|
|
|
@ -703,10 +703,10 @@ static void DumpContent(JsonBuilder *js, const DetectContentData *cd)
|
|
|
|
|
jb_set_uint(js, "depth", cd->depth);
|
|
|
|
|
}
|
|
|
|
|
if (cd->flags & DETECT_CONTENT_DISTANCE) {
|
|
|
|
|
jb_set_uint(js, "distance", cd->distance);
|
|
|
|
|
jb_set_int(js, "distance", cd->distance);
|
|
|
|
|
}
|
|
|
|
|
if (cd->flags & DETECT_CONTENT_WITHIN) {
|
|
|
|
|
jb_set_uint(js, "within", cd->within);
|
|
|
|
|
jb_set_int(js, "within", cd->within);
|
|
|
|
|
}
|
|
|
|
|
jb_set_bool(js, "fast_pattern", cd->flags & DETECT_CONTENT_FAST_PATTERN);
|
|
|
|
|
jb_set_bool(js, "relative_next", cd->flags & DETECT_CONTENT_RELATIVE_NEXT);
|
|
|
|
@ -779,9 +779,9 @@ static void DumpMatches(RuleAnalyzer *ctx, JsonBuilder *js, const SigMatchData *
|
|
|
|
|
|
|
|
|
|
jb_open_object(js, "byte_jump");
|
|
|
|
|
jb_set_uint(js, "nbytes", cd->nbytes);
|
|
|
|
|
jb_set_uint(js, "offset", cd->offset);
|
|
|
|
|
jb_set_int(js, "offset", cd->offset);
|
|
|
|
|
jb_set_uint(js, "multiplier", cd->multiplier);
|
|
|
|
|
jb_set_uint(js, "post_offset", cd->post_offset);
|
|
|
|
|
jb_set_int(js, "post_offset", cd->post_offset);
|
|
|
|
|
switch (cd->base) {
|
|
|
|
|
case DETECT_BYTEJUMP_BASE_UNSET:
|
|
|
|
|
jb_set_string(js, "base", "unset");
|
|
|
|
@ -824,7 +824,7 @@ static void DumpMatches(RuleAnalyzer *ctx, JsonBuilder *js, const SigMatchData *
|
|
|
|
|
|
|
|
|
|
jb_open_object(js, "byte_test");
|
|
|
|
|
jb_set_uint(js, "nbytes", cd->nbytes);
|
|
|
|
|
jb_set_uint(js, "offset", cd->offset);
|
|
|
|
|
jb_set_int(js, "offset", cd->offset);
|
|
|
|
|
switch (cd->base) {
|
|
|
|
|
case DETECT_BYTETEST_BASE_UNSET:
|
|
|
|
|
jb_set_string(js, "base", "unset");
|
|
|
|
|