Suricata

Looking at this rule:

alert tcp any any -> any any (msg:"src not in iprep list";sid:1;iprep:src,myCategory,=,0;)

Suricata accepts it, giving me the impression that if a packet arrives with a src IP not in the referenced iprep list, it will match this rule.

However, if you look at this code, we actually never call the match method, unless the ip reputation score is > 0.

            if (val > 0) {
                return DetectU8Match(val, &rd->du8);
            }
            break;

https://github.com/OISF/suricata/blob/4afaadc0ceb1462e9fa075cbfb7fefb88115d73e/src/detect-iprep.c#L176-L184

therefore, even if I want my alert rule to match on that condition, the rule never gets evaluated.

I'd call this a bug, as Suricata accepts '=,0' as valid arguments. It should honor the intent of the rule, or reject it at startup. As this is valid use case, e.g. alert on IPs not on a list of known sources, I'd prefer we implement the behavior rather than reject the rule.