Project

General

Profile

Actions

Bug #2249

open

rule with file keyword used with ip or tcp not seen as invalid

Added by Eric Leblond about 5 years ago. Updated over 3 years ago.

Status:
New
Priority:
Normal
Assignee:
Target version:
Affected Versions:
Effort:
low
Difficulty:
medium
Label:

Description

Currently signature using ip and tcp and using a file keyword like filemd5 are not valid in the sense they will not match:

alert ip any any -> any any (msg:"guess what"; filemd5:test.md5; sid: 1; rev: 1;)
alert tcp any any -> any any (msg:"guess what"; filemd5:test.md5; sid: 2; rev: 1;)

But Suricata does not complain about it.


Related issues 1 (1 open0 closed)

Related to Feature #2213: file matching: allow generic file matching / storeNewOISF Dev09/15/2017Actions
Actions #1

Updated by Andreas Herz about 5 years ago

  • Assignee set to OISF Dev
  • Target version set to TBD
Actions #2

Updated by Andreas Herz over 3 years ago

  • Effort set to low
  • Difficulty set to medium
Actions #3

Updated by Victor Julien about 3 years ago

  • Related to Feature #2213: file matching: allow generic file matching / store added
Actions

Also available in: Atom PDF