From e9a2a341ceda1f1c23918949f483508144a22aea Mon Sep 17 00:00:00 2001 From: Andreas Herz Date: Tue, 14 Jun 2016 23:14:40 +0200 Subject: [PATCH] util-threshold-config: parse suppress rules with spaces in ip list This modified regex allows spaces witihn the ip list for supress rules like [10.0.0.1, 10.0.0.2] --- src/util-threshold-config.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/src/util-threshold-config.c b/src/util-threshold-config.c index d7f24769e2..d45f7b7030 100644 --- a/src/util-threshold-config.c +++ b/src/util-threshold-config.c @@ -73,7 +73,7 @@ typedef enum ThresholdRuleType { * suppress gen_id 1, sig_id 2000328 * suppress gen_id 1, sig_id 2000328, track by_src, ip fe80::/10 */ -#define DETECT_SUPPRESS_REGEX "^,\\s*track\\s*(by_dst|by_src|by_either)\\s*,\\s*ip\\s*([\\[\\],\\$\\da-zA-Z.:/_]+)*\\s*$" +#define DETECT_SUPPRESS_REGEX "^,\\s*track\\s*(by_dst|by_src|by_either)\\s*,\\s*ip\\s*([\\[\\],\\$\\s\\da-zA-Z.:/_]+)*\\s*$" /* Default path for the threshold.config file */ #if defined OS_WIN32 || defined __CYGWIN__ -- 2.47.2