Project

General

Profile

Actions
Copy link

Feature #257

closed

adding negation support to isdataat

Added by Peter Manev almost 14 years ago. Updated almost 14 years ago.

Status:
Closed
Priority:
Normal
Assignee:
Anoop Saldanha
Target version:
1.1beta2
Effort:
Difficulty:
Label:

Description

[ERRCODE: SC_ERR_PCRE_MATCH(2)] - pcre_exec parse error, ret -1, string !9,relative

Example:

[9838] 20/12/2010 -- 11:50:18 - (detect-isdataat.c:146) <Error> (DetectIsdataatParse) -- [ERRCODE: SC_ERR_PCRE_MATCH(2)] - pcre_exec parse error, ret -1, string !9,relative

[9838] 20/12/2010 -- 11:50:18 - (detect.c:526) <Error> (DetectLoadSigFile) -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - Error parsing signature "alert udp $EXTERNAL_NET any -> $DNS_SERVERS 53 (msg:"SPECIFIC-THREATS ISC BIND DNSSEC Validation Multiple RRsets DoS"; flow:to_server; content:"|01 10|"; depth:2; offset:2; content:"|00 80 01 00 01 00 00 29|"; isdataat:!9,relative; content:"|03|com"; content:"|03|com"; within:4; distance:4; metadata:policy balanced-ips drop, policy security-ips drop; reference:bugtraq,22231; reference:cve,2007-0494; classtype:attempted-dos; sid:17680; rev:1;)" from file /etc/suricata/rules/specific-threats.rules at line 540

Files

0003-support-isdataat-negation.-Also-fix-addiing-isdataat.patch (32.2 KB) 0003-support-isdataat-negation.-Also-fix-addiing-isdataat.patch Anoop Saldanha, 12/31/2010 05:05 AM
Actions
Copy link

Also available in: Atom PDF