Currently the following rule can't be loaded:
alert tcp any any -> any 25 (msg:"SMTP file_data test"; flow:to_server,established; file_data; content:"abc";sid:1;)
and produces the error output:
"Can't use file_data with flow:to_server or from_client with http or smtp."
This checks if the alproto is not http in a signature,
so permits to use flow keyword also.
Issue reported by rmkml.
This commit do a find and replace of the following:
- DETECT_SM_LIST_HSBDMATCH by DETECT_SM_LIST_FILEDATA
sed -i 's/DETECT_SM_LIST_HSBDMATCH/DETECT_SM_LIST_FILEDATA/g' src/*
- HSBD by FILEDATA:
sed -i 's/HSBDMATCH/FILEDATA/g' src/*
The output of the list-keyword is modified to include the url to
the keyword documentation when this is available. All documented
keywords should have their link set.
list-keyword can be used with an optional value:
no option or short: display list of keywords
csv: display a csv output on info an all keywords
all: display a human readable output of keywords info
$KWD: display the info about one keyword.
Support file_data for: content, pcre (relative), byte_test, byte_jump,
byte_extract, isdataat.
File_data support is handled at signature parsing time, all matches
occurring after the file_data in the rule are converted to http_server_body
matches.
Content matches relative to the file_data are converted. Within to depth,
distance to offset. Relative to the start of the body buffer.
Giuseppe Longo
Victor Julien
Ken Steele
Last G
Eric Leblond
Eileen Donlon