[Prelude Hybrid IDS] #148: Prewikka 0.9.4 crashes when the 'Filter on Target' option is used
Prelude Hybrid IDS <[email protected]>
| Newsgroups | gmane.comp.security.ids.prelude.devel |
|---|---|
| Message-ID | <[email protected]> |
#148: Prewikka 0.9.4 crashes when the 'Filter on Target' option is used
------------------------------+---------------------------------------------
Reporter: Gijs Hollestelle | Owner: yoann
Type: defect | Status: new
Priority: normal | Milestone:
Component: prewikka | Version: 0.9
Severity: normal | Keywords:
------------------------------+---------------------------------------------
In the eventlisting, clicking on an IP address and selecting 'Filter on
this Target' will result in a crash (see backtrace below).
The crash is caused by the fact that in the created filter string
alert.target.node.address is used instead of
alert.target.node.address.address.
The attached patch fixes this.
Backtrace:
Traceback (most recent call last):
File "/usr/lib/python2.3/site-packages/prewikka/Core.py", line 306, in
process
getattr(view["object"], view["handler"])()
File "/usr/lib/python2.3/site-
packages/prewikka/views/messagelisting.py", line 1242, in render
total = self._setMessages(criteria)
File "/usr/lib/python2.3/site-
packages/prewikka/views/messagelisting.py", line 1183, in _setMessages
return self._setAggregatedMessagesNoValues(criteria, aggregated_on)
File "/usr/lib/python2.3/site-
packages/prewikka/views/messagelisting.py", line 956, in
_setAggregatedMessagesNoValues
results2 = self.env.idmef_db.getValues(selection, criteria +
["alert.correlation_alert.name"])
File "/usr/lib/python2.3/site-packages/prewikka/IDMEFDatabase.py", line
342, in getValues
criteria = idmef_criteria_new_from_string(criteria)
PreludeError: Object type 'class' does not support operator '<>*'
--
Ticket URL: <https://trac.prelude-ids.org/ticket/148>
Prelude Hybrid IDS <http://www.prelude-ids.org>
The Prelude Hybrid Intrusion Detection System suite
_______________________________________________
Prelude-devel site list
[email protected]
http://www.prelude-ids.org/mailman/listinfo/prelude-devel