Added by Anoop Saldanha almost 16 years ago. Updated almost 16 years ago.
Description
a content string
"we need to fix this and yes fix this now"
and
content:fix; content:this; within:6; content:!\"and\"; distance:0;
should fail.
Fix attached.
Files
| 0001-fix-false-positives-for-a-negated-content-case.patch (4.13 KB) 0001-fix-false-positives-for-a-negated-content-case.patch | Anoop Saldanha, 07/16/2010 08:58 AM | ||
| 0002-fix-relative-contents-with-a-negated-content-for-det.patch (10.2 KB) 0002-fix-relative-contents-with-a-negated-content-for-det.patch | Anoop Saldanha, 07/16/2010 09:38 AM | ||
| fixthisnow.pcap (491 Bytes) fixthisnow.pcap | we need to fix this and yes fix this now pcap | Will Metcalf, 07/19/2010 12:52 PM |
another patch attached.
You will have to apply both. The first one addresses payload.c and the second, dcepayload.c and uri.c.
tested. works.
alert tcp any any -> any 55555 (msg:"negated content + relative modifier"; content:"fix"; content:"this"; within:6; content:!"and"; distance:0; sid:7777;)
alert tcp any any -> any 55555 (msg:"negated content + relative modifier"; content:"fix"; content:"this"; within:6; content:!"foo"; distance:0; sid:7778;)
src/suricata -c suricata.yaml -l ./ -s blah2.rules -r /home/coz/fixthisnow.pcap
...
cat fast.log
07/19/10-18:37:15.687507 [**] [1:7778:0] negated content + relative modifier [**] [Classification: (null)] [Priority: 3] {6} 192.168.2.3:60229 -> 192.168.2.138:55555