diff --git a/src/detect-base64-data.c b/src/detect-base64-data.c index eeea153d29..107b90ca42 100644 --- a/src/detect-base64-data.c +++ b/src/detect-base64-data.c @@ -77,7 +77,7 @@ int DetectBase64DataDoMatch(DetectEngineCtx *de_ctx, return DetectEngineContentInspection(de_ctx, det_ctx, s, s->sm_lists[DETECT_SM_LIST_BASE64_DATA], f, det_ctx->base64_decoded, det_ctx->base64_decoded_len, 0, - DETECT_ENGINE_CONTENT_INSPECTION_MODE_BASE64, NULL); + DETECT_ENGINE_CONTENT_INSPECTION_MODE_STATE, NULL); } return 0; diff --git a/src/detect-engine-content-inspection.h b/src/detect-engine-content-inspection.h index 3fc4b451e9..91b62d6c6b 100644 --- a/src/detect-engine-content-inspection.h +++ b/src/detect-engine-content-inspection.h @@ -24,37 +24,13 @@ #ifndef __DETECT_ENGINE_CONTENT_INSPECTION_H__ #define __DETECT_ENGINE_CONTENT_INSPECTION_H__ -/** \warning make sure to add new entries to the proper position - * wrt flow lock status +/** indication to content engine what type of data + * we're inspecting */ enum { - /* called with flow unlocked */ DETECT_ENGINE_CONTENT_INSPECTION_MODE_PAYLOAD = 0, DETECT_ENGINE_CONTENT_INSPECTION_MODE_STREAM, - - /* called with flow locked */ - DETECT_ENGINE_CONTENT_INSPECTION_MODE_DCE, - DETECT_ENGINE_CONTENT_INSPECTION_MODE_URI, - DETECT_ENGINE_CONTENT_INSPECTION_MODE_HRL, - DETECT_ENGINE_CONTENT_INSPECTION_MODE_HRUD, - DETECT_ENGINE_CONTENT_INSPECTION_MODE_HHD, - DETECT_ENGINE_CONTENT_INSPECTION_MODE_HRHD, - DETECT_ENGINE_CONTENT_INSPECTION_MODE_HCBD, - DETECT_ENGINE_CONTENT_INSPECTION_MODE_HSBD, - DETECT_ENGINE_CONTENT_INSPECTION_MODE_HCD, - DETECT_ENGINE_CONTENT_INSPECTION_MODE_HMD, - DETECT_ENGINE_CONTENT_INSPECTION_MODE_HSCD, - DETECT_ENGINE_CONTENT_INSPECTION_MODE_HSMD, - DETECT_ENGINE_CONTENT_INSPECTION_MODE_HUAD, - DETECT_ENGINE_CONTENT_INSPECTION_MODE_HHHD, - DETECT_ENGINE_CONTENT_INSPECTION_MODE_HRHHD, - DETECT_ENGINE_CONTENT_INSPECTION_MODE_DNSQUERY, - DETECT_ENGINE_CONTENT_INSPECTION_MODE_TLSSNI, - DETECT_ENGINE_CONTENT_INSPECTION_MODE_TLSISSUER, - DETECT_ENGINE_CONTENT_INSPECTION_MODE_TLSSUBJECT, - DETECT_ENGINE_CONTENT_INSPECTION_MODE_FD_SMTP, - DETECT_ENGINE_CONTENT_INSPECTION_MODE_BASE64, - DETECT_ENGINE_CONTENT_INSPECTION_MODE_TEMPLATE_BUFFER, + DETECT_ENGINE_CONTENT_INSPECTION_MODE_STATE, }; int DetectEngineContentInspection(DetectEngineCtx *de_ctx, DetectEngineThreadCtx *det_ctx, diff --git a/src/detect-engine-dcepayload.c b/src/detect-engine-dcepayload.c index 44fc98d942..5cdb10d35f 100644 --- a/src/detect-engine-dcepayload.c +++ b/src/detect-engine-dcepayload.c @@ -90,7 +90,7 @@ int DetectEngineInspectDcePayload(DetectEngineCtx *de_ctx, dce_stub_data, dce_stub_data_len, 0, - DETECT_ENGINE_CONTENT_INSPECTION_MODE_DCE, dcerpc_state); + 0, dcerpc_state); //r = DoInspectDcePayload(de_ctx, det_ctx, s, s->sm_lists[DETECT_SM_LIST_DMATCH], f, //dce_stub_data, dce_stub_data_len, dcerpc_state); if (r == 1) { @@ -113,7 +113,7 @@ int DetectEngineInspectDcePayload(DetectEngineCtx *de_ctx, dce_stub_data, dce_stub_data_len, 0, - DETECT_ENGINE_CONTENT_INSPECTION_MODE_DCE, dcerpc_state); + 0, dcerpc_state); //r = DoInspectDcePayload(de_ctx, det_ctx, s, s->sm_lists[DETECT_SM_LIST_DMATCH], f, //dce_stub_data, dce_stub_data_len, dcerpc_state); if (r == 1) { diff --git a/src/detect-engine-dns.c b/src/detect-engine-dns.c index d7a135e3a7..0dac77734f 100644 --- a/src/detect-engine-dns.c +++ b/src/detect-engine-dns.c @@ -88,7 +88,7 @@ int DetectEngineInspectDnsQueryName(ThreadVars *tv, r = DetectEngineContentInspection(de_ctx, det_ctx, s, s->sm_lists[DETECT_SM_LIST_DNSQUERYNAME_MATCH], f, buffer, buffer_len, 0, - DETECT_ENGINE_CONTENT_INSPECTION_MODE_DNSQUERY, NULL); + DETECT_ENGINE_CONTENT_INSPECTION_MODE_STATE, NULL); if (r == 1) break; } diff --git a/src/detect-engine-filedata-smtp.c b/src/detect-engine-filedata-smtp.c index 5d0d3aec15..e0fa467e9e 100644 --- a/src/detect-engine-filedata-smtp.c +++ b/src/detect-engine-filedata-smtp.c @@ -208,7 +208,7 @@ int DetectEngineInspectSMTPFiledata(ThreadVars *tv, (uint8_t *)buffer, buffer_len, stream_start_offset, - DETECT_ENGINE_CONTENT_INSPECTION_MODE_FD_SMTP, NULL); + DETECT_ENGINE_CONTENT_INSPECTION_MODE_STATE, NULL); if (match == 1) r = 1; } diff --git a/src/detect-engine-hcbd.c b/src/detect-engine-hcbd.c index 8c8ac0645e..62d12517cb 100644 --- a/src/detect-engine-hcbd.c +++ b/src/detect-engine-hcbd.c @@ -282,7 +282,7 @@ int DetectEngineInspectHttpClientBody(ThreadVars *tv, (uint8_t *)buffer, buffer_len, stream_start_offset, - DETECT_ENGINE_CONTENT_INSPECTION_MODE_HCBD, NULL); + DETECT_ENGINE_CONTENT_INSPECTION_MODE_STATE, NULL); if (r == 1) return DETECT_ENGINE_INSPECT_SIG_MATCH; diff --git a/src/detect-engine-hcd.c b/src/detect-engine-hcd.c index b43bf5096d..63ed33fe93 100644 --- a/src/detect-engine-hcd.c +++ b/src/detect-engine-hcd.c @@ -198,7 +198,7 @@ int DetectEngineInspectHttpCookie(ThreadVars *tv, (uint8_t *)bstr_ptr(h->value), bstr_len(h->value), 0, - DETECT_ENGINE_CONTENT_INSPECTION_MODE_HCD, NULL); + DETECT_ENGINE_CONTENT_INSPECTION_MODE_STATE, NULL); if (r == 