*
* Returns "can't match" if depth is reached.
*/
-int DetectEngineInspectStream(ThreadVars *tv,
- DetectEngineCtx *de_ctx, DetectEngineThreadCtx *det_ctx,
- const Signature *s, const SigMatchData *smd,
- Flow *f, uint8_t flags, void *alstate, void *txv, uint64_t tx_id)
+int DetectEngineInspectStream(DetectEngineCtx *de_ctx, DetectEngineThreadCtx *det_ctx,
+ const struct DetectEngineAppInspectionEngine_ *engine, const Signature *s, Flow *f,
+ uint8_t flags, void *alstate, void *txv, uint64_t tx_id)
{
Packet *p = det_ctx->p; /* TODO: get rid of this HACK */
/* in certain sigs, e.g. 'alert dns', which apply to both tcp and udp
* we can get called for UDP. Then we simply inspect the packet payload */
if (p->proto == IPPROTO_UDP) {
- return DetectEngineInspectStreamUDPPayload(de_ctx, det_ctx, s, smd, f, p);
+ return DetectEngineInspectStreamUDPPayload(de_ctx, det_ctx, s, engine->smd, f, p);
/* for other non-TCP protocols we assume match */
} else if (p->proto != IPPROTO_TCP)
return DETECT_ENGINE_INSPECT_SIG_MATCH;
det_ctx->raw_stream_progress,
(s->flags & SIG_FLAG_FLUSH)?"true":"false");
uint64_t unused;
- struct StreamContentInspectEngineData inspect_data = { de_ctx, det_ctx, s, smd, f };
+ struct StreamContentInspectEngineData inspect_data = { de_ctx, det_ctx, s, engine->smd, f };
int match = StreamReassembleRaw(f->protoctx, p,
StreamContentInspectEngineFunc, &inspect_data,
&unused, ((s->flags & SIG_FLAG_FLUSH) != 0));
int DetectEngineInspectStreamPayload(DetectEngineCtx *,
DetectEngineThreadCtx *, const Signature *, Flow *,
Packet *);
-int DetectEngineInspectStream(ThreadVars *tv,
- DetectEngineCtx *de_ctx, DetectEngineThreadCtx *det_ctx,
- const Signature *s, const SigMatchData *smd,
- Flow *f, uint8_t flags, void *alstate, void *txv, uint64_t tx_id);
+int DetectEngineInspectStream(DetectEngineCtx *de_ctx, DetectEngineThreadCtx *det_ctx,
+ const struct DetectEngineAppInspectionEngine_ *engine, const Signature *s, Flow *f,
+ uint8_t flags, void *alstate, void *txv, uint64_t tx_id);
void PayloadRegisterTests(void);