aiden
/
suricata
mirror of https://github.com/OISF/suricata
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

detect/content: pass START/END flags to inspection

Browse Source
pull/3246/head
Victor Julien 9 years ago
parent c8bd489aa1
commit d14e51a4aa
31 changed files with 82 additions and 57 deletions
Show Stats Download Patch File Download Diff File

2
src/detect-base64-data.c
Unescape Escape View File

@ -64,7 +64,7 @@ int DetectBase64DataDoMatch(DetectEngineCtx *de_ctx,
if (det_ctx->base64_decoded_len) {
return DetectEngineContentInspection(de_ctx, det_ctx, s,
s->sm_arrays[DETECT_SM_LIST_BASE64_DATA], f, det_ctx->base64_decoded,
det_ctx->base64_decoded_len, 0,
det_ctx->base64_decoded_len, 0, DETECT_CI_FLAGS_SINGLE,
DETECT_ENGINE_CONTENT_INSPECTION_MODE_STATE, NULL);
}

2
src/detect-dce-stub-data.c
Unescape Escape View File

@ -181,7 +181,7 @@ static int InspectEngineDceStubData(ThreadVars *tv,
int r = DetectEngineContentInspection(de_ctx, det_ctx, s, smd,
f,
buffer, buffer_len,
0,
0, DETECT_CI_FLAGS_SINGLE,
DETECT_ENGINE_CONTENT_INSPECTION_MODE_STATE,
dcerpc_state);
if (r == 1)

6
src/detect-dnp3.c
Unescape Escape View File

@ -154,12 +154,14 @@ static int DetectEngineInspectDNP3Data(ThreadVars *tv, DetectEngineCtx *de_ctx,
if (flags & STREAM_TOSERVER && tx->request_buffer != NULL) {
r = DetectEngineContentInspection(de_ctx, det_ctx, s,
smd, f, tx->request_buffer,
tx->request_buffer_len, 0, 0, NULL);
tx->request_buffer_len, 0, DETECT_CI_FLAGS_SINGLE,
DETECT_ENGINE_CONTENT_INSPECTION_MODE_STATE, NULL);
}
else if (flags & STREAM_TOCLIENT && tx->response_buffer != NULL) {
r = DetectEngineContentInspection(de_ctx, det_ctx, s,
smd, f, tx->response_buffer,
tx->response_buffer_len, 0, 0, NULL);
tx->response_buffer_len, 0, DETECT_CI_FLAGS_SINGLE,
DETECT_ENGINE_CONTENT_INSPECTION_MODE_STATE, NULL);
}
SCReturnInt(r);

4
src/detect-dns-query.c
Unescape Escape View File

@ -164,7 +164,7 @@ static int DetectEngineInspectDnsQuery(
f,
(uint8_t *)buffer->inspect,
buffer->inspect_len,
buffer->inspect_offset,
buffer->inspect_offset, DETECT_CI_FLAGS_SINGLE,
DETECT_ENGINE_CONTENT_INSPECTION_MODE_STATE, NULL);
if (match == 1) {
return DETECT_ENGINE_INSPECT_SIG_MATCH;
@ -190,7 +190,7 @@ static int DetectEngineInspectDnsQuery(
f,
(uint8_t *)buffer->inspect,
buffer->inspect_len,
buffer->inspect_offset,
buffer->inspect_offset, DETECT_CI_FLAGS_SINGLE,
DETECT_ENGINE_CONTENT_INSPECTION_MODE_STATE, NULL);
if (match == 1) {
return DETECT_ENGINE_INSPECT_SIG_MATCH;

