detect/flowbits: remove DETECT_FLOWBITS_CMD_NOALERT

DETECT_FLOWBITS_CMD_NOALERT is misleading as it gives an impression that
noalert is a flowbit specific command that'll be used and dealt with at
some point but as soon as noalert is found in the rule lang, signature
flag for noalert is set and control is returned. It never gets added to
cmd of the flowbits object.
pull/10028/head
Shivani Bhardwaj 1 year ago committed by Victor Julien
parent 34858808c1
commit 75471dd69b

@ -285,7 +285,10 @@ int DetectFlowbitSetup (DetectEngineCtx *de_ctx, Signature *s, const char *rawst
} }
if (strcmp(fb_cmd_str,"noalert") == 0) { if (strcmp(fb_cmd_str,"noalert") == 0) {
fb_cmd = DETECT_FLOWBITS_CMD_NOALERT; if (strlen(fb_name) != 0)
goto error;
s->flags |= SIG_FLAG_NOALERT;
return 0;
} else if (strcmp(fb_cmd_str,"isset") == 0) { } else if (strcmp(fb_cmd_str,"isset") == 0) {
fb_cmd = DETECT_FLOWBITS_CMD_ISSET; fb_cmd = DETECT_FLOWBITS_CMD_ISSET;
} else if (strcmp(fb_cmd_str,"isnotset") == 0) { } else if (strcmp(fb_cmd_str,"isnotset") == 0) {
@ -302,11 +305,6 @@ int DetectFlowbitSetup (DetectEngineCtx *de_ctx, Signature *s, const char *rawst
} }
switch (fb_cmd) { switch (fb_cmd) {
case DETECT_FLOWBITS_CMD_NOALERT:
if (strlen(fb_name) != 0)
goto error;
s->flags |= SIG_FLAG_NOALERT;
return 0;
case DETECT_FLOWBITS_CMD_ISNOTSET: case DETECT_FLOWBITS_CMD_ISNOTSET:
case DETECT_FLOWBITS_CMD_ISSET: case DETECT_FLOWBITS_CMD_ISSET:
case DETECT_FLOWBITS_CMD_SET: case DETECT_FLOWBITS_CMD_SET:
@ -340,8 +338,7 @@ int DetectFlowbitSetup (DetectEngineCtx *de_ctx, Signature *s, const char *rawst
* and put it in the Signature. */ * and put it in the Signature. */
switch (fb_cmd) { switch (fb_cmd) {
/* case DETECT_FLOWBITS_CMD_NOALERT can't happen here */ /* noalert can't happen here */
case DETECT_FLOWBITS_CMD_ISNOTSET: case DETECT_FLOWBITS_CMD_ISNOTSET:
case DETECT_FLOWBITS_CMD_ISSET: case DETECT_FLOWBITS_CMD_ISSET:
/* checks, so packet list */ /* checks, so packet list */

@ -30,8 +30,7 @@
#define DETECT_FLOWBITS_CMD_UNSET 2 #define DETECT_FLOWBITS_CMD_UNSET 2
#define DETECT_FLOWBITS_CMD_ISNOTSET 3 #define DETECT_FLOWBITS_CMD_ISNOTSET 3
#define DETECT_FLOWBITS_CMD_ISSET 4 #define DETECT_FLOWBITS_CMD_ISSET 4
#define DETECT_FLOWBITS_CMD_NOALERT 5 #define DETECT_FLOWBITS_CMD_MAX 5
#define DETECT_FLOWBITS_CMD_MAX 6
typedef struct DetectFlowbitsData_ { typedef struct DetectFlowbitsData_ {
uint32_t idx; uint32_t idx;

Loading…
Cancel
Save