Bug 484361 - IDMEF_getraw can return 0 results causing errors in IDMEF_set
IDMEF_getraw can return 0 results causing errors in IDMEF_set
Status: CLOSED NEXTRELEASE
Product: Fedora
Classification: Fedora
Component: prelude-correlator (Show other bugs)
10
All Linux
low Severity medium
: ---
: ---
Assigned To: Steve Grubb
Fedora Extras Quality Assurance
:
Depends On:
Blocks:
  Show dependency treegraph
 
Reported: 2009-02-06 09:10 EST by Jeffrey C. Ollie
Modified: 2009-03-20 14:35 EDT (History)
1 user (show)

See Also:
Fixed In Version: 0.9.0-0.5.beta3.fc10
Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of:
Environment:
Last Closed: 2009-03-20 14:35:05 EDT
Type: ---
Regression: ---
Mount Type: ---
Documentation: ---
CRM:
Verified Versions:
Category: ---
oVirt Team: ---
RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: ---


Attachments (Terms of Use)
Return nil from IDMEF_getraw if idmef_path_get returns 0 (474 bytes, patch)
2009-02-06 09:10 EST, Jeffrey C. Ollie
no flags Details | Diff

  None (edit)
Description Jeffrey C. Ollie 2009-02-06 09:10:03 EST
Created attachment 331127 [details]
Return nil from IDMEF_getraw if idmef_path_get returns 0

IDMEF_getraw can sometimes return zero results on the Lua stack, which essentialy turns this call:

 ca:set("alert.source", INPUT:getraw("alert.source")) 

into:

 ca:set("alert.source")

That causes an error because the IDMEF_set method is expecting 3 arguments (self, path, value):

 prelude-correlator: ERROR: LUA error on 'business_hour': /etc/prelude-correlator/lua-rules/business-hour.lua:31: set(): require 3 arguments, got 2. (lua.c:148 lua_run)

Changing IDMEF_getraw so that it returns nil where previously it would return nothing seems to fix the problem for me.  I've attached a patch with the fix.

This has been reported upstream as ticket #332:

https://trac.prelude-ids.org/ticket/332
Comment 1 Steve Grubb 2009-02-06 10:13:58 EST
Thanks for reporting this. But I am subscribed to the prelude mail lists and saw the bug reports. I am also in contact with the upstream developers frequently. I'll apply the upstream patch when Yoann agrees to the fix and if he does not release a new update soon.
Comment 2 Fedora Update System 2009-03-02 15:10:35 EST
prelude-correlator-0.9.0-0.5.beta3.fc10 has been submitted as an update for Fedora 10.
http://admin.fedoraproject.org/updates/prelude-correlator-0.9.0-0.5.beta3.fc10
Comment 3 Steve Grubb 2009-03-02 15:20:41 EST
The patch attached to this bz was applied and a new package was built. It should be in the updates-testing repo soon.
Comment 4 Fedora Update System 2009-03-03 10:27:33 EST
prelude-correlator-0.9.0-0.5.beta3.fc10 has been pushed to the Fedora 10 testing repository.  If problems still persist, please make note of it in this bug report.
 If you want to test the update, you can install it with 
 su -c 'yum --enablerepo=updates-testing update prelude-correlator'.  You can provide feedback for this update here: http://admin.fedoraproject.org/updates/F10/FEDORA-2009-2259
Comment 5 Fedora Update System 2009-03-20 14:35:00 EDT
prelude-correlator-0.9.0-0.5.beta3.fc10 has been pushed to the Fedora 10 stable repository.  If problems still persist, please make note of it in this bug report.

Note You need to log in before you can comment on or make changes to this bug.