Actions
Feature #4381
openTask #4380: tracking: improvements to bits, ints, vars
flowbits: warn if flowbit dependencies don't follow suricata inspection order
Effort:
Difficulty:
Label:
Description
Consider 2 rules:
file.data; content:"abc"; flowbit:set,bit1; http.uri; content:"xyz"; flowbit:isset,bit1;
The first rule will be evaluated last because it is part of the response. We should warn here.
Consider 2 rules:
http.request_body; content:"abc"; flowbit:set,bit1; http.uri; content:"xyz"; flowbit:isset,bit1;
The first rule will be evaluated last because it happens later in the stream. We should warn here. We can look at the max "progress value" associated with a buffer perhaps.
Actions