Bug 12260 - suricata won't start Core 139
Summary: suricata won't start Core 139
Status: CLOSED FIXED
Alias: None
Product: IPFire
Classification: Unclassified
Component: --- (show other bugs)
Version: 2
Hardware: all All
: Will affect an average number of users Crash
Assignee: Peter Müller
QA Contact: Stefan Schantl
URL:
Keywords: Security
: 12256 (view as bug list)
Depends on:
Blocks: 12257
  Show dependency tree / graph
 
Reported: 2019-12-13 07:19 UTC by DJ-Melo
Modified: 2020-01-22 20:35 UTC (History)
3 users (show)

See Also:

Attachments
wui of ips (13.57 KB, image/png)
2019-12-13 07:19 UTC, DJ-Melo 		Details
View All Add an attachment (proposed patch, testcase, etc.)

Note You need to log in before you can comment on or make changes to this bug.
Description DJ-Melo 2019-12-13 07:19:58 UTC 
Created attachment 725 [details]
wui of ips

Hi,

Intrusion Prevention Service not start in 139

Dec 12 20:15:58 cyberdyne suricata: This is Suricata version 4.1.5 RELEASE
Dec 12 20:15:58 cyberdyne suricata: [ERRCODE: SC_ERR_ADDRESS_ENGINE_GENERIC(89)] - failed to parse address " 84.200.69.80 194.150.168.168"
Dec 12 20:15:58 cyberdyne suricata: [ERRCODE: SC_ERR_INVALID_YAML_CONF_ENTRY(139)] - failed to parse address var “DNS_SERVERS” with value “[ 84.200.69.80 194.150.168.168]”. Please check it’s syntax
Dec 12 20:15:58 cyberdyne suricata: [ERRCODE: SC_ERR_INVALID_YAML_CONF_ENTRY(139)] - basic address vars test failed. Please check /etc/suricata/suricata.yaml for errors

I think the error is in the file suricata-dns-servers.yaml.
Here is a space between the bracket and the first ip-address

“[ 84.200.69.80 194.150.168.168]”

same here. IPS is stopped in the log:

[ERRCODE: SC_ERR_ADDRESS_ENGINE_GENERIC(89)] - failed to parse address " 81.3.27 .54 46.182.19.48"
13:49:19 suricata: [ERRCODE: SC_ERR_INVALID_YAML_CONF_ENTRY(139)] - failed to parse address var “DN S_SERVERS” with value “[ 81.3.27.54 46.182.19.48]”. Please check it’s syntax
13:49:19 suricata: [ERRCODE: SC_ERR_INVALID_YAML_CONF_ENTRY(139)] - basic address vars test failed. Please check /etc/suricata/suricata.yaml for errors

also with space "[ 81.3.27.54 46.182.19.48]

I don’t know if that’s the problem
Comment 1 DJ-Melo 2019-12-13 07:42:36 UTC 
I think it's related to 12166.
Comment 2 Michael Tremer 2019-12-13 11:50:55 UTC 
Stefan, could you please urgently fix this? We will have to rebuild the Core Update after this.
Comment 3 Michael Tremer 2019-12-13 11:54:32 UTC 
*** Bug 12256 has been marked as a duplicate of this bug. ***
Comment 4 Peter Müller 2019-12-13 17:29:56 UTC 
https://patchwork.ipfire.org/patch/2644/