]> git.ipfire.org Git - thirdparty/suricata.git/commitdiff
detect/stream_size: allow match on pseudo packets
authorVictor Julien <vjulien@oisf.net>
Thu, 16 May 2024 10:25:07 +0000 (12:25 +0200)
committerVictor Julien <victor@inliniac.net>
Tue, 18 Jun 2024 19:09:00 +0000 (21:09 +0200)
Often used with stream content, which can be inspected with pseudo packets.

src/detect-stream_size.c

index 7597b71b135aff87060a6bdd29351c365c4503fa..b9220e9dfebeb33b5af6ae53692a051dc953c6ba 100644 (file)
@@ -118,8 +118,6 @@ static int DetectStreamSizeMatchAux(const DetectStreamSizeData *sd, const TcpSes
 static int DetectStreamSizeMatch(
         DetectEngineThreadCtx *det_ctx, Packet *p, const Signature *s, const SigMatchCtx *ctx)
 {
-    DEBUG_VALIDATE_BUG_ON(PKT_IS_PSEUDOPKT(p));
-
     const DetectStreamSizeData *sd = (const DetectStreamSizeData *)ctx;
 
     if (!(PacketIsTCP(p)))
@@ -171,7 +169,6 @@ void DetectStreamSizeFree(DetectEngineCtx *de_ctx, void *ptr)
 static void PrefilterPacketStreamsizeMatch(
         DetectEngineThreadCtx *det_ctx, Packet *p, const void *pectx)
 {
-    DEBUG_VALIDATE_BUG_ON(PKT_IS_PSEUDOPKT(p));
     if (!(PacketIsTCP(p)))
         return;
 
@@ -214,9 +211,9 @@ static bool PrefilterPacketStreamSizeCompare(PrefilterPacketHeaderValue v, void
 
 static int PrefilterSetupStreamSize(DetectEngineCtx *de_ctx, SigGroupHead *sgh)
 {
-    return PrefilterSetupPacketHeader(de_ctx, sgh, DETECT_STREAM_SIZE,
-            SIG_MASK_REQUIRE_FLOW | SIG_MASK_REQUIRE_REAL_PKT, PrefilterPacketStreamSizeSet,
-            PrefilterPacketStreamSizeCompare, PrefilterPacketStreamsizeMatch);
+    return PrefilterSetupPacketHeader(de_ctx, sgh, DETECT_STREAM_SIZE, SIG_MASK_REQUIRE_FLOW,
+            PrefilterPacketStreamSizeSet, PrefilterPacketStreamSizeCompare,
+            PrefilterPacketStreamsizeMatch);
 }
 
 static bool PrefilterStreamSizeIsPrefilterable(const Signature *s)