; rev:1;)
It just silently drops it https://github.com/OISF/suricata/blob/suricata-8.0.7/src/detect-metadata.c#L192-L201
I'll admit this is a bit more questionable as an issue since this is arguably a problem with the rule. In my fork I accept them and ensure they round trip through Metadatas.String(). This would be a good linter as well.
As before my Slopfix™ is here: https://github.com/kallen-vc/gonids/commit/b5d8f08b1ad1228c3538325b24c97f17ed501217
- Dominant language
- Go
- Stars
- 197
- Forks
- 52
- Avg merge
- 1d 1h
- Merged PRs (30d)
- 21
Getting set up
- No Dockerfile or Docker Compose file
- No pull request template
- Read the contributing guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
More from google/gonids
-
Difficulty 2/5 1-3 hours Newbie friendliness 67/100
Maintainers usually reply within 1 day
-
Difficulty 3/5 1-2 days Newbie friendliness 35/100
Maintainers usually reply within 1 day
-
Difficulty 3/5 1-2 days Newbie friendliness 65/100
google/gonids#251 · 2 comments ·
Maintainers usually reply within 1 day
-
Difficulty 3/5 1-2 days Newbie friendliness 58/100
google/gonids#249 · 1 comment ·
Maintainers usually reply within 1 day
-
Difficulty 4/5 3-5 days Newbie friendliness 20/100
Maintainers usually reply within 1 day
Similar issues
-
Project submission:Open
Difficulty 1/5 Under an hour Newbie friendliness 72/100
slavakurilyak/awesome-ai-agents#845 ·
Maintainers usually reply within 1 day
-
bug
Difficulty 2/5 1-3 hours Newbie friendliness 68/100
Maintainers usually reply within 3 days
-
Difficulty 2/5 1-3 hours Newbie friendliness 85/100
-
Difficulty 2/5 1-3 hours Newbie friendliness 74/100
JakeChampion/lang#13132 ·
Maintainers usually reply within 1 day
-
[BUG] deploy.restart_policy without condition drops the restart policyPossibly taken @akshat-lakhera claimed this today. Open
Difficulty 2/5 1-3 hours Newbie friendliness 82/100
docker/compose#14383 · 1 comment ·
Maintainers usually reply within 1 day