Project

General

Profile

Actions

Bug #5576

open

Dataset is setting data despite the signature being a complete match

Added by Andreas Herz 4 months ago. Updated 3 months ago.

Status:
In Review
Priority:
Normal
Assignee:
Target version:
Affected Versions:
Effort:
Difficulty:
Label:

Description

The following rule doesn't match on the content of the pcap:

alert http any any -> $HOME_NET any (msg:"HTTP learning"; flow:established,to_client; http.content_type; content:"noone"; http.server; content:"ECS"; fast_pattern; dataset:set,http,type string,state output/http.intel; sid:2; rev:1; priority:2;)

But the data for the dataset is still set. This is not expected if we compare datasets to behave like flowbits at that point. A flowbit is only set POSTMATCH, so dataset should as well when setting actual data to a set.

Attached pcap to reproduce it.
Suricata-Verify test will follow


Files

input.pcap (1.88 KB) input.pcap Andreas Herz, 10/14/2022 11:33 AM
Actions #2

Updated by Victor Julien 4 months ago

The set-alert pattern is used to match on the initial set.

Actions #3

Updated by Eric Leblond 3 months ago

  • Status changed from Assigned to In Review
  • Assignee changed from Shivani Bhardwaj to Eric Leblond
Actions

Also available in: Atom PDF