mirror of https://github.com/OISF/suricata
detect/content: account for distance variables
Under some cases (below), the depth and offset values are used twice. This commit disregards the distance variable (if any), when computing the final depth. These rules are logically equivalent:: 1. alert tcp any any -> any 8080 (msg:"distance name"; flow:to_server; content:"Authorization:"; content:"5f71ycy"; distance:0; byte_extract:1,0,option_len,string,relative; content:!"|38|"; distance:option_len; within:1; content:"|37|"; distance:-1; within:1; content:"|49|"; distance:option_len; within:1; sid:1;) 2. alert tcp any any -> any 8080 (msg:"distance number"; flow:to_server; content:"Authorization:"; content:"5f71ycy"; distance:0; byte_extract:1,0,option_len,string,relative; content:!"|38|"; distance:7; within:1; content:"|37|"; distance:-1; within:1; content:"|49|"; distance:option_len; within:1; sid:2;) The differences: Rule 1: content:!"|38|"; distance:option_len; within:1; //option_len == 7 Rule 2: content:!"|38|"; distance:7; within:1; Without this commit, rule 2 triggers an alert but rule 1 doesn't. Issue: 7390pull/13383/head
parent
5dcd0a36f9
commit
ace0d37636
Loading…
Reference in New Issue