Feature #196

Keywords for which we don't support fast_pattern as a modifer should accept the sig and warn.

Added by Will Metcalf almost 4 years ago. Updated almost 4 years ago.

Status:ClosedStart date:06/29/2010
Priority:NormalDue date:07/05/2010
Assignee:Pablo Rincon% Done:

100%

Category:-Estimated time:4.00 hours
Target version:1.0.0

Description

"fast_pattern found inside the rule, without any preceding keywords"

The output above came from a fast_pattern modifier to a uricontent keyword. fast_pattern may not make sense or may not be possible for all keywords in suricata where it may make sense in snort. Since these are simply rule optimizations for snort, perhaps in cases such as this we should do the following..

1. Warn the user that the rule can not be optimized with fast_pattern; and the previous keyword they used.
2. Go ahead and parse the rule ignoring the fast_pattern modifier.

0001-Load-signatures-with-incompatible-fast_pattern-optio.patch Magnifier - Now it continue loading and warn with a message of compatiblity. (3.26 KB) Pablo Rincon, 06/30/2010 07:05 AM

0002-Updating-the-http-modifers-that-cannot-be-loaded-wit.patch Magnifier - Updating the http modifers that cannot be loaded with fast_pattern (2.95 KB) Pablo Rincon, 06/30/2010 07:37 AM

0003-Print-also-the-Signature-raw-string.patch Magnifier (2 KB) Pablo Rincon, 06/30/2010 10:20 AM

0005-Updating-other-http-modifiers-for-sigs-with-fast_pat.patch Magnifier - Updating other http modifiers for sigs with fast_pattern option (3.02 KB) Pablo Rincon, 07/01/2010 05:16 AM

History

#1 Updated by Victor Julien almost 4 years ago

  • Due date set to 07/05/2010
  • Assignee changed from Victor Julien to Pablo Rincon
  • Estimated time set to 4.00

Agreed. Let's do it like this.

#2 Updated by Pablo Rincon almost 4 years ago

I have attached a patch for this issue. Now it continue loading and warn with a message of compatiblity.

#3 Updated by Pablo Rincon almost 4 years ago

Updating the http modifers that cannot be loaded with fast_pattern. (It's an incremental patch).

#4 Updated by Pablo Rincon almost 4 years ago

Adding another patch that also print the signature raw string from the warning (as it now load the rule, it wasn't returning an error, and the complete sig was not displayed).

#5 Updated by Will Metcalf almost 4 years ago

regarding patch 0002 it appears as if we need to extend this behavior to http_client_body, http_header, and http_uri as well, based on what seems to be supported by snort.

#6 Updated by Will Metcalf almost 4 years ago

seems we have two failing unit tests as well now... These should be fixed prior to release.

Test DetectHttpCookieTest04 : [2746] 30/6/2010 -- 21:46:20 - (detect-http-cookie.c:228) <Warning> (DetectHttpCookieSetup) -- [ERRCODE: SC_WARN_COMPATIBILITY(159)] - http_cookie rule can not be used with the fast_pattern rule keyword. Unsetting fast_pattern on this modifier. Signature > alert icmp any any -> any any (msg:"Testing http_cookie"; content:"one"; fast_pattern; http_cookie; sid:1;)
FAILED

Test DetectHttpMethodTest04 : [2746] 30/6/2010 -- 21:46:20 - (detect-http-method.c:182) &lt;Warning&gt; (DetectHttpMethodSetup) -- [ERRCODE: SC_WARN_COMPATIBILITY(159)] - http_method cannot be used with "fast_pattern" currently.Unsetting fast_pattern on this modifier. Signature > alert tcp any any -> any any (msg:"Testing http_method"; content:"GET"; fast_pattern; http_method; sid:1;)
FAILED

#7 Updated by Pablo Rincon almost 4 years ago

Updating other http modifiers for sigs with fast_pattern option

#8 Updated by Victor Julien almost 4 years ago

  • Target version changed from 1.0.1 to 1.0.0
  • % Done changed from 0 to 100

All applied, thanks guys.

#9 Updated by Victor Julien almost 4 years ago

  • Status changed from Resolved to Closed

Also available in: Atom PDF