33
src/detect-engine-content-inspection.c
Unescape Escape View File

@ -102,7 +102,7 @@ int DetectEngineContentInspection(DetectEngineCtx *de_ctx, DetectEngineThreadCtx
const Signature *s, const SigMatchData *smd,
Flow *f,
uint8_t *buffer, uint32_t buffer_len,
uint32_t stream_start_offset,
uint32_t stream_start_offset, uint8_t flags,
uint8_t inspection_mode, void *data)
{
SCEnter();
@ -332,7 +332,8 @@ int DetectEngineContentInspection(DetectEngineCtx *de_ctx, DetectEngineThreadCtx
* search for another occurence of this content and see
* if the others match then until we run out of matches */
int r = DetectEngineContentInspection(de_ctx, det_ctx, s, smd+1,
f, buffer, buffer_len, stream_start_offset, inspection_mode, data);
f, buffer, buffer_len, stream_start_offset, flags,
inspection_mode, data);
if (r == 1) {
SCReturnInt(1);
}
@ -435,7 +436,8 @@ int DetectEngineContentInspection(DetectEngineCtx *de_ctx, DetectEngineThreadCtx
* search for another occurence of this pcre and see
* if the others match, until we run out of matches */
r = DetectEngineContentInspection(de_ctx, det_ctx, s, smd+1,
f, buffer, buffer_len, stream_start_offset, inspection_mode, data);
f, buffer, buffer_len, stream_start_offset, flags,
inspection_mode, data);
if (r == 1) {
SCReturnInt(1);
}
@ -449,27 +451,27 @@ int DetectEngineContentInspection(DetectEngineCtx *de_ctx, DetectEngineThreadCtx
} else if (smd->type == DETECT_BYTETEST) {
DetectBytetestData *btd = (DetectBytetestData *)smd->ctx;
uint8_t flags = btd->flags;
uint8_t btflags = btd->flags;
int32_t offset = btd->offset;
uint64_t value = btd->value;
if (flags & DETECT_BYTETEST_OFFSET_BE) {
if (btflags & DETECT_BYTETEST_OFFSET_BE) {
offset = det_ctx->bj_values[offset];
}
if (flags & DETECT_BYTETEST_VALUE_BE) {
if (btflags & DETECT_BYTETEST_VALUE_BE) {
value = det_ctx->bj_values[value];
}
/* if we have dce enabled we will have to use the endianness
* specified by the dce header */
if (flags & DETECT_BYTETEST_DCE && data != NULL) {
if (btflags & DETECT_BYTETEST_DCE && data != NULL) {
DCERPCState *dcerpc_state = (DCERPCState *)data;
/* enable the endianness flag temporarily. once we are done
* processing we reset the flags to the original value*/
flags |= ((dcerpc_state->dcerpc.dcerpchdr.packed_drep[0] & 0x10) ?
btflags |= ((dcerpc_state->dcerpc.dcerpchdr.packed_drep[0] & 0x10) ?
DETECT_BYTETEST_LITTLE: 0);
}
if (DetectBytetestDoMatch(det_ctx, s, smd->ctx, buffer, buffer_len, flags,
if (DetectBytetestDoMatch(det_ctx, s, smd->ctx, buffer, buffer_len, btflags,
offset, value) != 1) {
goto no_match;
}
@ -478,25 +480,25 @@ int DetectEngineContentInspection(DetectEngineCtx *de_ctx, DetectEngineThreadCtx
} else if (smd->type == DETECT_BYTEJUMP) {
DetectBytejumpData *bjd = (DetectBytejumpData *)smd->ctx;
uint8_t flags = bjd->flags;
uint8_t bjflags = bjd->flags;
int32_t offset = bjd->offset;
if (flags & DETECT_BYTEJUMP_OFFSET_BE) {
if (bjflags & DETECT_BYTEJUMP_OFFSET_BE) {
offset = det_ctx->bj_values[offset];
}
/* if we have dce enabled we will have to use the endianness
* specified by the dce header */
if (flags & DETECT_BYTEJUMP_DCE && data != NULL) {
if (bjflags & DETECT_BYTEJUMP_DCE && data != NULL) {
DCERPCState *dcerpc_state = (DCERPCState *)data;
/* enable the endianness flag temporarily. once we are done
* processing we reset the flags to the original value*/
flags |= ((dcerpc_state->dcerpc.dcerpchdr.packed_drep[0] & 0x10) ?
bjflags |= ((dcerpc_state->dcerpc.dcerpchdr.packed_drep[0] & 0x10) ?
DETECT_BYTEJUMP_LITTLE: 0);
}
if (DetectBytejumpDoMatch(det_ctx, s, smd->ctx, buffer, buffer_len,
flags, offset) != 1) {
bjflags, offset) != 1) {
goto no_match;
}
@ -604,7 +606,8 @@ match:
if (!smd->is_last) {
KEYWORD_PROFILING_END(det_ctx, smd->type, 1);
int r = DetectEngineContentInspection(de_ctx, det_ctx, s, smd+1,
f, buffer, buffer_len, stream_start_offset, inspection_mode, data);
f, buffer, buffer_len, stream_start_offset, flags,
inspection_mode, data);
SCReturnInt(r);
}
final_match:

