Project

General

Profile

Actions

Bug #6834

open

iprep: rule with '=,0' can't match

Added by Rob Hardt 3 months ago. Updated 17 days ago.

Status:
Resolved
Priority:
Normal
Assignee:
Target version:
Affected Versions:
Effort:
low
Difficulty:
Label:

Description

Looking at this rule:

alert tcp any any -> any any (msg:"src not in iprep list";sid:1;iprep:src,myCategory,=,0;)

Suricata accepts it, giving me the impression that if a packet arrives with a src IP not in the referenced iprep list, it will match this rule.

However, if you look at this code, we actually never call the match method, unless the ip reputation score is > 0.

            if (val > 0) {
                return DetectU8Match(val, &rd->du8);
            }
            break;

https://github.com/OISF/suricata/blob/4afaadc0ceb1462e9fa075cbfb7fefb88115d73e/src/detect-iprep.c#L176-L184

therefore, even if I want my alert rule to match on that condition, the rule never gets evaluated.

I'd call this a bug, as Suricata accepts '=,0' as valid arguments. It should honor the intent of the rule, or reject it at startup. As this is valid use case, e.g. alert on IPs not on a list of known sources, I'd prefer we implement the behavior rather than reject the rule.


Subtasks 1 (0 open1 closed)

Bug #6986: iprep: rule with '=,0' can't match (7.0.x backport)ClosedVictor JulienActions

Related issues 1 (1 open0 closed)

Related to Suricata - Feature #6857: iprep: support seeing if rule is part of a rep listIn ReviewVictor JulienActions
Actions #1

Updated by Victor Julien 2 months ago

  • Assignee changed from OISF Dev to Victor Julien
Actions #2

Updated by Victor Julien 2 months ago

  • Subject changed from Rule with iprep keyword never matches when used with '=,0' to iprep: rule with '=,0' can't match
Actions #3

Updated by Victor Julien 2 months ago

  • Related to Feature #6857: iprep: support seeing if rule is part of a rep list added
Actions #4

Updated by Victor Julien 26 days ago

  • Status changed from New to In Progress
  • Target version changed from TBD to 8.0.0-beta1
  • Label Needs backport to 7.0 added
Actions #5

Updated by OISF Ticketbot 26 days ago

  • Subtask #6986 added
Actions #6

Updated by OISF Ticketbot 26 days ago

  • Label deleted (Needs backport to 7.0)
Actions #7

Updated by Victor Julien 26 days ago

  • Status changed from In Progress to In Review
Actions #8

Updated by Victor Julien 19 days ago

  • Status changed from In Review to Resolved
Actions

Also available in: Atom PDF