From: Shivani Bhardwaj <shivanib134@gmail.com>
Date: Fri, 28 Jan 2022 20:17:17 +0000 (+0530)
Subject: detect/dataset: fix space condition in rule lang
X-Git-Tag: suricata-5.0.10~79
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=eb4eebb45e224ab526c318eaf7d5402011a22d05;p=thirdparty%2Fsuricata.git

detect/dataset: fix space condition in rule lang

If there is a space following a keyword that does not expect a value,
the rule fails to load due to improper value evaluation.
e.g. Space after "set" command
alert http any any -> any any (http.user_agent; dataset:set  ,ua-seen,type string,save datasets.csv; sid:1;)

gives error
[ERRCODE: SC_ERR_UNKNOWN_VALUE(129)] - dataset action "" is not supported.

Fix this by handling values correctly for such cases.

(cherry picked from commit 6d2a2a073120906304f70c0e120565eae96e36b8)
---

diff --git a/src/detect-dataset.c b/src/detect-dataset.c
index b29d4eb1df..ad579b0b2f 100644
--- a/src/detect-dataset.c
+++ b/src/detect-dataset.c
@@ -131,13 +131,13 @@ static int DetectDatasetParse(const char *str,
         }
 
         if (!cmd_set) {
-            if (val) {
+            if (val && strlen(val) != 0) {
                 return -1;
             }
             strlcpy(cmd, key, cmd_len);
             cmd_set = true;
         } else if (!name_set) {
-            if (val) {
+            if (val && strlen(val) != 0) {
                 return -1;
             }
             strlcpy(name, key, name_len);