@ -47,6 +47,7 @@ static pcre_extra *parse_regex_study;
int DetectEngineEventMatch ( ThreadVars * , DetectEngineThreadCtx * , Packet * , Signature * , SigMatch * ) ;
int DetectEngineEventMatch ( ThreadVars * , DetectEngineThreadCtx * , Packet * , Signature * , SigMatch * ) ;
static int DetectEngineEventSetup ( DetectEngineCtx * , Signature * , char * ) ;
static int DetectEngineEventSetup ( DetectEngineCtx * , Signature * , char * ) ;
static int DetectStreamEventSetup ( DetectEngineCtx * , Signature * , char * ) ;
void EngineEventRegisterTests ( void ) ;
void EngineEventRegisterTests ( void ) ;
@ -67,6 +68,13 @@ void DetectEngineEventRegister (void) {
sigmatch_table [ DETECT_DECODE_EVENT ] . Free = NULL ;
sigmatch_table [ DETECT_DECODE_EVENT ] . Free = NULL ;
sigmatch_table [ DETECT_DECODE_EVENT ] . flags | = SIGMATCH_DEONLY_COMPAT ;
sigmatch_table [ DETECT_DECODE_EVENT ] . flags | = SIGMATCH_DEONLY_COMPAT ;
sigmatch_table [ DETECT_STREAM_EVENT ] . name = " stream-event " ;
sigmatch_table [ DETECT_STREAM_EVENT ] . Match = DetectEngineEventMatch ;
sigmatch_table [ DETECT_STREAM_EVENT ] . Setup = DetectStreamEventSetup ;
sigmatch_table [ DETECT_STREAM_EVENT ] . Free = NULL ;
sigmatch_table [ DETECT_STREAM_EVENT ] . flags | = SIGMATCH_DEONLY_COMPAT ;
const char * eb ;
const char * eb ;
int eo ;
int eo ;
int opts = 0 ;
int opts = 0 ;
@ -207,6 +215,7 @@ error:
return - 1 ;
return - 1 ;
}
}
/**
/**
* \ brief this function will free memory associated with DetectEngineEventData
* \ brief this function will free memory associated with DetectEngineEventData
*
*
@ -216,6 +225,19 @@ void DetectEngineEventFree(DetectEngineEventData *de) {
if ( de ) SCFree ( de ) ;
if ( de ) SCFree ( de ) ;
}
}
/**
* \ brief this function Setup the ' stream - event ' keyword by resolving the alias
*/
static int DetectStreamEventSetup ( DetectEngineCtx * de_ctx , Signature * s , char * rawstr )
{
char srawstr [ MAX_SUBSTRINGS * 2 ] = " stream. " ;
/* stream:$EVENT alias command develop as decode-event:stream.$EVENT */
strncat ( srawstr , rawstr , 2 * MAX_SUBSTRINGS - strlen ( " stream. " ) - 1 ) ;
return DetectEngineEventSetup ( de_ctx , s , srawstr ) ;
}
/*
/*
* ONLY TESTS BELOW THIS COMMENT
* ONLY TESTS BELOW THIS COMMENT
*/
*/