detect/stream_size: allow match on pseudo packets

Often used with stream content, which can be inspected with pseudo packets.
pull/11326/head
Victor Julien 10 months ago committed by Victor Julien
parent 6958efa2dc
commit 44d2e1aad7

@ -118,8 +118,6 @@ static int DetectStreamSizeMatchAux(const DetectStreamSizeData *sd, const TcpSes
static int DetectStreamSizeMatch(
DetectEngineThreadCtx *det_ctx, Packet *p, const Signature *s, const SigMatchCtx *ctx)
{
DEBUG_VALIDATE_BUG_ON(PKT_IS_PSEUDOPKT(p));
const DetectStreamSizeData *sd = (const DetectStreamSizeData *)ctx;
if (!(PacketIsTCP(p)))
@ -171,7 +169,6 @@ void DetectStreamSizeFree(DetectEngineCtx *de_ctx, void *ptr)
static void PrefilterPacketStreamsizeMatch(
DetectEngineThreadCtx *det_ctx, Packet *p, const void *pectx)
{
DEBUG_VALIDATE_BUG_ON(PKT_IS_PSEUDOPKT(p));
if (!(PacketIsTCP(p)))
return;
@ -214,9 +211,9 @@ static bool PrefilterPacketStreamSizeCompare(PrefilterPacketHeaderValue v, void
static int PrefilterSetupStreamSize(DetectEngineCtx *de_ctx, SigGroupHead *sgh)
{
return PrefilterSetupPacketHeader(de_ctx, sgh, DETECT_STREAM_SIZE,
SIG_MASK_REQUIRE_FLOW | SIG_MASK_REQUIRE_REAL_PKT, PrefilterPacketStreamSizeSet,
PrefilterPacketStreamSizeCompare, PrefilterPacketStreamsizeMatch);
return PrefilterSetupPacketHeader(de_ctx, sgh, DETECT_STREAM_SIZE, SIG_MASK_REQUIRE_FLOW,
PrefilterPacketStreamSizeSet, PrefilterPacketStreamSizeCompare,
PrefilterPacketStreamsizeMatch);
}
static bool PrefilterStreamSizeIsPrefilterable(const Signature *s)

Loading…
Cancel
Save