1) return DETECT_ENGINE_INSPECT_SIG_MATCH; diff --git a/src/detect-engine-hhd.c b/src/detect-engine-hhd.c index fe48fdbaac..7a3af7e12e 100644 --- a/src/detect-engine-hhd.c +++ b/src/detect-engine-hhd.c @@ -338,7 +338,7 @@ int DetectEngineInspectHttpHeader(ThreadVars *tv, buffer, buffer_len, 0, - DETECT_ENGINE_CONTENT_INSPECTION_MODE_HHD, NULL); + DETECT_ENGINE_CONTENT_INSPECTION_MODE_STATE, NULL); if (r == 1) return DETECT_ENGINE_INSPECT_SIG_MATCH; diff --git a/src/detect-engine-hhhd.c b/src/detect-engine-hhhd.c index 4824db7a41..b761a1fe6c 100644 --- a/src/detect-engine-hhhd.c +++ b/src/detect-engine-hhhd.c @@ -136,7 +136,7 @@ int DetectEngineInspectHttpHH(ThreadVars *tv, f, hname, hname_len, 0, - DETECT_ENGINE_CONTENT_INSPECTION_MODE_HHHD, NULL); + DETECT_ENGINE_CONTENT_INSPECTION_MODE_STATE, NULL); if (r == 1) return DETECT_ENGINE_INSPECT_SIG_MATCH; diff --git a/src/detect-engine-hmd.c b/src/detect-engine-hmd.c index fbf92e7b8d..23b964cf98 100644 --- a/src/detect-engine-hmd.c +++ b/src/detect-engine-hmd.c @@ -134,7 +134,7 @@ int DetectEngineInspectHttpMethod(ThreadVars *tv, (uint8_t *)bstr_ptr(tx->request_method), bstr_len(tx->request_method), 0, - DETECT_ENGINE_CONTENT_INSPECTION_MODE_HMD, NULL); + DETECT_ENGINE_CONTENT_INSPECTION_MODE_STATE, NULL); if (r == 1) return DETECT_ENGINE_INSPECT_SIG_MATCH; else diff --git a/src/detect-engine-hrhd.c b/src/detect-engine-hrhd.c index 7f0a56a828..3181d45bf3 100644 --- a/src/detect-engine-hrhd.c +++ b/src/detect-engine-hrhd.c @@ -202,7 +202,7 @@ int DetectEngineInspectHttpRawHeader(ThreadVars *tv, headers_raw, headers_raw_len, 0, - DETECT_ENGINE_CONTENT_INSPECTION_MODE_HRHD, NULL); + DETECT_ENGINE_CONTENT_INSPECTION_MODE_STATE, NULL); if (r == 1) return DETECT_ENGINE_INSPECT_SIG_MATCH; diff --git a/src/detect-engine-hrhhd.c b/src/detect-engine-hrhhd.c index 2f4edfbcf7..02db16fe1a 100644 --- a/src/detect-engine-hrhhd.c +++ b/src/detect-engine-hrhhd.c @@ -159,7 +159,7 @@ int DetectEngineInspectHttpHRH(ThreadVars *tv, f, hname, hname_len, 0, - DETECT_ENGINE_CONTENT_INSPECTION_MODE_HRHHD, NULL); + DETECT_ENGINE_CONTENT_INSPECTION_MODE_STATE, NULL); if (r == 1) return DETECT_ENGINE_INSPECT_SIG_MATCH; diff --git a/src/detect-engine-hrl.c b/src/detect-engine-hrl.c index 30dd06441f..244f64436b 100644 --- a/src/detect-engine-hrl.c +++ b/src/detect-engine-hrl.c @@ -94,7 +94,7 @@ int DetectEngineInspectHttpRequestLine(ThreadVars *tv, bstr_ptr(tx->request_line), bstr_len(tx->request_line), 