detect: register progress in inspect engines

Register required progress so we can stop inspecting as soon
as the progress isn't far enough yet.

src/detect-app-layer-event.c

@@ -75,10 +75,10 @@ void DetectAppLayerEventRegister(void)
         DetectAppLayerEventRegisterTests;
 
     DetectAppLayerInspectEngineRegister("app-layer-events",
-            ALPROTO_UNKNOWN, SIG_FLAG_TOSERVER,
+            ALPROTO_UNKNOWN, SIG_FLAG_TOSERVER, 0,
             DetectEngineAptEventInspect);
     DetectAppLayerInspectEngineRegister("app-layer-events",
-            ALPROTO_UNKNOWN, SIG_FLAG_TOCLIENT,
+            ALPROTO_UNKNOWN, SIG_FLAG_TOCLIENT, 0,
             DetectEngineAptEventInspect);
 
     DetectBufferTypeRegisterSetupCallback("app-layer-events",

src/detect-cipservice.c

@@ -59,10 +59,10 @@ void DetectCipServiceRegister(void)
             = DetectCipServiceRegisterTests;
 
     DetectAppLayerInspectEngineRegister("cip",
-            ALPROTO_ENIP, SIG_FLAG_TOSERVER,
+            ALPROTO_ENIP, SIG_FLAG_TOSERVER, 0,
             DetectEngineInspectCIP);
     DetectAppLayerInspectEngineRegister("cip",
-            ALPROTO_ENIP, SIG_FLAG_TOCLIENT,
+            ALPROTO_ENIP, SIG_FLAG_TOCLIENT, 0,
             DetectEngineInspectCIP);
 
     g_cip_buffer_id = DetectBufferTypeGetByName("cip");
@@ -313,10 +313,10 @@ void DetectEnipCommandRegister(void)
             = DetectEnipCommandRegisterTests;
 
     DetectAppLayerInspectEngineRegister("enip",
-            ALPROTO_ENIP, SIG_FLAG_TOSERVER,
+            ALPROTO_ENIP, SIG_FLAG_TOSERVER, 0,
             DetectEngineInspectENIP);
     DetectAppLayerInspectEngineRegister("enip",
-            ALPROTO_ENIP, SIG_FLAG_TOCLIENT,
+            ALPROTO_ENIP, SIG_FLAG_TOCLIENT, 0,
             DetectEngineInspectENIP);
 
     g_enip_buffer_id = DetectBufferTypeGetByName("enip");

src/detect-dce-iface.c

@@ -83,14 +83,14 @@ void DetectDceIfaceRegister(void)
     g_dce_generic_list_id = DetectBufferTypeRegister("dce_generic");
 
     DetectAppLayerInspectEngineRegister("dce_generic",
-            ALPROTO_DCERPC, SIG_FLAG_TOSERVER, InspectDceGeneric);
+            ALPROTO_DCERPC, SIG_FLAG_TOSERVER, 0, InspectDceGeneric);
     DetectAppLayerInspectEngineRegister("dce_generic",
-            ALPROTO_SMB, SIG_FLAG_TOSERVER, InspectDceGeneric);
+            ALPROTO_SMB, SIG_FLAG_TOSERVER, 0, InspectDceGeneric);
 
     DetectAppLayerInspectEngineRegister("dce_generic",
-            ALPROTO_DCERPC, SIG_FLAG_TOCLIENT, InspectDceGeneric);
+            ALPROTO_DCERPC, SIG_FLAG_TOCLIENT, 0, InspectDceGeneric);
     DetectAppLayerInspectEngineRegister("dce_generic",
-            ALPROTO_SMB, SIG_FLAG_TOCLIENT, InspectDceGeneric);
+            ALPROTO_SMB, SIG_FLAG_TOCLIENT, 0, InspectDceGeneric);
 }
 
 static int InspectDceGeneric(ThreadVars *tv,

src/detect-dce-stub-data.c

@@ -207,17 +207,17 @@ void DetectDceStubDataRegister(void)
             PrefilterTxDceStubDataResponseRegister);
 
     DetectAppLayerInspectEngineRegister(BUFFER_NAME,
-            ALPROTO_DCERPC, SIG_FLAG_TOSERVER,
+            ALPROTO_DCERPC, SIG_FLAG_TOSERVER, 0,
             InspectEngineDceStubData);
     DetectAppLayerInspectEngineRegister(BUFFER_NAME,
-            ALPROTO_DCERPC, SIG_FLAG_TOCLIENT,
+            ALPROTO_DCERPC, SIG_FLAG_TOCLIENT, 0,
             InspectEngineDceStubData);
 
