Bug #1508: address var parsing issue - Suricata - Open Information Security Foundation

Actions

Copy link

Bug #1508

closed

address var parsing issue

Added by Victor Julien over 9 years ago. Updated over 9 years ago.

Status:

Closed

Priority:

Normal

Assignee:

Jason Ish

Target version:

3.0RC1

Affected Versions:

Effort:

Difficulty:

Label:

Description

This works:

  address-groups:
    LOAD_BALANCERS: "[10.2.1.1/32, 10.3.1.2/32]" 
    HOME_NET: "[![$LOAD_BALANCERS], 10.2.0.0/16, 10.3.0.0/16]" 
    EXTERNAL_NET: "[!$HOME_NET,$LOAD_BALANCERS]"

This doesn't:

  address-groups:
    LOAD_BALANCERS: "[10.2.1.1/32, 10.3.1.2/32]" 
    HOME_NET: "[![$LOAD_BALANCERS], 10.2.0.0/16, 10.3.0.0/16]" 
    EXTERNAL_NET: "[!$HOME_NET, $LOAD_BALANCERS]"

The only diff: the space between !$HOME_NET, and $LOAD_BALANCERS

@Jason Borden can you check this and see if it also affects 2.0?