From: Jason Ish <jason.ish@oisf.net>
Date: Thu, 7 Sep 2023 17:53:55 +0000 (-0600)
Subject: conf: fix include handling from arrays
X-Git-Tag: suricata-7.0.2~39
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=252e8dbb32b23c0bc20e6bb5690c5516a4213e9b;p=thirdparty%2Fsuricata.git

conf: fix include handling from arrays

Includes from an "include" array were being loaded into the wrong
parent as the logic for array handing in include context was not
updated.

If we are descending into an array in include context, pass through
the current parent so the included configuration is included where it
is expected.

Bug: #6300
---

diff --git a/src/conf-yaml-loader.c b/src/conf-yaml-loader.c
index 9312a189e8..1bd107e0c1 100644
--- a/src/conf-yaml-loader.c
+++ b/src/conf-yaml-loader.c
@@ -374,8 +374,9 @@ static int ConfYamlParse(yaml_parser_t *parser, ConfNode *parent, int inseq, int
         }
         else if (event.type == YAML_SEQUENCE_START_EVENT) {
             SCLogDebug("event.type=YAML_SEQUENCE_START_EVENT; state=%d", state);
-            if (ConfYamlParse(parser, node, 1, rlevel, state == CONF_INCLUDE ? CONF_INCLUDE : 0) !=
-                    0)
+            /* If we're processing a list of includes, use the current parent. */
+            if (ConfYamlParse(parser, state == CONF_INCLUDE ? parent : node, 1, rlevel,
+                        state == CONF_INCLUDE ? CONF_INCLUDE : 0) != 0)
                 goto fail;
             node->is_seq = 1;
             state = CONF_KEY;