0, - DETECT_ENGINE_CONTENT_INSPECTION_MODE_HRL, NULL); + DETECT_ENGINE_CONTENT_INSPECTION_MODE_STATE, NULL); if (r == 1) { return DETECT_ENGINE_INSPECT_SIG_MATCH; } else { diff --git a/src/detect-engine-hrud.c b/src/detect-engine-hrud.c index e0a0d50805..4957f3292f 100644 --- a/src/detect-engine-hrud.c +++ b/src/detect-engine-hrud.c @@ -136,7 +136,7 @@ int DetectEngineInspectHttpRawUri(ThreadVars *tv, (uint8_t *)bstr_ptr(tx->request_uri), bstr_len(tx->request_uri), 0, - DETECT_ENGINE_CONTENT_INSPECTION_MODE_HRUD, NULL); + DETECT_ENGINE_CONTENT_INSPECTION_MODE_STATE, NULL); if (r == 1) return DETECT_ENGINE_INSPECT_SIG_MATCH; else diff --git a/src/detect-engine-hsbd.c b/src/detect-engine-hsbd.c index 8f94954535..84856fc51b 100644 --- a/src/detect-engine-hsbd.c +++ b/src/detect-engine-hsbd.c @@ -288,7 +288,7 @@ int DetectEngineInspectHttpServerBody(ThreadVars *tv, (uint8_t *)buffer, buffer_len, stream_start_offset, - DETECT_ENGINE_CONTENT_INSPECTION_MODE_HSBD, NULL); + DETECT_ENGINE_CONTENT_INSPECTION_MODE_STATE, NULL); if (r == 1) return DETECT_ENGINE_INSPECT_SIG_MATCH; diff --git a/src/detect-engine-hscd.c b/src/detect-engine-hscd.c index 929f788ff5..e8e94822d0 100644 --- a/src/detect-engine-hscd.c +++ b/src/detect-engine-hscd.c @@ -134,7 +134,7 @@ int DetectEngineInspectHttpStatCode(ThreadVars *tv, (uint8_t *)bstr_ptr(tx->response_status), bstr_len(tx->response_status), 0, - DETECT_ENGINE_CONTENT_INSPECTION_MODE_HSCD, NULL); + DETECT_ENGINE_CONTENT_INSPECTION_MODE_STATE, NULL); if (r == 1) return DETECT_ENGINE_INSPECT_SIG_MATCH; else diff --git a/src/detect-engine-hsmd.c b/src/detect-engine-hsmd.c index c707ab381a..68811eea7b 100644 --- a/src/detect-engine-hsmd.c +++ b/src/detect-engine-hsmd.c @@ -134,7 +134,7 @@ int DetectEngineInspectHttpStatMsg(ThreadVars *tv, (uint8_t *)bstr_ptr(tx->response_message), bstr_len(tx->response_message), 0, - DETECT_ENGINE_CONTENT_INSPECTION_MODE_HSMD, NULL); + DETECT_ENGINE_CONTENT_INSPECTION_MODE_STATE, NULL); if (r == 1) return DETECT_ENGINE_INSPECT_SIG_MATCH; else diff --git a/src/detect-engine-hua.c b/src/detect-engine-hua.c index b057db38ae..66c8859cb2 100644 --- a/src/detect-engine-hua.c +++ b/src/detect-engine-hua.c @@ -142,7 +142,7 @@ int DetectEngineInspectHttpUA(ThreadVars *tv, (uint8_t *)bstr_ptr(h->value), bstr_len(h->value), 0, - DETECT_ENGINE_CONTENT_INSPECTION_MODE_HUAD, NULL); + DETECT_ENGINE_CONTENT_INSPECTION_MODE_STATE, NULL); if (r == 1) return DETECT_ENGINE_INSPECT_SIG_MATCH; diff --git a/src/detect-engine-template.c b/src/detect-engine-template.c index 1d70d11fed..70785da1e3 