diff --git a/src/detect-engine-event.c b/src/detect-engine-event.c index 4e87881f65..8c26552794 100644 --- a/src/detect-engine-event.c +++ b/src/detect-engine-event.c @@ -47,6 +47,7 @@ static pcre_extra *parse_regex_study; int DetectEngineEventMatch (ThreadVars *, DetectEngineThreadCtx *, Packet *, Signature *, SigMatch *); static int DetectEngineEventSetup (DetectEngineCtx *, Signature *, char *); +static int DetectStreamEventSetup (DetectEngineCtx *, Signature *, char *); void EngineEventRegisterTests(void); @@ -67,6 +68,13 @@ void DetectEngineEventRegister (void) { sigmatch_table[DETECT_DECODE_EVENT].Free = NULL; sigmatch_table[DETECT_DECODE_EVENT].flags |= SIGMATCH_DEONLY_COMPAT; + sigmatch_table[DETECT_STREAM_EVENT].name = "stream-event"; + sigmatch_table[DETECT_STREAM_EVENT].Match = DetectEngineEventMatch; + sigmatch_table[DETECT_STREAM_EVENT].Setup = DetectStreamEventSetup; + sigmatch_table[DETECT_STREAM_EVENT].Free = NULL; + sigmatch_table[DETECT_STREAM_EVENT].flags |= SIGMATCH_DEONLY_COMPAT; + + const char *eb; int eo; int opts = 0; @@ -207,6 +215,7 @@ error: return -1; } + /** * \brief this function will free memory associated with DetectEngineEventData * @@ -216,6 +225,19 @@ void DetectEngineEventFree(DetectEngineEventData *de) { if(de) SCFree(de); } +/** + * \brief this function Setup the 'stream-event' keyword by resolving the alias +*/ +static int DetectStreamEventSetup (DetectEngineCtx *de_ctx, Signature *s, char *rawstr) +{ + char srawstr[MAX_SUBSTRINGS * 2] = "stream."; + + /* stream:$EVENT alias command develop as decode-event:stream.$EVENT */ + strncat(srawstr, rawstr, 2 * MAX_SUBSTRINGS - strlen("stream.") - 1); + + return DetectEngineEventSetup (de_ctx, s, srawstr); +} + /* * ONLY TESTS BELOW THIS COMMENT */ diff --git a/src/detect.h b/src/detect.h index 07b002a5a8..8b5a1ea1d5 100644 --- a/src/detect.h +++ b/src/detect.h @@ -1013,6 +1013,7 @@ enum { DETECT_ASN1, DETECT_ENGINE_EVENT, + DETECT_STREAM_EVENT, /* make sure this stays last */ DETECT_TBLSIZE,