From: Victor Julien <victor@inliniac.net>
Date: Tue, 30 Sep 2014 07:56:41 +0000 (+0200)
Subject: filestore: fix parsing bug
X-Git-Tag: suricata-2.1beta2~92
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=d9c523a332259777f594acb1f3887be5e05f2b7d;p=thirdparty%2Fsuricata.git

filestore: fix parsing bug

Filestore keyword can have options or no options, and the parser
was enforcing the NOOPT flag too strictly.

Bug #1288
---

diff --git a/src/detect-filestore.c b/src/detect-filestore.c
index 6ec5b5f8e5..f9bfdf55c2 100644
--- a/src/detect-filestore.c
+++ b/src/detect-filestore.c
@@ -77,7 +77,7 @@ void DetectFilestoreRegister(void)
     sigmatch_table[DETECT_FILESTORE].Setup = DetectFilestoreSetup;
     sigmatch_table[DETECT_FILESTORE].Free  = DetectFilestoreFree;
     sigmatch_table[DETECT_FILESTORE].RegisterTests = NULL;
-    sigmatch_table[DETECT_FILESTORE].flags = SIGMATCH_NOOPT;
+    sigmatch_table[DETECT_FILESTORE].flags = SIGMATCH_OPTIONAL_OPT;
 
     const char *eb;
     int eo;
diff --git a/src/detect-parse.c b/src/detect-parse.c
index 1a5d683b25..a94b546be3 100644
--- a/src/detect-parse.c
+++ b/src/detect-parse.c
@@ -552,7 +552,7 @@ static int SigParseOptions(DetectEngineCtx *de_ctx, Signature *s, char *optstr,
         }
     }
 
-    if (!(st->flags & SIGMATCH_NOOPT)) {
+    if (!(st->flags & (SIGMATCH_NOOPT|SIGMATCH_OPTIONAL_OPT))) {
         if (strlen(optvalue) == 0) {
             SCLogError(SC_ERR_INVALID_SIGNATURE, "invalid formatting or malformed option to %s keyword: \'%s\'",
                     optname, optstr);
diff --git a/src/detect.h b/src/detect.h
index 432b70500d..a3a7d4a7de 100644
--- a/src/detect.h
+++ b/src/detect.h
@@ -1023,6 +1023,9 @@ typedef struct SigGroupHead_ {
 #define SIGMATCH_PAYLOAD        (1 << 3)
 /**< Flag to indicate that the signature is not built-in */
 #define SIGMATCH_NOT_BUILT      (1 << 4)
+/** sigmatch may have options, so the parser should be ready to
+ *  deal with both cases */
+#define SIGMATCH_OPTIONAL_OPT   (1 << 5)
 
 /** Remember to add the options in SignatureIsIPOnly() at detect.c otherwise it wont be part of a signature group */