Moving urilen inspection to detect-engine-uri. Adding unittests for pcre /U and urilen, in combination with uricontent

remotes/origin/master-1.0.x
Pablo Rincon 15 years ago committed by Victor Julien
parent 36e4b1830e
commit bcb0b9ef9b

File diff suppressed because it is too large Load Diff

@ -62,7 +62,7 @@ void DetectUrilenRegister(void)
sigmatch_table[DETECT_AL_URILEN].name = "urilen";
sigmatch_table[DETECT_AL_URILEN].Match = NULL;
sigmatch_table[DETECT_AL_URILEN].alproto = ALPROTO_HTTP;
sigmatch_table[DETECT_AL_URILEN].AppLayerMatch = DetectUrilenMatch;
sigmatch_table[DETECT_AL_URILEN].AppLayerMatch = NULL /**< We handle this at detect-engine-uri.c now */;
sigmatch_table[DETECT_AL_URILEN].Setup = DetectUrilenSetup;
sigmatch_table[DETECT_AL_URILEN].Free = DetectUrilenFree;
sigmatch_table[DETECT_AL_URILEN].RegisterTests = DetectUrilenRegisterTests;
@ -301,7 +301,7 @@ static int DetectUrilenSetup (DetectEngineCtx *de_ctx, Signature *s, char *urile
sm->type = DETECT_AL_URILEN;
sm->ctx = (void *)urilend;
SigMatchAppendAppLayer(s, sm);
SigMatchAppendUricontent(s,sm);
/* Flagged the signature as to inspect the app layer data */
s->flags |= SIG_FLAG_APPLAYER;

@ -35,6 +35,8 @@ typedef struct DetectUrilenData_ {
uint8_t mode; /**< operator used in the signature */
}DetectUrilenData;
int DetectUrilenMatch (ThreadVars *, DetectEngineThreadCtx *, Flow *,
uint8_t, void *, Signature *, SigMatch *);
void DetectUrilenRegister(void);
#endif /* _DETECT_URILEN_H */

Loading…
Cancel
Save