     DetectAppLayerInspectEngineRegister(BUFFER_NAME,
-            ALPROTO_SMB, SIG_FLAG_TOSERVER,
+            ALPROTO_SMB, SIG_FLAG_TOSERVER, 0,
             InspectEngineDceStubData);
     DetectAppLayerInspectEngineRegister(BUFFER_NAME,
-            ALPROTO_SMB, SIG_FLAG_TOCLIENT,
+            ALPROTO_SMB, SIG_FLAG_TOCLIENT, 0,
             InspectEngineDceStubData);
 
     g_dce_stub_data_buffer_id = DetectBufferTypeGetByName(BUFFER_NAME);

src/detect-dnp3.c

@@ -545,10 +545,10 @@ static void DetectDNP3DataRegister(void)
     sigmatch_table[DETECT_AL_DNP3DATA].flags |= SIGMATCH_NOOPT;
 
     DetectAppLayerInspectEngineRegister("dnp3_data",
-            ALPROTO_DNP3, SIG_FLAG_TOSERVER,
+            ALPROTO_DNP3, SIG_FLAG_TOSERVER, 0,
             DetectEngineInspectDNP3Data);
     DetectAppLayerInspectEngineRegister("dnp3_data",
-            ALPROTO_DNP3, SIG_FLAG_TOCLIENT,
+            ALPROTO_DNP3, SIG_FLAG_TOCLIENT, 0,
             DetectEngineInspectDNP3Data);
 
     g_dnp3_data_buffer_id = DetectBufferTypeGetByName("dnp3_data");
@@ -565,10 +565,10 @@ void DetectDNP3Register(void)
 
     /* Register the list of func, ind and obj. */
     DetectAppLayerInspectEngineRegister("dnp3",
-            ALPROTO_DNP3, SIG_FLAG_TOSERVER,
+            ALPROTO_DNP3, SIG_FLAG_TOSERVER, 0,
             DetectEngineInspectDNP3);
     DetectAppLayerInspectEngineRegister("dnp3",
-            ALPROTO_DNP3, SIG_FLAG_TOCLIENT,
+            ALPROTO_DNP3, SIG_FLAG_TOCLIENT, 0,
             DetectEngineInspectDNP3);
 
     g_dnp3_match_buffer_id = DetectBufferTypeRegister("dnp3");

src/detect-dns-query.c

@@ -80,7 +80,7 @@ void DetectDnsQueryRegister (void)
             PrefilterTxDnsQueryRegister);
 
     DetectAppLayerInspectEngineRegister("dns_query",
-            ALPROTO_DNS, SIG_FLAG_TOSERVER,
+            ALPROTO_DNS, SIG_FLAG_TOSERVER, 1,
             DetectEngineInspectDnsQueryName);
 
     DetectBufferTypeSetDescriptionByName("dns_query",
@@ -90,10 +90,10 @@ void DetectDnsQueryRegister (void)
 
     /* register these generic engines from here for now */
     DetectAppLayerInspectEngineRegister("dns_request",
-            ALPROTO_DNS, SIG_FLAG_TOSERVER,
+            ALPROTO_DNS, SIG_FLAG_TOSERVER, 1,
             DetectEngineInspectDnsRequest);
     DetectAppLayerInspectEngineRegister("dns_response",
-            ALPROTO_DNS, SIG_FLAG_TOCLIENT,
+            ALPROTO_DNS, SIG_FLAG_TOCLIENT, 1,
             DetectEngineInspectDnsResponse);
 
