detect: app-event list in engine

pull/2559/head
Victor Julien 9 years ago
parent 747dbf92ce
commit f5adccba1d

@ -88,14 +88,13 @@ void DetectAppLayerEventRegister(void)
static int DetectEngineAptEventInspect(ThreadVars *tv,
DetectEngineCtx *de_ctx, DetectEngineThreadCtx *det_ctx,
const Signature *s, const SigMatch *smi,
const Signature *s, const SigMatch *sm,
Flow *f, uint8_t flags, void *alstate,
void *tx, uint64_t tx_id)
{
AppLayerDecoderEvents *decoder_events = NULL;
int r = 0;
AppProto alproto;
SigMatch *sm;
DetectAppLayerEventData *aled = NULL;
alproto = f->alproto;
@ -103,7 +102,7 @@ static int DetectEngineAptEventInspect(ThreadVars *tv,
if (decoder_events == NULL)
goto end;
for (sm = s->sm_lists[DETECT_SM_LIST_APP_EVENT]; sm != NULL; sm = sm->next) {
for ( ; sm != NULL; sm = sm->next) {
aled = (DetectAppLayerEventData *)sm->ctx;
KEYWORD_PROFILING_START;
if (AppLayerDecoderEventsIsEventSet(decoder_events, aled->event_id)) {

@ -198,6 +198,8 @@ int DetectEngineAppInspectionEngine2Signature(Signature *s)
case DETECT_SM_LIST_TLSSUBJECT_MATCH:
//case DETECT_SM_LIST_TLSVALIDITY_MATCH:
case DETECT_SM_LIST_APP_EVENT:
new_engine->sm = s->sm_lists[new_engine->sm_list];
s->sm_lists[new_engine->sm_list] = NULL;
s->sm_lists_tail[new_engine->sm_list] = NULL;

Loading…
Cancel
Save