From eb4eebb45e224ab526c318eaf7d5402011a22d05 Mon Sep 17 00:00:00 2001 From: Shivani Bhardwaj Date: Sat, 29 Jan 2022 01:47:17 +0530 Subject: [PATCH] detect/dataset: fix space condition in rule lang If there is a space following a keyword that does not expect a value, the rule fails to load due to improper value evaluation. e.g. Space after "set" command alert http any any -> any any (http.user_agent; dataset:set ,ua-seen,type string,save datasets.csv; sid:1;) gives error [ERRCODE: SC_ERR_UNKNOWN_VALUE(129)] - dataset action "" is not supported. Fix this by handling values correctly for such cases. (cherry picked from commit 6d2a2a073120906304f70c0e120565eae96e36b8) --- src/detect-dataset.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/src/detect-dataset.c b/src/detect-dataset.c index b29d4eb1df..ad579b0b2f 100644 --- a/src/detect-dataset.c +++ b/src/detect-dataset.c @@ -131,13 +131,13 @@ static int DetectDatasetParse(const char *str, } if (!cmd_set) { - if (val) { + if (val && strlen(val) != 0) { return -1; } strlcpy(cmd, key, cmd_len); cmd_set = true; } else if (!name_set) { - if (val) { + if (val && strlen(val) != 0) { return -1; } strlcpy(name, key, name_len); -- 2.47.2