Project

General

Profile

Actions
Copy link

Bug #11

closed

negated content matches don't work when ! is outside of ""

Added by Will Metcalf about 15 years ago. Updated about 15 years ago.

Status:
Closed
Priority:
Normal
Assignee:
Anoop Saldanha
Target version:
0.8.0
Affected Versions:
Effort:
Difficulty:
Label:

Description

for example content:!"PASS"; is completely valid in snort but doesn't work in our engine. However content:"!PASS"; does. unit test attached to display the issue.

Files

Download all files
0001-failing-unit-test-for-outside-of-negated-content.patch (1.42 KB) 0001-failing-unit-test-for-outside-of-negated-content.patch failing unittest for ! outside of "" in negated content matches Will Metcalf, 11/19/2009 04:52 PM
0001-Fix-for-handling-negated-content-CONTENT.patch (3.36 KB) 0001-Fix-for-handling-negated-content-CONTENT.patch Anoop Saldanha, 12/02/2009 12:13 AM
Actions
Copy link
 #1

Updated by Victor Julien about 15 years ago

  • Assignee changed from OISF Dev to Anoop Saldanha
Actions
Copy link
 #2

Updated by Victor Julien about 15 years ago

  • Estimated time changed from 0.50 h to 2.00 h
Actions
Copy link
 #3

Updated by Anoop Saldanha about 15 years ago

Will Metcalf wrote:

for example content:!"PASS"; is completely valid in snort but doesn't work in our engine.

I thought it does. I think it is the other way round. !\"CONTENT\" is supported

However content:"!PASS"; does. unit test attached to display the issue.

This isn't supported.

The test patch you supplied would fail, because you have called SigTestNegativeTestContent and not SigTestPositiveTestContent.

If you meant \"!PASS\" should also be supported, here is a patch.;

Actions
Copy link
 #4

Updated by Victor Julien about 15 years ago

  • Status changed from New to Resolved
  • % Done changed from 0 to 100

Applied, thanks guys.

Actions
Copy link
 #5

Updated by Victor Julien about 15 years ago

  • Status changed from Resolved to Closed
Actions
Copy link

Also available in: Atom PDF