Project

General

Profile

Actions

Bug #11

closed

negated content matches don't work when ! is outside of ""

Added by Will Metcalf almost 12 years ago. Updated almost 12 years ago.

Status:
Closed
Priority:
Normal
Target version:
Affected Versions:
Effort:
Difficulty:
Label:

Description

for example content:!"PASS"; is completely valid in snort but doesn't work in our engine. However content:"!PASS"; does. unit test attached to display the issue.


Files

0001-failing-unit-test-for-outside-of-negated-content.patch (1.42 KB) 0001-failing-unit-test-for-outside-of-negated-content.patch failing unittest for ! outside of "" in negated content matches Will Metcalf, 11/19/2009 04:52 PM
0001-Fix-for-handling-negated-content-CONTENT.patch (3.36 KB) 0001-Fix-for-handling-negated-content-CONTENT.patch Anoop Saldanha, 12/02/2009 12:13 AM
Actions #1

Updated by Victor Julien almost 12 years ago

  • Assignee changed from OISF Dev to Anoop Saldanha
Actions #2

Updated by Victor Julien almost 12 years ago

  • Estimated time changed from 0.50 h to 2.00 h
Actions #3

Updated by Anoop Saldanha almost 12 years ago

Will Metcalf wrote:

for example content:!"PASS"; is completely valid in snort but doesn't work in our engine.

I thought it does. I think it is the other way round. !\"CONTENT\" is supported

However content:"!PASS"; does. unit test attached to display the issue.

This isn't supported.

The test patch you supplied would fail, because you have called SigTestNegativeTestContent and not SigTestPositiveTestContent.

If you meant \"!PASS\" should also be supported, here is a patch.;

Actions #4

Updated by Victor Julien almost 12 years ago

  • Status changed from New to Resolved
  • % Done changed from 0 to 100

Applied, thanks guys.

Actions #5

Updated by Victor Julien almost 12 years ago

  • Status changed from Resolved to Closed
Actions

Also available in: Atom PDF