From 6a01f40d40895388b2eace39b1e01c40ef7f66ab Mon Sep 17 00:00:00 2001 From: Victor Julien Date: Sat, 2 Dec 2023 09:45:15 +0100 Subject: [PATCH] detect/krb5.sname: use new content inspect entry --- src/detect-krb5-sname.c | 7 +++---- 1 file changed, 3 insertions(+), 4 deletions(-) diff --git a/src/detect-krb5-sname.c b/src/detect-krb5-sname.c index 9fbe550b02..dae5c46e52 100644 --- a/src/detect-krb5-sname.c +++ b/src/detect-krb5-sname.c @@ -81,6 +81,7 @@ static InspectionBuffer *GetKrb5SNameData(DetectEngineThreadCtx *det_ctx, } InspectionBufferSetupMulti(buffer, transforms, b, b_len); + buffer->flags = DETECT_CI_FLAGS_SINGLE; SCReturnPtr(buffer, "InspectionBuffer"); } @@ -100,13 +101,11 @@ static uint8_t DetectEngineInspectKrb5SName(DetectEngineCtx *de_ctx, DetectEngin struct Krb5PrincipalNameDataArgs cbdata = { local_id, txv, }; InspectionBuffer *buffer = GetKrb5SNameData(det_ctx, transforms, f, &cbdata, engine->sm_list); - if (buffer == NULL || buffer->inspect == NULL) break; - const bool match = DetectEngineContentInspection(de_ctx, det_ctx, s, engine->smd, NULL, f, - buffer->inspect, buffer->inspect_len, buffer->inspect_offset, - DETECT_CI_FLAGS_SINGLE, DETECT_ENGINE_CONTENT_INSPECTION_MODE_STATE); + const bool match = DetectEngineContentInspectionBuffer(de_ctx, det_ctx, s, engine->smd, + NULL, f, buffer, DETECT_ENGINE_CONTENT_INSPECTION_MODE_STATE); if (match) { return DETECT_ENGINE_INSPECT_SIG_MATCH; } -- 2.47.2