From 382cb7c8af374ea59a68cbec231d5fbba0466fb0 Mon Sep 17 00:00:00 2001 From: Victor Julien Date: Tue, 30 Sep 2014 09:56:41 +0200 Subject: [PATCH] filestore: fix parsing bug Filestore keyword can have options or no options, and the parser was enforcing the NOOPT flag too strictly. Bug #1288 --- src/detect-filestore.c | 2 +- src/detect-parse.c | 2 +- src/detect.h | 3 +++ 3 files changed, 5 insertions(+), 2 deletions(-) diff --git a/src/detect-filestore.c b/src/detect-filestore.c index bbbaa964b2..cd847fc4dd 100644 --- a/src/detect-filestore.c +++ b/src/detect-filestore.c @@ -76,7 +76,7 @@ void DetectFilestoreRegister(void) { sigmatch_table[DETECT_FILESTORE].Setup = DetectFilestoreSetup; sigmatch_table[DETECT_FILESTORE].Free = DetectFilestoreFree; sigmatch_table[DETECT_FILESTORE].RegisterTests = NULL; - sigmatch_table[DETECT_FILESTORE].flags = SIGMATCH_NOOPT; + sigmatch_table[DETECT_FILESTORE].flags = SIGMATCH_OPTIONAL_OPT; const char *eb; int eo; diff --git a/src/detect-parse.c b/src/detect-parse.c index 7d940ae8e6..0b147fef8e 100644 --- a/src/detect-parse.c +++ b/src/detect-parse.c @@ -545,7 +545,7 @@ static int SigParseOptions(DetectEngineCtx *de_ctx, Signature *s, char *optstr, } } - if (!(st->flags & SIGMATCH_NOOPT)) { + if (!(st->flags & (SIGMATCH_NOOPT|SIGMATCH_OPTIONAL_OPT))) { if (strlen(optvalue) == 0) { SCLogError(SC_ERR_INVALID_SIGNATURE, "invalid formatting or malformed option to %s keyword: \'%s\'", optname, optstr); diff --git a/src/detect.h b/src/detect.h index 4ad199ac26..1839252ab3 100644 --- a/src/detect.h +++ b/src/detect.h @@ -1021,6 +1021,9 @@ typedef struct SigGroupHead_ { #define SIGMATCH_PAYLOAD (1 << 3) /**< Flag to indicate that the signature is not built-in */ #define SIGMATCH_NOT_BUILT (1 << 4) +/** sigmatch may have options, so the parser should be ready to + * deal with both cases */ +#define SIGMATCH_OPTIONAL_OPT (1 << 5) /** Remember to add the options in SignatureIsIPOnly() at detect.c otherwise it wont be part of a signature group */ -- 2.47.3