From: Victor Julien Date: Thu, 18 Feb 2021 13:22:41 +0000 (+0100) Subject: detect/content: generalize pattern pretty printing X-Git-Tag: suricata-7.0.0-beta1~1489 X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=5703aec44e3e0506ab77a76082e8a4731d230b78;p=thirdparty%2Fsuricata.git detect/content: generalize pattern pretty printing --- diff --git a/src/detect-content.c b/src/detect-content.c index 89dddc4711..2d4da9250d 100644 --- a/src/detect-content.c +++ b/src/detect-content.c @@ -627,6 +627,47 @@ void DetectContentPropagateLimits(Signature *s) } } +static inline bool NeedsAsHex(uint8_t c) +{ + if (!isprint(c)) + return true; + + switch (c) { + case '/': + case ';': + case ':': + case '\\': + case ' ': + case '|': + case '"': + case '`': + case '\'': + return true; + } + return false; +} + +void DetectContentPatternPrettyPrint(const DetectContentData *cd, char *str, size_t str_len) +{ + bool hex = false; + for (uint16_t i = 0; i < cd->content_len; i++) { + if (NeedsAsHex(cd->content[i])) { + char hex_str[4]; + snprintf(hex_str, sizeof(hex_str), "%s%02X", !hex ? "|" : " ", cd->content[i]); + strlcat(str, hex_str, str_len); + hex = true; + } else { + char p_str[3]; + snprintf(p_str, sizeof(p_str), "%s%c", hex ? "|" : "", cd->content[i]); + strlcat(str, p_str, str_len); + hex = false; + } + } + if (hex) { + strlcat(str, "|", str_len); + } +} + #ifdef UNITTESTS /* UNITTESTS */ static bool TestLastContent(const Signature *s, uint16_t o, uint16_t d) diff --git a/src/detect-content.h b/src/detect-content.h index d51df26beb..5959d6473f 100644 --- a/src/detect-content.h +++ b/src/detect-content.h @@ -123,4 +123,6 @@ void DetectContentFree(DetectEngineCtx *, void *); bool DetectContentPMATCHValidateCallback(const Signature *s); void DetectContentPropagateLimits(Signature *s); +void DetectContentPatternPrettyPrint(const DetectContentData *cd, char *str, size_t str_len); + #endif /* __DETECT_CONTENT_H__ */ diff --git a/src/detect-engine-analyzer.c b/src/detect-engine-analyzer.c index 9491f7fb1d..0f7a1506ce 100644 --- a/src/detect-engine-analyzer.c +++ b/src/detect-engine-analyzer.c @@ -1052,47 +1052,6 @@ error: return -1; } -static inline bool NeedsAsHex(uint8_t c) -{ - if (!isprint(c)) - return true; - - switch (c) { - case '/': - case ';': - case ':': - case '\\': - case ' ': - case '|': - case '"': - case '`': - case '\'': - return true; - } - return false; -} - -static void PatternPrettyPrint(const DetectContentData *cd, char *str, size_t str_len) -{ - bool hex = false; - for (uint16_t i = 0; i < cd->content_len; i++) { - if (NeedsAsHex(cd->content[i])) { - char hex_str[4]; - snprintf(hex_str, sizeof(hex_str), "%s%02X", !hex ? "|" : " ", cd->content[i]); - strlcat(str, hex_str, str_len); - hex = true; - } else { - char p_str[3]; - snprintf(p_str, sizeof(p_str), "%s%c", hex ? "|" : "", cd->content[i]); - strlcat(str, p_str, str_len); - hex = false; - } - } - if (hex) { - strlcat(str, "|", str_len); - } -} - void DumpPatterns(DetectEngineCtx *de_ctx) { if (de_ctx->buffer_type_map_elements == 0 || de_ctx->pattern_hash_table == NULL) @@ -1108,7 +1067,7 @@ void DumpPatterns(DetectEngineCtx *de_ctx) htb != NULL; htb = HashListTableGetListNext(htb)) { char str[1024] = ""; struct PatternItem *p = HashListTableGetListData(htb); - PatternPrettyPrint(p->cd, str, sizeof(str)); + DetectContentPatternPrettyPrint(p->cd, str, sizeof(str)); JsonBuilder *jb = arrays[p->sm_list]; if (arrays[p->sm_list] == NULL) {