detect: register progress in inspect engines

Register required progress so we can stop inspecting as soon
as the progress isn't far enough yet.

diff --git a/src/detect-app-layer-event.c b/src/detect-app-layer-event.c
index 8658d3955e78582e27b2f54c233851d655bfdec5..b69ace9d8e944e7ac6d09fcdbf16373cdfef75e8 100644 (file)
--- a/src/detect-app-layer-event.c
+++ b/src/detect-app-layer-event.c
@@ -75,10 +75,10 @@ void DetectAppLayerEventRegister(void)
         DetectAppLayerEventRegisterTests;
 
     DetectAppLayerInspectEngineRegister("app-layer-events",
-            ALPROTO_UNKNOWN, SIG_FLAG_TOSERVER,
+            ALPROTO_UNKNOWN, SIG_FLAG_TOSERVER, 0,
             DetectEngineAptEventInspect);
     DetectAppLayerInspectEngineRegister("app-layer-events",
-            ALPROTO_UNKNOWN, SIG_FLAG_TOCLIENT,
+            ALPROTO_UNKNOWN, SIG_FLAG_TOCLIENT, 0,
             DetectEngineAptEventInspect);
 
     DetectBufferTypeRegisterSetupCallback("app-layer-events",

diff --git a/src/detect-cipservice.c b/src/detect-cipservice.c
index de9aa04c4028236359dbfa1e762031633246b863..b142d8d5581f90a648aac4e22a34f6997953801b 100644 (file)
--- a/src/detect-cipservice.c
+++ b/src/detect-cipservice.c
@@ -59,10 +59,10 @@ void DetectCipServiceRegister(void)
             = DetectCipServiceRegisterTests;
 
     DetectAppLayerInspectEngineRegister("cip",
-            ALPROTO_ENIP, SIG_FLAG_TOSERVER,
+            ALPROTO_ENIP, SIG_FLAG_TOSERVER, 0,
             DetectEngineInspectCIP);
     DetectAppLayerInspectEngineRegister("cip",
-            ALPROTO_ENIP, SIG_FLAG_TOCLIENT,
+            ALPROTO_ENIP, SIG_FLAG_TOCLIENT, 0,
             DetectEngineInspectCIP);
 
     g_cip_buffer_id = DetectBufferTypeGetByName("cip");
@@ -313,10 +313,10 @@ void DetectEnipCommandRegister(void)
             = DetectEnipCommandRegisterTests;
 
     DetectAppLayerInspectEngineRegister("enip",
-            ALPROTO_ENIP, SIG_FLAG_TOSERVER,
+            ALPROTO_ENIP, SIG_FLAG_TOSERVER, 0,
             DetectEngineInspectENIP);
     DetectAppLayerInspectEngineRegister("enip",
-            ALPROTO_ENIP, SIG_FLAG_TOCLIENT,
+            ALPROTO_ENIP, SIG_FLAG_TOCLIENT, 0,
             DetectEngineInspectENIP);
 
     g_enip_buffer_id = DetectBufferTypeGetByName("enip");

diff --git a/src/detect-dce-iface.c b/src/detect-dce-iface.c
index e1bf69d4dfc59f8e80bcafb1a83c2d8791801a80..dd37326e1f0959bc1174661352ed11e90a876ec0 100644 (file)
--- a/src/detect-dce-iface.c
+++ b/src/detect-dce-iface.c
@@ -83,14 +83,14 @@ void DetectDceIfaceRegister(void)
     g_dce_generic_list_id = DetectBufferTypeRegister("dce_generic");
 
     DetectAppLayerInspectEngineRegister("dce_generic",
-            ALPROTO_DCERPC, SIG_FLAG_TOSERVER, InspectDceGeneric);
+            ALPROTO_DCERPC, SIG_FLAG_TOSERVER, 0, InspectDceGeneric);
     DetectAppLayerInspectEngineRegister("dce_generic",
-            ALPROTO_SMB, SIG_FLAG_TOSERVER, InspectDceGeneric);
+            ALPROTO_SMB, SIG_FLAG_TOSERVER, 0, InspectDceGeneric);
 
     DetectAppLayerInspectEngineRegister("dce_generic",
-            ALPROTO_DCERPC, SIG_FLAG_TOCLIENT, InspectDceGeneric);
+            ALPROTO_DCERPC, SIG_FLAG_TOCLIENT, 0, InspectDceGeneric);
     DetectAppLayerInspectEngineRegister("dce_generic",
-            ALPROTO_SMB, SIG_FLAG_TOCLIENT, InspectDceGeneric);
+            ALPROTO_SMB, SIG_FLAG_TOCLIENT, 0, InspectDceGeneric);
 }
 
 static int InspectDceGeneric(ThreadVars *tv,

diff --git a/src/detect-dce-stub-data.c b/src/detect-dce-stub-data.c
index ee7275dede6e44a7c3e0d8ffb48a26eae6000d27..ea3d37624b7b22d96c11fb5917ca04bee7f003cb 100644 (file)
--- a/src/detect-dce-stub-data.c
+++ b/src/detect-dce-stub-data.c
@@ -207,17 +207,17 @@ void DetectDceStubDataRegister(void)
             PrefilterTxDceStubDataResponseRegister);
 
     DetectAppLayerInspectEngineRegister(BUFFER_NAME,
-            ALPROTO_DCERPC, SIG_FLAG_TOSERVER,
+            ALPROTO_DCERPC, SIG_FLAG_TOSERVER, 0,
             InspectEngineDceStubData);
     DetectAppLayerInspectEngineRegister(BUFFER_NAME,
-            ALPROTO_DCERPC, SIG_FLAG_TOCLIENT,
+            ALPROTO_DCERPC, SIG_FLAG_TOCLIENT, 0,
             InspectEngineDceStubData);
 
