Project

General

Profile

Actions
Copy link

Feature #6857

closed

iprep: support seeing if rule is part of a rep list

Added by Victor Julien 4 months ago. Updated 19 days ago.

Status:
Closed
Priority:
Normal
Assignee:
Victor Julien
Target version:
8.0.0-beta1
Effort:
Difficulty:
Label:

Description

E.g. something like iprep:src,myCategory,isset; and iprep:src,myCategory,isnotset;. Not sure about the keyword, just used that is done in dataset.

Subtasks 1 (0 open — 1 closed)

Feature #7102: iprep: support seeing if rule is part of a rep list (7.0.x backport)ClosedVictor JulienActions

Related issues 1 (0 open — 1 closed)

Related to Suricata - Bug #6834: iprep: rule with '=,0' can't matchClosedVictor JulienActions
Actions
Copy link
 #1

Updated by Victor Julien 4 months ago

  • Related to Bug #6834: iprep: rule with '=,0' can't match added
Actions
Copy link
 #2

Updated by Jason Ish 3 months ago

isset and isnotset do map well to the dataset idea, but couldn't -1 be an option that also fits well with the current syntax?

Actions
Copy link
 #3

Updated by Victor Julien 2 months ago

Jason Ish wrote in #note-2:

isset and isnotset do map well to the dataset idea, but couldn't -1 be an option that also fits well with the current syntax?

I think making things explicit is preferred over using a magic value.

Actions
Copy link
 #4

Updated by Victor Julien 2 months ago

  • Status changed from New to In Review
  • Assignee changed from OISF Dev to Victor Julien
  • Target version changed from TBD to 8.0.0-beta1
Actions
Copy link
 #5

Updated by Victor Julien about 1 month ago

  • Label Needs backport to 7.0 added
Actions
Copy link
 #6

Updated by OISF Ticketbot about 1 month ago

  • Subtask #7102 added
Actions
Copy link
 #7

Updated by OISF Ticketbot about 1 month ago

  • Label deleted (Needs backport to 7.0)
Actions
Copy link
 #8

Updated by Victor Julien about 1 month ago

  • Status changed from In Review to Resolved
Actions
Copy link
 #9

Updated by Victor Julien 19 days ago

  • Status changed from Resolved to Closed
Actions
Copy link

Also available in: Atom PDF