]> git.ipfire.org Git - thirdparty/suricata.git/commitdiff
detect/multi-buf: use only one progress
authorPhilippe Antoine <pantoine@oisf.net>
Tue, 22 Apr 2025 12:21:05 +0000 (14:21 +0200)
committerVictor Julien <victor@inliniac.net>
Fri, 25 Apr 2025 07:51:44 +0000 (09:51 +0200)
for both inspect engine and app-layer mpm

15 files changed:
src/detect-dns-name.c
src/detect-engine-helper.c
src/detect-engine.c
src/detect-engine.h
src/detect-ftp-reply.c
src/detect-http-header.c
src/detect-http2.c
src/detect-ike-vendor.c
src/detect-krb5-cname.c
src/detect-krb5-sname.c
src/detect-quic-cyu-hash.c
src/detect-quic-cyu-string.c
src/detect-tls-alpn.c
src/detect-tls-certs.c
src/detect-tls-subjectaltname.c

index 5a2b75aa25b4c61cf7a698d5b3d021dd5262e12a..24c30ee5133977fb608202d114ec9787769557a2 100644 (file)
@@ -89,8 +89,8 @@ static int Register(const char *keyword, const char *desc, const char *doc,
     sigmatch_table[keyword_id].flags |= SIGMATCH_NOOPT;
     sigmatch_table[keyword_id].flags |= SIGMATCH_INFO_STICKY_BUFFER;
 
-    DetectAppLayerMultiRegister(keyword, ALPROTO_DNS, SIG_FLAG_TOSERVER, 0, GetBufferFn, 2, 1);
-    DetectAppLayerMultiRegister(keyword, ALPROTO_DNS, SIG_FLAG_TOCLIENT, 0, GetBufferFn, 2, 1);
+    DetectAppLayerMultiRegister(keyword, ALPROTO_DNS, SIG_FLAG_TOSERVER, 1, GetBufferFn, 2);
+    DetectAppLayerMultiRegister(keyword, ALPROTO_DNS, SIG_FLAG_TOCLIENT, 1, GetBufferFn, 2);
 
     DetectBufferTypeSetDescriptionByName(keyword, keyword);
     DetectBufferTypeSupportsMultiInstance(keyword);
index 410c8b9200f57b82aa57dd6e58a8eddebe4d0a0e..58f64dca40ae9cefa5642684e476f0e0a1cd6745 100644 (file)
@@ -84,12 +84,10 @@ int DetectHelperMultiBufferProgressMpmRegister(const char *name, const char *des
         bool toclient, bool toserver, InspectionMultiBufferGetDataPtr GetData, int progress)
 {
     if (toserver) {
-        DetectAppLayerMultiRegister(
-                name, alproto, SIG_FLAG_TOSERVER, progress, GetData, 2, progress);
+        DetectAppLayerMultiRegister(name, alproto, SIG_FLAG_TOSERVER, progress, GetData, 2);
     }
     if (toclient) {
-        DetectAppLayerMultiRegister(
-                name, alproto, SIG_FLAG_TOCLIENT, progress, GetData, 2, progress);
+        DetectAppLayerMultiRegister(name, alproto, SIG_FLAG_TOCLIENT, progress, GetData, 2);
     }
     DetectBufferTypeSupportsMultiInstance(name);
     DetectBufferTypeSetDescriptionByName(name, desc);
index 061b7c08f7d65a28a0167963da41fdb7fced101d..f6fed8a495476244e6e42adefd0a87459d32d2b7 100644 (file)
@@ -2300,12 +2300,12 @@ uint8_t DetectEngineInspectBufferGeneric(DetectEngineCtx *de_ctx, DetectEngineTh
 // wrapper for both DetectAppLayerInspectEngineRegister and DetectAppLayerMpmRegister
 // with cast of callback function
 void DetectAppLayerMultiRegister(const char *name, AppProto alproto, uint32_t dir, int progress,
-        InspectionMultiBufferGetDataPtr GetData, int priority, int tx_min_progress)
+        InspectionMultiBufferGetDataPtr GetData, int priority)
 {
     AppLayerInspectEngineRegisterInternal(
             name, alproto, dir, progress, DetectEngineInspectMultiBufferGeneric, NULL, GetData);
-    DetectAppLayerMpmMultiRegister(name, dir, priority, PrefilterMultiGenericMpmRegister, GetData,
-            alproto, tx_min_progress);
+    DetectAppLayerMpmMultiRegister(
+            name, dir, priority, PrefilterMultiGenericMpmRegister, GetData, alproto, progress);
 }
 