11
src/detect-engine-content-inspection.h
Unescape Escape View File

@ -19,6 +19,7 @@
* \file
*
* \author Anoop Saldanha <anoopsaldanha@gmail.com>
* \author Victor Julien <victor@inliniac.net>
*/
#ifndef __DETECT_ENGINE_CONTENT_INSPECTION_H__
@ -33,11 +34,19 @@ enum {
DETECT_ENGINE_CONTENT_INSPECTION_MODE_STATE,
};
#define DETECT_CI_FLAGS_START BIT_U8(0) /**< unused, reserved for future use */
#define DETECT_CI_FLAGS_END BIT_U8(1) /**< indication that current buffer
* is the end of the data */
/** buffer is a single, non-streaming, buffer. Data sent to the content
* inspection function contains both start and end of the data. */
#define DETECT_CI_FLAGS_SINGLE (DETECT_CI_FLAGS_START|DETECT_CI_FLAGS_END)
int DetectEngineContentInspection(DetectEngineCtx *de_ctx, DetectEngineThreadCtx *det_ctx,
const Signature *s, const SigMatchData *smd,
Flow *f,
uint8_t *buffer, uint32_t buffer_len,
uint32_t stream_start_offset,
uint32_t stream_start_offset, uint8_t flags,
uint8_t inspection_mode, void *data);
void DetectEngineContentInspectionRegisterTests(void);

7
src/detect-engine-filedata.c
Unescape Escape View File

@ -162,6 +162,11 @@ int DetectEngineInspectFiledata(
if (buffer == NULL)
continue;
bool eof = (file->state == FILE_STATE_CLOSED);
uint8_t ciflags = eof ? DETECT_CI_FLAGS_END : 0;
if (buffer->inspect_offset == 0)
ciflags |= DETECT_CI_FLAGS_START;
det_ctx->buffer_offset = 0;
det_ctx->discontinue_matching = 0;
det_ctx->inspection_recursion_counter = 0;
@ -169,7 +174,7 @@ int DetectEngineInspectFiledata(
f,
(uint8_t *)buffer->inspect,
buffer->inspect_len,
buffer->inspect_offset,
buffer->inspect_offset, ciflags,
DETECT_ENGINE_CONTENT_INSPECTION_MODE_STATE, NULL);
if (match == 1) {
r = 1;

8
src/detect-engine-hcbd.c
Unescape Escape View File

@ -269,6 +269,7 @@ int DetectEngineInspectHttpClientBody(ThreadVars *tv,
HtpState *htp_state = (HtpState *)alstate;
uint32_t buffer_len = 0;
uint32_t stream_start_offset = 0;
const bool eof = (AppLayerParserGetStateProgress(IPPROTO_TCP, ALPROTO_HTTP, tx, flags) > HTP_REQUEST_BODY);
const uint8_t *buffer = DetectEngineHCBDGetBufferForTX(tx, tx_id,
de_ctx, det_ctx,
f, htp_state,
@ -278,6 +279,9 @@ int DetectEngineInspectHttpClientBody(ThreadVars *tv,
if (buffer_len == 0)
goto end;
uint8_t ci_flags = eof ? DETECT_CI_FLAGS_END : 0;
ci_flags |= (stream_start_offset == 0 ? DETECT_CI_FLAGS_START : 0);
det_ctx->buffer_offset = 0;
det_ctx->discontinue_matching = 0;
det_ctx->inspection_recursion_counter = 0;
@ -285,14 +289,14 @@ int DetectEngineInspectHttpClientBody(ThreadVars *tv,
f,
(uint8_t *)buffer,
buffer_len,
stream_start_offset,
stream_start_offset, ci_flags,
DETECT_ENGINE_CONTENT_INSPECTION_MODE_STATE, NULL);
if (r == 1)
return DETECT_ENGINE_INSPECT_SIG_MATCH;
end:
if (AppLayerParserGetStateProgress(IPPROTO_TCP, ALPROTO_HTTP, tx, flags) > HTP_REQUEST_BODY)
if (eof)
return DETECT_ENGINE_INSPECT_SIG_CANT_MATCH;
else
return DETECT_ENGINE_INSPECT_SIG_NO_MATCH;

