From 63603fe14aff010af8a67b1c93c9a75eefcae712 Mon Sep 17 00:00:00 2001 From: Philippe Antoine Date: Wed, 1 Apr 2026 22:06:19 +0200 Subject: [PATCH] detect/snmp: sticky buffers at progress 1 Since snmp txs are created at progress 1 which is the completion, this does not change detection, except allowing firewall mode to use these keywords with generic hook like snmp:request_complete Ticket: 8395 --- rust/src/snmp/detect.rs | 12 +++++++----- 1 file changed, 7 insertions(+), 5 deletions(-) diff --git a/rust/src/snmp/detect.rs b/rust/src/snmp/detect.rs index ebfba6430e..167c404f72 100644 --- a/rust/src/snmp/detect.rs +++ b/rust/src/snmp/detect.rs @@ -30,9 +30,9 @@ use std::ffi::CStr; use std::os::raw::{c_int, c_void}; use suricata_sys::sys::{ DetectEngineCtx, DetectEngineThreadCtx, Flow, SCDetectBufferSetActiveList, - SCDetectHelperBufferMpmRegister, SCDetectHelperBufferProgressRegister, SCDetectHelperKeywordRegister, - SCDetectSignatureSetAppProto, SCSigMatchAppendSMToList, SCSigTableAppLiteElmt, SigMatchCtx, - Signature, + SCDetectHelperBufferProgressMpmRegister, SCDetectHelperBufferProgressRegister, + SCDetectHelperKeywordRegister, SCDetectSignatureSetAppProto, SCSigMatchAppendSMToList, + SCSigTableAppLiteElmt, SigMatchCtx, Signature, }; static mut G_SNMP_VERSION_KW_ID: u16 = 0; @@ -229,12 +229,13 @@ pub(super) unsafe extern "C" fn detect_snmp_register() { setup: snmp_detect_usm_setup, }; let _g_snmp_usm_kw_id = helper_keyword_register_sticky_buffer(&kw); - G_SNMP_USM_BUFFER_ID = SCDetectHelperBufferMpmRegister( + G_SNMP_USM_BUFFER_ID = SCDetectHelperBufferProgressMpmRegister( b"snmp.usm\0".as_ptr() as *const libc::c_char, b"SNMP USM\0".as_ptr() as *const libc::c_char, ALPROTO_SNMP, STREAM_TOSERVER | STREAM_TOCLIENT, Some(snmp_detect_usm_get_data), + 1, ); let kw = SigTableElmtStickyBuffer { @@ -244,11 +245,12 @@ pub(super) unsafe extern "C" fn detect_snmp_register() { setup: snmp_detect_community_setup, }; let _g_snmp_community_kw_id = helper_keyword_register_sticky_buffer(&kw); - G_SNMP_COMMUNITY_BUFFER_ID = SCDetectHelperBufferMpmRegister( + G_SNMP_COMMUNITY_BUFFER_ID = SCDetectHelperBufferProgressMpmRegister( b"snmp.community\0".as_ptr() as *const libc::c_char, b"SNMP Community identifier\0".as_ptr() as *const libc::c_char, ALPROTO_SNMP, STREAM_TOSERVER | STREAM_TOCLIENT, Some(snmp_detect_community_get_data), + 1, ); }