detect/bytemath: pass match ctx directly

Adjust includes to enable this.
pull/9999/head
Victor Julien 3 years ago committed by Victor Julien
parent e2fbcf9654
commit 53591702aa

@ -22,10 +22,11 @@
*/
#include "suricata-common.h"
#include "rust.h"
#include "detect-byte.h"
#include "detect-byte-extract.h"
#include "detect-bytemath.h"
#include "rust.h"
/**
* \brief Used to retrieve args from BM.
*

@ -29,21 +29,23 @@
#include "threads.h"
#include "decode.h"
#include "app-layer-parser.h"
#include "app-layer-protos.h"
#include "detect.h"
#include "detect-parse.h"
#include "detect-engine.h"
#include "detect-engine-mpm.h"
#include "detect-engine-state.h"
#include "detect-engine-build.h"
#include "rust-bindings.h"
#include "detect-content.h"
#include "detect-pcre.h"
#include "detect-byte.h"
#include "detect-bytemath.h"
#include "app-layer-parser.h"
#include "app-layer-protos.h"
#include "rust-bindings.h"
#include "flow.h"
#include "flow-var.h"
#include "flow-util.h"
@ -82,11 +84,10 @@ static inline bool DetectByteMathValidateNbytesOnly(const DetectByteMathData *da
(((data->flags & DETECT_BYTEMATH_FLAG_STRING) && nbytes <= 10) || (nbytes <= 4));
}
int DetectByteMathDoMatch(DetectEngineThreadCtx *det_ctx, const SigMatchData *smd,
int DetectByteMathDoMatch(DetectEngineThreadCtx *det_ctx, const DetectByteMathData *data,
const Signature *s, const uint8_t *payload, uint16_t payload_len, uint8_t nbytes,
uint64_t rvalue, uint64_t *value, uint8_t endian)
{
const DetectByteMathData *data = (DetectByteMathData *)smd->ctx;
if (payload_len == 0) {
return 0;
}

@ -27,7 +27,7 @@
void DetectBytemathRegister(void);
SigMatch *DetectByteMathRetrieveSMVar(const char *, const Signature *);
int DetectByteMathDoMatch(DetectEngineThreadCtx *, const SigMatchData *, const Signature *,
int DetectByteMathDoMatch(DetectEngineThreadCtx *, const DetectByteMathData *, const Signature *,
const uint8_t *, uint16_t, uint8_t, uint64_t, uint64_t *, uint8_t);
#endif /* __DETECT_BYTEMATH_H__ */

@ -25,12 +25,14 @@
#include "suricata-common.h"
#include "suricata.h"
#include "decode.h"
#include "detect.h"
#include "detect-engine.h"
#include "detect-parse.h"
#include "rust.h"
#include "detect-asn1.h"
#include "detect-content.h"
#include "detect-pcre.h"
@ -60,8 +62,6 @@
#include "util-unittest-helper.h"
#include "util-profiling.h"
#include "rust.h"
#ifdef HAVE_LUA
#include "util-lua.h"
#endif
@ -569,17 +569,16 @@ static int DetectEngineContentInspectionInternal(DetectEngineThreadCtx *det_ctx,
} else if (smd->type == DETECT_BYTEMATH) {
DetectByteMathData *bmd = (DetectByteMathData *)smd->ctx;
const DetectByteMathData *bmd = (const DetectByteMathData *)smd->ctx;
uint8_t endian = bmd->endian;
/* if we have dce enabled we will have to use the endianness
* specified by the dce header */
if ((bmd->flags & DETECT_BYTEMATH_FLAG_ENDIAN) && endian == (int)EndianDCE &&
flags & (DETECT_CI_FLAGS_DCE_LE | DETECT_CI_FLAGS_DCE_BE)) {
/* enable the endianness flag temporarily. once we are done
* processing we reset the flags to the original value*/
endian |= (uint8_t)((flags & DETECT_CI_FLAGS_DCE_LE) ? LittleEndian : BigEndian);
endian = (uint8_t)((flags & DETECT_CI_FLAGS_DCE_LE) ? LittleEndian : BigEndian);
}
uint64_t rvalue;
if (bmd->flags & DETECT_BYTEMATH_FLAG_RVALUE_VAR) {
@ -596,7 +595,7 @@ static int DetectEngineContentInspectionInternal(DetectEngineThreadCtx *det_ctx,
}
DEBUG_VALIDATE_BUG_ON(buffer_len > UINT16_MAX);
if (DetectByteMathDoMatch(det_ctx, smd, s, buffer, (uint16_t)buffer_len, nbytes, rvalue,
if (DetectByteMathDoMatch(det_ctx, bmd, s, buffer, (uint16_t)buffer_len, nbytes, rvalue,
&det_ctx->byte_values[bmd->local_id], endian) != 1) {
goto no_match;
}

@ -43,6 +43,8 @@
#include "detect-engine-threshold.h"
#include "detect-engine-prefilter.h"
#include "rust.h"
#include "detect-engine-payload.h"
#include "detect-engine-dcepayload.h"
#include "detect-dns-opcode.h"

Loading…
Cancel
Save