100644 --- a/src/detect-engine-template.c +++ b/src/detect-engine-template.c @@ -47,13 +47,13 @@ int DetectEngineInspectTemplateBuffer(ThreadVars *tv, DetectEngineCtx *de_ctx, ret = DetectEngineContentInspection(de_ctx, det_ctx, s, s->sm_lists[DETECT_SM_LIST_TEMPLATE_BUFFER_MATCH], f, tx->request_buffer, tx->request_buffer_len, 0, - DETECT_ENGINE_CONTENT_INSPECTION_MODE_TEMPLATE_BUFFER, NULL); + DETECT_ENGINE_CONTENT_INSPECTION_MODE_STATE, NULL); } else if (flags & STREAM_TOCLIENT && tx->response_buffer != NULL) { ret = DetectEngineContentInspection(de_ctx, det_ctx, s, s->sm_lists[DETECT_SM_LIST_TEMPLATE_BUFFER_MATCH], f, tx->response_buffer, tx->response_buffer_len, 0, - DETECT_ENGINE_CONTENT_INSPECTION_MODE_TEMPLATE_BUFFER, NULL); + DETECT_ENGINE_CONTENT_INSPECTION_MODE_STATE, NULL); } SCLogNotice("Returning %d.", ret); diff --git a/src/detect-engine-tls.c b/src/detect-engine-tls.c index 6e6f025a7e..6adac0f8b8 100644 --- a/src/detect-engine-tls.c +++ b/src/detect-engine-tls.c @@ -117,7 +117,7 @@ int DetectEngineInspectTlsSni(ThreadVars *tv, DetectEngineCtx *de_ctx, cnt = DetectEngineContentInspection(de_ctx, det_ctx, s, s->sm_lists[DETECT_SM_LIST_TLSSNI_MATCH], f, buffer, buffer_len, 0, - DETECT_ENGINE_CONTENT_INSPECTION_MODE_TLSSNI, NULL); + DETECT_ENGINE_CONTENT_INSPECTION_MODE_STATE, NULL); return cnt; } @@ -193,7 +193,7 @@ int DetectEngineInspectTlsIssuer(ThreadVars *tv, DetectEngineCtx *de_ctx, cnt = DetectEngineContentInspection(de_ctx, det_ctx, s, s->sm_lists[DETECT_SM_LIST_TLSISSUER_MATCH], f, buffer, buffer_len, 0, - DETECT_ENGINE_CONTENT_INSPECTION_MODE_TLSISSUER, NULL); + DETECT_ENGINE_CONTENT_INSPECTION_MODE_STATE, NULL); return cnt; } @@ -269,7 +269,7 @@ int DetectEngineInspectTlsSubject(ThreadVars *tv, DetectEngineCtx *de_ctx, cnt = DetectEngineContentInspection(de_ctx, det_ctx, s, s->sm_lists[DETECT_SM_LIST_TLSSUBJECT_MATCH], f, buffer, buffer_len, 0, - DETECT_ENGINE_CONTENT_INSPECTION_MODE_TLSSUBJECT, NULL); + DETECT_ENGINE_CONTENT_INSPECTION_MODE_STATE, NULL); return cnt; } diff --git a/src/detect-engine-uri.c b/src/detect-engine-uri.c index 7b6ad2ab1b..caf5c10ecd 100644 --- a/src/detect-engine-uri.c +++ b/src/detect-engine-uri.c @@ -136,7 +136,7 @@ int DetectEngineInspectPacketUris(ThreadVars *tv, bstr_ptr(tx_ud->request_uri_normalized), bstr_len(tx_ud->request_uri_normalized), 0, - DETECT_ENGINE_CONTENT_INSPECTION_MODE_URI, NULL); + DETECT_ENGINE_CONTENT_INSPECTION_MODE_STATE, NULL); if (r == 1) { return DETECT_ENGINE_INSPECT_SIG_MATCH; } else {