Project

General

Profile

Actions
Copy link

Bug #5081

closed

detect/iponly: rule parsing does not always apply netmask correctly

Added by Victor Julien about 1 year ago. Updated about 1 year ago.

Status:
Closed
Priority:
Normal
Assignee:
Victor Julien
Target version:
7.0.0-beta1
Affected Versions:
Effort:
Difficulty:
Label:
Needs backport to 5.0, Needs backport to 6.0

Description

If the ipaddress is not the address range start, it's not masked to turn it into that. So 1.2.3.4/24 is not stored as address 1.2.3.0 with netmask 24, but as 1.2.3.4 with netmask 24. This is then propagated into the radix tree, where it is used as an exact key in exact lookups, giving unexpected results.

Related issues 7 (0 open — 7 closed)

Related to Bug #5066: detect/iponly: mixing netblocks can lead to FN/FPClosedVictor JulienActions
Related to Bug #5086: htp: server personality radix handling issueClosedVictor JulienActions
Related to Bug #5084: iprep: cidr support can set up radix incorrectlyClosedVictor JulienActions
Related to Bug #5085: defrag: policy config can setup radix incorrectlyClosedVictor JulienActions
Related to Bug #5168: detect/iponly: non-cidr netmask settings can lead incorrect detectionClosedVictor JulienActions
Copied to Bug #5106: detect/iponly: rule parsing does not always apply netmask correctlyClosedVictor JulienActions
Copied to Bug #5107: detect/iponly: rule parsing does not always apply netmask correctlyClosedJeff LucovskyActions
Actions
Copy link

Also available in: Atom PDF