Skip to content

Commit 6d4a314

Browse files
committed
rules: manual flowbit id setting
Use a manual increment to compute the ID of flowbit object. Previous algorithm was triggering an integer overflow when importing the Suricata traffic id source.
1 parent 88f31fe commit 6d4a314

File tree

1 file changed

+7
-4
lines changed

1 file changed

+7
-4
lines changed

rules/models.py

Lines changed: 7 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -1123,6 +1123,11 @@ def get_rules(self, source, existing_rules_hash=None):
11231123
rules_list.append(rule)
11241124

11251125
flowbits = { 'added': {'flowbit': [], 'through_set': [], 'through_isset': [] }}
1126+
existing_flowbits = Flowbit.objects.all().order_by('-pk')
1127+
if len(existing_flowbits):
1128+
flowbits['last_pk'] = existing_flowbits[0].pk
1129+
else:
1130+
flowbits['last_pk'] = 1
11261131
for key in ('flowbits', 'hostbits', 'xbits'):
11271132
flowbits[key] = {}
11281133
for flowb in Flowbit.objects.filter(source=source, type=key):
@@ -1358,7 +1363,6 @@ def get_absolute_url(self):
13581363
return reverse('rule', args=[str(self.sid)])
13591364

13601365
def parse_flowbits(self, source, flowbits, addition = False):
1361-
flowbit_count = 0
13621366
for ftype in self.BITSREGEXP:
13631367
match = self.BITSREGEXP[ftype].findall(self.content)
13641368
if match:
@@ -1373,9 +1377,8 @@ def parse_flowbits(self, source, flowbits, addition = False):
13731377
if not flowinst[1] in flowbits[ftype].keys():
13741378
elt = Flowbit(type = ftype, name = flowinst[1],
13751379
source = source)
1376-
# limit at 20 *bits per rule
1377-
elt.id = int(self.sid) * 20 + flowbit_count
1378-
flowbit_count += 1
1380+
flowbits['last_pk'] += 1
1381+
elt.id = flowbits['last_pk']
13791382
flowbits[ftype][flowinst[1]] = elt
13801383
flowbits['added']['flowbit'].append(elt)
13811384
else:

0 commit comments

Comments
 (0)