Bug #1329: Invalid rule being processed and loaded. - Suricata - Open Information Security Foundation

Actions

Copy link

Bug #1329

closed

Invalid rule being processed and loaded.

Added by Duane Howard over 9 years ago. Updated over 9 years ago.

Status:

Closed

Priority:

Normal

Assignee:

Victor Julien

Target version:

2.0.5

Affected Versions:

Effort:

Difficulty:

Label:

Description

I noticed by setting the protocol after 'alert' to some invalid option the rule 'loads' successfully.

For example if I take:
alert tcp $HOME_NET any -> $EXTERNAL_NET !6666:7000 (msg:"ET TROJAN IRC Channel JOIN on non-standard port"; flow:to_server,established; dsize:<64; content:"JOIN "; nocase; depth:5; pcre:"/&|#|\+|!/R"; reference:url,doc.emergingthreats.net/bin/view/Main/2000348; classtype:trojan-activity; sid:2000348; rev:12;)

and turn it into:
alert this_isnt_a_protocol $HOME_NET any -> $EXTERNAL_NET !6666:7000 (msg:"ET TROJAN IRC Channel JOIN on non-standard port"; flow:to_server,established; dsize:<64; content:"JOIN "; nocase; depth:5; pcre:"/&|#|\+|!/R"; reference:url,doc.emergingthreats.net/bin/view/Main/2000348; classtype:trojan-activity; sid:2000348; rev:12;) ....

The rule appears to load and no error is thrown.

This was tested on 2.0.4 and on 2.1

Actions

Copy link

Updated by Victor Julien over 9 years ago

Target version set to 2.0.5

Actions

Copy link

Updated by Duane Howard over 9 years ago

Sorry for the delay again on testing, been swamped. Looks like it's working to me... =)

[3452] 9/12/2014 -- 15:45:00 - (detect-parse.c:611) <Error> (SigParseProto) -- [ERRCODE: SC_ERR_UNKNOWN_PROTOCOL(124)] - protocol "this_isnt_a_protocol" cannot be used in a signature. Either detection for this protocol supported yet OR detection has been disabled for protocol through the yaml option app-layer.protocols.this_isnt_a_protocol.detection-enabled

[3452] 9/12/2014 -- 15:45:00 - (detect.c:357) <Error> (DetectLoadSigFile) -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "alert this_isnt_a_protocol $HOME_NET any -> $EXTERNAL_NET !6666:7000 (msg:"ET TROJAN IRC Channel JOIN on non-standard port"; flow:to_server,established; dsize:<64; content:"JOIN "; nocase; depth:5; pcre:"/&|#|\+|!/R"; reference:url,doc.emergingthreats.net/bin/view/Main/2000348; classtype:trojan-activity; sid:2000348; rev:12;)" from file /etc/suricata/rules/empty.rules at line 5

Actions

Copy link