From: Jeff Lucovsky <jeff@lucovsky.org>
Date: Thu, 11 Jun 2020 12:31:55 +0000 (-0400)
Subject: detect/transform: Add transform "validate" function
X-Git-Tag: suricata-5.0.4~54
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=00ffcf1012178a9dfeb1559ec826cde60273830b;p=thirdparty%2Fsuricata.git

detect/transform: Add transform "validate" function

This commit adds an (optional) entry for a validation function. The
validation function, if present, will be used during rule processing.

Its role is to determine if the arguments are compatible with the
transform. E.g., a content string of "this string has whitespace" is not
compatible with the `strip_whitespace` transform.

(cherry picked from commit 596875fa68af18746abbbd9e307d14a93f23c3f7)
---

diff --git a/src/detect.h b/src/detect.h
index c79c8bd91d..4392f09b62 100644
--- a/src/detect.h
+++ b/src/detect.h
@@ -1182,6 +1182,7 @@ typedef struct SigTableElmt_ {
 
     /** InspectionBuffer transformation callback */
     void (*Transform)(InspectionBuffer *);
+    bool (*TransformValidate)(const uint8_t *content, uint16_t content_len);
 
     /** keyword setup function pointer */
     int (*Setup)(DetectEngineCtx *, Signature *, const char *);