Project

General

Profile

Actions
Copy link

Bug #7799

closed

suricata-update: complex address and port lists not parsed correctly

Added by Jason Ish 24 days ago. Updated 23 days ago.

Status:
Closed
Priority:
Normal
Assignee:
Jason Ish
Target version:
1.3.6
Affected Versions:
1.3.5
Effort:
Difficulty:
Label:

Description

Example rule:

alert http [any,![$EXTERNAL_IP,$REVERSE_PROXY_HOSTS,$ODD_HTTP_HOSTS]] any -> [any,![$EXTERNAL_IP,$REVERSE_PROXY_HOSTS,$ODD_HTTP_HOSTS]] 80 (msg:"TEST Unknown var"; sid: 99000003; rev: 1;)

confuses the parser, and address variables end up in the parsed ports.

Actions
Copy link
 #1

Updated by Jason Ish 23 days ago

  • Status changed from In Progress to Closed
Actions
Copy link

Also available in: Atom PDF