     DetectBufferTypeSetDescriptionByName("dns_request",

src/detect-engine.c

@@ -101,7 +101,8 @@ static uint32_t DetectEngineTentantGetIdFromPcap(const void *ctx, const Packet *
 static DetectEngineAppInspectionEngine *g_app_inspect_engines = NULL;
 
 void DetectAppLayerInspectEngineRegister(const char *name,
-        AppProto alproto, uint32_t dir, InspectEngineFuncPtr Callback)
+        AppProto alproto, uint32_t dir,
+        int progress, InspectEngineFuncPtr Callback)
 {
     DetectBufferTypeRegister(name);
     int sm_list = DetectBufferTypeGetByName(name);
@@ -113,7 +114,7 @@ void DetectAppLayerInspectEngineRegister(const char *name,
         (Callback == NULL))
     {
         SCLogError(SC_ERR_INVALID_ARGUMENTS, "Invalid arguments");
-        exit(EXIT_FAILURE);
+        BUG_ON(1);
     }
 
     int direction;
@@ -131,6 +132,7 @@ void DetectAppLayerInspectEngineRegister(const char *name,
     new_engine->alproto = alproto;
     new_engine->dir = direction;
     new_engine->sm_list = sm_list;
+    new_engine->progress = progress;
     new_engine->Callback = Callback;
 
     if (g_app_inspect_engines == NULL) {

src/detect-engine.h

@@ -107,10 +107,12 @@ int DetectEngineInspectGenericList(ThreadVars *, const DetectEngineCtx *,
  * \param alproto App layer protocol for which we will register the engine.
  * \param direction The direction for the engine: SIG_FLAG_TOSERVER or
  *                  SIG_FLAG_TOCLIENT
+ * \param progress Minimal progress value for inspect engine to run
  * \param Callback The engine callback.
  */
 void DetectAppLayerInspectEngineRegister(const char *name,
-        AppProto alproto, uint32_t dir, InspectEngineFuncPtr Callback);
+        AppProto alproto, uint32_t dir,
+        int progress, InspectEngineFuncPtr Callback);
 
 int DetectEngineAppInspectionEngine2Signature(Signature *s);
 void DetectEngineAppInspectionEngineSignatureFree(Signature *s);

src/detect-file-data.c

@@ -71,10 +71,10 @@ void DetectFiledataRegister(void)
             PrefilterTxHttpResponseBodyRegister);
 
     DetectAppLayerInspectEngineRegister("file_data",
-            ALPROTO_HTTP, SIG_FLAG_TOCLIENT,
+            ALPROTO_HTTP, SIG_FLAG_TOCLIENT, HTP_RESPONSE_BODY,
             DetectEngineInspectHttpServerBody);
     DetectAppLayerInspectEngineRegister("file_data",
-            ALPROTO_SMTP, SIG_FLAG_TOSERVER,
+            ALPROTO_SMTP, SIG_FLAG_TOSERVER, 0,
             DetectEngineInspectSMTPFiledata);
 
     DetectBufferTypeRegisterSetupCallback("file_data",

src/detect-filename.c

@@ -73,14 +73,14 @@ void DetectFilenameRegister(void)
     sigmatch_table[DETECT_FILENAME].RegisterTests = DetectFilenameRegisterTests;
 
     DetectAppLayerInspectEngineRegister("files",
-            ALPROTO_HTTP, SIG_FLAG_TOSERVER,
+            ALPROTO_HTTP, SIG_FLAG_TOSERVER, HTP_REQUEST_BODY,
             DetectFileInspectHttp);
     DetectAppLayerInspectEngineRegister("files",
-            ALPROTO_HTTP, SIG_FLAG_TOCLIENT,
+            ALPROTO_HTTP, SIG_FLAG_TOCLIENT, HTP_RESPONSE_BODY,
             DetectFileInspectHttp);
 
     DetectAppLayerInspectEngineRegister("files",
-            ALPROTO_SMTP, SIG_FLAG_TOSERVER,
+            ALPROTO_SMTP, SIG_FLAG_TOSERVER, 0,
             DetectFileInspectSmtp);
 
     g_file_match_list_id = DetectBufferTypeGetByName("files");

src/detect-ftpbounce.c

@@ -76,7 +76,8 @@ void DetectFtpbounceRegister(void)
     g_ftp_request_list_id = DetectBufferTypeRegister("ftp_request");
 
     DetectAppLayerInspectEngineRegister("ftp_request",
-            ALPROTO_FTP, SIG_FLAG_TOSERVER, InspectFtpRequest);
+            ALPROTO_FTP, SIG_FLAG_TOSERVER, 0,
+            InspectFtpRequest);
 }
 
 static int InspectFtpRequest(ThreadVars *tv,

src/detect-http-client-body.c

@@ -83,7 +83,7 @@ void DetectHttpClientBodyRegister(void)
             PrefilterTxHttpRequestBodyRegister);
 
