diff --git a/src/detect-parse.c b/src/detect-parse.c index ac58e575ea..4cb3510ebc 100644 --- a/src/detect-parse.c +++ b/src/detect-parse.c @@ -90,7 +90,7 @@ typedef struct SigDuplWrapper_ { #define CONFIG_OPTS 7 // action protocol src sp dir dst dp options -#define CONFIG_PCRE "^([A-z]+)\\s+([A-z0-9]+)\\s+([\\[\\]A-z0-9\\.\\:_\\$\\!\\-,\\/]+)\\s+([\\:A-z0-9_\\$\\!,]+)\\s+(-\\>|\\<\\>)\\s+([\\[\\]A-z0-9\\.\\:_\\$\\!\\-,/]+)\\s+([\\:A-z0-9_\\$\\!,]+)(?:\\s+\\((.*)?(?:\\s*)\\))?(?:(?:\\s*)\\n)?$" +#define CONFIG_PCRE "^([A-z]+)\\s+([A-z0-9]+)\\s+([\\[\\]A-z0-9\\.\\:_\\$\\!\\-,\\/]+)\\s+([\\:A-z0-9_\\$\\!,]+)\\s+(-\\>|\\<\\>)\\s+([\\[\\]A-z0-9\\.\\:_\\$\\!\\-,/]+)\\s+([\\:A-z0-9_\\$\\!,]+)(?:\\s+\\((.*)?(?:\\s*)\\))?(?:(?:\\s*)\\n)?\\s*$" #define OPTION_PARTS 3 #define OPTION_PCRE "^\\s*([A-z_0-9-\\.]+)(?:\\s*\\:\\s*(.*)(? any 80 (msg:\"Snort_Inline is blocking the http link\";) "); + if (s == NULL) { + printf("sig 1 didn't parse: "); + goto end; + } + + s = DetectEngineAppendSig(de_ctx, "drop tcp any any -> any 80 (msg:\"Snort_Inline is blocking the http link\"; sid:1;) "); + if (s == NULL) { + printf("sig 2 didn't parse: "); + goto end; + } + + result = 1; +end: + if (de_ctx != NULL) + DetectEngineCtxFree(de_ctx); + return result; +} + /** \test Direction operator validation (invalid) */ int SigParseBidirecTest06 (void) { int result = 1; @@ -2977,6 +3009,7 @@ void SigParseRegisterTests(void) { UtRegisterTest("SigParseTest08", SigParseTest08, 1); UtRegisterTest("SigParseTest09", SigParseTest09, 1); UtRegisterTest("SigParseTest10", SigParseTest10, 1); + UtRegisterTest("SigParseTest11", SigParseTest11, 1); UtRegisterTest("SigParseBidirecTest06", SigParseBidirecTest06, 1); UtRegisterTest("SigParseBidirecTest07", SigParseBidirecTest07, 1);