Match fails with 2 content, the second of length = 1
The match of two contents in the same rule fail if the second has a length of 1.
alert tcp any any -> any any (msg:\"Test 32 sig1\"; content:\"0\"; content:\"a\"; sid:1;)
Updated by Pablo Rincon almost 12 years ago
- File 0001-Match-content-fail-when-two-contents-are-specified-i.patch 0001-Match-content-fail-when-two-contents-are-specified-i.patch added
The first unittest had "!" as the second content (so it was processed like a negated). This new file use "H" and "i" as contents. And the first word of the payload is Hi.