incorrect parsing of rules with missing semi-colon for keywords
|Assignee:||Anoop Saldanha||% Done:|
|Category:||-||Estimated time:||3.00 hours|
Currently we seem to parse rules which contains keywords with missing semi-colons
for example, alert tcp any any -> any any (content:boom; offset:10 sid:1;)
such rules should be invalidated.
#7 Updated by Victor Julien about 3 years ago
- Target version changed from 1.2 to 1.3beta2
In 1.2dev (rev 4c1e417) # Suricata not complaining: alert tcp $EXTERNAL_NET 443 -> $HOME_NET any (msg:"B0rked rule - no error in suricata"; flow:established,from_server; content:"|FF|" content:"TEST"; classtype:trojan-activity; sid:66; rev:1;) That rules dont give any error message.