detect: add helper for getting hook name

To fetch hook name from app-layer, or use built-ins.
pull/15601/head
Victor Julien 5 months ago
parent 2a2cb40336
commit b02fa53134

@ -805,6 +805,39 @@ static void AppendAppInspectEngine(DetectEngineCtx *de_ctx,
s->init_data->init_flags |= SIG_FLAG_INIT_STATE_MATCH;
}
/**
* \param direction STREAM_TOSERVER or STREAM_TOCLIENT
*/
const char *DetectEngineAppHookToName(
const AppProto p, const uint8_t state, const uint8_t direction)
{
if (!((direction & (STREAM_TOSERVER | STREAM_TOCLIENT)) == STREAM_TOSERVER) &&
!((direction & (STREAM_TOSERVER | STREAM_TOCLIENT)) == STREAM_TOCLIENT))
return NULL;
const char *pname = AppLayerParserGetStateNameById(IPPROTO_TCP, // TODO
p, state, direction);
if (pname == NULL) {
if (state == 0) {
if (direction == STREAM_TOSERVER) {
pname = "request_started";
} else {
pname = "response_started";
}
} else {
const int complete = AppLayerParserGetStateProgressCompletionStatus(p, direction);
if (state == complete) {
if (direction == STREAM_TOSERVER) {
pname = "request_complete";
} else {
pname = "response_complete";
}
}
}
}
return pname;
}
/** \brief get the sm_list for a app hook */
int DetectEngineAppHookToSmlist(const AppProto p, const uint8_t state, const int direction)
{

@ -210,6 +210,8 @@ void DetectLowerSetupCallback(
void DeStateRegisterTests(void);
const char *DetectEngineAppHookToName(
const AppProto p, const uint8_t state, const uint8_t direction);
int DetectEngineAppHookToSmlist(const AppProto p, const uint8_t state, const int direction);
#endif /* SURICATA_DETECT_ENGINE_H */

Loading…
Cancel
Save