     DetectAppLayerInspectEngineRegister("http_client_body",
-            ALPROTO_HTTP, SIG_FLAG_TOSERVER,
+            ALPROTO_HTTP, SIG_FLAG_TOSERVER, HTP_REQUEST_BODY,
             DetectEngineInspectHttpClientBody);
 
     DetectBufferTypeSetDescriptionByName("http_client_body",

src/detect-http-cookie.c

@@ -88,10 +88,10 @@ void DetectHttpCookieRegister(void)
             PrefilterTxResponseCookieRegister);
 
     DetectAppLayerInspectEngineRegister("http_cookie",
-            ALPROTO_HTTP, SIG_FLAG_TOSERVER,
+            ALPROTO_HTTP, SIG_FLAG_TOSERVER, HTP_REQUEST_HEADERS,
             DetectEngineInspectHttpCookie);
     DetectAppLayerInspectEngineRegister("http_cookie",
-            ALPROTO_HTTP, SIG_FLAG_TOCLIENT,
+            ALPROTO_HTTP, SIG_FLAG_TOCLIENT, HTP_RESPONSE_HEADERS,
             DetectEngineInspectHttpCookie);
 
     DetectBufferTypeSetDescriptionByName("http_cookie",

src/detect-http-header-names.c

@@ -387,10 +387,10 @@ void DetectHttpHeaderNamesRegister(void)
             PrefilterTxHttpResponseHeaderNamesRegister);
 
     DetectAppLayerInspectEngineRegister(BUFFER_NAME,
-            ALPROTO_HTTP, SIG_FLAG_TOSERVER,
+            ALPROTO_HTTP, SIG_FLAG_TOSERVER, HTP_REQUEST_HEADERS,
             InspectEngineHttpHeaderNames);
     DetectAppLayerInspectEngineRegister(BUFFER_NAME,
-            ALPROTO_HTTP, SIG_FLAG_TOCLIENT,
+            ALPROTO_HTTP, SIG_FLAG_TOCLIENT, HTP_RESPONSE_HEADERS,
             InspectEngineHttpHeaderNames);
 
     DetectBufferTypeSetDescriptionByName(BUFFER_NAME,

src/detect-http-header.c

@@ -400,10 +400,10 @@ void DetectHttpHeaderRegister(void)
             PrefilterTxHttpResponseHeadersRegister);
 
     DetectAppLayerInspectEngineRegister("http_header",
-            ALPROTO_HTTP, SIG_FLAG_TOSERVER,
+            ALPROTO_HTTP, SIG_FLAG_TOSERVER, HTP_REQUEST_HEADERS,
             DetectEngineInspectHttpHeader);
     DetectAppLayerInspectEngineRegister("http_header",
-            ALPROTO_HTTP, SIG_FLAG_TOCLIENT,
+            ALPROTO_HTTP, SIG_FLAG_TOCLIENT, HTP_RESPONSE_HEADERS,
             DetectEngineInspectHttpHeader);
 
     DetectBufferTypeSetDescriptionByName("http_header",

src/detect-http-headers-stub.h

@@ -345,12 +345,12 @@ static void DetectHttpHeadersRegisterStub(void)
 #endif
 #ifdef KEYWORD_TOSERVER
     DetectAppLayerInspectEngineRegister(BUFFER_NAME,
-            ALPROTO_HTTP, SIG_FLAG_TOSERVER,
+            ALPROTO_HTTP, SIG_FLAG_TOSERVER, HTP_REQUEST_HEADERS,
             InspectEngineHttpRequestHeader);
 #endif
 #ifdef KEYWORD_TOCLIENT
     DetectAppLayerInspectEngineRegister(BUFFER_NAME,
-            ALPROTO_HTTP, SIG_FLAG_TOCLIENT,
+            ALPROTO_HTTP, SIG_FLAG_TOCLIENT, HTP_RESPONSE_HEADERS,
             InspectEngineHttpResponseHeader);
 #endif
 

src/detect-http-hh.c

@@ -84,7 +84,7 @@ void DetectHttpHHRegister(void)
             PrefilterTxHostnameRegister);
 
     DetectAppLayerInspectEngineRegister("http_host",
-            ALPROTO_HTTP, SIG_FLAG_TOSERVER,
+            ALPROTO_HTTP, SIG_FLAG_TOSERVER, HTP_REQUEST_HEADERS,
             DetectEngineInspectHttpHH);
 