     DetectAppLayerInspectEngineRegister(BUFFER_NAME,
-            ALPROTO_SMB, SIG_FLAG_TOSERVER,
+            ALPROTO_SMB, SIG_FLAG_TOSERVER, 0,
             InspectEngineDceStubData);
     DetectAppLayerInspectEngineRegister(BUFFER_NAME,
-            ALPROTO_SMB, SIG_FLAG_TOCLIENT,
+            ALPROTO_SMB, SIG_FLAG_TOCLIENT, 0,
             InspectEngineDceStubData);
 
     g_dce_stub_data_buffer_id = DetectBufferTypeGetByName(BUFFER_NAME);

diff --git a/src/detect-dnp3.c b/src/detect-dnp3.c
index 153e151f8e238bc5be1af321db1001825068654a..e152ad92e0845b9b062e59bbda8d44dedcc0d539 100644 (file)
--- a/src/detect-dnp3.c
+++ b/src/detect-dnp3.c
@@ -545,10 +545,10 @@ static void DetectDNP3DataRegister(void)
     sigmatch_table[DETECT_AL_DNP3DATA].flags |= SIGMATCH_NOOPT;
 
     DetectAppLayerInspectEngineRegister("dnp3_data",
-            ALPROTO_DNP3, SIG_FLAG_TOSERVER,
+            ALPROTO_DNP3, SIG_FLAG_TOSERVER, 0,
             DetectEngineInspectDNP3Data);
     DetectAppLayerInspectEngineRegister("dnp3_data",
-            ALPROTO_DNP3, SIG_FLAG_TOCLIENT,
+            ALPROTO_DNP3, SIG_FLAG_TOCLIENT, 0,
             DetectEngineInspectDNP3Data);
 
     g_dnp3_data_buffer_id = DetectBufferTypeGetByName("dnp3_data");
@@ -565,10 +565,10 @@ void DetectDNP3Register(void)
 
     /* Register the list of func, ind and obj. */
     DetectAppLayerInspectEngineRegister("dnp3",
-            ALPROTO_DNP3, SIG_FLAG_TOSERVER,
+            ALPROTO_DNP3, SIG_FLAG_TOSERVER, 0,
             DetectEngineInspectDNP3);
     DetectAppLayerInspectEngineRegister("dnp3",
-            ALPROTO_DNP3, SIG_FLAG_TOCLIENT,
+            ALPROTO_DNP3, SIG_FLAG_TOCLIENT, 0,
             DetectEngineInspectDNP3);
 
     g_dnp3_match_buffer_id = DetectBufferTypeRegister("dnp3");

diff --git a/src/detect-dns-query.c b/src/detect-dns-query.c
index 7269df5fcc37e51a214a071abe8b8a9235ce29c8..e50fc03d3b8b422102f4739aecf612e790da9a1e 100644 (file)
--- a/src/detect-dns-query.c
+++ b/src/detect-dns-query.c
@@ -80,7 +80,7 @@ void DetectDnsQueryRegister (void)
             PrefilterTxDnsQueryRegister);
 
     DetectAppLayerInspectEngineRegister("dns_query",
-            ALPROTO_DNS, SIG_FLAG_TOSERVER,
+            ALPROTO_DNS, SIG_FLAG_TOSERVER, 1,
             DetectEngineInspectDnsQueryName);
 
     DetectBufferTypeSetDescriptionByName("dns_query",
@@ -90,10 +90,10 @@ void DetectDnsQueryRegister (void)
 
     /* register these generic engines from here for now */
     DetectAppLayerInspectEngineRegister("dns_request",
-            ALPROTO_DNS, SIG_FLAG_TOSERVER,
+            ALPROTO_DNS, SIG_FLAG_TOSERVER, 1,
             DetectEngineInspectDnsRequest);
     DetectAppLayerInspectEngineRegister("dns_response",
-            ALPROTO_DNS, SIG_FLAG_TOCLIENT,
+            ALPROTO_DNS, SIG_FLAG_TOCLIENT, 1,
             DetectEngineInspectDnsResponse);
 
     DetectBufferTypeSetDescriptionByName("dns_request",

diff --git a/src/detect-engine.c b/src/detect-engine.c
index c1fc09800aae4a45c545be5136cb64b930504517..d0be271119c9c788b96e9234a1ca658324d09664 100644 (file)
--- a/src/detect-engine.c
+++ b/src/detect-engine.c
@@ -101,7 +101,8 @@ static uint32_t DetectEngineTentantGetIdFromPcap(const void *ctx, const Packet *
 static DetectEngineAppInspectionEngine *g_app_inspect_engines = NULL;
 
 void DetectAppLayerInspectEngineRegister(const char *name,
-        AppProto alproto, uint32_t dir, InspectEngineFuncPtr Callback)
+        AppProto alproto, uint32_t dir,
+        int progress, InspectEngineFuncPtr Callback)
 {
     DetectBufferTypeRegister(name);
     int sm_list = DetectBufferTypeGetByName(name);
@@ -113,7 +114,7 @@ void DetectAppLayerInspectEngineRegister(const char *name,
         (Callback == NULL))
     {
         SCLogError(SC_ERR_INVALID_ARGUMENTS, "Invalid arguments");
-        exit(EXIT_FAILURE);
+        BUG_ON(1);
     }
 
     int direction;
@@ -131,6 +132,7 @@ void DetectAppLayerInspectEngineRegister(const char *name,
     new_engine->alproto = alproto;
     new_engine->dir = direction;
     new_engine->sm_list = sm_list;
+    new_engine->progress = progress;
     new_engine->Callback = Callback;
 
