Project

General

Profile

Actions

Bug #3580

closed

Faulty signature with two threshold keywords does not generate an error and never match

Added by Jeff Lucovsky over 1 year ago. Updated over 1 year ago.

Status:
Closed
Priority:
Normal
Assignee:
Target version:
Affected Versions:
Effort:
Difficulty:
Label:

Description

alert http any any -> any any (msg:"CURL1"; flow:established,to_server; content:"GET"; http_method;  content:"curl"; http_user_agent; threshold: type limit, track by_src, count 1 , seconds 60; sid:1;)
alert http any any -> any any (msg:"CURL2"; flow:established,to_server; content:"GET"; http_method;  content:"curl"; http_user_agent; threshold: type limit, track by_src, count 1 , seconds 60; threshold: type limit, track by_src, count 1 , seconds 60; sid:2;)

The first rule will trigger an alert, but the second one will not trigger an alert. The second one is faulty and contains two threshold fields. Rules that contains error is often listed in suricata.log and not loaded. It would be good if similar validation is performed on these cases.


Related issues

Copied from Bug #3463: Faulty signature with two threshold keywords does not generate an error and never matchClosedJeff LucovskyActions
Actions #1

Updated by Jeff Lucovsky over 1 year ago

  • Copied from Bug #3463: Faulty signature with two threshold keywords does not generate an error and never match added
Actions #2

Updated by Jeff Lucovsky over 1 year ago

  • Status changed from Assigned to In Review
Actions #4

Updated by Jeff Lucovsky over 1 year ago

  • Status changed from In Review to Closed
Actions

Also available in: Atom PDF