Project

General

Profile

Actions

Bug #13

closed

Depth is not modified by offset

Added by Will Metcalf over 14 years ago. Updated about 14 years ago.

Status:
Closed
Priority:
Normal
Assignee:
Target version:
Affected Versions:
Effort:
Difficulty:
Label:

Description

given a packet with the following payload

AllWorkAndNoPlayMakesVictorADullBoy AllWorkAndNoPlayMakesVictorADullBoy AllWorkAndNoPlayMakesVictorADullBoy AllWorkAndNoPlayMakesVictorADullBoy AllWorkAndNoPlayMakesVictorADullBoy AllWorkAndNoPlayMakesVictorADullBoy AllWorkAndNoPlayMakesVictorADullBoy AllWorkAndNoPlayMakesVictorADullBoy AllWorkAndNoPlayMakesVictorADullBoy AllWorkAndNoPlayMakesVictorADullBoy AllWorkAndNoPlayMakesVictorADullBoy AllWorkAndNoPlayMakesVictorADullBoy AllWorkAndNoPlayMakesVictorADullBoy AllWorkAndNoPlayMakesVictorADullBoy AllWorkAndNoPlayMakesVictorADullBoy AllWorkAndNoPlayMakesVictorADullBoy AllWorkAndNoPlayMakesVictorADullBoy AllWorkAndNoPlayMakesVictorADullBoy AllWorkAndNoPlayMakesVictorADullBoy

The following rules should fire as it is the behavior of snort to modify depth to however many bytes are specified by offset. I have attached a unit test showing this behavior

alert tcp any any -> any any (msg:"all work and no play"; content:"Work"; offset: 3; depth: 4; sid:1;)
alert tcp any any -> any any (msg:"all work and no play hex"; content:"|57 6F 72 6B|"; offset: 3; depth: 4; sid:2;)


Files

0001-failing-unit-test-depth-doesn-t-take-into-account-of.patch (2.87 KB) 0001-failing-unit-test-depth-doesn-t-take-into-account-of.patch unit test showing that depth does not take into account offset Will Metcalf, 11/24/2009 09:51 PM
Actions #1

Updated by Victor Julien over 14 years ago

  • Estimated time changed from 0.50 h to 2.50 h
Actions #2

Updated by Victor Julien about 14 years ago

  • Assignee changed from OISF Dev to Victor Julien
Actions #3

Updated by Victor Julien about 14 years ago

Fixed by yesterdays master.

Actions #4

Updated by Victor Julien about 14 years ago

  • Status changed from New to Closed
Actions

Also available in: Atom PDF