Project

General

Profile

Actions
Copy link

Bug #7799

open

suricata-update: complex address and port lists not parsed correctly

Added by Jason Ish about 17 hours ago.

Status:
In Progress
Priority:
Normal
Assignee:
Jason Ish
Target version:
1.3.6
Affected Versions:
1.3.5
Effort:
Difficulty:
Label:

Description

Example rule:

alert http [any,![$EXTERNAL_IP,$REVERSE_PROXY_HOSTS,$ODD_HTTP_HOSTS]] any -> [any,![$EXTERNAL_IP,$REVERSE_PROXY_HOSTS,$ODD_HTTP_HOSTS]] 80 (msg:"TEST Unknown var"; sid: 99000003; rev: 1;)

confuses the parser, and address variables end up in the parsed ports.

No data to display

Actions
Copy link

Also available in: Atom PDF