|
|
|
|
@ -61,7 +61,7 @@ TODO:
|
|
|
|
|
hostbits:set,bitname,both,120;
|
|
|
|
|
*/
|
|
|
|
|
|
|
|
|
|
#define PARSE_REGEX "([a-z]+)" /* Action */ \
|
|
|
|
|
#define PARSE_REGEX "^([a-z]+)" /* Action */ \
|
|
|
|
|
"(?:\\s*,\\s*([^\\s,]+))?(?:\\s*)?" /* Name. */ \
|
|
|
|
|
"(?:\\s*,\\s*([^,\\s]+))?(?:\\s*)?" /* Direction. */ \
|
|
|
|
|
"(.+)?" /* Any remainding data. */
|
|
|
|
|
@ -619,6 +619,10 @@ static int HostBitsTestSig02(void)
|
|
|
|
|
"alert ip any any -> any any (hostbits:isnotset,abc,dst; content:\"GET \"; sid:2;)");
|
|
|
|
|
FAIL_IF_NULL(s);
|
|
|
|
|
|
|
|
|
|
s = DetectEngineAppendSig(de_ctx,
|
|
|
|
|
"alert ip any any -> any any (hostbits:!isset,abc,dst; content:\"GET \"; sid:3;)");
|
|
|
|
|
FAIL_IF_NOT_NULL(s);
|
|
|
|
|
|
|
|
|
|
/* TODO reenable after both is supported
|
|
|
|
|
s = DetectEngineAppendSig(de_ctx,
|
|
|
|
|
"alert ip any any -> any any (hostbits:set,abc,both; content:\"GET \"; sid:3;)");
|
|
|
|
|
|