inliniac/suricata — pull request #1137 by jasonish (2014-09-29 17:52:35+00:00)
Title: Bug 1230 - byte_extract, within combination not working - fix - v1.

This patch will fix rules like:

alert tcp any any -> any any (\
msg:"test rule"; \
content:"abc"; \
http_client_body; \
byte_extract:2,0,somevar,relative; \
content:"def"; \
within:somevar; \
http_client_body; \
sid:4; rev:1;)

What currently happens is the first http_client_body causes the byte_extract to be put on the DETECT_SM_LIST_HCBDMATCH list. As the within comes after content (which could be called a terminal option as it terminates the previous modifiers), but before the next http_client_body, it fails to find "somevar" as its looking in the wrong list.

One fix (perhaps a bit naive) is to look in all lists when looking up a byte_extract variable. The following http_client_body option will move all the list items to the correct list keeping everything intact for packet evaulation.

Last minute thought - perhaps restrict the lookup to the last list used (current default) and fallback to DETECT_SM_LIST_PMATCH instead of looking at all lists.

Buildbot output:
- PR build: https://buildbot.openinfosecfoundation.org/builders/jasonish/builds/8
- PR pcaps: https://buildbot.openinfosecfoundation.org/builders/jasonish-pcap/builds/8