2
src/detect-engine-hcd.c
Unescape Escape View File

@ -197,7 +197,7 @@ int DetectEngineInspectHttpCookie(ThreadVars *tv,
f,
(uint8_t *)bstr_ptr(h->value),
bstr_len(h->value),
0,
0, DETECT_CI_FLAGS_SINGLE,
DETECT_ENGINE_CONTENT_INSPECTION_MODE_STATE, NULL);
if (r == 1)
return DETECT_ENGINE_INSPECT_SIG_MATCH;

2
src/detect-engine-hhhd.c
Unescape Escape View File

@ -134,7 +134,7 @@ int DetectEngineInspectHttpHH(ThreadVars *tv,
int r = DetectEngineContentInspection(de_ctx, det_ctx, s, smd,
f,
hname, hname_len,
0,
0, DETECT_CI_FLAGS_SINGLE,
DETECT_ENGINE_CONTENT_INSPECTION_MODE_STATE, NULL);
if (r == 1)
return DETECT_ENGINE_INSPECT_SIG_MATCH;

2
src/detect-engine-hmd.c
Unescape Escape View File

@ -132,7 +132,7 @@ int DetectEngineInspectHttpMethod(ThreadVars *tv,
f,
(uint8_t *)bstr_ptr(tx->request_method),
bstr_len(tx->request_method),
0,
0, DETECT_CI_FLAGS_SINGLE,
DETECT_ENGINE_CONTENT_INSPECTION_MODE_STATE, NULL);
if (r == 1)
return DETECT_ENGINE_INSPECT_SIG_MATCH;

2
src/detect-engine-hrhd.c
Unescape Escape View File

@ -201,7 +201,7 @@ int DetectEngineInspectHttpRawHeader(ThreadVars *tv,
f,
headers_raw,
headers_raw_len,
0,
0, DETECT_CI_FLAGS_SINGLE,
DETECT_ENGINE_CONTENT_INSPECTION_MODE_STATE, NULL);
if (r == 1)
return DETECT_ENGINE_INSPECT_SIG_MATCH;

2
src/detect-engine-hrhhd.c
Unescape Escape View File

@ -157,7 +157,7 @@ int DetectEngineInspectHttpHRH(ThreadVars *tv,
int r = DetectEngineContentInspection(de_ctx, det_ctx, s, smd,
f,
hname, hname_len,
0,
0, DETECT_CI_FLAGS_SINGLE,
DETECT_ENGINE_CONTENT_INSPECTION_MODE_STATE, NULL);
if (r == 1)
return DETECT_ENGINE_INSPECT_SIG_MATCH;

2
src/detect-engine-hrud.c
Unescape Escape View File

@ -134,7 +134,7 @@ int DetectEngineInspectHttpRawUri(ThreadVars *tv,
f,
(uint8_t *)bstr_ptr(tx->request_uri),
bstr_len(tx->request_uri),
0,
0, DETECT_CI_FLAGS_SINGLE,
DETECT_ENGINE_CONTENT_INSPECTION_MODE_STATE, NULL);
if (r == 1)
return DETECT_ENGINE_INSPECT_SIG_MATCH;

2
src/detect-engine-hscd.c
Unescape Escape View File

@ -131,7 +131,7 @@ int DetectEngineInspectHttpStatCode(ThreadVars *tv,
f,
(uint8_t *)bstr_ptr(tx->response_status),
bstr_len(tx->response_status),
0,
0, DETECT_CI_FLAGS_SINGLE,
DETECT_ENGINE_CONTENT_INSPECTION_MODE_STATE, NULL);
if (r == 1)
return DETECT_ENGINE_INSPECT_SIG_MATCH;

2
src/detect-engine-hsmd.c
Unescape Escape View File

@ -131,7 +131,7 @@ int DetectEngineInspectHttpStatMsg(ThreadVars *tv,
f,
(uint8_t *)bstr_ptr(tx->response_message),
bstr_len(tx->response_message),
0,
0, DETECT_CI_FLAGS_SINGLE,
DETECT_ENGINE_CONTENT_INSPECTION_MODE_STATE, NULL);
if (r == 1)
return DETECT_ENGINE_INSPECT_SIG_MATCH;