     DetectBufferTypeSetDescriptionByName("http_host",

src/detect-http-hrh.c

@@ -83,7 +83,7 @@ void DetectHttpHRHRegister(void)
             PrefilterTxHostnameRawRegister);
 
     DetectAppLayerInspectEngineRegister("http_raw_host",
-            ALPROTO_HTTP, SIG_FLAG_TOSERVER,
+            ALPROTO_HTTP, SIG_FLAG_TOSERVER, HTP_REQUEST_HEADERS,
             DetectEngineInspectHttpHRH);
 
     DetectBufferTypeSetDescriptionByName("http_raw_host",

src/detect-http-method.c

@@ -85,7 +85,7 @@ void DetectHttpMethodRegister(void)
             PrefilterTxMethodRegister);
 
     DetectAppLayerInspectEngineRegister("http_method",
-            ALPROTO_HTTP, SIG_FLAG_TOSERVER,
+            ALPROTO_HTTP, SIG_FLAG_TOSERVER, HTP_REQUEST_LINE,
             DetectEngineInspectHttpMethod);
 
     DetectBufferTypeSetDescriptionByName("http_method",

src/detect-http-protocol.c

@@ -223,10 +223,10 @@ void DetectHttpProtocolRegister(void)
             PrefilterTxHttpResponseProtocolRegister);
 
     DetectAppLayerInspectEngineRegister(BUFFER_NAME,
-            ALPROTO_HTTP, SIG_FLAG_TOSERVER,
+            ALPROTO_HTTP, SIG_FLAG_TOSERVER, HTP_REQUEST_LINE,
             InspectEngineHttpProtocol);
     DetectAppLayerInspectEngineRegister(BUFFER_NAME,
-            ALPROTO_HTTP, SIG_FLAG_TOCLIENT,
+            ALPROTO_HTTP, SIG_FLAG_TOCLIENT, HTP_RESPONSE_LINE,
             InspectEngineHttpProtocol);
 
     DetectBufferTypeSetDescriptionByName(BUFFER_NAME,

src/detect-http-raw-header.c

@@ -86,10 +86,10 @@ void DetectHttpRawHeaderRegister(void)
             PrefilterTxResponseHeadersRawRegister);
 
     DetectAppLayerInspectEngineRegister("http_raw_header",
-            ALPROTO_HTTP, SIG_FLAG_TOSERVER,
+            ALPROTO_HTTP, SIG_FLAG_TOSERVER, HTP_REQUEST_HEADERS,
             DetectEngineInspectHttpRawHeader);
     DetectAppLayerInspectEngineRegister("http_raw_header",
-            ALPROTO_HTTP, SIG_FLAG_TOCLIENT,
+            ALPROTO_HTTP, SIG_FLAG_TOCLIENT, HTP_RESPONSE_HEADERS,
             DetectEngineInspectHttpRawHeader);
 
     DetectBufferTypeSetDescriptionByName("http_raw_header",

src/detect-http-raw-uri.c

@@ -78,7 +78,7 @@ void DetectHttpRawUriRegister(void)
             PrefilterTxRawUriRegister);
 
     DetectAppLayerInspectEngineRegister("http_raw_uri",
-            ALPROTO_HTTP, SIG_FLAG_TOSERVER,
+            ALPROTO_HTTP, SIG_FLAG_TOSERVER, HTP_REQUEST_LINE,
             DetectEngineInspectHttpRawUri);
 
     DetectBufferTypeSetDescriptionByName("http_raw_uri",

src/detect-http-request-line.c

@@ -88,7 +88,7 @@ void DetectHttpRequestLineRegister(void)
             PrefilterTxHttpRequestLineRegister);
 
     DetectAppLayerInspectEngineRegister("http_request_line",
-            ALPROTO_HTTP, SIG_FLAG_TOSERVER,
+            ALPROTO_HTTP, SIG_FLAG_TOSERVER, HTP_REQUEST_LINE,
             DetectEngineInspectHttpRequestLine);
 
     DetectBufferTypeSetDescriptionByName("http_request_line",

src/detect-http-response-line.c

@@ -88,7 +88,7 @@ void DetectHttpResponseLineRegister(void)
             PrefilterTxHttpResponseLineRegister);
 
     DetectAppLayerInspectEngineRegister("http_response_line",
-            ALPROTO_HTTP, SIG_FLAG_TOCLIENT,
+            ALPROTO_HTTP, SIG_FLAG_TOCLIENT, HTP_RESPONSE_LINE,
             DetectEngineInspectHttpResponseLine);
 
