From a2f857ed900fcefdb775203825a262f4f1ed3343 Mon Sep 17 00:00:00 2001 From: Philippe Antoine Date: Thu, 28 Apr 2022 16:24:46 +0200 Subject: [PATCH] threshold: fix regex to accept by_both and by_rule As is done in detect-threshold.c or in DETECT_RATE_REGEX and is expected by switch (rule_type) which makes the same for THRESHOLD_TYPE_THRESHOLD and THRESHOLD_TYPE_RATE Ticket: #5327 --- src/util-threshold-config.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/src/util-threshold-config.c b/src/util-threshold-config.c index 97c7507624..84dd61ecd1 100644 --- a/src/util-threshold-config.c +++ b/src/util-threshold-config.c @@ -67,7 +67,9 @@ static FILE *g_ut_threshold_fp = NULL; /* common base for all options */ #define DETECT_BASE_REGEX "^\\s*(event_filter|threshold|rate_filter|suppress)\\s*gen_id\\s*(\\d+)\\s*,\\s*sig_id\\s*(\\d+)\\s*(.*)\\s*$" -#define DETECT_THRESHOLD_REGEX "^,\\s*type\\s*(limit|both|threshold)\\s*,\\s*track\\s*(by_dst|by_src)\\s*,\\s*count\\s*(\\d+)\\s*,\\s*seconds\\s*(\\d+)\\s*$" +#define DETECT_THRESHOLD_REGEX \ + "^,\\s*type\\s*(limit|both|threshold)\\s*,\\s*track\\s*(by_dst|by_src|by_both|by_rule)\\s*," \ + "\\s*count\\s*(\\d+)\\s*,\\s*seconds\\s*(\\d+)\\s*$" /* TODO: "apply_to" */ #define DETECT_RATE_REGEX "^,\\s*track\\s*(by_dst|by_src|by_both|by_rule)\\s*,\\s*count\\s*(\\d+)\\s*,\\s*seconds\\s*(\\d+)\\s*,\\s*new_action\\s*(alert|drop|pass|log|sdrop|reject)\\s*,\\s*timeout\\s*(\\d+)\\s*$" -- 2.47.2