Feature #494
closed
Added by Victor Julien almost 12 years ago.
Updated over 11 years ago.
Description
Instead of "alert ip" allow for "alert ipv4" and "alert ip4". Likewise for IPv6.
Interesting question is how this should behave wrt address vars. If HOME_NET contains both ip4 and ip6, how should a rule like "alert ipv4 $HOME_NET..." behave? Error out? Use only the ipv4 part of the addresses?
Files
I think we should only use the matching subset. But it could trigger some funny things like a null subset. It this case, we should ERROR out.
Agreed. I think the rule analyzer should also display this information.
- % Done changed from 0 to 80
Current code uses only the matching part of a variable. It does not fire an error if there is no intersection. It may be enough to have the rule analysers trigger a warning.
Adding the patches to the ticket.
- Status changed from Assigned to Closed
- % Done changed from 80 to 100
Also available in: Atom
PDF