From a1613fecb4adf0b209022df2c49740af2b039673 Mon Sep 17 00:00:00 2001 From: Philippe Antoine Date: Thu, 16 Oct 2025 13:04:22 +0200 Subject: [PATCH] detect: tcp.flags rejects non-sensical values ignored flags are only meaningful for equal mode --- rust/src/detect/tcp.rs | 8 ++++++++ 1 file changed, 8 insertions(+) diff --git a/rust/src/detect/tcp.rs b/rust/src/detect/tcp.rs index d77e4852c7..c52c1081ca 100644 --- a/rust/src/detect/tcp.rs +++ b/rust/src/detect/tcp.rs @@ -64,6 +64,10 @@ pub fn tcp_flags_parse(s: &str) -> Option> { SCLogError!("Too many commas"); return None; } + if modifier != DetectBitflagModifier::Equal { + SCLogError!("Ignored flags are only meaningful with equal mode"); + return None; + } ignoring = true; } else if let Some(enum_val) = TcpFlag::from_str(vals) { let val = enum_val.into_u(); @@ -142,5 +146,9 @@ mod test { assert!(tcp_flags_parse("+S*").is_none()); let ctx = tcp_flags_parse("CE").unwrap(); assert_eq!(ctx.arg2, 0xC0); + assert!(tcp_flags_parse("A,A").is_none()); + assert!(tcp_flags_parse("+A,U").is_none()); + assert!(tcp_flags_parse("*A,U").is_none()); + assert!(tcp_flags_parse("-A,U").is_none()); } }