Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Rule engine doesn't care about rule type if no conditions are defined on the payload #210

Closed
banditopazzo opened this issue Sep 25, 2023 · 0 comments · Fixed by #211
Closed

Comments

@banditopazzo
Copy link
Member

Rule engine contains an unwanted behaviour.

Take for example this 2 rules:

- name: Test curl request
  type: DnsQuery
  condition: header.image == "/usr/bin/curl"
- name: Test curl response
  type: DnsResponse
  condition: header.image == "/usr/bin/curl"

Even if there is for DnsQuery or DnsResponse in the type field of the rule, but without any rule on the Payload, this condition will match on every type of events, not only DnsQuery or DnsResponse.

This behaviour is not wrong from validation point of view, because it's generic and only looks strictly at conditions.

We need is a way to enforce this check for our specific case, where payload type is an additional condition.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging a pull request may close this issue.

1 participant