     if (g_app_inspect_engines == NULL) {

diff --git a/src/detect-engine.h b/src/detect-engine.h
index 590d4db6bfe820a2ed59787273f0bf018007f8e2..447042101402a649fd808433adf50e8f22320586 100644 (file)
--- a/src/detect-engine.h
+++ b/src/detect-engine.h
@@ -107,10 +107,12 @@ int DetectEngineInspectGenericList(ThreadVars *, const DetectEngineCtx *,
  * \param alproto App layer protocol for which we will register the engine.
  * \param direction The direction for the engine: SIG_FLAG_TOSERVER or
  *                  SIG_FLAG_TOCLIENT
+ * \param progress Minimal progress value for inspect engine to run
  * \param Callback The engine callback.
  */
 void DetectAppLayerInspectEngineRegister(const char *name,
-        AppProto alproto, uint32_t dir, InspectEngineFuncPtr Callback);
+        AppProto alproto, uint32_t dir,
+        int progress, InspectEngineFuncPtr Callback);
 
 int DetectEngineAppInspectionEngine2Signature(Signature *s);
 void DetectEngineAppInspectionEngineSignatureFree(Signature *s);

diff --git a/src/detect-file-data.c b/src/detect-file-data.c
index da9a011bc7ed3cb795aa0b5990c39b8c82f3a7a1..3c5e5b5d4183cfa4d4902a63afd1f7b4070b9f6c 100644 (file)
--- a/src/detect-file-data.c
+++ b/src/detect-file-data.c
@@ -71,10 +71,10 @@ void DetectFiledataRegister(void)
             PrefilterTxHttpResponseBodyRegister);
 
     DetectAppLayerInspectEngineRegister("file_data",
-            ALPROTO_HTTP, SIG_FLAG_TOCLIENT,
+            ALPROTO_HTTP, SIG_FLAG_TOCLIENT, HTP_RESPONSE_BODY,
             DetectEngineInspectHttpServerBody);
     DetectAppLayerInspectEngineRegister("file_data",
-            ALPROTO_SMTP, SIG_FLAG_TOSERVER,
+            ALPROTO_SMTP, SIG_FLAG_TOSERVER, 0,
             DetectEngineInspectSMTPFiledata);
 
     DetectBufferTypeRegisterSetupCallback("file_data",

diff --git a/src/detect-filename.c b/src/detect-filename.c
index fcfff9b3997f0517d2a97a57d79b691dc69a22af..d7ccde6201220892cd68bc6dfda4731041a1b475 100644 (file)
--- a/src/detect-filename.c
+++ b/src/detect-filename.c
@@ -73,14 +73,14 @@ void DetectFilenameRegister(void)
     sigmatch_table[DETECT_FILENAME].RegisterTests = DetectFilenameRegisterTests;
 
     DetectAppLayerInspectEngineRegister("files",
-            ALPROTO_HTTP, SIG_FLAG_TOSERVER,
+            ALPROTO_HTTP, SIG_FLAG_TOSERVER, HTP_REQUEST_BODY,
             DetectFileInspectHttp);
     DetectAppLayerInspectEngineRegister("files",
-            ALPROTO_HTTP, SIG_FLAG_TOCLIENT,
+            ALPROTO_HTTP, SIG_FLAG_TOCLIENT, HTP_RESPONSE_BODY,
             DetectFileInspectHttp);
 
     DetectAppLayerInspectEngineRegister("files",
-            ALPROTO_SMTP, SIG_FLAG_TOSERVER,
+            ALPROTO_SMTP, SIG_FLAG_TOSERVER, 0,
             DetectFileInspectSmtp);
 
     g_file_match_list_id = DetectBufferTypeGetByName("files");

diff --git a/src/detect-ftpbounce.c b/src/detect-ftpbounce.c
index 8e33aaf9d0dc46efe9cd93e45af3894459272aa1..0e595e582d75bd1c37edef7fb158893af8fe5c96 100644 (file)
--- a/src/detect-ftpbounce.c
+++ b/src/detect-ftpbounce.c
@@ -76,7 +76,8 @@ void DetectFtpbounceRegister(void)
     g_ftp_request_list_id = DetectBufferTypeRegister("ftp_request");
 
     DetectAppLayerInspectEngineRegister("ftp_request",
-            ALPROTO_FTP, SIG_FLAG_TOSERVER, InspectFtpRequest);
+            ALPROTO_FTP, SIG_FLAG_TOSERVER, 0,
+            InspectFtpRequest);
 }
 
 static int InspectFtpRequest(ThreadVars *tv,

diff --git a/src/detect-http-client-body.c b/src/detect-http-client-body.c
index d227890e218e45fbaf68f9c52d1136a79bb19634..c9da5d02473259ee3d1193ad43065b36993de2e3 100644 (file)
--- a/src/detect-http-client-body.c
+++ b/src/detect-http-client-body.c
@@ -83,7 +83,7 @@ void DetectHttpClientBodyRegister(void)
             PrefilterTxHttpRequestBodyRegister);
 
     DetectAppLayerInspectEngineRegister("http_client_body",
-            ALPROTO_HTTP, SIG_FLAG_TOSERVER,
+            ALPROTO_HTTP, SIG_FLAG_TOSERVER, HTP_REQUEST_BODY,
             DetectEngineInspectHttpClientBody);
 
     DetectBufferTypeSetDescriptionByName("http_client_body",

diff --git a/src/detect-http-cookie.c b/src/detect-http-cookie.c
index 391dce187dd2582073fde5e19c1297b6eafe6d27..4a6fde19013a036224926f94313dced4c8fd86dc 100644 (file)
--- a/src/detect-http-cookie.c
+++ b/src/detect-http-cookie.c
@@ -88,10 +88,10 @@ void DetectHttpCookieRegister(void)
             PrefilterTxResponseCookieRegister);
 
     DetectAppLayerInspectEngineRegister("http_cookie",
-            ALPROTO_HTTP, SIG_FLAG_TOSERVER,
+            ALPROTO_HTTP, SIG_FLAG_TOSERVER, HTP_REQUEST_HEADERS,
             DetectEngineInspectHttpCookie);
     DetectAppLayerInspectEngineRegister("http_cookie",
-            ALPROTO_HTTP, SIG_FLAG_TOCLIENT,
+            ALPROTO_HTTP, SIG_FLAG_TOCLIENT, HTP_RESPONSE_HEADERS,
             DetectEngineInspectHttpCookie);
 