 InspectionBuffer *DetectGetMultiData(struct DetectEngineThreadCtx_ *det_ctx,
index 6ee7b183dd15dec23910a65422825ea2ce43bd4c..cc6e55b526f499992d6f4b293676da8324f9aef5 100644 (file)
@@ -177,7 +177,7 @@ void DetectAppLayerInspectEngineRegister(const char *name, AppProto alproto, uin
         int progress, InspectEngineFuncPtr Callback2, InspectionBufferGetDataPtr GetData);
 
 void DetectAppLayerMultiRegister(const char *name, AppProto alproto, uint32_t dir, int progress,
-        InspectionMultiBufferGetDataPtr GetData, int priority, int tx_min_progress);
+        InspectionMultiBufferGetDataPtr GetData, int priority);
 
 void DetectPktInspectEngineRegister(const char *name,
         InspectionBufferGetPktDataPtr GetPktData,
index f025ccbfe002e3c2c4c45c29517f1531d6e4f30a..2c51e3b5f8d99c49892ade4aea4703e49982f1ea 100644 (file)
@@ -96,7 +96,7 @@ void DetectFtpReplyRegister(void)
     sigmatch_table[DETECT_FTP_REPLY].flags |= SIGMATCH_NOOPT;
 
     DetectAppLayerMultiRegister(
-            BUFFER_NAME, ALPROTO_FTP, SIG_FLAG_TOCLIENT, 0, DetectFTPReplyGetData, 2, 1);
+            BUFFER_NAME, ALPROTO_FTP, SIG_FLAG_TOCLIENT, 1, DetectFTPReplyGetData, 2);
 
     DetectBufferTypeSetDescriptionByName(BUFFER_NAME, BUFFER_DESC);
 
index 746a3b42d08e271ddd752d23f61eb8ca1f66ccbe..938a9049d755b4333d67bf23d1fb3eabd6ef9a48 100644 (file)
@@ -591,9 +591,9 @@ void DetectHttpRequestHeaderRegister(void)
             SIGMATCH_NOOPT | SIGMATCH_INFO_STICKY_BUFFER;
 
     DetectAppLayerMultiRegister("http_request_header", ALPROTO_HTTP2, SIG_FLAG_TOSERVER,
-            HTTP2StateOpen, rs_http2_tx_get_header, 2, HTTP2StateOpen);
+            HTTP2StateOpen, rs_http2_tx_get_header, 2);
     DetectAppLayerMultiRegister("http_request_header", ALPROTO_HTTP1, SIG_FLAG_TOSERVER,
-            HTP_REQUEST_PROGRESS_HEADERS, GetHttp1HeaderData, 2, HTP_REQUEST_PROGRESS_HEADERS);
+            HTP_REQUEST_PROGRESS_HEADERS, GetHttp1HeaderData, 2);
 
     DetectBufferTypeSetDescriptionByName("http_request_header", "HTTP header name and value");
     g_http_request_header_buffer_id = DetectBufferTypeGetByName("http_request_header");
@@ -624,9 +624,9 @@ void DetectHttpResponseHeaderRegister(void)
             SIGMATCH_NOOPT | SIGMATCH_INFO_STICKY_BUFFER;
 
     DetectAppLayerMultiRegister("http_response_header", ALPROTO_HTTP2, SIG_FLAG_TOCLIENT,
-            HTTP2StateOpen, rs_http2_tx_get_header, 2, HTTP2StateOpen);
+            HTTP2StateOpen, rs_http2_tx_get_header, 2);
     DetectAppLayerMultiRegister("http_response_header", ALPROTO_HTTP1, SIG_FLAG_TOCLIENT,
-            HTP_RESPONSE_PROGRESS_HEADERS, GetHttp1HeaderData, 2, HTP_RESPONSE_PROGRESS_HEADERS);
+            HTP_RESPONSE_PROGRESS_HEADERS, GetHttp1HeaderData, 2);
 
     DetectBufferTypeSetDescriptionByName("http_response_header", "HTTP header name and value");
     g_http_response_header_buffer_id = DetectBufferTypeGetByName("http_response_header");
index f0bc0daa8195dd656ed9e5696660e80bae40227f..aea75be824181f0fce4034008166759ee7c8906d 100644 (file)
@@ -174,9 +174,9 @@ void DetectHttp2Register(void)
     sigmatch_table[DETECT_HTTP2_HEADERNAME].flags |= SIGMATCH_NOOPT | SIGMATCH_INFO_STICKY_BUFFER;
 
