Bug #2080
closed
Rules with bad port group var do not error
Added by Francis Trudeau over 7 years ago.
Updated over 5 years ago.
Description
This does not error in Suricata 3.2.1 and 4.0dev (rev 3726fd6) (latest as of now) or any other version of Suricata I tested:
alert tcp $HOME_NET any -> $EXTERNAL_NET non_existent_var (msg:"bad portvar test"; content:"31d7c3e829be03400641f80b821ef728"; sid:3032; rev:1;)
also - for info - it errs like that:
[3902] 30/3/2017 -- 09:06:44 - (util-rule-vars.c:102) <Error> (SCRuleVarsGetConfVar) -- [ERRCODE: SC_ERR_UNDEFINED_VAR(101)] - Variable "non_existent_var" is not defined in configuration file
[3902] 30/3/2017 -- 09:06:44 - (detect.c:365) <Error> (DetectLoadSigFile) -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "alert tcp $HOME_NET any -> $EXTERNAL_NET $non_existent_var (msg:"bad portvar test"; content:"31d7c3e829be03400641f80b821ef728"; sid:3033; rev:1;)" from file badportvar.rules at line 3
when the rule uses the "$" in front of the variable ( $non_existent_var ) -
alert tcp $HOME_NET any -> $EXTERNAL_NET $non_existent_var (msg:"bad portvar test"; content:"31d7c3e829be03400641f80b821ef728"; sid:3033; rev:1;)
I worded this wrong due to getting my wires crossed during testing.
It probably should read "Rules with illegal port parameter does not error"
- Assignee set to OISF Dev
- Target version set to TBD
- Assignee changed from OISF Dev to Philippe Antoine
- Status changed from New to Closed
- Target version changed from TBD to 5.0rc1
- Related to Bug #3053: Replace atoi with StringParse* for better error handling added
Also available in: Atom
PDF