From: Jason Ish <ish@unx.ca>
Date: Thu, 31 May 2018 23:05:52 +0000 (-0600)
Subject: dhcp: add dhcp app-layer rules file
X-Git-Tag: suricata-4.1.0-rc1~54
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=c052e23348e71e4fef27204642eee56ac476ea42;p=thirdparty%2Fsuricata.git

dhcp: add dhcp app-layer rules file
---

diff --git a/rules/dhcp-events.rules b/rules/dhcp-events.rules
new file mode 100644
index 0000000000..c99d9816e8
--- /dev/null
+++ b/rules/dhcp-events.rules
@@ -0,0 +1,7 @@
+# DHCP app-layer event rules.  See
+#
+# https://redmine.openinfosecfoundation.org/projects/suricata/wiki/AppLayer
+# for SID allocation.
+
+alert dhcp any any -> any any (msg:"SURICATA DHCP malformed options"; app-layer-event:dhcp.malformed_options; classtype:protocol-command-decode; sid:2227000; rev:1;)
+alert dhcp any any -> any any (msg:"SURICATA DHCP truncated options"; app-layer-event:dhcp.truncated_options; classtype:protocol-command-decode; sid:2227001; rev:1;)