[Oisf-users] suricata-update - TypeError: int() argument must be a string, etc....

[John Peters]

Started receiving errors when running s-u. Discovered someone inadvertently
deleted a semicolon in an older rule (in our case it was between
the reference: and sid: fields).

It took a bit to dig through and find the bad rule, but could have been
much worse if it was one of the larger custom rule files (or if we ever
decided to go the monolithic file setup). I'm wondering if there is a bug
that's keeping me from finding out what what files/lines/sid/gid/etc is
causing the error, or if that is on a roadmap for future development?

The error:

Traceback (most recent call last):
  File "/bin/suricata-update", line 33, in <module>
    sys.exit(main.main())
  File "/bin/../lib/python3.4/site-packages/suricata/update/main.py", line
1454, in main
    sys.exit(_main())
  File "/bin/../lib/python3.4/site-packages/suricata/update/main.py", line
1334, in _main
    rulemap = build_rule_map(rules)
  File "/bin/../lib/python3.4/site-packages/suricata/update/main.py", line
696, in build_rule_map
    if rule.id not in rulemap:
  File "/bin/../lib/python3.4/site-packages/suricata/update/rule.py", line
121, in id
    return (int(self.gid), int(self.sid))
TypeError: int() argument must be a string, a bytes-like object or a
number, not 'NoneType'

Closest I could guess was the File "...rule.py" was trying to tell me the
error was on line 121 and return the gid & sid, but none of that lined up
with where the rule actually was.  Could the dropped semicolon before the
sid: field have messed that up?

Thanks.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.openinfosecfoundation.org/pipermail/oisf-users/attachments/20190306/f4047f00/attachment.html>