     DetectBufferTypeSetDescriptionByName("http_response_line",

src/detect-http-start.c

@@ -312,10 +312,10 @@ void DetectHttpStartRegister(void)
             PrefilterTxHttpResponseStartRegister);
 
     DetectAppLayerInspectEngineRegister(BUFFER_NAME,
-            ALPROTO_HTTP, SIG_FLAG_TOSERVER,
+            ALPROTO_HTTP, SIG_FLAG_TOSERVER, HTP_REQUEST_HEADERS,
             InspectEngineHttpStart);
     DetectAppLayerInspectEngineRegister(BUFFER_NAME,
-            ALPROTO_HTTP, SIG_FLAG_TOCLIENT,
+            ALPROTO_HTTP, SIG_FLAG_TOCLIENT, HTP_RESPONSE_HEADERS,
             InspectEngineHttpStart);
 
     DetectBufferTypeSetDescriptionByName(BUFFER_NAME,

src/detect-http-stat-code.c

@@ -87,7 +87,7 @@ void DetectHttpStatCodeRegister (void)
             PrefilterTxHttpStatCodeRegister);
 
     DetectAppLayerInspectEngineRegister("http_stat_code",
-            ALPROTO_HTTP, SIG_FLAG_TOCLIENT,
+            ALPROTO_HTTP, SIG_FLAG_TOCLIENT, HTP_RESPONSE_LINE,
             DetectEngineInspectHttpStatCode);
 
     DetectBufferTypeSetDescriptionByName("http_stat_code",

src/detect-http-stat-msg.c

@@ -87,7 +87,7 @@ void DetectHttpStatMsgRegister (void)
             PrefilterTxHttpStatMsgRegister);
 
     DetectAppLayerInspectEngineRegister("http_stat_msg",
-            ALPROTO_HTTP, SIG_FLAG_TOCLIENT,
+            ALPROTO_HTTP, SIG_FLAG_TOCLIENT, HTP_RESPONSE_LINE,
             DetectEngineInspectHttpStatMsg);
 
     DetectBufferTypeSetDescriptionByName("http_stat_msg",

src/detect-http-ua.c

@@ -84,7 +84,7 @@ void DetectHttpUARegister(void)
             PrefilterTxUARegister);
 
     DetectAppLayerInspectEngineRegister("http_user_agent",
-            ALPROTO_HTTP, SIG_FLAG_TOSERVER,
+            ALPROTO_HTTP, SIG_FLAG_TOSERVER, HTP_REQUEST_HEADERS,
             DetectEngineInspectHttpUA);
 
     DetectBufferTypeSetDescriptionByName("http_user_agent",

src/detect-http-uri.c

@@ -79,7 +79,8 @@ void DetectHttpUriRegister (void)
     DetectAppLayerMpmRegister("http_uri", SIG_FLAG_TOSERVER, 2,
             PrefilterTxUriRegister);
 
-    DetectAppLayerInspectEngineRegister("http_uri", ALPROTO_HTTP, SIG_FLAG_TOSERVER,
+    DetectAppLayerInspectEngineRegister("http_uri",
+            ALPROTO_HTTP, SIG_FLAG_TOSERVER, HTP_REQUEST_LINE,
             DetectEngineInspectHttpUri);
 
     DetectBufferTypeSetDescriptionByName("http_uri",

src/detect-lua.c

@@ -122,10 +122,10 @@ void DetectLuaRegister(void)
     g_smtp_generic_list_id = DetectBufferTypeRegister("smtp_generic");
 
     DetectAppLayerInspectEngineRegister("smtp_generic",
-            ALPROTO_SMTP, SIG_FLAG_TOSERVER,
+            ALPROTO_SMTP, SIG_FLAG_TOSERVER, 0,
             InspectSmtpGeneric);
     DetectAppLayerInspectEngineRegister("smtp_generic",
-            ALPROTO_SMTP, SIG_FLAG_TOCLIENT,
+            ALPROTO_SMTP, SIG_FLAG_TOCLIENT, 0,
             InspectSmtpGeneric);
 
 	SCLogDebug("registering lua rule option");

src/detect-modbus.c

@@ -414,10 +414,10 @@ void DetectModbusRegister(void)
             &access_parse_regex, &access_parse_regex_study);
 
