Feature #597
closed
case insensitive fileext match
Added by Peter Manev over 11 years ago.
Updated about 10 years ago.
Description
alert http any any -> any any (msg:"File magic on GIF"; fileext:"GIF";sid:666; rev:1;)
- would not alert on a http downloaded file with
extension *.gif BUT it would on **.GIF (notice the upper case)
It would be beneficial if it could be made case insensitive - have the nocase keyword apply to it as well.
thanks
- Status changed from New to Assigned
- Assignee set to Victor Julien
- Target version set to 2.0rc2
- Target version changed from 2.0rc2 to 2.0beta2
- Target version changed from 2.0beta2 to 2.0rc1
- Status changed from Assigned to Closed
- % Done changed from 0 to 100
Merged https://github.com/inliniac/suricata/pull/820 to address this.
What it does it is change the matching of fileext:"exe"; to case insensitive unconditionally. This isn't ideal, but I would prefer overhauling the fileext and filename keywords completely to act like file_data.
Also available in: Atom
PDF