     DetectBufferTypeSetDescriptionByName("http_cookie",

diff --git a/src/detect-http-header-names.c b/src/detect-http-header-names.c
index 1fc8f3546ad19fe6b321928d0aecc86e25e3b249..177ab6ae318c80aed95e649669849127f87c78a5 100644 (file)
--- a/src/detect-http-header-names.c
+++ b/src/detect-http-header-names.c
@@ -387,10 +387,10 @@ void DetectHttpHeaderNamesRegister(void)
             PrefilterTxHttpResponseHeaderNamesRegister);
 
     DetectAppLayerInspectEngineRegister(BUFFER_NAME,
-            ALPROTO_HTTP, SIG_FLAG_TOSERVER,
+            ALPROTO_HTTP, SIG_FLAG_TOSERVER, HTP_REQUEST_HEADERS,
             InspectEngineHttpHeaderNames);
     DetectAppLayerInspectEngineRegister(BUFFER_NAME,
-            ALPROTO_HTTP, SIG_FLAG_TOCLIENT,
+            ALPROTO_HTTP, SIG_FLAG_TOCLIENT, HTP_RESPONSE_HEADERS,
             InspectEngineHttpHeaderNames);
 
     DetectBufferTypeSetDescriptionByName(BUFFER_NAME,

diff --git a/src/detect-http-header.c b/src/detect-http-header.c
index 21fb0746bb950e72467008ed5cc321fb37c17e55..6609075ef17869f6c704650ca3882012788899cb 100644 (file)
--- a/src/detect-http-header.c
+++ b/src/detect-http-header.c
@@ -400,10 +400,10 @@ void DetectHttpHeaderRegister(void)
             PrefilterTxHttpResponseHeadersRegister);
 
     DetectAppLayerInspectEngineRegister("http_header",
-            ALPROTO_HTTP, SIG_FLAG_TOSERVER,
+            ALPROTO_HTTP, SIG_FLAG_TOSERVER, HTP_REQUEST_HEADERS,
             DetectEngineInspectHttpHeader);
     DetectAppLayerInspectEngineRegister("http_header",
-            ALPROTO_HTTP, SIG_FLAG_TOCLIENT,
+            ALPROTO_HTTP, SIG_FLAG_TOCLIENT, HTP_RESPONSE_HEADERS,
             DetectEngineInspectHttpHeader);
 
     DetectBufferTypeSetDescriptionByName("http_header",

diff --git a/src/detect-http-headers-stub.h b/src/detect-http-headers-stub.h
index b6f7331205ca0f9fb0081c17195ee32de4b5bdf3..2267671311187d68b6f05723fbe060056682700d 100644 (file)
--- a/src/detect-http-headers-stub.h
+++ b/src/detect-http-headers-stub.h
@@ -345,12 +345,12 @@ static void DetectHttpHeadersRegisterStub(void)
 #endif
 #ifdef KEYWORD_TOSERVER
     DetectAppLayerInspectEngineRegister(BUFFER_NAME,
-            ALPROTO_HTTP, SIG_FLAG_TOSERVER,
+            ALPROTO_HTTP, SIG_FLAG_TOSERVER, HTP_REQUEST_HEADERS,
             InspectEngineHttpRequestHeader);
 #endif
 #ifdef KEYWORD_TOCLIENT
     DetectAppLayerInspectEngineRegister(BUFFER_NAME,
-            ALPROTO_HTTP, SIG_FLAG_TOCLIENT,
+            ALPROTO_HTTP, SIG_FLAG_TOCLIENT, HTP_RESPONSE_HEADERS,
             InspectEngineHttpResponseHeader);
 #endif
 

diff --git a/src/detect-http-hh.c b/src/detect-http-hh.c
index 182a49e685976e38b1ed9becf709bd2cda549689..4f0c45ead5d8c1e97a03399a3e1d3353e1c6b117 100644 (file)
--- a/src/detect-http-hh.c
+++ b/src/detect-http-hh.c
@@ -84,7 +84,7 @@ void DetectHttpHHRegister(void)
             PrefilterTxHostnameRegister);
 
     DetectAppLayerInspectEngineRegister("http_host",
-            ALPROTO_HTTP, SIG_FLAG_TOSERVER,
+            ALPROTO_HTTP, SIG_FLAG_TOSERVER, HTP_REQUEST_HEADERS,
             DetectEngineInspectHttpHH);
 
     DetectBufferTypeSetDescriptionByName("http_host",

diff --git a/src/detect-http-hrh.c b/src/detect-http-hrh.c
index a477a515703385e75dfabff96a4b606ce5b4674a..620cacaa257a74b43eb7d8f6703b3df9e1984a15 100644 (file)
--- a/src/detect-http-hrh.c
+++ b/src/detect-http-hrh.c
@@ -83,7 +83,7 @@ void DetectHttpHRHRegister(void)
             PrefilterTxHostnameRawRegister);
 
     DetectAppLayerInspectEngineRegister("http_raw_host",
-            ALPROTO_HTTP, SIG_FLAG_TOSERVER,
+            ALPROTO_HTTP, SIG_FLAG_TOSERVER, HTP_REQUEST_HEADERS,
             DetectEngineInspectHttpHRH);
 
     DetectBufferTypeSetDescriptionByName("http_raw_host",

diff --git a/src/detect-http-method.c b/src/detect-http-method.c
index 433c343291ffbb7dfe268c9b2dab7a58403c2b54..1559ff59287c34eff5bf1c952ec8bc44d8fb976f 100644 (file)
--- a/src/detect-http-method.c
+++ b/src/detect-http-method.c
@@ -85,7 +85,7 @@ void DetectHttpMethodRegister(void)
             PrefilterTxMethodRegister);
 