     DetectAppLayerInspectEngineRegister("modbus",
-            ALPROTO_MODBUS, SIG_FLAG_TOSERVER,
+            ALPROTO_MODBUS, SIG_FLAG_TOSERVER, 0,
             DetectEngineInspectModbus);
     DetectAppLayerInspectEngineRegister("modbus",
-            ALPROTO_MODBUS, SIG_FLAG_TOCLIENT,
+            ALPROTO_MODBUS, SIG_FLAG_TOCLIENT, 0,
             DetectEngineInspectModbus);
 
     g_modbus_buffer_id = DetectBufferTypeGetByName("modbus");

src/detect-ssh-proto.c

@@ -195,10 +195,10 @@ void DetectSshProtocolRegister(void)
             PrefilterTxSshResponseProtocolRegister);
 
     DetectAppLayerInspectEngineRegister(BUFFER_NAME,
-            ALPROTO_SSH, SIG_FLAG_TOSERVER,
+            ALPROTO_SSH, SIG_FLAG_TOSERVER, SSH_STATE_BANNER_DONE,
             InspectEngineSshProtocol);
     DetectAppLayerInspectEngineRegister(BUFFER_NAME,
-            ALPROTO_SSH, SIG_FLAG_TOCLIENT,
+            ALPROTO_SSH, SIG_FLAG_TOCLIENT, SSH_STATE_BANNER_DONE,
             InspectEngineSshProtocol);
 
     DetectBufferTypeSetDescriptionByName(BUFFER_NAME,

src/detect-ssh-software-version.c

@@ -100,9 +100,11 @@ void DetectSshSoftwareVersionRegister(void)
     g_ssh_banner_list_id = DetectBufferTypeRegister("ssh_banner");
 
     DetectAppLayerInspectEngineRegister("ssh_banner",
-            ALPROTO_SSH, SIG_FLAG_TOSERVER, InspectSshBanner);
+            ALPROTO_SSH, SIG_FLAG_TOSERVER, SSH_STATE_BANNER_DONE,
+            InspectSshBanner);
     DetectAppLayerInspectEngineRegister("ssh_banner",
-            ALPROTO_SSH, SIG_FLAG_TOCLIENT, InspectSshBanner);
+            ALPROTO_SSH, SIG_FLAG_TOCLIENT, SSH_STATE_BANNER_DONE,
+            InspectSshBanner);
 }
 
 /**

src/detect-ssh-software.c

@@ -195,10 +195,10 @@ void DetectSshSoftwareRegister(void)
             PrefilterTxSshResponseSoftwareRegister);
 
     DetectAppLayerInspectEngineRegister(BUFFER_NAME,
-            ALPROTO_SSH, SIG_FLAG_TOSERVER,
+            ALPROTO_SSH, SIG_FLAG_TOSERVER, SSH_STATE_BANNER_DONE,
             InspectEngineSshSoftware);
     DetectAppLayerInspectEngineRegister(BUFFER_NAME,
-            ALPROTO_SSH, SIG_FLAG_TOCLIENT,
+            ALPROTO_SSH, SIG_FLAG_TOCLIENT, SSH_STATE_BANNER_DONE,
             InspectEngineSshSoftware);
 
     DetectBufferTypeSetDescriptionByName(BUFFER_NAME,

src/detect-ssl-state.c

@@ -94,10 +94,10 @@ void DetectSslStateRegister(void)
             "generic ssl/tls inspection");
 
     DetectAppLayerInspectEngineRegister("tls_generic",
-            ALPROTO_TLS, SIG_FLAG_TOSERVER,
+            ALPROTO_TLS, SIG_FLAG_TOSERVER, 0,
             InspectTlsGeneric);
     DetectAppLayerInspectEngineRegister("tls_generic",
-            ALPROTO_TLS, SIG_FLAG_TOCLIENT,
+            ALPROTO_TLS, SIG_FLAG_TOCLIENT, 0,
             InspectTlsGeneric);
 }
 

src/detect-template-buffer.c

@@ -59,10 +59,10 @@ void DetectTemplateBufferRegister(void)
 
