http_response_line: register inspect engine from keyword

pull/2310/head
Victor Julien 9 years ago
parent 0feeb8d538
commit cc96fedb90

@ -72,8 +72,6 @@
#include "detect-uricontent.h"
#include "detect-engine-threshold.h"
#include "detect-http-response-line.h"
#include "detect-engine-loader.h"
#include "util-classification-config.h"
@ -216,9 +214,6 @@ void DetectEngineRegisterAppInspectionEngines(void)
{ ALPROTO_HTTP,
DETECT_SM_LIST_HSCDMATCH,
DetectEngineInspectHttpStatCode },
{ ALPROTO_HTTP,
DETECT_SM_LIST_HTTP_RESLINEMATCH,
DetectEngineInspectHttpResponseLine },
/* Modbus */
{ ALPROTO_MODBUS,
DETECT_SM_LIST_MODBUS_MATCH,

@ -64,6 +64,12 @@ int DetectHttpResponseLineSetup(DetectEngineCtx *, Signature *, char *);
void DetectHttpResponseLineRegisterTests(void);
void DetectHttpResponseLineFree(void *);
static int PrefilterTxHttpResponseLineRegister(SigGroupHead *sgh, MpmCtx *mpm_ctx);
static int DetectEngineInspectHttpResponseLine(ThreadVars *tv,
DetectEngineCtx *de_ctx,
DetectEngineThreadCtx *det_ctx,
Signature *s, Flow *f, uint8_t flags,
void *alstate,
void *txv, uint64_t tx_id);
/**
* \brief Registers the keyword handlers for the "http_response_line" keyword.
@ -84,6 +90,11 @@ void DetectHttpResponseLineRegister(void)
DetectMpmAppLayerRegister("http_response_line", SIG_FLAG_TOCLIENT,
DETECT_SM_LIST_HTTP_RESLINEMATCH, 2,
PrefilterTxHttpResponseLineRegister);
DetectAppLayerInspectEngineRegister(ALPROTO_HTTP, SIG_FLAG_TOCLIENT,
DETECT_SM_LIST_HTTP_RESLINEMATCH,
DetectEngineInspectHttpResponseLine);
return;
}

@ -24,12 +24,6 @@
#ifndef __DETECT_HTTP_RESPONSE_LINE_H__
#define __DETECT_HTTP_RESPONSE_LINE_H__
int DetectEngineInspectHttpResponseLine(ThreadVars *tv,
DetectEngineCtx *de_ctx,
DetectEngineThreadCtx *det_ctx,
Signature *s, Flow *f, uint8_t flags,
void *alstate,
void *txv, uint64_t tx_id);
void DetectHttpResponseLineRegister(void);
#endif /* __DETECT_HTTP_RESPONSE_LINE_H__ */

Loading…
Cancel
Save