From: Jason Ish <jason.ish@oisf.net>
Date: Fri, 24 Mar 2023 05:51:11 +0000 (-0600)
Subject: conf: deprecate multiple "include" statements at same level
X-Git-Tag: suricata-7.0.0-rc2~483
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=6ebb643b83083f801c38f309251e7b448dfefd89;p=thirdparty%2Fsuricata.git

conf: deprecate multiple "include" statements at same level

The YAML spec considers duplicate keys to be an error, as do some YAML
implementations, most notably Rust's serde_yaml which would be nice to
use in the future.

Multiple include lines at the same level will still work, but a warning
will be emitted.

These can be fixed by moving to an "include" array:

include:
  - file1.yaml
  - file2.yaml

Ticket: #5939
---

diff --git a/src/conf-yaml-loader.c b/src/conf-yaml-loader.c
index 57b793aa69..cef10ec88f 100644
--- a/src/conf-yaml-loader.c
+++ b/src/conf-yaml-loader.c
@@ -175,6 +175,7 @@ static int ConfYamlParse(yaml_parser_t *parser, ConfNode *parent, int inseq, int
     int seq_idx = 0;
     int retval = 0;
     int was_empty = -1;
+    int include_count = 0;
 
     if (rlevel++ > RECURSION_LIMIT) {
         SCLogError("Recursion limit reached while parsing "
@@ -298,6 +299,12 @@ static int ConfYamlParse(yaml_parser_t *parser, ConfNode *parent, int inseq, int
 
                     if (strcmp(value, "include") == 0) {
                         state = CONF_INCLUDE;
+                        if (++include_count > 1) {
+                            SCLogWarning("Multipline \"include\" fields at the same level are "
+                                         "deprecated and will not work in Suricata 8, please move "
+                                         "to an array of include files: line: %zu",
+                                    parser->mark.line);
+                        }
                         goto next;
                     }