Actions
Bug #7773
openBug #7638: detect: incorrect rule ordering with more complex flowbit chains
flowbits: no-op unset + isnotset combinations are accepted
Affected Versions:
Effort:
Difficulty:
low
Label:
Description
For example, a rule like:
alert tcp any any -> any any (msg:"unset + isnotset"; flowbits:isnotset,abc; http.method; content:"GET"; flowbits:unset,abc; sid:111)
Updated by Shivani Bhardwaj about 1 month ago
- Description updated (diff)
- Priority changed from Normal to High
Updated by Shivani Bhardwaj about 1 month ago
- Target version changed from 8.0.0 to 9.0.0-beta1
Updated by Shivani Bhardwaj 12 days ago
In Review PR: https://github.com/OISF/suricata/pull/13613
Updated by Shivani Bhardwaj 12 days ago
- Status changed from Assigned to In Review
Actions