Project

General

Profile

Actions
Copy link

Feature #6857

closed
VJ VJ

iprep: support seeing if rule is part of a rep list

Feature #6857: iprep: support seeing if rule is part of a rep list

Added by Victor Julien about 2 years ago. Updated over 1 year ago.

Status:
Closed
Priority:
Normal
Assignee:
Victor Julien
Target version:
8.0.0-beta1
Effort:
Difficulty:
Label:

Description

E.g. something like iprep:src,myCategory,isset; and iprep:src,myCategory,isnotset;. Not sure about the keyword, just used that is done in dataset.

Subtasks 1 (0 open — 1 closed)

Feature #7102: iprep: support seeing if rule is part of a rep list (7.0.x backport)ClosedVictor JulienActions

Related issues 1 (0 open — 1 closed)

Related to Suricata - Bug #6834: iprep: rule with '=,0' can't matchClosedVictor JulienActions

VJ Updated by Victor Julien about 2 years ago Actions
Copy link
 #1

  • Related to Bug #6834: iprep: rule with '=,0' can't match added

JI Updated by Jason Ish almost 2 years ago Actions
Copy link
 #2

isset and isnotset do map well to the dataset idea, but couldn't -1 be an option that also fits well with the current syntax?

VJ Updated by Victor Julien almost 2 years ago Actions
Copy link
 #3

Jason Ish wrote in #note-2:

isset and isnotset do map well to the dataset idea, but couldn't -1 be an option that also fits well with the current syntax?

I think making things explicit is preferred over using a magic value.

VJ Updated by Victor Julien almost 2 years ago Actions
Copy link
 #4

  • Status changed from New to In Review
  • Assignee changed from OISF Dev to Victor Julien
  • Target version changed from TBD to 8.0.0-beta1

VJ Updated by Victor Julien almost 2 years ago Actions
Copy link
 #5

  • Label Needs backport to 7.0 added

OT Updated by OISF Ticketbot almost 2 years ago Actions
Copy link
 #6

  • Subtask #7102 added

OT Updated by OISF Ticketbot almost 2 years ago Actions
Copy link
 #7

  • Label deleted (Needs backport to 7.0)

VJ Updated by Victor Julien almost 2 years ago Actions
Copy link
 #8

  • Status changed from In Review to Resolved

VJ Updated by Victor Julien over 1 year ago Actions
Copy link
 #9

  • Status changed from Resolved to Closed
Actions
Copy link

Also available in: PDF Atom