https://redmine.openinfosecfoundation.org/https://redmine.openinfosecfoundation.org/favicon.ico?17011170022013-01-28T04:27:35ZOpen Information Security FoundationSuricata - Feature #735: Introduce content_len keywordhttps://redmine.openinfosecfoundation.org/issues/735?journal_id=27472013-01-28T04:27:35ZVictor Julienvictor@inliniac.net
<ul></ul><p>I think the syntax should probably be more like urilen, filesize and dsize:</p>
<p>dsize:1; is exact match<br />urilen:5<>10; is a range</p>
<p>Like the concept. Think it makes sense to have a generic match for this.</p> Suricata - Feature #735: Introduce content_len keywordhttps://redmine.openinfosecfoundation.org/issues/735?journal_id=27522013-01-30T10:20:11ZAnoop Saldanhaanoopsaldanha@gmail.com
<ul></ul><p>Have almost completed this work, but I've used the operators like the way I've specified. Felt it was neater if one wants to specify equal_to or not_equal_to.</p>
<p>Will change it to the dsize format if needed.</p> Suricata - Feature #735: Introduce content_len keywordhttps://redmine.openinfosecfoundation.org/issues/735?journal_id=35512013-10-25T04:58:18ZVictor Julienvictor@inliniac.net
<ul><li><strong>Status</strong> changed from <i>New</i> to <i>Assigned</i></li><li><strong>Target version</strong> changed from <i>TBD</i> to <i>2.0rc2</i></li></ul> Suricata - Feature #735: Introduce content_len keywordhttps://redmine.openinfosecfoundation.org/issues/735?journal_id=39972014-01-31T06:48:29ZVictor Julienvictor@inliniac.net
<ul><li><strong>Target version</strong> changed from <i>2.0rc2</i> to <i>3.0RC2</i></li></ul> Suricata - Feature #735: Introduce content_len keywordhttps://redmine.openinfosecfoundation.org/issues/735?journal_id=52252015-05-20T06:11:04ZVictor Julienvictor@inliniac.net
<ul><li><strong>Target version</strong> changed from <i>3.0RC2</i> to <i>TBD</i></li></ul> Suricata - Feature #735: Introduce content_len keywordhttps://redmine.openinfosecfoundation.org/issues/735?journal_id=73772016-09-08T15:28:01ZAndreas Herzoisf@herzandreas.de
<ul><li><strong>Assignee</strong> changed from <i>Anoop Saldanha</i> to <i>OISF Dev</i></li></ul> Suricata - Feature #735: Introduce content_len keywordhttps://redmine.openinfosecfoundation.org/issues/735?journal_id=90652017-12-01T05:08:15ZVictor Julienvictor@inliniac.net
<ul><li><strong>Related to</strong> <i><a class="issue tracker-5 status-2 priority-4 priority-default child" href="/issues/2309">Task #2309</a>: SuriCon 2017 brainstorm</i> added</li></ul> Suricata - Feature #735: Introduce content_len keywordhttps://redmine.openinfosecfoundation.org/issues/735?journal_id=92812017-12-21T07:17:20ZVictor Julienvictor@inliniac.net
<ul><li><strong>Assignee</strong> changed from <i>OISF Dev</i> to <i>Victor Julien</i></li><li><strong>Target version</strong> changed from <i>TBD</i> to <i>70</i></li></ul> Suricata - Feature #735: Introduce content_len keywordhttps://redmine.openinfosecfoundation.org/issues/735?journal_id=95922018-03-22T04:55:06ZVictor Julienvictor@inliniac.net
<ul><li><strong>Status</strong> changed from <i>Assigned</i> to <i>Closed</i></li><li><strong>Target version</strong> changed from <i>70</i> to <i>4.1beta1</i></li></ul><p><a class="external" href="https://github.com/OISF/suricata/pull/3232">https://github.com/OISF/suricata/pull/3232</a> implements this under a different name: 'bsize'.</p>