]> git.ipfire.org Git - thirdparty/suricata.git/commitdiff
detect-parse: simplify port prefiltering
authorEric Leblond <eric@regit.org>
Tue, 10 Jan 2017 22:46:48 +0000 (14:46 -0800)
committerVictor Julien <victor@inliniac.net>
Tue, 17 Jan 2017 09:38:53 +0000 (10:38 +0100)
Regular expression was not matching some authorized setting like
"![1234, 1235]". This patch simplify the regexp to match on
possible character and let the port parsing code handle the
complete verification.

src/detect-parse.c

index 1af519b090bd4f6fedf6297c944cd55cf1611ee0..7307d974be7baf4902caf44bb936b3a3f5f49ff5 100644 (file)
@@ -104,11 +104,7 @@ typedef struct SigDuplWrapper_ {
                            ")"
 
 /* if enclosed in [], spaces are allowed */
-#define CONFIG_PCRE_PORT   "(" \
-                            "[\\:A-z0-9_\\$\\!,]+"\
-                           "|"\
-                            "\\[[\\:A-z0-9_\\$\\!,\\s]+\\]"\
-                           ")"
+#define CONFIG_PCRE_PORT   "([\\[\\]\\:A-z0-9_\\$\\!,\\s]+)"
 
 /* format: action space(s) protocol spaces(s) src space(s) sp spaces(s) dir spaces(s) dst spaces(s) dp spaces(s) options */
 #define CONFIG_PCRE "^([A-z]+)\\s+([A-z0-9\\-]+)\\s+" \