content inspection: support transforms

Make sure content is applied to the transformed version of a buffer.

Support content with its modifiers, and also isdataat, pcre, bytetest
and bytejump.
pull/3246/head
Victor Julien 8 years ago
parent a499a44f7a
commit 313661451d

@ -517,6 +517,9 @@ static int DetectBytejumpSetup(DetectEngineCtx *de_ctx, Signature *s, const char
int sm_list;
if (s->init_data->list != DETECT_SM_LIST_NOTSET) {
if (DetectBufferGetActiveList(de_ctx, s) == -1)
goto error;
sm_list = s->init_data->list;
if (data->flags & DETECT_BYTEJUMP_RELATIVE) {

@ -444,6 +444,9 @@ static int DetectBytetestSetup(DetectEngineCtx *de_ctx, Signature *s, const char
int sm_list;
if (s->init_data->list != DETECT_SM_LIST_NOTSET) {
if (DetectBufferGetActiveList(de_ctx, s) == -1)
goto error;
sm_list = s->init_data->list;
if (data->flags & DETECT_BYTETEST_RELATIVE) {

@ -329,6 +329,9 @@ int DetectContentSetup(DetectEngineCtx *de_ctx, Signature *s, const char *conten
DetectContentPrint(cd);
if (DetectBufferGetActiveList(de_ctx, s) == -1)
goto error;
int sm_list = s->init_data->list;
if (sm_list == DETECT_SM_LIST_NOTSET) {
sm_list = DETECT_SM_LIST_PMATCH;

@ -217,6 +217,8 @@ int DetectIsdataatSetup (DetectEngineCtx *de_ctx, Signature *s, const char *isda
int sm_list;
if (s->init_data->list != DETECT_SM_LIST_NOTSET) {
if (DetectBufferGetActiveList(de_ctx, s) == -1)
return -1;
sm_list = s->init_data->list;
if (idad->flags & ISDATAAT_RELATIVE) {

@ -827,6 +827,9 @@ static int DetectPcreSetup (DetectEngineCtx *de_ctx, Signature *s, const char *r
int sm_list = -1;
if (s->init_data->list != DETECT_SM_LIST_NOTSET) {
if (DetectBufferGetActiveList(de_ctx, s) == -1)
goto error;
s->flags |= SIG_FLAG_APPLAYER;
sm_list = s->init_data->list;
} else {

Loading…
Cancel
Save