From: Andreas Herz <andi@geekosphere.org>
Date: Tue, 14 Jun 2016 21:14:40 +0000 (+0200)
Subject: util-threshold-config: parse suppress rules with spaces in ip list
X-Git-Tag: suricata-3.1.1~24
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=refs%2Fpull%2F2160%2Fhead;p=thirdparty%2Fsuricata.git

util-threshold-config: parse suppress rules with spaces in ip list

This modified regex allows spaces witihn the ip list for supress rules
like [10.0.0.1, 10.0.0.2]
---

diff --git a/src/util-threshold-config.c b/src/util-threshold-config.c
index d7f24769e2..d45f7b7030 100644
--- a/src/util-threshold-config.c
+++ b/src/util-threshold-config.c
@@ -73,7 +73,7 @@ typedef enum ThresholdRuleType {
  *  suppress gen_id 1, sig_id 2000328
  *  suppress gen_id 1, sig_id 2000328, track by_src, ip fe80::/10
 */
-#define DETECT_SUPPRESS_REGEX "^,\\s*track\\s*(by_dst|by_src|by_either)\\s*,\\s*ip\\s*([\\[\\],\\$\\da-zA-Z.:/_]+)*\\s*$"
+#define DETECT_SUPPRESS_REGEX "^,\\s*track\\s*(by_dst|by_src|by_either)\\s*,\\s*ip\\s*([\\[\\],\\$\\s\\da-zA-Z.:/_]+)*\\s*$"
 
 /* Default path for the threshold.config file */
 #if defined OS_WIN32 || defined __CYGWIN__