Added by Victor Julien almost 14 years ago. Updated over 13 years ago.
Description
Instead of "alert ip" allow for "alert ipv4" and "alert ip4". Likewise for IPv6.
Interesting question is how this should behave wrt address vars. If HOME_NET contains both ip4 and ip6, how should a rule like "alert ipv4 $HOME_NET..." behave? Error out? Use only the ipv4 part of the addresses?
Files
| 0001-sig-Add-ipv6-and-ipv4-to-list-of-protocols.patch (4.23 KB) 0001-sig-Add-ipv6-and-ipv4-to-list-of-protocols.patch | Eric Leblond, 07/17/2012 02:52 AM | ||
| 0002-sig-add-l3_proto-keyword.patch (6.87 KB) 0002-sig-add-l3_proto-keyword.patch | Eric Leblond, 07/17/2012 02:52 AM |
I think we should only use the matching subset. But it could trigger some funny things like a null subset. It this case, we should ERROR out.
Agreed. I think the rule analyzer should also display this information.
Current code uses only the matching part of a variable. It does not fire an error if there is no intersection. It may be enough to have the rule analysers trigger a warning.
Adding the patches to the ticket.
Pull request on github: https://github.com/inliniac/suricata/pull/5
Merged https://github.com/inliniac/suricata/pull/48
Thanks Eric!