diff --git a/README.md b/README.md index 2764e4c0b..7e7ac42a9 100644 --- a/README.md +++ b/README.md @@ -180,7 +180,12 @@ checks: # Check if a string is contained within a JSON list. # Eg. "ftp":{"reply":["Opening BINARY mode data connection for temp.txt (1164 bytes).","Transfer complete."], } ftp.reply.__contains: 'Transfer complete.' - + - filter: + # Check line number of an entry + count: 1 + match: + __lineno: 5 + alert.signature_id: 15 - shell: # A simple shell check. If the command exits with a non-0 exit code the # check will fail. The script is run in the output directory of the diff --git a/run.py b/run.py index 21e65a117..af91cbef8 100755 --- a/run.py +++ b/run.py @@ -574,8 +574,11 @@ def run(self): count = 0 with open(json_filename, "r", encoding="utf-8") as fileobj: + lineno = 1 for line in fileobj: event = json.loads(line) + event["__lineno"] = lineno + lineno = lineno + 1 if self.match(event): count += 1 if count == self.config["count"]: diff --git a/tests/bug-7638-flowbits-sigorder-01/test.rules b/tests/bug-7638-flowbits-sigorder-01/test.rules new file mode 100644 index 000000000..59c8c19bd --- /dev/null +++ b/tests/bug-7638-flowbits-sigorder-01/test.rules @@ -0,0 +1,4 @@ +alert http any any -> any any (http.uri; content:"down"; flowbits:set,uritest; sid:11;) +alert http any any -> any any (http.user_agent; content:"Mozilla"; flowbits:isset, headtest; flowbits:set,moz; sid:10;) +alert http any any -> any any (http.method; content:"GET"; flowbits:isset,uritest; flowbits:set,headtest; sid:12;) +alert http any any -> any any (http.host; content:"ether"; flowbits:isset,moz; sid:14;) diff --git a/tests/bug-7638-flowbits-sigorder-01/test.yaml b/tests/bug-7638-flowbits-sigorder-01/test.yaml new file mode 100644 index 000000000..c44d0f121 --- /dev/null +++ b/tests/bug-7638-flowbits-sigorder-01/test.yaml @@ -0,0 +1,33 @@ +requires: + min-version: 8.0 + +pcap: false + +args: + - --engine-analysis + +checks: +- filter: + filename: rules.json + count: 1 + match: + __lineno: 1 + id: 11 +- filter: + filename: rules.json + count: 1 + match: + __lineno: 2 + id: 12 +- filter: + filename: rules.json + count: 1 + match: + __lineno: 3 + id: 10 +- filter: + filename: rules.json + count: 1 + match: + __lineno: 4 + id: 14