Add 'stream-event' keyword.

This patch adds an alias to the 'engine-event' keyword. It is now
possible to access to the stream events via the 'stream-event'
keyword. A simple transformation is done:
    stream-event:reassembly_segment_before_base_seq
is a shortcut for:
    engine-event:stream.reassembly_segment_before_base_seq
remotes/origin/master-1.1.x
Eric Leblond 15 years ago
parent eb0d4e4d8b
commit 3f153fb0da

@ -47,6 +47,7 @@ static pcre_extra *parse_regex_study;
int DetectEngineEventMatch (ThreadVars *, DetectEngineThreadCtx *, Packet *, Signature *, SigMatch *); int DetectEngineEventMatch (ThreadVars *, DetectEngineThreadCtx *, Packet *, Signature *, SigMatch *);
static int DetectEngineEventSetup (DetectEngineCtx *, Signature *, char *); static int DetectEngineEventSetup (DetectEngineCtx *, Signature *, char *);
static int DetectStreamEventSetup (DetectEngineCtx *, Signature *, char *);
void EngineEventRegisterTests(void); void EngineEventRegisterTests(void);
@ -67,6 +68,13 @@ void DetectEngineEventRegister (void) {
sigmatch_table[DETECT_DECODE_EVENT].Free = NULL; sigmatch_table[DETECT_DECODE_EVENT].Free = NULL;
sigmatch_table[DETECT_DECODE_EVENT].flags |= SIGMATCH_DEONLY_COMPAT; sigmatch_table[DETECT_DECODE_EVENT].flags |= SIGMATCH_DEONLY_COMPAT;
sigmatch_table[DETECT_STREAM_EVENT].name = "stream-event";
sigmatch_table[DETECT_STREAM_EVENT].Match = DetectEngineEventMatch;
sigmatch_table[DETECT_STREAM_EVENT].Setup = DetectStreamEventSetup;
sigmatch_table[DETECT_STREAM_EVENT].Free = NULL;
sigmatch_table[DETECT_STREAM_EVENT].flags |= SIGMATCH_DEONLY_COMPAT;
const char *eb; const char *eb;
int eo; int eo;
int opts = 0; int opts = 0;
@ -207,6 +215,7 @@ error:
return -1; return -1;
} }
/** /**
* \brief this function will free memory associated with DetectEngineEventData * \brief this function will free memory associated with DetectEngineEventData
* *
@ -216,6 +225,19 @@ void DetectEngineEventFree(DetectEngineEventData *de) {
if(de) SCFree(de); if(de) SCFree(de);
} }
/**
* \brief this function Setup the 'stream-event' keyword by resolving the alias
*/
static int DetectStreamEventSetup (DetectEngineCtx *de_ctx, Signature *s, char *rawstr)
{
char srawstr[MAX_SUBSTRINGS * 2] = "stream.";
/* stream:$EVENT alias command develop as decode-event:stream.$EVENT */
strncat(srawstr, rawstr, 2 * MAX_SUBSTRINGS - strlen("stream.") - 1);
return DetectEngineEventSetup (de_ctx, s, srawstr);
}
/* /*
* ONLY TESTS BELOW THIS COMMENT * ONLY TESTS BELOW THIS COMMENT
*/ */

@ -1013,6 +1013,7 @@ enum {
DETECT_ASN1, DETECT_ASN1,
DETECT_ENGINE_EVENT, DETECT_ENGINE_EVENT,
DETECT_STREAM_EVENT,
/* make sure this stays last */ /* make sure this stays last */
DETECT_TBLSIZE, DETECT_TBLSIZE,

Loading…
Cancel
Save