incorrect object names "domain|ip" and "ip|port"

[JanKoDFNCERT]

Hi all,

IMHO the objects names "domain|ip" and "ip|port" should read "domain-ip" and "ip-port". Otherwise, an exception "UnknownMISPObjectTemplate" could be thrown if:

• an existing Event which contains at least one of these objects is loaded by PyMISP:

• load() method in mispevent.py calls "set_all_values" (line 397) calls "from_dict"
• line 480: tmp_object = MISPObject(obj['name']) whereas obj['name'] results in either "domain|ip" or "ip|port" which are no valid object names leading to the exception

[adulau]

@Rafiot What do you think about it? It's related to the template or the code for the object handling in PyMISP?

[Rafiot]

Woops, I didn't know that. I'll sort it out tomorrow.

[Rafiot]

Okay, I loaded an event with an attribute of type "domain|ip" and it worked just fine.

I want to make sure of one thing: "domain-ip" is an object, when "domain|ip"is a composite attribute (you can consider it as the old and crappy way to represent objects in MISP).

So creating a MISPObject of type "domain|ip" is in fact invalid.

You should be able to create a MISPObject of type "domain-ip", if it fails, can you please try again with the most recent version of PyMISP (2.4.81)? It might be because the object list wasn't updated.

[JanKoDFNCERT]

I agree that object creation using types "domain-ip" and "ip-Port" works without any issue. But please note, that the names contained in the json object definition files are different (e.g. definition.json of "ip-port", line 57 reads: "name": "ip|port"). Same applies to "domain-ip object". These are the names I am referring to. So under specific circumstances, it may happen that these invalid values are used to inistanciate an object (mispevent.py line 480) even if the object is created with the correct name.

[Rafiot]

Oh, wow, yeah, I misunderstood you, sorry, this is a mistake... Fixing it now

[Rafiot]

@adulau @iglocska Can you check the fix, I'm not sure of the impact of changing an object name on MISP itself...

[adulau]

It should be ok as the object template is based on UUID. It's better to change it now than later.