2
src/detect-engine-hua.c
Unescape Escape View File

@ -140,7 +140,7 @@ int DetectEngineInspectHttpUA(ThreadVars *tv,
f,
(uint8_t *)bstr_ptr(h->value),
bstr_len(h->value),
0,
0, DETECT_CI_FLAGS_SINGLE,
DETECT_ENGINE_CONTENT_INSPECTION_MODE_STATE, NULL);
if (r == 1)
return DETECT_ENGINE_INSPECT_SIG_MATCH;

8
src/detect-engine-payload.c
Unescape Escape View File

@ -163,7 +163,7 @@ int DetectEngineInspectPacketPayload(DetectEngineCtx *de_ctx,
det_ctx->replist = NULL;
r = DetectEngineContentInspection(de_ctx, det_ctx, s, s->sm_arrays[DETECT_SM_LIST_PMATCH],
f, p->payload, p->payload_len, 0,
f, p->payload, p->payload_len, 0, DETECT_CI_FLAGS_SINGLE,
DETECT_ENGINE_CONTENT_INSPECTION_MODE_PAYLOAD, p);
if (r == 1) {
SCReturnInt(1);
@ -205,7 +205,7 @@ static int DetectEngineInspectStreamUDPPayload(DetectEngineCtx *de_ctx,
det_ctx->replist = NULL;
r = DetectEngineContentInspection(de_ctx, det_ctx, s, smd,
f, p->payload, p->payload_len, 0,
f, p->payload, p->payload_len, 0, DETECT_CI_FLAGS_SINGLE,
DETECT_ENGINE_CONTENT_INSPECTION_MODE_PAYLOAD, p);
if (r == 1) {
SCReturnInt(1);
@ -235,7 +235,7 @@ static int StreamContentInspectFunc(void *cb_data, const uint8_t *data, const ui
r = DetectEngineContentInspection(smd->de_ctx, smd->det_ctx,
smd->s, smd->s->sm_arrays[DETECT_SM_LIST_PMATCH],
smd->f, (uint8_t *)data, data_len, 0,
smd->f, (uint8_t *)data, data_len, 0, 0, //TODO
DETECT_ENGINE_CONTENT_INSPECTION_MODE_STREAM, NULL);
if (r == 1) {
SCReturnInt(1);
@ -293,7 +293,7 @@ static int StreamContentInspectEngineFunc(void *cb_data, const uint8_t *data, co
r = DetectEngineContentInspection(smd->de_ctx, smd->det_ctx,
smd->s, smd->smd,
smd->f, (uint8_t *)data, data_len, 0,
smd->f, (uint8_t *)data, data_len, 0, 0, // TODO
DETECT_ENGINE_CONTENT_INSPECTION_MODE_STREAM, NULL);
if (r == 1) {
SCReturnInt(1);

10
src/detect-engine-tls.c
Unescape Escape View File

@ -117,7 +117,7 @@ int DetectEngineInspectTlsSni(ThreadVars *tv,
buffer_len = strlen(ssl_state->client_connp.sni);
cnt = DetectEngineContentInspection(de_ctx, det_ctx, s, smd,
f, buffer, buffer_len, 0,
f, buffer, buffer_len, 0, DETECT_CI_FLAGS_SINGLE,
DETECT_ENGINE_CONTENT_INSPECTION_MODE_STATE, NULL);
return cnt;
@ -193,7 +193,7 @@ int DetectEngineInspectTlsIssuer(ThreadVars *tv,
buffer_len = strlen(ssl_state->server_connp.cert0_issuerdn);
cnt = DetectEngineContentInspection(de_ctx, det_ctx, s, smd,
f, buffer, buffer_len, 0,
f, buffer, buffer_len, 0, DETECT_CI_FLAGS_SINGLE,
DETECT_ENGINE_CONTENT_INSPECTION_MODE_STATE, NULL);
return cnt;
@ -269,7 +269,7 @@ int DetectEngineInspectTlsSubject(ThreadVars *tv,
buffer_len = strlen(ssl_state->server_connp.cert0_subject);
cnt = DetectEngineContentInspection(de_ctx, det_ctx, s, smd,
f, buffer, buffer_len, 0,
f, buffer, buffer_len, 0, DETECT_CI_FLAGS_SINGLE,
DETECT_ENGINE_CONTENT_INSPECTION_MODE_STATE, NULL);
return cnt;
@ -346,7 +346,7 @@ int DetectEngineInspectTlsSerial(ThreadVars *tv, DetectEngineCtx *de_ctx,
buffer_len = strlen(ssl_state->server_connp.cert0_serial);
cnt = DetectEngineContentInspection(de_ctx, det_ctx, s, smd,
f, buffer, buffer_len, 0,
f, buffer, buffer_len, 0, DETECT_CI_FLAGS_SINGLE,
DETECT_ENGINE_CONTENT_INSPECTION_MODE_STATE, NULL);
return cnt;
@ -424,7 +424,7 @@ int DetectEngineInspectTlsFingerprint(ThreadVars *tv, DetectEngineCtx *de_ctx,
buffer_len = strlen(ssl_state->server_connp.cert0_fingerprint);
cnt = DetectEngineContentInspection(de_ctx, det_ctx, s, smd,
f, buffer, buffer_len, 0,
f, buffer, buffer_len, 0, DETECT_CI_FLAGS_SINGLE,
DETECT_ENGINE_CONTENT_INSPECTION_MODE_STATE, NULL);
return cnt;