     DetectAppLayerInspectEngineRegister("http_method",
-            ALPROTO_HTTP, SIG_FLAG_TOSERVER,
+            ALPROTO_HTTP, SIG_FLAG_TOSERVER, HTP_REQUEST_LINE,
             DetectEngineInspectHttpMethod);
 
     DetectBufferTypeSetDescriptionByName("http_method",

diff --git a/src/detect-http-protocol.c b/src/detect-http-protocol.c
index e87b034b5061bdeeb842f7c2d41c98d3ffe3e64b..65f064c3cdfeaa9697ad1f45df868ec4efc8d688 100644 (file)
--- a/src/detect-http-protocol.c
+++ b/src/detect-http-protocol.c
@@ -223,10 +223,10 @@ void DetectHttpProtocolRegister(void)
             PrefilterTxHttpResponseProtocolRegister);
 
     DetectAppLayerInspectEngineRegister(BUFFER_NAME,
-            ALPROTO_HTTP, SIG_FLAG_TOSERVER,
+            ALPROTO_HTTP, SIG_FLAG_TOSERVER, HTP_REQUEST_LINE,
             InspectEngineHttpProtocol);
     DetectAppLayerInspectEngineRegister(BUFFER_NAME,
-            ALPROTO_HTTP, SIG_FLAG_TOCLIENT,
+            ALPROTO_HTTP, SIG_FLAG_TOCLIENT, HTP_RESPONSE_LINE,
             InspectEngineHttpProtocol);
 
     DetectBufferTypeSetDescriptionByName(BUFFER_NAME,

diff --git a/src/detect-http-raw-header.c b/src/detect-http-raw-header.c
index 18872b7b4483b5cd69f35b9d3352bcf6a1a1bc8e..96ea83cc42783ddfeff62c20df24d01bea88050c 100644 (file)
--- a/src/detect-http-raw-header.c
+++ b/src/detect-http-raw-header.c
@@ -86,10 +86,10 @@ void DetectHttpRawHeaderRegister(void)
             PrefilterTxResponseHeadersRawRegister);
 
     DetectAppLayerInspectEngineRegister("http_raw_header",
-            ALPROTO_HTTP, SIG_FLAG_TOSERVER,
+            ALPROTO_HTTP, SIG_FLAG_TOSERVER, HTP_REQUEST_HEADERS,
             DetectEngineInspectHttpRawHeader);
     DetectAppLayerInspectEngineRegister("http_raw_header",
-            ALPROTO_HTTP, SIG_FLAG_TOCLIENT,
+            ALPROTO_HTTP, SIG_FLAG_TOCLIENT, HTP_RESPONSE_HEADERS,
             DetectEngineInspectHttpRawHeader);
 
     DetectBufferTypeSetDescriptionByName("http_raw_header",

diff --git a/src/detect-http-raw-uri.c b/src/detect-http-raw-uri.c
index 51df60d1b9e7b0213ca33149b17a4d46acb30335..801e2aac2088518ccc5f991d7d5966a83edb89fb 100644 (file)
--- a/src/detect-http-raw-uri.c
+++ b/src/detect-http-raw-uri.c
@@ -78,7 +78,7 @@ void DetectHttpRawUriRegister(void)
             PrefilterTxRawUriRegister);
 
     DetectAppLayerInspectEngineRegister("http_raw_uri",
-            ALPROTO_HTTP, SIG_FLAG_TOSERVER,
+            ALPROTO_HTTP, SIG_FLAG_TOSERVER, HTP_REQUEST_LINE,
             DetectEngineInspectHttpRawUri);
 
     DetectBufferTypeSetDescriptionByName("http_raw_uri",

diff --git a/src/detect-http-request-line.c b/src/detect-http-request-line.c
index 3d4d69b058012d5695c4ba1a180258d0a600ddc6..d8bfc0872d235be01711060cbb1048914b8b31c4 100644 (file)
--- a/src/detect-http-request-line.c
+++ b/src/detect-http-request-line.c
@@ -88,7 +88,7 @@ void DetectHttpRequestLineRegister(void)
             PrefilterTxHttpRequestLineRegister);
 
     DetectAppLayerInspectEngineRegister("http_request_line",
-            ALPROTO_HTTP, SIG_FLAG_TOSERVER,
+            ALPROTO_HTTP, SIG_FLAG_TOSERVER, HTP_REQUEST_LINE,
             DetectEngineInspectHttpRequestLine);
 
     DetectBufferTypeSetDescriptionByName("http_request_line",

diff --git a/src/detect-http-response-line.c b/src/detect-http-response-line.c
index cb28358c922f492839ed66bed13bd9b1d1692e92..f35e393a3512ec465a06c78437323e741322ad39 100644 (file)
--- a/src/detect-http-response-line.c
+++ b/src/detect-http-response-line.c
@@ -88,7 +88,7 @@ void DetectHttpResponseLineRegister(void)
             PrefilterTxHttpResponseLineRegister);
 
     DetectAppLayerInspectEngineRegister("http_response_line",
-            ALPROTO_HTTP, SIG_FLAG_TOCLIENT,
+            ALPROTO_HTTP, SIG_FLAG_TOCLIENT, HTP_RESPONSE_LINE,
             DetectEngineInspectHttpResponseLine);
 
     DetectBufferTypeSetDescriptionByName("http_response_line",

diff --git a/src/detect-http-start.c b/src/detect-http-start.c
index 1e5836b77baa5e51bc2dcbf5cc1502d0db66a9b5..1937da1a5d8254cdff256dce042a38cb5a5a9c5d 100644 (file)
--- a/src/detect-http-start.c
+++ b/src/detect-http-start.c
@@ -312,10 +312,10 @@ void DetectHttpStartRegister(void)
             PrefilterTxHttpResponseStartRegister);
 
