From: Andreas Herz <andi@geekosphere.org>
Date: Fri, 11 Aug 2017 21:11:46 +0000 (+0200)
Subject: rule-parser: detect duplicate classtype keyword
X-Git-Tag: suricata-4.0.1~35
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=0210d70550bd006e01e9cc5e42b01ffe44ccb2c4;p=thirdparty%2Fsuricata.git

rule-parser: detect duplicate classtype keyword
---

diff --git a/src/detect-classtype.c b/src/detect-classtype.c
index 036a9c8c41..bd25882a73 100644
--- a/src/detect-classtype.c
+++ b/src/detect-classtype.c
@@ -121,6 +121,12 @@ static int DetectClasstypeSetup(DetectEngineCtx *de_ctx, Signature *s, const cha
         goto error;
     }
 
+    if ((s->class > 0) || (s->class_msg != NULL))
+    {
+        SCLogError(SC_ERR_INVALID_RULE_ARGUMENT, "duplicated 'classtype' keyword detected");
+        goto error;
+    }
+
     /* if we have retrieved the classtype, assign the message to be displayed
      * for this Signature by fast.log, if a Packet matches this Signature */
     s->class = ct->classtype_id;