detect/snmp: sticky buffers at progress 1

Since snmp txs are created at progress 1 which is the completion,
this does not change detection, except allowing firewall mode
to use these keywords with generic hook like
snmp:request_complete

Ticket: 8395
pull/15217/head
Philippe Antoine 4 months ago committed by Victor Julien
parent 8f824458c2
commit 63603fe14a

@ -30,9 +30,9 @@ use std::ffi::CStr;
use std::os::raw::{c_int, c_void};
use suricata_sys::sys::{
DetectEngineCtx, DetectEngineThreadCtx, Flow, SCDetectBufferSetActiveList,
SCDetectHelperBufferMpmRegister, SCDetectHelperBufferProgressRegister, SCDetectHelperKeywordRegister,
SCDetectSignatureSetAppProto, SCSigMatchAppendSMToList, SCSigTableAppLiteElmt, SigMatchCtx,
Signature,
SCDetectHelperBufferProgressMpmRegister, SCDetectHelperBufferProgressRegister,
SCDetectHelperKeywordRegister, SCDetectSignatureSetAppProto, SCSigMatchAppendSMToList,
SCSigTableAppLiteElmt, SigMatchCtx, Signature,
};
static mut G_SNMP_VERSION_KW_ID: u16 = 0;
@ -229,12 +229,13 @@ pub(super) unsafe extern "C" fn detect_snmp_register() {
setup: snmp_detect_usm_setup,
};
let _g_snmp_usm_kw_id = helper_keyword_register_sticky_buffer(&kw);
G_SNMP_USM_BUFFER_ID = SCDetectHelperBufferMpmRegister(
G_SNMP_USM_BUFFER_ID = SCDetectHelperBufferProgressMpmRegister(
b"snmp.usm\0".as_ptr() as *const libc::c_char,
b"SNMP USM\0".as_ptr() as *const libc::c_char,
ALPROTO_SNMP,
STREAM_TOSERVER | STREAM_TOCLIENT,
Some(snmp_detect_usm_get_data),
1,
);
let kw = SigTableElmtStickyBuffer {
@ -244,11 +245,12 @@ pub(super) unsafe extern "C" fn detect_snmp_register() {
setup: snmp_detect_community_setup,
};
let _g_snmp_community_kw_id = helper_keyword_register_sticky_buffer(&kw);
G_SNMP_COMMUNITY_BUFFER_ID = SCDetectHelperBufferMpmRegister(
G_SNMP_COMMUNITY_BUFFER_ID = SCDetectHelperBufferProgressMpmRegister(
b"snmp.community\0".as_ptr() as *const libc::c_char,
b"SNMP Community identifier\0".as_ptr() as *const libc::c_char,
ALPROTO_SNMP,
STREAM_TOSERVER | STREAM_TOCLIENT,
Some(snmp_detect_community_get_data),
1,
);
}

Loading…
Cancel
Save