     DetectAppLayerInspectEngineRegister(BUFFER_NAME,
-            ALPROTO_HTTP, SIG_FLAG_TOSERVER,
+            ALPROTO_HTTP, SIG_FLAG_TOSERVER, HTP_REQUEST_HEADERS,
             InspectEngineHttpStart);
     DetectAppLayerInspectEngineRegister(BUFFER_NAME,
-            ALPROTO_HTTP, SIG_FLAG_TOCLIENT,
+            ALPROTO_HTTP, SIG_FLAG_TOCLIENT, HTP_RESPONSE_HEADERS,
             InspectEngineHttpStart);
 
     DetectBufferTypeSetDescriptionByName(BUFFER_NAME,

diff --git a/src/detect-http-stat-code.c b/src/detect-http-stat-code.c
index 80743c92bae114c1d4ffa09e7f73aa482c2370fa..4821ad10db2ed95d362de4f81eed86a50ad9f799 100644 (file)
--- a/src/detect-http-stat-code.c
+++ b/src/detect-http-stat-code.c
@@ -87,7 +87,7 @@ void DetectHttpStatCodeRegister (void)
             PrefilterTxHttpStatCodeRegister);
 
     DetectAppLayerInspectEngineRegister("http_stat_code",
-            ALPROTO_HTTP, SIG_FLAG_TOCLIENT,
+            ALPROTO_HTTP, SIG_FLAG_TOCLIENT, HTP_RESPONSE_LINE,
             DetectEngineInspectHttpStatCode);
 
     DetectBufferTypeSetDescriptionByName("http_stat_code",

diff --git a/src/detect-http-stat-msg.c b/src/detect-http-stat-msg.c
index 5ae19559ecd2380317515a58d44a1c021974b40b..e12b8d1ba642dc77f99e34b0aa2b717fd8ba8723 100644 (file)
--- a/src/detect-http-stat-msg.c
+++ b/src/detect-http-stat-msg.c
@@ -87,7 +87,7 @@ void DetectHttpStatMsgRegister (void)
             PrefilterTxHttpStatMsgRegister);
 
     DetectAppLayerInspectEngineRegister("http_stat_msg",
-            ALPROTO_HTTP, SIG_FLAG_TOCLIENT,
+            ALPROTO_HTTP, SIG_FLAG_TOCLIENT, HTP_RESPONSE_LINE,
             DetectEngineInspectHttpStatMsg);
 
     DetectBufferTypeSetDescriptionByName("http_stat_msg",

diff --git a/src/detect-http-ua.c b/src/detect-http-ua.c
index 654e72f05b757ef0555cd3cebd3359b8183c7378..4291bc276f373233d6937776837880aeb3171e54 100644 (file)
--- a/src/detect-http-ua.c
+++ b/src/detect-http-ua.c
@@ -84,7 +84,7 @@ void DetectHttpUARegister(void)
             PrefilterTxUARegister);
 
     DetectAppLayerInspectEngineRegister("http_user_agent",
-            ALPROTO_HTTP, SIG_FLAG_TOSERVER,
+            ALPROTO_HTTP, SIG_FLAG_TOSERVER, HTP_REQUEST_HEADERS,
             DetectEngineInspectHttpUA);
 
     DetectBufferTypeSetDescriptionByName("http_user_agent",

diff --git a/src/detect-http-uri.c b/src/detect-http-uri.c
index 64e2c03dd881444d09074e9e4e0d7f25875cdadf..f42548f590aa99508ccbb5c8b7b0a98c37dc77ee 100644 (file)
--- a/src/detect-http-uri.c
+++ b/src/detect-http-uri.c
@@ -79,7 +79,8 @@ void DetectHttpUriRegister (void)
     DetectAppLayerMpmRegister("http_uri", SIG_FLAG_TOSERVER, 2,
             PrefilterTxUriRegister);
 
-    DetectAppLayerInspectEngineRegister("http_uri", ALPROTO_HTTP, SIG_FLAG_TOSERVER,
+    DetectAppLayerInspectEngineRegister("http_uri",
+            ALPROTO_HTTP, SIG_FLAG_TOSERVER, HTP_REQUEST_LINE,
             DetectEngineInspectHttpUri);
 
     DetectBufferTypeSetDescriptionByName("http_uri",

diff --git a/src/detect-lua.c b/src/detect-lua.c
index 0c00edc8bf0d33e4417a004dc9a4476942f04af1..5eb9f0eca9efdc80b701fad7c281cd9c4650d0cf 100644 (file)
--- a/src/detect-lua.c
+++ b/src/detect-lua.c
@@ -122,10 +122,10 @@ void DetectLuaRegister(void)
     g_smtp_generic_list_id = DetectBufferTypeRegister("smtp_generic");
 
     DetectAppLayerInspectEngineRegister("smtp_generic",
-            ALPROTO_SMTP, SIG_FLAG_TOSERVER,
+            ALPROTO_SMTP, SIG_FLAG_TOSERVER, 0,
             InspectSmtpGeneric);
     DetectAppLayerInspectEngineRegister("smtp_generic",
-            ALPROTO_SMTP, SIG_FLAG_TOCLIENT,
+            ALPROTO_SMTP, SIG_FLAG_TOCLIENT, 0,
             InspectSmtpGeneric);
 
        SCLogDebug("registering lua rule option");

diff --git a/src/detect-modbus.c b/src/detect-modbus.c
index 1c84f5778ebf36501e29b8719ed981a5768406b8..e0ab9c88c315a4832305ac8713408576ead6314c 100644 (file)
--- a/src/detect-modbus.c
+++ b/src/detect-modbus.c
@@ -414,10 +414,10 @@ void DetectModbusRegister(void)
             &access_parse_regex, &access_parse_regex_study);
 
