Bug #5107: detect/iponly: rule parsing does not always apply netmask correctly - Suricata - Open Information Security Foundation

Actions

Copy link

Bug #5107

closed

detect/iponly: rule parsing does not always apply netmask correctly

Added by Jeff Lucovsky over 2 years ago. Updated over 2 years ago.

Status:

Closed

Priority:

Normal

Assignee:

Jeff Lucovsky

Target version:

5.0.9

Affected Versions:

Effort:

Difficulty:

Label:

Description

If the ipaddress is not the address range start, it's not masked to turn it into that. So 1.2.3.4/24 is not stored as address 1.2.3.0 with netmask 24, but as 1.2.3.4 with netmask 24. This is then propagated into the radix tree, where it is used as an exact key in exact lookups, giving unexpected results.

Related issues 1 (0 open — 1 closed)