From e09fa43ba53af63c5e9969d3f9ce5b150a5ea6a2 Mon Sep 17 00:00:00 2001 From: Eric Leblond Date: Mon, 18 Feb 2019 22:59:01 +0100 Subject: [PATCH] detect-xbits: error on some invalid config --- src/detect-xbits.c | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) diff --git a/src/detect-xbits.c b/src/detect-xbits.c index c521076e30..e722193609 100644 --- a/src/detect-xbits.c +++ b/src/detect-xbits.c @@ -53,7 +53,7 @@ xbits:set,bitname,track ip_pair,expire 60 */ -#define PARSE_REGEX "([a-z]+)" "(?:,\\s*([^,]+))?" "(?:,\\s*(?:track\\s+([^,]+)))" "(?:,\\s*(?:expire\\s+([^,]+)))?" +#define PARSE_REGEX "^([a-z]+)" "(?:,\\s*([^,]+))?" "(?:,\\s*(?:track\\s+([^,]+)))" "(?:,\\s*(?:expire\\s+([^,]+)))?" static pcre *parse_regex; static pcre_extra *parse_regex_study; @@ -528,6 +528,10 @@ static int XBitsTestSig02(void) "alert ip any any -> any any (xbits:toggle,abc,track ip_dst; content:\"GET \"; sid:5;)"); FAIL_IF_NULL(s); + s = DetectEngineAppendSig(de_ctx, + "alert ip any any -> any any (xbits:!set,abc,track ip_dst; content:\"GET \"; sid:6;)"); + FAIL_IF_NOT_NULL(s); + DetectEngineCtxFree(de_ctx); PASS; }