|
|
|
@ -56,9 +56,8 @@ static int DetectKrb5SNameSetup(DetectEngineCtx *de_ctx, Signature *s, const cha
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
static InspectionBuffer *GetKrb5SNameData(DetectEngineThreadCtx *det_ctx,
|
|
|
|
|
const DetectEngineTransforms *transforms,
|
|
|
|
|
Flow *_f, const struct Krb5PrincipalNameDataArgs *cbdata,
|
|
|
|
|
int list_id, bool first)
|
|
|
|
|
const DetectEngineTransforms *transforms, Flow *_f,
|
|
|
|
|
const struct Krb5PrincipalNameDataArgs *cbdata, int list_id)
|
|
|
|
|
{
|
|
|
|
|
SCEnter();
|
|
|
|
|
|
|
|
|
@ -66,7 +65,7 @@ static InspectionBuffer *GetKrb5SNameData(DetectEngineThreadCtx *det_ctx,
|
|
|
|
|
InspectionBufferMultipleForListGet(det_ctx, list_id, cbdata->local_id);
|
|
|
|
|
if (buffer == NULL)
|
|
|
|
|
return NULL;
|
|
|
|
|
if (!first && buffer->inspect != NULL)
|
|
|
|
|
if (buffer->initialized)
|
|
|
|
|
return buffer;
|
|
|
|
|
|
|
|
|
|
uint32_t b_len = 0;
|
|
|
|
@ -95,8 +94,8 @@ static uint8_t DetectEngineInspectKrb5SName(DetectEngineCtx *de_ctx, DetectEngin
|
|
|
|
|
|
|
|
|
|
while (1) {
|
|
|
|
|
struct Krb5PrincipalNameDataArgs cbdata = { local_id, txv, };
|
|
|
|
|
InspectionBuffer *buffer = GetKrb5SNameData(det_ctx,
|
|
|
|
|
transforms, f, &cbdata, engine->sm_list, false);
|
|
|
|
|
InspectionBuffer *buffer =
|
|
|
|
|
GetKrb5SNameData(det_ctx, transforms, f, &cbdata, engine->sm_list);
|
|
|
|
|
|
|
|
|
|
if (buffer == NULL || buffer->inspect == NULL)
|
|
|
|
|
break;
|
|
|
|
@ -149,8 +148,7 @@ static void PrefilterTxKrb5SName(DetectEngineThreadCtx *det_ctx, const void *pec
|
|
|
|
|
// loop until we get a NULL
|
|
|
|
|
|
|
|
|
|
struct Krb5PrincipalNameDataArgs cbdata = { local_id, txv };
|
|
|
|
|
InspectionBuffer *buffer = GetKrb5SNameData(det_ctx, ctx->transforms,
|
|
|
|
|
f, &cbdata, list_id, true);
|
|
|
|
|
InspectionBuffer *buffer = GetKrb5SNameData(det_ctx, ctx->transforms, f, &cbdata, list_id);
|
|
|
|
|
if (buffer == NULL)
|
|
|
|
|
break;
|
|
|
|
|
|
|
|
|
|