IPS policy matching by classtype

[mnaiman]

Describe the bug

On 21.1 When I create policy to match rules Im able to match them using rulesets, severity and other items and when I look to rules matched_policy\name they are there.

When I try to do same but match by classtype (any classtype) matched_policy\name is always empty

There are definitely rules to be matched.

[mnaiman]

Ok I think I found problem.

This is generated rules-policies.config

[899f34deb7874e03aacd47fa3abc2309]
enabled=1
prio=30
content=classtype.policy-violation
action=alert,drop
target_action=disable
policy_id=899f34de-b787-4e03-aacd-47fa3abc2309
policy_description=Disable nag alerts

But here https://suricata.readthedocs.io/en/latest/rules/meta.html#classtype is written that correct syntax is classtype:trojan-activity

When I changed
content=classtype.policy-violation
to
content=classtype:policy-violation

It loaded all rules by this classtype.

[mnaiman]

Using semicolon syntax it loaded more rules even other classtypes :/
At least it loads something, but not very predictable.

eg.

[AdSchellevis]

first upgrade to 21.1.1 and then b465a41 should be applied (using opnsense-update b465a41). it's specifically an issue with "category" since it's not a metadata field (former_category is, but not always supplied by Proofpoint)

[mnaiman]

perfect, fixed, thanks