     DetectAppLayerMultiRegister("http2_header_name", ALPROTO_HTTP2, SIG_FLAG_TOCLIENT,
-            HTTP2StateOpen, rs_http2_tx_get_header_name, 2, HTTP2StateOpen);
+            HTTP2StateOpen, rs_http2_tx_get_header_name, 2);
     DetectAppLayerMultiRegister("http2_header_name", ALPROTO_HTTP2, SIG_FLAG_TOSERVER,
-            HTTP2StateOpen, rs_http2_tx_get_header_name, 2, HTTP2StateOpen);
+            HTTP2StateOpen, rs_http2_tx_get_header_name, 2);
 
     DetectBufferTypeSupportsMultiInstance("http2_header_name");
     DetectBufferTypeSetDescriptionByName("http2_header_name",
index dad081dd11d8cd576cc41a404a8b1fe3c0fffc0c..6042461dd323ba1dcb3cf014d32d6ce4b44c5a1d 100644 (file)
@@ -52,7 +52,7 @@ void DetectIkeVendorRegister(void)
     sigmatch_table[DETECT_IKE_VENDOR].flags |= SIGMATCH_INFO_STICKY_BUFFER;
 
     DetectAppLayerMultiRegister(
-            "ike.vendor", ALPROTO_IKE, SIG_FLAG_TOSERVER, 1, rs_ike_tx_get_vendor, 1, 1);
+            "ike.vendor", ALPROTO_IKE, SIG_FLAG_TOSERVER, 1, rs_ike_tx_get_vendor, 1);
 
     g_ike_vendor_buffer_id = DetectBufferTypeGetByName("ike.vendor");
 
index b46997a16e1e5eacd5dff27450c9f7ddf848f453..dbd828669b32ed2f72f22375abe8cbeb05d0f7de 100644 (file)
@@ -59,7 +59,7 @@ void DetectKrb5CNameRegister(void)
     sigmatch_table[DETECT_KRB5_CNAME].desc = "sticky buffer to match on Kerberos 5 client name";
 
     DetectAppLayerMultiRegister(
-            "krb5_cname", ALPROTO_KRB5, SIG_FLAG_TOCLIENT, 0, rs_krb5_tx_get_cname, 2, 1);
+            "krb5_cname", ALPROTO_KRB5, SIG_FLAG_TOCLIENT, 1, rs_krb5_tx_get_cname, 2);
 
     DetectBufferTypeSetDescriptionByName("krb5_cname",
             "Kerberos 5 ticket client name");
index e3eb8ca39be444febca5322a63faf4166fb344ae..a806803fb3282eb40bc215f3ff83391644b3f881 100644 (file)
@@ -59,7 +59,7 @@ void DetectKrb5SNameRegister(void)
     sigmatch_table[DETECT_KRB5_SNAME].desc = "sticky buffer to match on Kerberos 5 server name";
 
     DetectAppLayerMultiRegister(
-            "krb5_sname", ALPROTO_KRB5, SIG_FLAG_TOCLIENT, 0, rs_krb5_tx_get_sname, 2, 1);
+            "krb5_sname", ALPROTO_KRB5, SIG_FLAG_TOCLIENT, 1, rs_krb5_tx_get_sname, 2);
 
     DetectBufferTypeSetDescriptionByName("krb5_sname",
             "Kerberos 5 ticket server name");
index 587a804e5dcc1739b3e5faef269d56a4eb084294..2cb9a31740bf9da5e209dbf9ca3d7bf0be561c7f 100644 (file)
@@ -68,7 +68,7 @@ void DetectQuicCyuHashRegister(void)
 #endif
 
     DetectAppLayerMultiRegister(
-            BUFFER_NAME, ALPROTO_QUIC, SIG_FLAG_TOSERVER, 0, rs_quic_tx_get_cyu_hash, 2, 1);
+            BUFFER_NAME, ALPROTO_QUIC, SIG_FLAG_TOSERVER, 1, rs_quic_tx_get_cyu_hash, 2);
 
