detect-tls-cert-serial: add setup callback to uppercase content

Add setup callback that uppercase the content that follows
'tls_cert_serial'.

diff --git a/src/detect-tls-cert-serial.c b/src/detect-tls-cert-serial.c
index 6514ac5ef0a87c85d026d840b25565f32520c7cf..17a2e340e15bd02ba101aca8404c2593b143cf7c 100644 (file)
--- a/src/detect-tls-cert-serial.c
+++ b/src/detect-tls-cert-serial.c
@@ -60,6 +60,8 @@ static InspectionBuffer *GetData(DetectEngineThreadCtx *det_ctx,
         const DetectEngineTransforms *transforms,
         Flow *_f, const uint8_t _flow_flags,
         void *txv, const int list_id);
+static void DetectTlsSerialSetupCallback(const DetectEngineCtx *de_ctx,
+        Signature *s);
 static _Bool DetectTlsSerialValidateCallback(const Signature *s,
         const char **sigerror);
 static int g_tls_cert_serial_buffer_id = 0;
@@ -90,6 +92,9 @@ void DetectTlsSerialRegister(void)
     DetectBufferTypeSetDescriptionByName("tls_cert_serial",
             "TLS certificate serial number");
 
+    DetectBufferTypeRegisterSetupCallback("tls_cert_serial",
+            DetectTlsSerialSetupCallback);
+
     DetectBufferTypeRegisterValidateCallback("tls_cert_serial",
             DetectTlsSerialValidateCallback);
 
@@ -170,6 +175,36 @@ static _Bool DetectTlsSerialValidateCallback(const Signature *s,
     return TRUE;
 }
 
+static void DetectTlsSerialSetupCallback(const DetectEngineCtx *de_ctx,
+                                         Signature *s)
+{
+    SigMatch *sm = s->init_data->smlists[g_tls_cert_serial_buffer_id];
+    for ( ; sm != NULL; sm = sm->next)
+    {
+        if (sm->type != DETECT_CONTENT)
+            continue;
+
+        DetectContentData *cd = (DetectContentData *)sm->ctx;
+
+        _Bool changed = FALSE;
+        uint32_t u;
+        for (u = 0; u < cd->content_len; u++)
+        {
+            if (islower(cd->content[u])) {
+                cd->content[u] = toupper(cd->content[u]);
+                changed = TRUE;
+            }
+        }
+
+        /* recreate the context if changes were made */
+        if (changed) {
+            SpmDestroyCtx(cd->spm_ctx);
+            cd->spm_ctx = SpmInitCtx(cd->content, cd->content_len, 1,
+                                     de_ctx->spm_global_thread_ctx);
+        }
+    }
+}
+
 #ifdef UNITTESTS
 
 /**