Re: [Prelude Hybrid IDS] #148: Prewikka 0.9.4 crashes when the 'Filter on Target' option is used

#148: Prewikka 0.9.4 crashes when the 'Filter on Target' option is used
------------------------------+---------------------------------------------
 Reporter:  Gijs Hollestelle  |        Owner:  yoann         
     Type:  defect            |       Status:  assigned      
 Priority:  normal            |    Milestone:  Prewikka 0.9.5
Component:  prewikka          |      Version:  0.9           
 Severity:  normal            |   Resolution:                
 Keywords:                    |  
------------------------------+---------------------------------------------
Changes (by yoann):

  * milestone:  => Prewikka 0.9.5
  * status:  new => assigned

Old description:

> In the eventlisting, clicking on an IP address and selecting 'Filter on
> this Target' will result in a crash (see backtrace below).
>
> The crash is caused by the fact that in the created filter string
> alert.target.node.address is used instead of
> alert.target.node.address.address.
>
> The attached patch fixes this.
>
> Backtrace:
> Traceback (most recent call last):
>   File "/usr/lib/python2.3/site-packages/prewikka/Core.py", line 306, in
> process
>     getattr(view["object"], view["handler"])()
>   File "/usr/lib/python2.3/site-
> packages/prewikka/views/messagelisting.py", line 1242, in render
>     total = self._setMessages(criteria)
>   File "/usr/lib/python2.3/site-
> packages/prewikka/views/messagelisting.py", line 1183, in _setMessages
>     return self._setAggregatedMessagesNoValues(criteria, aggregated_on)
>   File "/usr/lib/python2.3/site-
> packages/prewikka/views/messagelisting.py", line 956, in
> _setAggregatedMessagesNoValues
>     results2 = self.env.idmef_db.getValues(selection, criteria +
> ["alert.correlation_alert.name"])
>   File "/usr/lib/python2.3/site-packages/prewikka/IDMEFDatabase.py", line
> 342, in getValues
>     criteria = idmef_criteria_new_from_string(criteria)
> PreludeError: Object type 'class' does not support operator '<>*'

New description:

 In the eventlisting, clicking on an IP address and selecting 'Filter on
 this Target' will result in a crash (see backtrace below).

 The crash is caused by the fact that in the created filter string
 alert.target.node.address is used instead of
 alert.target.node.address.address.

 The attached patch fixes this.

 Backtrace:
 {{{
 Traceback (most recent call last):
   File "/usr/lib/python2.3/site-packages/prewikka/Core.py", line 306, in
 process
     getattr(view["object"], view["handler"])()
   File "/usr/lib/python2.3/site-
 packages/prewikka/views/messagelisting.py", line 1242, in render
     total = self._setMessages(criteria)
   File "/usr/lib/python2.3/site-
 packages/prewikka/views/messagelisting.py", line 1183, in _setMessages
     return self._setAggregatedMessagesNoValues(criteria, aggregated_on)
   File "/usr/lib/python2.3/site-
 packages/prewikka/views/messagelisting.py", line 956, in
 _setAggregatedMessagesNoValues
     results2 = self.env.idmef_db.getValues(selection, criteria +
 ["alert.correlation_alert.name"])
   File "/usr/lib/python2.3/site-packages/prewikka/IDMEFDatabase.py", line
 342, in getValues
     criteria = idmef_criteria_new_from_string(criteria)
 PreludeError: Object type 'class' does not support operator '<>*'
 }}}

-- 
Ticket URL: <https://trac.prelude-ids.org/ticket/148>
Prelude Hybrid IDS <http://www.prelude-ids.org>
The Prelude Hybrid Intrusion Detection System suite

_______________________________________________
Prelude-devel site list
[email protected]
http://www.prelude-ids.org/mailman/listinfo/prelude-devel