static void DetectAppLayerEventRegisterTests(void);
#endif
static void DetectAppLayerEventFree(DetectEngineCtx *, void *);
-static int DetectEngineAptEventInspect(ThreadVars *tv,
- DetectEngineCtx *de_ctx, DetectEngineThreadCtx *det_ctx,
- const Signature *s, const SigMatchData *smd,
- Flow *f, uint8_t flags, void *alstate,
- void *tx, uint64_t tx_id);
+static int DetectEngineAptEventInspect(DetectEngineCtx *de_ctx, DetectEngineThreadCtx *det_ctx,
+ const struct DetectEngineAppInspectionEngine_ *engine, const Signature *s, Flow *f,
+ uint8_t flags, void *alstate, void *tx, uint64_t tx_id);
static int g_applayer_events_list_id = 0;
/**
sigmatch_table[DETECT_AL_APP_LAYER_EVENT].RegisterTests =
DetectAppLayerEventRegisterTests;
#endif
- DetectAppLayerInspectEngineRegister("app-layer-events",
- ALPROTO_UNKNOWN, SIG_FLAG_TOSERVER, 0,
- DetectEngineAptEventInspect);
- DetectAppLayerInspectEngineRegister("app-layer-events",
- ALPROTO_UNKNOWN, SIG_FLAG_TOCLIENT, 0,
- DetectEngineAptEventInspect);
+
+ DetectAppLayerInspectEngineRegister2("app-layer-events", ALPROTO_UNKNOWN, SIG_FLAG_TOSERVER, 0,
+ DetectEngineAptEventInspect, NULL);
+ DetectAppLayerInspectEngineRegister2("app-layer-events", ALPROTO_UNKNOWN, SIG_FLAG_TOCLIENT, 0,
+ DetectEngineAptEventInspect, NULL);
g_applayer_events_list_id = DetectBufferTypeGetByName("app-layer-events");
}
-static int DetectEngineAptEventInspect(ThreadVars *tv,
- DetectEngineCtx *de_ctx, DetectEngineThreadCtx *det_ctx,
- const Signature *s, const SigMatchData *smd,
- Flow *f, uint8_t flags, void *alstate,
- void *tx, uint64_t tx_id)
+static int DetectEngineAptEventInspect(DetectEngineCtx *de_ctx, DetectEngineThreadCtx *det_ctx,
+ const struct DetectEngineAppInspectionEngine_ *engine, const Signature *s, Flow *f,
+ uint8_t flags, void *alstate, void *tx, uint64_t tx_id)
{
int r = 0;
const AppProto alproto = f->alproto;
if (decoder_events == NULL)
goto end;
+ SigMatchData *smd = engine->smd;
while (1) {
DetectAppLayerEventData *aled = (DetectAppLayerEventData *)smd->ctx;
KEYWORD_PROFILING_START;