     DetectAppLayerInspectEngineRegister("modbus",
-            ALPROTO_MODBUS, SIG_FLAG_TOSERVER,
+            ALPROTO_MODBUS, SIG_FLAG_TOSERVER, 0,
             DetectEngineInspectModbus);
     DetectAppLayerInspectEngineRegister("modbus",
-            ALPROTO_MODBUS, SIG_FLAG_TOCLIENT,
+            ALPROTO_MODBUS, SIG_FLAG_TOCLIENT, 0,
             DetectEngineInspectModbus);
 
     g_modbus_buffer_id = DetectBufferTypeGetByName("modbus");

diff --git a/src/detect-ssh-proto.c b/src/detect-ssh-proto.c
index ac1757388caba93dc36573fbf4184f8663da6768..794290b7a2387ba7b755c54ae9ca006de36111e3 100644 (file)
--- a/src/detect-ssh-proto.c
+++ b/src/detect-ssh-proto.c
@@ -195,10 +195,10 @@ void DetectSshProtocolRegister(void)
             PrefilterTxSshResponseProtocolRegister);
 
     DetectAppLayerInspectEngineRegister(BUFFER_NAME,
-            ALPROTO_SSH, SIG_FLAG_TOSERVER,
+            ALPROTO_SSH, SIG_FLAG_TOSERVER, SSH_STATE_BANNER_DONE,
             InspectEngineSshProtocol);
     DetectAppLayerInspectEngineRegister(BUFFER_NAME,
-            ALPROTO_SSH, SIG_FLAG_TOCLIENT,
+            ALPROTO_SSH, SIG_FLAG_TOCLIENT, SSH_STATE_BANNER_DONE,
             InspectEngineSshProtocol);
 
     DetectBufferTypeSetDescriptionByName(BUFFER_NAME,

diff --git a/src/detect-ssh-software-version.c b/src/detect-ssh-software-version.c
index da5cc5190b88079fa8fb9cd6dcb0f23867844457..85d5769271767af4c0c3ef56461f3ef87328d86d 100644 (file)
--- a/src/detect-ssh-software-version.c
+++ b/src/detect-ssh-software-version.c
@@ -100,9 +100,11 @@ void DetectSshSoftwareVersionRegister(void)
     g_ssh_banner_list_id = DetectBufferTypeRegister("ssh_banner");
 
     DetectAppLayerInspectEngineRegister("ssh_banner",
-            ALPROTO_SSH, SIG_FLAG_TOSERVER, InspectSshBanner);
+            ALPROTO_SSH, SIG_FLAG_TOSERVER, SSH_STATE_BANNER_DONE,
+            InspectSshBanner);
     DetectAppLayerInspectEngineRegister("ssh_banner",
-            ALPROTO_SSH, SIG_FLAG_TOCLIENT, InspectSshBanner);
+            ALPROTO_SSH, SIG_FLAG_TOCLIENT, SSH_STATE_BANNER_DONE,
+            InspectSshBanner);
 }
 
 /**

diff --git a/src/detect-ssh-software.c b/src/detect-ssh-software.c
index bf2a7e187643b50464aefe444b8c43b1f787e757..c93579f69ef434669c8533e73bc3798b0b9421d3 100644 (file)
--- a/src/detect-ssh-software.c
+++ b/src/detect-ssh-software.c
@@ -195,10 +195,10 @@ void DetectSshSoftwareRegister(void)
             PrefilterTxSshResponseSoftwareRegister);
 
     DetectAppLayerInspectEngineRegister(BUFFER_NAME,
-            ALPROTO_SSH, SIG_FLAG_TOSERVER,
+            ALPROTO_SSH, SIG_FLAG_TOSERVER, SSH_STATE_BANNER_DONE,
             InspectEngineSshSoftware);
     DetectAppLayerInspectEngineRegister(BUFFER_NAME,
-            ALPROTO_SSH, SIG_FLAG_TOCLIENT,
+            ALPROTO_SSH, SIG_FLAG_TOCLIENT, SSH_STATE_BANNER_DONE,
             InspectEngineSshSoftware);
 
     DetectBufferTypeSetDescriptionByName(BUFFER_NAME,

diff --git a/src/detect-ssl-state.c b/src/detect-ssl-state.c
index 84155881884932e25bbad9f31834c0f44bb3f5d8..3e7dda0213f684cf0141b85bb36f0a61cc0910ba 100644 (file)
--- a/src/detect-ssl-state.c
+++ b/src/detect-ssl-state.c
@@ -94,10 +94,10 @@ void DetectSslStateRegister(void)
             "generic ssl/tls inspection");
 
     DetectAppLayerInspectEngineRegister("tls_generic",
-            ALPROTO_TLS, SIG_FLAG_TOSERVER,
+            ALPROTO_TLS, SIG_FLAG_TOSERVER, 0,
             InspectTlsGeneric);
     DetectAppLayerInspectEngineRegister("tls_generic",
-            ALPROTO_TLS, SIG_FLAG_TOCLIENT,
+            ALPROTO_TLS, SIG_FLAG_TOCLIENT, 0,
             InspectTlsGeneric);
 }
 

diff --git a/src/detect-template-buffer.c b/src/detect-template-buffer.c
index aba807cbe24d3aaed6b6e8d244493177afda8229..1e7fcceea2a30bff5f7c2859d902f66ba61a9d71 100644 (file)
--- a/src/detect-template-buffer.c
+++ b/src/detect-template-buffer.c
@@ -59,10 +59,10 @@ void DetectTemplateBufferRegister(void)
 
     /* register inspect engines */
     DetectAppLayerInspectEngineRegister("template_buffer",
-            ALPROTO_TEMPLATE, SIG_FLAG_TOSERVER,
+            ALPROTO_TEMPLATE, SIG_FLAG_TOSERVER, 0,
             DetectEngineInspectTemplateBuffer);
     DetectAppLayerInspectEngineRegister("template_buffer",
-            ALPROTO_TEMPLATE, SIG_FLAG_TOCLIENT,
+            ALPROTO_TEMPLATE, SIG_FLAG_TOCLIENT, 0,
             DetectEngineInspectTemplateBuffer);
 
     g_template_buffer_id = DetectBufferTypeGetByName("template_buffer");

diff --git a/src/detect-tls-cert-issuer.c b/src/detect-tls-cert-issuer.c
index dc4c8b621e33a957d83e8469ad541836e82fb55f..c88a5334398342b9160f106011e0098e2054105b 100644 (file)
--- a/src/detect-tls-cert-issuer.c
+++ b/src/detect-tls-cert-issuer.c
@@ -76,7 +76,7 @@ void DetectTlsIssuerRegister(void)
             PrefilterTxTlsIssuerRegister);
 
