From 2a113d4ea85cf6d85b69c85a5d7ab677b99da611 Mon Sep 17 00:00:00 2001 From: Victor Julien Date: Fri, 27 Feb 2026 15:01:19 +0100 Subject: [PATCH] detect/transforms: update gunzip / zlib_deflate syntax Use standard space separated syntax. (cherry picked from commit b55be5a44f7791d321cd25204d70c294e4bf0dcb) --- rust/src/detect/transforms/decompress.rs | 12 ++++++------ 1 file changed, 6 insertions(+), 6 deletions(-) diff --git a/rust/src/detect/transforms/decompress.rs b/rust/src/detect/transforms/decompress.rs index 110476be36..bf5d0aa95c 100644 --- a/rust/src/detect/transforms/decompress.rs +++ b/rust/src/detect/transforms/decompress.rs @@ -43,7 +43,7 @@ const ABSOLUTE_MAX_SIZE: u32 = 16 * 1024 * 1024; fn decompress_parse_do(s: &str) -> Option { let mut max_size_parsed = None; for p in s.split(',') { - let kv: Vec<&str> = p.split('=').collect(); + let kv: Vec<&str> = p.split(' ').collect(); if kv.len() != 2 { SCLogError!("Bad key value for decompress transform {}", p); return None; @@ -257,12 +257,12 @@ mod tests { #[test] fn test_decompress_parse() { assert!(decompress_parse_do("keywithoutvalue").is_none()); - assert!(decompress_parse_do("unknown=1").is_none()); - assert!(decompress_parse_do("max-size=0").is_none()); - assert!(decompress_parse_do("max-size=1,max-size=1").is_none()); - assert!(decompress_parse_do("max-size=toto").is_none()); + assert!(decompress_parse_do("unknown 1").is_none()); + assert!(decompress_parse_do("max-size 0").is_none()); + assert!(decompress_parse_do("max-size 1,max-size 1").is_none()); + assert!(decompress_parse_do("max-size toto").is_none()); assert_eq!( - decompress_parse_do("max-size=1MiB"), + decompress_parse_do("max-size 1MiB"), Some(DetectTransformDecompressData { max_size: 1024 * 1024 })