rule-parser: detect duplicate classtype keyword

diff --git a/src/detect-classtype.c b/src/detect-classtype.c
index 036a9c8c4123ad662ddc5a6de2f4ce1b792d8247..bd25882a7367f393652a7b2fde6ecca270cac8d1 100644 (file)
--- a/src/detect-classtype.c
+++ b/src/detect-classtype.c
@@ -121,6 +121,12 @@ static int DetectClasstypeSetup(DetectEngineCtx *de_ctx, Signature *s, const cha
         goto error;
     }
 
+    if ((s->class > 0) || (s->class_msg != NULL))
+    {
+        SCLogError(SC_ERR_INVALID_RULE_ARGUMENT, "duplicated 'classtype' keyword detected");
+        goto error;
+    }
+
     /* if we have retrieved the classtype, assign the message to be displayed
      * for this Signature by fast.log, if a Packet matches this Signature */
     s->class = ct->classtype_id;