detect-tls-cert-fingerprint: add setup callback to lowercase content

Add setup callback that lowercase the content that follows
'tls_cert_fingerprint'.

diff --git a/src/detect-tls-cert-fingerprint.c b/src/detect-tls-cert-fingerprint.c
index 25eb75a1ee02e66da368cbf51be0f0bb149fa183..4cb21271756db89baee5b46f528a9c8f18b9cc75 100644 (file)
--- a/src/detect-tls-cert-fingerprint.c
+++ b/src/detect-tls-cert-fingerprint.c
@@ -60,6 +60,8 @@ static InspectionBuffer *GetData(DetectEngineThreadCtx *det_ctx,
         const DetectEngineTransforms *transforms,
         Flow *_f, const uint8_t _flow_flags,
         void *txv, const int list_id);
+static void DetectTlsFingerprintSetupCallback(const DetectEngineCtx *de_ctx,
+        Signature *s);
 static _Bool DetectTlsFingerprintValidateCallback(const Signature *s,
         const char **sigerror);
 static int g_tls_cert_fingerprint_buffer_id = 0;
@@ -90,6 +92,9 @@ void DetectTlsFingerprintRegister(void)
     DetectBufferTypeSetDescriptionByName("tls_cert_fingerprint",
             "TLS certificate fingerprint");
 
+    DetectBufferTypeRegisterSetupCallback("tls_cert_fingerprint",
+            DetectTlsFingerprintSetupCallback);
+
     DetectBufferTypeRegisterValidateCallback("tls_cert_fingerprint",
             DetectTlsFingerprintValidateCallback);
 
@@ -181,6 +186,36 @@ static _Bool DetectTlsFingerprintValidateCallback(const Signature *s,
     return TRUE;
 }
 
+static void DetectTlsFingerprintSetupCallback(const DetectEngineCtx *de_ctx,
+                                              Signature *s)
+{
+    SigMatch *sm = s->init_data->smlists[g_tls_cert_fingerprint_buffer_id];
+    for ( ; sm != NULL; sm = sm->next)
+    {
+        if (sm->type != DETECT_CONTENT)
+            continue;
+
+        DetectContentData *cd = (DetectContentData *)sm->ctx;
+
+        _Bool changed = FALSE;
+        uint32_t u;
+        for (u = 0; u < cd->content_len; u++)
+        {
+            if (isupper(cd->content[u])) {
+                cd->content[u] = tolower(cd->content[u]);
+                changed = TRUE;
+            }
+        }
+
+        /* recreate the context if changes were made */
+        if (changed) {
+            SpmDestroyCtx(cd->spm_ctx);
+            cd->spm_ctx = SpmInitCtx(cd->content, cd->content_len, 1,
+                                     de_ctx->spm_global_thread_ctx);
+        }
+    }
+}
+
 #ifdef UNITTESTS
 
 /**