Project

General

Profile

Actions
Copy link

Bug #3656

open

Matching and modifies requires double backslash in front of $ characters

Added by Jason Ish over 4 years ago. Updated 5 months ago.

Status:
New
Priority:
Normal
Assignee:
Jason Ish
Target version:
TBD
Affected Versions:
1.1.1
Effort:
Difficulty:
Label:

Description

For example, when modifying a rule one would think the following should work in modify.conf:

2000418 "tcp \$EXTERNAL_NET !\$HTTP_PORTS" "tcp $EXTERNAL_NET [!$HTTP_PORTS,!$OTHER_PORTS]"

but the following is actually required:
2000418 "tcp \\$EXTERNAL_NET !\\$HTTP_PORTS" "tcp $EXTERNAL_NET [!$HTTP_PORTS,!$OTHER_PORTS]"

The source of this behaviour is due to some compatibility with PulledPork that may have been handled badly.

I'd like to see if we can support the single \ case while not breaking existing configurations, and verify PulledPork compatibility.

Actions
Copy link

Also available in: Atom PDF