Project

General

Profile

Actions

Bug #7799

closed

suricata-update: complex address and port lists not parsed correctly

Added by Jason Ish 24 days ago. Updated 23 days ago.

Status:
Closed
Priority:
Normal
Assignee:
Target version:
Affected Versions:
Effort:
Difficulty:
Label:

Description

Example rule:

alert http [any,![$EXTERNAL_IP,$REVERSE_PROXY_HOSTS,$ODD_HTTP_HOSTS]] any -> [any,![$EXTERNAL_IP,$REVERSE_PROXY_HOSTS,$ODD_HTTP_HOSTS]] 80 (msg:"TEST Unknown var"; sid: 99000003; rev: 1;)

confuses the parser, and address variables end up in the parsed ports.

Actions #1

Updated by Jason Ish 23 days ago

  • Status changed from In Progress to Closed
Actions

Also available in: Atom PDF