2
src/detect-engine-uri.c
Unescape Escape View File

@ -135,7 +135,7 @@ int DetectEngineInspectHttpUri(ThreadVars *tv,
f,
bstr_ptr(tx_ud->request_uri_normalized),
bstr_len(tx_ud->request_uri_normalized),
0,
0, DETECT_CI_FLAGS_SINGLE,
DETECT_ENGINE_CONTENT_INSPECTION_MODE_STATE, NULL);
if (r == 1) {
return DETECT_ENGINE_INSPECT_SIG_MATCH;

2
src/detect-engine.c
Unescape Escape View File

@ -1199,7 +1199,7 @@ int DetectEngineInspectBufferGeneric(
int r = DetectEngineContentInspection(de_ctx, det_ctx,
s, engine->smd,
f,
(uint8_t *)data, data_len, offset,
(uint8_t *)data, data_len, offset, DETECT_CI_FLAGS_SINGLE,
DETECT_ENGINE_CONTENT_INSPECTION_MODE_STATE, NULL);
if (r == 1) {
return DETECT_ENGINE_INSPECT_SIG_MATCH;

2
src/detect-http-header-names.c
Unescape Escape View File

@ -332,7 +332,7 @@ static int InspectEngineHttpHeaderNames(ThreadVars *tv,
int r = DetectEngineContentInspection(de_ctx, det_ctx, s, smd,
f,
buffer, buffer_len,
0,
0, DETECT_CI_FLAGS_SINGLE,
DETECT_ENGINE_CONTENT_INSPECTION_MODE_STATE, NULL);
if (r == 1)
return DETECT_ENGINE_INSPECT_SIG_MATCH;

2
src/detect-http-header.c
Unescape Escape View File

@ -331,7 +331,7 @@ static int DetectEngineInspectHttpHeader(ThreadVars *tv,
f,
buffer,
buffer_len,
0,
0, DETECT_CI_FLAGS_SINGLE,
DETECT_ENGINE_CONTENT_INSPECTION_MODE_STATE, NULL);
if (r == 1)
return DETECT_ENGINE_INSPECT_SIG_MATCH;

4
src/detect-http-headers-stub.h
Unescape Escape View File

@ -251,7 +251,7 @@ static int InspectEngineHttpRequestHeader(ThreadVars *tv,
int r = DetectEngineContentInspection(de_ctx, det_ctx, s, smd,
f,
buffer, buffer_len,
0,
0, DETECT_CI_FLAGS_SINGLE,
DETECT_ENGINE_CONTENT_INSPECTION_MODE_STATE, NULL);
if (r == 1)
return DETECT_ENGINE_INSPECT_SIG_MATCH;
@ -292,7 +292,7 @@ static int InspectEngineHttpResponseHeader(ThreadVars *tv,
int r = DetectEngineContentInspection(de_ctx, det_ctx, s, smd,
f,
buffer, buffer_len,
0,
0, DETECT_CI_FLAGS_SINGLE,
DETECT_ENGINE_CONTENT_INSPECTION_MODE_STATE, NULL);
if (r == 1)
return DETECT_ENGINE_INSPECT_SIG_MATCH;