     DetectAppLayerInspectEngineRegister("tls_cert_issuer",
-            ALPROTO_TLS, SIG_FLAG_TOCLIENT,
+            ALPROTO_TLS, SIG_FLAG_TOCLIENT, TLS_STATE_CERT_READY,
             DetectEngineInspectTlsIssuer);
 
     g_tls_cert_issuer_buffer_id = DetectBufferTypeGetByName("tls_cert_issuer");

diff --git a/src/detect-tls-cert-serial.c b/src/detect-tls-cert-serial.c
index 4d0a8e4da8886fa9a90968bc2e2fc1899e7364f9..5463fccaca7ef78a612b81e63792b3f3777afa6f 100644 (file)
--- a/src/detect-tls-cert-serial.c
+++ b/src/detect-tls-cert-serial.c
@@ -76,7 +76,8 @@ void DetectTlsSerialRegister(void)
             PrefilterTxTlsSerialRegister);
 
     DetectAppLayerInspectEngineRegister("tls_cert_serial", ALPROTO_TLS,
-            SIG_FLAG_TOCLIENT, DetectEngineInspectTlsSerial);
+            SIG_FLAG_TOCLIENT, TLS_STATE_CERT_READY,
+            DetectEngineInspectTlsSerial);
 
     g_tls_cert_serial_buffer_id = DetectBufferTypeGetByName("tls_cert_serial");
 }

diff --git a/src/detect-tls-cert-subject.c b/src/detect-tls-cert-subject.c
index d6581fca4cb53250dc066c12a64ff5717b70cd0c..271e8f2230e694d2f25414606a742f4dcee62867 100644 (file)
--- a/src/detect-tls-cert-subject.c
+++ b/src/detect-tls-cert-subject.c
@@ -76,7 +76,7 @@ void DetectTlsSubjectRegister(void)
             PrefilterTxTlsSubjectRegister);
 
     DetectAppLayerInspectEngineRegister("tls_cert_subject",
-            ALPROTO_TLS, SIG_FLAG_TOCLIENT,
+            ALPROTO_TLS, SIG_FLAG_TOCLIENT, TLS_STATE_CERT_READY,
             DetectEngineInspectTlsSubject);
 
     g_tls_cert_subject_buffer_id = DetectBufferTypeGetByName("tls_cert_subject");

diff --git a/src/detect-tls-cert-validity.c b/src/detect-tls-cert-validity.c
index 17e4b32df7c804168539f56c2721ccf372ca74b3..99a12b6b7ebd017250ad1b9043ee88e5e863468f 100644 (file)
--- a/src/detect-tls-cert-validity.c
+++ b/src/detect-tls-cert-validity.c
@@ -121,7 +121,7 @@ void DetectTlsValidityRegister (void)
     DetectSetupParseRegexes(PARSE_REGEX, &parse_regex, &parse_regex_study);
 
     DetectAppLayerInspectEngineRegister("tls_validity",
-            ALPROTO_TLS, SIG_FLAG_TOCLIENT,
+            ALPROTO_TLS, SIG_FLAG_TOCLIENT, TLS_STATE_CERT_READY,
             DetectEngineInspectTlsValidity);
 
     g_tls_validity_buffer_id = DetectBufferTypeGetByName("tls_validity");

diff --git a/src/detect-tls-sni.c b/src/detect-tls-sni.c
index 195175a70f6692f5bbe4ad13c85112eae9ae13f5..5b5350c643fa977c1a05028aea2350cbc33b3ec8 100644 (file)
--- a/src/detect-tls-sni.c
+++ b/src/detect-tls-sni.c
@@ -76,7 +76,7 @@ void DetectTlsSniRegister(void)
             PrefilterTxTlsSniRegister);
 
     DetectAppLayerInspectEngineRegister("tls_sni",
-            ALPROTO_TLS, SIG_FLAG_TOSERVER,
+            ALPROTO_TLS, SIG_FLAG_TOSERVER, 0,
             DetectEngineInspectTlsSni);
 
     g_tls_sni_buffer_id = DetectBufferTypeGetByName("tls_sni");

diff --git a/src/detect-tls.c b/src/detect-tls.c
index 585eabe3c94a91c2414f4ef559f6ab58d39e80c7..222e4f9335e048dd418822a94f308bccdab0812e 100644 (file)
--- a/src/detect-tls.c
+++ b/src/detect-tls.c
@@ -159,7 +159,7 @@ void DetectTlsRegister (void)
     g_tls_cert_list_id = DetectBufferTypeRegister("tls_cert");
 
     DetectAppLayerInspectEngineRegister("tls_cert",
-            ALPROTO_TLS, SIG_FLAG_TOCLIENT,
+            ALPROTO_TLS, SIG_FLAG_TOCLIENT, TLS_STATE_CERT_READY,
             InspectTlsCert);
 }
 

diff --git a/src/detect.h b/src/detect.h
index 85f5f241bb8bf2735f75582be9afecdcfbb5e841..acb2cc694de14845bbf25c9264d5df7c70de4974 100644 (file)
--- a/src/detect.h
+++ b/src/detect.h
@@ -334,7 +334,8 @@ typedef struct DetectEngineAppInspectionEngine_ {
     AppProto alproto;
     uint8_t dir;
     uint8_t id;     /**< per sig id used in state keeping */
-    int sm_list;
+    int16_t sm_list;
+    int16_t progress;
 
     /* \retval 0 No match.  Don't discontinue matching yet.  We need more data.
      *         1 Match.