Bug #13771
closed
Suricata tries to load invalid SID file
100%
Description
Tested on 6.0.8_2, pfSense-23.01.b.20221217.1429.
After trying to start Suricata using inline mode, the following is shown in system logs:
[Suricata] ERROR: unable to find reject_sid list "none" specified for LAN
The config.xml file contains the following after saving the SID Mgmt page:
<reject_sid_file>none</reject_sid_file>
Files
Updated by Bill Meeks over 2 years ago
A lowercase "none" should not be present there. A value of "None" (note the uppercase "N") is automatically added to the drop-down selector list for each SID modification list file (Enable, Disable, Modify, Drop, Reject). See the code in /usr/local/www/suricata/suricata_sid_mgmt.php .
Upon saving on the SID MGMT tab, when the selection "None" is detected as the choice in the drop-down selector, the corresponding entry in config.xml is unset (deleted).
If the lowercase value was somehow manually entered, that would explain the error as "None" would not equal "none" during the save comparison and thus the config.xml entry would receive the value "none". Since no actual list exists with that name, the subsequent error is expected.
I can modify the existing PHP code to perform a case insensitive comparison, but I am still curious where the lowercase "none" originated. Can you shed additional light on that? Was this reported from a customer using a non-English locale?
Updated by Marcos M over 2 years ago
- File suricata.png suricata.png added
I haven't looked at how the value is ending up there, but I can say that I've never used that particular option, nor has it been added manually. It seems the lower case none value comes from the value property of the input element, see the attached screenshot.
Updated by Bill Meeks over 2 years ago
I will investigate further and get a fix submitted to address this.
Updated by Bill Meeks over 2 years ago
A fix for this issue has been posted in Pull Request #1208 against DEVEL posted here: https://github.com/pfsense/FreeBSD-ports/pull/1208.
This issue can be marked resolved when the pull request is merged.
Updated by Jim Pingle over 2 years ago
- Status changed from New to Resolved
- % Done changed from 0 to 100
PR Merged