]> git.ipfire.org Git - thirdparty/suricata.git/commit
detect: absent keyword to test absence of sticky buffer 12174/head
authorPhilippe Antoine <pantoine@oisf.net>
Thu, 30 Nov 2023 13:47:14 +0000 (14:47 +0100)
committerVictor Julien <victor@inliniac.net>
Thu, 28 Nov 2024 13:59:23 +0000 (14:59 +0100)
commit4ec90bd2276afab1c3c3eea82a1fd1216ee0961c
treec3bd0a84b52ff7c91563d2cda1aa01cf0cf599a6
parent7682816ef92fc7c158ca7c76b0666013fb52031a
detect: absent keyword to test absence of sticky buffer

Ticket: 2224

It takes an argument to match only if the buffer is absent,
or it can still match if the buffer is present, but we test
the absence of some content.

For multi buffers, absent matches if there are 0 buffers.

For file keywords, absent matches if there is no file.
16 files changed:
doc/userguide/rules/payload-keywords.rst
src/detect-engine-analyzer.c
src/detect-engine-content-inspection.c
src/detect-engine-content-inspection.h
src/detect-engine-mpm.c
src/detect-engine-register.h
src/detect-engine.c
src/detect-file-data.c
src/detect-filemagic.c
src/detect-filename.c
src/detect-http-client-body.c
src/detect-http-header.c
src/detect-isdataat.c
src/detect-isdataat.h
src/detect-parse.c
src/detect.h