Project

General

Profile

Bug #312

incorrect parsing of rules with missing semi-colon for keywords

Added by Anoop Saldanha about 5 years ago. Updated 6 days ago.

Status:
Closed
Priority:
Low
Assignee:
Target version:
Start date:
08/09/2011
Due date:
% Done:

40%


Description

Currently we seem to parse rules which contains keywords with missing semi-colons

for example, alert tcp any any -> any any (content:boom; offset:10 sid:1;)

such rules should be invalidated.

History

#1 Updated by Anoop Saldanha about 5 years ago

  • Subject changed from incorrct parsing of rules with missing semi-colon for keywords to incorrect parsing of rules with missing semi-colon for keywords

#2 Updated by Victor Julien about 5 years ago

  • Assignee set to Anoop Saldanha
  • Target version set to 1.1beta3
  • Estimated time set to 3.00 h

#3 Updated by Victor Julien almost 5 years ago

  • Target version changed from 1.1beta3 to 1.1rc1

#4 Updated by Victor Julien almost 5 years ago

  • % Done changed from 0 to 40

#5 Updated by Victor Julien almost 5 years ago

  • Status changed from New to Assigned
  • Priority changed from Normal to Low

Low prio for 1.1, we can push this back to 1.2 if you run out of time.

#6 Updated by Victor Julien almost 5 years ago

  • Target version changed from 1.1rc1 to 1.2

#7 Updated by Victor Julien over 4 years ago

  • Target version changed from 1.2 to 1.3beta2

Additional example:

In 1.2dev (rev 4c1e417)

# Suricata not complaining:
alert tcp $EXTERNAL_NET 443 -> $HOME_NET any (msg:"B0rked rule - no
error in suricata"; flow:established,from_server; content:"|FF|" 
content:"TEST"; classtype:trojan-activity; sid:66; rev:1;)

That rules dont give any error message.

#8 Updated by Victor Julien over 4 years ago

  • Target version changed from 1.3beta2 to TBD

#9 Updated by Andreas Herz 9 months ago

  • Assignee changed from Anoop Saldanha to Andreas Herz

#10 Updated by Andreas Herz 9 months ago

The first rule in this ticket isn't working anymore:

[ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - content keyword arguments should be always enclosed in double quotes.  Invalid content keyword passed in this rule - "boom" 

But the one from Victor is still loaded without warning.

#12 Updated by Andreas Herz 6 days ago

  • Status changed from Assigned to Closed

#13 Updated by Victor Julien 6 days ago

  • Target version changed from TBD to 3.2beta1

Also available in: Atom PDF