2
src/detect-http-protocol.c
Unescape Escape View File

@ -180,7 +180,7 @@ static int InspectEngineHttpProtocol(ThreadVars *tv,
int r = DetectEngineContentInspection(de_ctx, det_ctx, s, smd,
f,
buffer, buffer_len,
0,
0, DETECT_CI_FLAGS_SINGLE,
DETECT_ENGINE_CONTENT_INSPECTION_MODE_STATE, NULL);
if (r == 1)
return DETECT_ENGINE_INSPECT_SIG_MATCH;

2
src/detect-http-response-line.c
Unescape Escape View File

@ -200,7 +200,7 @@ int DetectEngineInspectHttpResponseLine(ThreadVars *tv,
f,
bstr_ptr(tx->response_line),
bstr_len(tx->response_line),
0,
0, DETECT_CI_FLAGS_SINGLE,
DETECT_ENGINE_CONTENT_INSPECTION_MODE_STATE, NULL);
if (r == 1) {
return DETECT_ENGINE_INSPECT_SIG_MATCH;

2
src/detect-http-start.c
Unescape Escape View File

@ -269,7 +269,7 @@ static int InspectEngineHttpStart(ThreadVars *tv,
int r = DetectEngineContentInspection(de_ctx, det_ctx, s, smd,
f,
buffer, buffer_len,
0,
0, DETECT_CI_FLAGS_SINGLE,
DETECT_ENGINE_CONTENT_INSPECTION_MODE_STATE, NULL);
if (r == 1)
return DETECT_ENGINE_INSPECT_SIG_MATCH;

2
src/detect-ssh-proto.c
Unescape Escape View File

@ -161,7 +161,7 @@ static int InspectEngineSshProtocol(ThreadVars *tv,
int r = DetectEngineContentInspection(de_ctx, det_ctx, s, smd,
f,
buffer, buffer_len,
0,
0, DETECT_CI_FLAGS_SINGLE,
DETECT_ENGINE_CONTENT_INSPECTION_MODE_STATE, NULL);
if (r == 1)
return DETECT_ENGINE_INSPECT_SIG_MATCH;

2
src/detect-ssh-software.c
Unescape Escape View File

@ -161,7 +161,7 @@ static int InspectEngineSshSoftware(ThreadVars *tv,
int r = DetectEngineContentInspection(de_ctx, det_ctx, s, smd,
f,
buffer, buffer_len,
0,
0, DETECT_CI_FLAGS_SINGLE,
DETECT_ENGINE_CONTENT_INSPECTION_MODE_STATE, NULL);
if (r == 1)
return DETECT_ENGINE_INSPECT_SIG_MATCH;

6
src/detect-template-buffer.c
Unescape Escape View File

@ -97,12 +97,14 @@ static int DetectEngineInspectTemplateBuffer(ThreadVars *tv,
if (flags & STREAM_TOSERVER && tx->request_buffer != NULL) {
ret = DetectEngineContentInspection(de_ctx, det_ctx, s, smd,
f, tx->request_buffer, tx->request_buffer_len, 0,
f, tx->request_buffer, tx->request_buffer_len,
0, DETECT_CI_FLAGS_SINGLE,
DETECT_ENGINE_CONTENT_INSPECTION_MODE_STATE, NULL);
}
else if (flags & STREAM_TOCLIENT && tx->response_buffer != NULL) {
ret = DetectEngineContentInspection(de_ctx, det_ctx, s, smd,
f, tx->response_buffer, tx->response_buffer_len, 0,
f, tx->response_buffer, tx->response_buffer_len,
0, DETECT_CI_FLAGS_SINGLE,
DETECT_ENGINE_CONTENT_INSPECTION_MODE_STATE, NULL);
}

2
src/tests/detect-engine-content-inspection.c
Unescape Escape View File

@ -48,7 +48,7 @@
FAIL_IF_NULL(det_ctx); \
int r = DetectEngineContentInspection(de_ctx, det_ctx, \
s, s->sm_arrays[DETECT_SM_LIST_PMATCH], &f, \
(uint8_t *)(buf), (buflen), 0, \
(uint8_t *)(buf), (buflen), 0, DETECT_CI_FLAGS_SINGLE, \
DETECT_ENGINE_CONTENT_INSPECTION_MODE_PAYLOAD, NULL); \
FAIL_IF_NOT(r == (match)); \
FAIL_IF_NOT(det_ctx->inspection_recursion_counter == (steps)); \

Write Preview
Loading…
Cancel
Save