Project

General

Profile

Actions

Bug #5541

closed

Unexpected behavior of `endswith` in combination with negated content matches

Added by Brandon Murphy over 1 year ago. Updated 11 months ago.

Status:
Closed
Priority:
Normal
Assignee:
Target version:
Affected Versions:
Effort:
Difficulty:
Label:

Description

Please consider the following rule and attached pcaps.

The intention of the rule is to alert when the http.host buffer does not end with .google.com

alert http $HOME_NET any -> any any (msg:"Test"; flow:established,to_server; http.method; content:"GET"; http.uri; content:".exe"; endswith; http.host; content:!".google.com"; endswith; sid:1;)

However, in practice the endswith; keyword (and the use of isdataat:!1,relative) seems to have no effect on the leading negated content match and appears to be is applied to the entire buffer, thus resulting in a False Negative.

If the http host of www.google.com.example.com is provided, the negation appears to take effect and no alert is triggered, despite the buffer not ending with .google.com

In the attached pcaps, I would expect the above signature to fire on host_negation_2.pcap but not host_negation_1.pcap. In practice, the alert does not fire on either of the attached pcaps and leads to a False Negative.


Files

host_negation_1.pcap (422 Bytes) host_negation_1.pcap Brandon Murphy, 09/14/2022 06:22 PM
host_negation_2.pcap (434 Bytes) host_negation_2.pcap Brandon Murphy, 09/14/2022 06:22 PM

Subtasks 1 (0 open1 closed)

Bug #6007: Unexpected behavior of `endswith` in combination with negated content matches (6.0.x backport)ClosedJeff LucovskyActions
Actions #1

Updated by Brandon Murphy over 1 year ago

  • Description updated (diff)
Actions #2

Updated by Jeff Lucovsky about 1 year ago

  • Status changed from New to Assigned
  • Assignee changed from OISF Dev to Jeff Lucovsky
Actions #3

Updated by Jeff Lucovsky 12 months ago

  • Status changed from Assigned to In Review
Actions #4

Updated by Jeff Lucovsky 12 months ago

  • Status changed from In Review to Closed
Actions #5

Updated by Victor Julien 12 months ago

  • Target version changed from TBD to 7.0.0-rc2
  • Label Needs backport to 6.0 added
Actions #6

Updated by Jeff Lucovsky 12 months ago

  • Status changed from Closed to Resolved

Moving to resolved for ticket-bot action: create 6.0.x backport ticket.

Actions #7

Updated by OISF Ticketbot 12 months ago

  • Subtask #6007 added
Actions #8

Updated by OISF Ticketbot 12 months ago

  • Label deleted (Needs backport to 6.0)
Actions #9

Updated by Victor Julien 11 months ago

  • Status changed from Resolved to Closed
Actions

Also available in: Atom PDF