Bug #11
closed
negated content matches don't work when ! is outside of ""
Added by Will Metcalf about 15 years ago.
Updated about 15 years ago.
Description
for example content:!"PASS"; is completely valid in snort but doesn't work in our engine. However content:"!PASS"; does. unit test attached to display the issue.
Files
- Assignee changed from OISF Dev to Anoop Saldanha
- Estimated time changed from 0.50 h to 2.00 h
Will Metcalf wrote:
for example content:!"PASS"; is completely valid in snort but doesn't work in our engine.
I thought it does. I think it is the other way round. !\"CONTENT\" is supported
However content:"!PASS"; does. unit test attached to display the issue.
This isn't supported.
The test patch you supplied would fail, because you have called SigTestNegativeTestContent and not SigTestPositiveTestContent.
If you meant \"!PASS\" should also be supported, here is a patch.;
- Status changed from New to Resolved
- % Done changed from 0 to 100
- Status changed from Resolved to Closed
Also available in: Atom
PDF