Keywords for which we don't support fast_pattern as a modifer should accept the sig and warn.
"fast_pattern found inside the rule, without any preceding keywords"
The output above came from a fast_pattern modifier to a uricontent keyword. fast_pattern may not make sense or may not be possible for all keywords in suricata where it may make sense in snort. Since these are simply rule optimizations for snort, perhaps in cases such as this we should do the following..
1. Warn the user that the rule can not be optimized with fast_pattern; and the previous keyword they used.
2. Go ahead and parse the rule ignoring the fast_pattern modifier.
#2 Updated by Pablo Rincon over 7 years ago
- File 0001-Load-signatures-with-incompatible-fast_pattern-optio.patch 0001-Load-signatures-with-incompatible-fast_pattern-optio.patch added
- Status changed from New to Resolved
I have attached a patch for this issue. Now it continue loading and warn with a message of compatiblity.
#3 Updated by Pablo Rincon over 7 years ago
- File 0002-Updating-the-http-modifers-that-cannot-be-loaded-wit.patch 0002-Updating-the-http-modifers-that-cannot-be-loaded-wit.patch added
Updating the http modifers that cannot be loaded with fast_pattern. (It's an incremental patch).
#4 Updated by Pablo Rincon over 7 years ago
- File 0003-Print-also-the-Signature-raw-string.patch 0003-Print-also-the-Signature-raw-string.patch added
Adding another patch that also print the signature raw string from the warning (as it now load the rule, it wasn't returning an error, and the complete sig was not displayed).
#6 Updated by Will Metcalf over 7 years ago
seems we have two failing unit tests as well now... These should be fixed prior to release.
Test DetectHttpCookieTest04 :  30/6/2010 -- 21:46:20 - (detect-http-cookie.c:228) <Warning> (DetectHttpCookieSetup) -- [ERRCODE: SC_WARN_COMPATIBILITY(159)] - http_cookie rule can not be used with the fast_pattern rule keyword. Unsetting fast_pattern on this modifier. Signature > alert icmp any any -> any any (msg:"Testing http_cookie"; content:"one"; fast_pattern; http_cookie; sid:1;)
Test DetectHttpMethodTest04 :  30/6/2010 -- 21:46:20 - (detect-http-method.c:182) <Warning> (DetectHttpMethodSetup) -- [ERRCODE: SC_WARN_COMPATIBILITY(159)] - http_method cannot be used with "fast_pattern" currently.Unsetting fast_pattern on this modifier. Signature > alert tcp any any -> any any (msg:"Testing http_method"; content:"GET"; fast_pattern; http_method; sid:1;)
#7 Updated by Pablo Rincon over 7 years ago
- File 0005-Updating-other-http-modifiers-for-sigs-with-fast_pat.patch 0005-Updating-other-http-modifiers-for-sigs-with-fast_pat.patch added
Updating other http modifiers for sigs with fast_pattern option