     DetectBufferTypeSetDescriptionByName(BUFFER_NAME, BUFFER_DESC);
 
index 1681212d3b177cbd8b80708294a4b7355997c1c9..6dbb45684ffdb013f1fc2881abbfa4dd7a710141 100644 (file)
@@ -66,7 +66,7 @@ void DetectQuicCyuStringRegister(void)
 #endif
 
     DetectAppLayerMultiRegister(
-            BUFFER_NAME, ALPROTO_QUIC, SIG_FLAG_TOSERVER, 0, rs_quic_tx_get_cyu_string, 2, 1);
+            BUFFER_NAME, ALPROTO_QUIC, SIG_FLAG_TOSERVER, 1, rs_quic_tx_get_cyu_string, 2);
 
     DetectBufferTypeSetDescriptionByName(BUFFER_NAME, BUFFER_DESC);
 
index ca447d2e2f6be52769fd74e15dc68c8f46c87cf2..dfa6fb440849b7499cc5d22b707c03c4add97730 100644 (file)
@@ -104,9 +104,9 @@ void DetectTlsAlpnRegister(void)
     sigmatch_table[DETECT_TLS_ALPN].flags |= SIGMATCH_INFO_STICKY_BUFFER;
 
     DetectAppLayerMultiRegister("tls.alpn", ALPROTO_TLS, SIG_FLAG_TOSERVER,
-            TLS_STATE_CLIENT_HELLO_DONE, TlsAlpnGetData, 2, TLS_STATE_CLIENT_HELLO_DONE);
-    DetectAppLayerMultiRegister("tls.alpn", ALPROTO_TLS, SIG_FLAG_TOCLIENT, TLS_STATE_SERVER_HELLO,
-            TlsAlpnGetData, 2, TLS_STATE_SERVER_HELLO);
+            TLS_STATE_CLIENT_HELLO_DONE, TlsAlpnGetData, 2);
+    DetectAppLayerMultiRegister(
+            "tls.alpn", ALPROTO_TLS, SIG_FLAG_TOCLIENT, TLS_STATE_SERVER_HELLO, TlsAlpnGetData, 2);
 
     DetectBufferTypeSetDescriptionByName("tls.alpn", "TLS APLN");
 
index 86e2164eb6e4d35501b6f307fae7a8ee46292353..197ce42bdf07291023c268910895b53a14765ae0 100644 (file)
@@ -113,9 +113,9 @@ void DetectTlsCertsRegister(void)
     sigmatch_table[DETECT_TLS_CERTS].flags |= SIGMATCH_INFO_STICKY_BUFFER;
 
     DetectAppLayerMultiRegister("tls.certs", ALPROTO_TLS, SIG_FLAG_TOCLIENT,
-            TLS_STATE_SERVER_CERT_DONE, TlsCertsGetData, 2, 1);
+            TLS_STATE_SERVER_CERT_DONE, TlsCertsGetData, 2);
     DetectAppLayerMultiRegister("tls.certs", ALPROTO_TLS, SIG_FLAG_TOSERVER,
-            TLS_STATE_CLIENT_CERT_DONE, TlsCertsGetData, 2, 1);
+            TLS_STATE_CLIENT_CERT_DONE, TlsCertsGetData, 2);
 
     DetectBufferTypeSetDescriptionByName("tls.certs", "TLS certificate");
 
index 9c0915434c3678e3f468c16658f73f4c7528f1f3..ef0aafc3aa3f0b36ecc51a4243fe793ff28be733 100644 (file)
@@ -84,8 +84,8 @@ void DetectTlsSubjectAltNameRegister(void)
     sigmatch_table[DETECT_TLS_SUBJECTALTNAME].flags |= SIGMATCH_NOOPT;
     sigmatch_table[DETECT_TLS_SUBJECTALTNAME].flags |= SIGMATCH_INFO_STICKY_BUFFER;
 
-    DetectAppLayerMultiRegister("tls.subjectaltname", ALPROTO_TLS, SIG_FLAG_TOCLIENT, 0,
-            TlsSubjectAltNameGetData, 2, TLS_STATE_SERVER_CERT_DONE);
+    DetectAppLayerMultiRegister("tls.subjectaltname", ALPROTO_TLS, SIG_FLAG_TOCLIENT,
+            TLS_STATE_SERVER_CERT_DONE, TlsSubjectAltNameGetData, 2);
 
     DetectBufferTypeSetDescriptionByName("tls.subjectaltname", "TLS Subject Alternative Name");