From 0e1d47c87bc10aebe7616b2576aa0d0a03f44f25 Mon Sep 17 00:00:00 2001 From: Victor Julien Date: Thu, 2 May 2019 10:43:46 +0200 Subject: [PATCH] detect/http.method: minor cleanups --- src/detect-http-method.c | 15 ++++++++++----- 1 file changed, 10 insertions(+), 5 deletions(-) diff --git a/src/detect-http-method.c b/src/detect-http-method.c index 42b2247b8a..4095f8e6d9 100644 --- a/src/detect-http-method.c +++ b/src/detect-http-method.c @@ -1,4 +1,4 @@ -/* Copyright (C) 2007-2010 Open Information Security Foundation +/* Copyright (C) 2007-2019 Open Information Security Foundation * * You can copy, redistribute or modify this Program under the terms of * the GNU General Public License version 2 as published by the Free @@ -85,14 +85,15 @@ void DetectHttpMethodRegister(void) #ifdef UNITTESTS sigmatch_table[DETECT_AL_HTTP_METHOD].RegisterTests = DetectHttpMethodRegisterTests; #endif - sigmatch_table[DETECT_AL_HTTP_METHOD].flags |= SIGMATCH_NOOPT; + sigmatch_table[DETECT_AL_HTTP_METHOD].flags |= SIGMATCH_NOOPT|SIGMATCH_INFO_CONTENT_MODIFIER; + sigmatch_table[DETECT_AL_HTTP_METHOD].alternative = DETECT_HTTP_METHOD; /* http.method sticky buffer */ sigmatch_table[DETECT_HTTP_METHOD].name = "http.method"; sigmatch_table[DETECT_HTTP_METHOD].desc = "sticky buffer to match specifically and only on the HTTP method buffer"; sigmatch_table[DETECT_HTTP_METHOD].url = DOC_URL DOC_VERSION "/rules/http-keywords.html#http-method"; sigmatch_table[DETECT_HTTP_METHOD].Setup = DetectHttpMethodSetupSticky; - sigmatch_table[DETECT_HTTP_METHOD].flags |= SIGMATCH_NOOPT; + sigmatch_table[DETECT_HTTP_METHOD].flags |= SIGMATCH_NOOPT|SIGMATCH_INFO_STICKY_BUFFER; DetectAppLayerInspectEngineRegister2("http_method", ALPROTO_HTTP, SIG_FLAG_TOSERVER, HTP_REQUEST_LINE, @@ -143,8 +144,12 @@ static int DetectHttpMethodSetup(DetectEngineCtx *de_ctx, Signature *s, const ch */ static int DetectHttpMethodSetupSticky(DetectEngineCtx *de_ctx, Signature *s, const char *str) { - DetectBufferSetActiveList(s, g_http_method_buffer_id); - s->alproto = ALPROTO_HTTP; + if (DetectBufferSetActiveList(s, g_http_method_buffer_id) < 0) + return -1; + + if (DetectSignatureSetAppProto(s, ALPROTO_HTTP) < 0) + return -1; + return 0; }