diff --git a/rust/src/detect/uint.rs b/rust/src/detect/uint.rs index 7a8bc30d5a..8be54e7a75 100644 --- a/rust/src/detect/uint.rs +++ b/rust/src/detect/uint.rs @@ -79,6 +79,7 @@ pub struct DetectUintArrayData { fn parse_uint_index_precise(s: &str) -> IResult<&str, DetectUintIndex> { let (s, oob) = opt(tag("oob_or")).parse(s)?; + let (s, _explicit) = opt(tag("index")).parse(s)?; let (s, _) = opt(is_a(" ")).parse(s)?; let (s, i32_index) = nom_i32.parse(s)?; Ok(( @@ -91,7 +92,7 @@ fn parse_uint_index_precise(s: &str) -> IResult<&str, DetectUintIndex> { } fn parse_uint_index_nb(s: &str) -> IResult<&str, DetectUintIndex> { - let (s, _) = tag("nb").parse(s)?; + let (s, _) = alt((tag("nb"), tag("matches"))).parse(s)?; let (s, _) = opt(is_a(" ")).parse(s)?; let (s, du32) = detect_parse_uint::(s)?; Ok((s, DetectUintIndex::NumberMatches(du32))) @@ -1078,6 +1079,7 @@ fn parse_multi_index(s: &str) -> Option { "all_or_absent" => Some(DetectUintIndex::AllOrAbsent), "any" => Some(DetectUintIndex::Any), "absent_or" => Some(DetectUintIndex::OrAbsent), + "any_or_absent" => Some(DetectUintIndex::OrAbsent), // not only a literal, but some numeric value _ => return parse_uint_index_val(s), }