     /* register inspect engines */
     DetectAppLayerInspectEngineRegister("template_buffer",
-            ALPROTO_TEMPLATE, SIG_FLAG_TOSERVER,
+            ALPROTO_TEMPLATE, SIG_FLAG_TOSERVER, 0,
             DetectEngineInspectTemplateBuffer);
     DetectAppLayerInspectEngineRegister("template_buffer",
-            ALPROTO_TEMPLATE, SIG_FLAG_TOCLIENT,
+            ALPROTO_TEMPLATE, SIG_FLAG_TOCLIENT, 0,
             DetectEngineInspectTemplateBuffer);
 
     g_template_buffer_id = DetectBufferTypeGetByName("template_buffer");

src/detect-tls-cert-issuer.c

@@ -76,7 +76,7 @@ void DetectTlsIssuerRegister(void)
             PrefilterTxTlsIssuerRegister);
 
     DetectAppLayerInspectEngineRegister("tls_cert_issuer",
-            ALPROTO_TLS, SIG_FLAG_TOCLIENT,
+            ALPROTO_TLS, SIG_FLAG_TOCLIENT, TLS_STATE_CERT_READY,
             DetectEngineInspectTlsIssuer);
 
     g_tls_cert_issuer_buffer_id = DetectBufferTypeGetByName("tls_cert_issuer");

src/detect-tls-cert-serial.c

@@ -76,7 +76,8 @@ void DetectTlsSerialRegister(void)
             PrefilterTxTlsSerialRegister);
 
     DetectAppLayerInspectEngineRegister("tls_cert_serial", ALPROTO_TLS,
-            SIG_FLAG_TOCLIENT, DetectEngineInspectTlsSerial);
+            SIG_FLAG_TOCLIENT, TLS_STATE_CERT_READY,
+            DetectEngineInspectTlsSerial);
 
     g_tls_cert_serial_buffer_id = DetectBufferTypeGetByName("tls_cert_serial");
 }

src/detect-tls-cert-subject.c

@@ -76,7 +76,7 @@ void DetectTlsSubjectRegister(void)
             PrefilterTxTlsSubjectRegister);
 
     DetectAppLayerInspectEngineRegister("tls_cert_subject",
-            ALPROTO_TLS, SIG_FLAG_TOCLIENT,
+            ALPROTO_TLS, SIG_FLAG_TOCLIENT, TLS_STATE_CERT_READY,
             DetectEngineInspectTlsSubject);
 
     g_tls_cert_subject_buffer_id = DetectBufferTypeGetByName("tls_cert_subject");

src/detect-tls-cert-validity.c

@@ -121,7 +121,7 @@ void DetectTlsValidityRegister (void)
     DetectSetupParseRegexes(PARSE_REGEX, &parse_regex, &parse_regex_study);
 
     DetectAppLayerInspectEngineRegister("tls_validity",
-            ALPROTO_TLS, SIG_FLAG_TOCLIENT,
+            ALPROTO_TLS, SIG_FLAG_TOCLIENT, TLS_STATE_CERT_READY,
             DetectEngineInspectTlsValidity);
 
     g_tls_validity_buffer_id = DetectBufferTypeGetByName("tls_validity");

src/detect-tls-sni.c

@@ -76,7 +76,7 @@ void DetectTlsSniRegister(void)
             PrefilterTxTlsSniRegister);
 
     DetectAppLayerInspectEngineRegister("tls_sni",
-            ALPROTO_TLS, SIG_FLAG_TOSERVER,
+            ALPROTO_TLS, SIG_FLAG_TOSERVER, 0,
             DetectEngineInspectTlsSni);
 
     g_tls_sni_buffer_id = DetectBufferTypeGetByName("tls_sni");

src/detect-tls.c

@@ -159,7 +159,7 @@ void DetectTlsRegister (void)
     g_tls_cert_list_id = DetectBufferTypeRegister("tls_cert");
 
     DetectAppLayerInspectEngineRegister("tls_cert",
-            ALPROTO_TLS, SIG_FLAG_TOCLIENT,
+            ALPROTO_TLS, SIG_FLAG_TOCLIENT, TLS_STATE_CERT_READY,
             InspectTlsCert);
 }
 

src/detect.h

@@ -334,7 +334,8 @@ typedef struct DetectEngineAppInspectionEngine_ {
     AppProto alproto;
     uint8_t dir;
     uint8_t id;     /**< per sig id used in state keeping */
-    int sm_list;
+    int16_t sm_list;
+    int16_t progress;
 
     /* \retval 0 No match.  Don't discontinue matching yet.  We need more data.
      *         1 Match.