Bug #4548: rules: Unable to find the sm in any of the sm lists - Suricata - Open Information Security Foundation

Actions

Copy link

Bug #4548

closed

rules: Unable to find the sm in any of the sm lists

Added by albert wang over 3 years ago. Updated about 3 years ago.

Status:

Closed

Priority:

Normal

Assignee:

Shivani Bhardwaj

Target version:

6.0.4

Affected Versions:

6.0.2

Effort:

Difficulty:

Label:

Needs backport to 5.0

Description

I want to detect dns.flags.response==0 and dns.query is "test" or "abc" or "sdf".

alert dns any any -> any any (msg:"DNS_解析请求";byte_test:1,<,0x80,2;dns.query;pcre:"/test|abc|sdf/";sid:1;)

but this alerted "Unable to find the sm in any of the sm lists".

If modify the rule to:
alert dns any any -> any any (msg:"DNS_解析请求";dns.query;pcre:"/test|abc|sdf/";sid:1;)
or
alert dns any any -> any any (msg:"DNS_解析请求";byte_test:1,<,0x80,2;sid:1;)

These are ok. So,Why is this error reported.

Related issues 1 (0 open — 1 closed)

Actions

Copy link

Updated by Victor Julien over 3 years ago

Target version changed from 6.0.2 to 6.0.3
Label Needs backport to 5.0 added

This should be fixed in master by 9dd1444f4431731bf4917488e0abec0d9a46fdcc, so we'll need a backport (also to 5)

Actions

Copy link

Updated by Victor Julien over 3 years ago

Target version changed from 6.0.3 to 6.0.4

Actions

Copy link

Updated by Victor Julien over 3 years ago

Subject changed from Unable to find the sm in any of the sm lists to rules: Unable to find the sm in any of the sm lists
Status changed from New to Assigned
Assignee set to Shivani Bhardwaj