Feature #494: ipv4 or ipv6 only rules - Suricata - Open Information Security Foundation

Actions

Copy link

Feature #494

closed

ipv4 or ipv6 only rules

Added by Victor Julien over 12 years ago. Updated over 12 years ago.

Status:

Closed

Priority:

Normal

Assignee:

Eric Leblond

Target version:

1.4beta1

Effort:

Difficulty:

Label:

Description

Instead of "alert ip" allow for "alert ipv4" and "alert ip4". Likewise for IPv6.

Interesting question is how this should behave wrt address vars. If HOME_NET contains both ip4 and ip6, how should a rule like "alert ipv4 $HOME_NET..." behave? Error out? Use only the ipv4 part of the addresses?

Files

Download all files

0001-sig-Add-ipv6-and-ipv4-to-list-of-protocols.patch (4.23 KB) 0001-sig-Add-ipv6-and-ipv4-to-list-of-protocols.patch		Eric Leblond, 07/17/2012 02:52 AM
0002-sig-add-l3_proto-keyword.patch (6.87 KB) 0002-sig-add-l3_proto-keyword.patch		Eric Leblond, 07/17/2012 02:52 AM

Related issues 1 (0 open — 1 closed)

Actions

Copy link

Updated by Eric Leblond over 12 years ago

I think we should only use the matching subset. But it could trigger some funny things like a null subset. It this case, we should ERROR out.

Actions

Copy link

Updated by Victor Julien over 12 years ago

Agreed. I think the rule analyzer should also display this information.

Actions

Copy link

Updated by Eric Leblond over 12 years ago

% Done changed from 0 to 80

Actions

Copy link

Updated by Eric Leblond over 12 years ago

Current code uses only the matching part of a variable. It does not fire an error if there is no intersection. It may be enough to have the rule analysers trigger a warning.

Actions

Copy link Download all files