Actions
Bug #5576
openDataset is setting data despite the signature being a complete match
Affected Versions:
Effort:
Difficulty:
Label:
Description
The following rule doesn't match on the content of the pcap:
alert http any any -> $HOME_NET any (msg:"HTTP learning"; flow:established,to_client; http.content_type; content:"noone"; http.server; content:"ECS"; fast_pattern; dataset:set,http,type string,state output/http.intel; sid:2; rev:1; priority:2;)
But the data for the dataset is still set. This is not expected if we compare datasets to behave like flowbits at that point. A flowbit is only set POSTMATCH, so dataset should as well when setting actual data to a set.
Attached pcap to reproduce it.
Suricata-Verify test will follow
Files
Updated by Andreas Herz 12 months ago
Updated by Victor Julien 12 months ago
The set-alert pattern is used to match on the initial set.
Updated by Eric Leblond 11 months ago
- Status changed from Assigned to In Review
- Assignee changed from Shivani Bhardwaj to Eric Leblond
Code proposal for master: https://github.com/OISF/suricata/pull/8114
Actions