Moving urilen inspection to detect-engine-uri. Adding unittests for pcre /U and urilen, in combination with uricontent

remotes/origin/master-1.0.x
Pablo Rincon 15 years ago committed by Victor Julien
parent 36e4b1830e
commit bcb0b9ef9b

File diff suppressed because it is too large Load Diff

@ -62,7 +62,7 @@ void DetectUrilenRegister(void)
sigmatch_table[DETECT_AL_URILEN].name = "urilen"; sigmatch_table[DETECT_AL_URILEN].name = "urilen";
sigmatch_table[DETECT_AL_URILEN].Match = NULL; sigmatch_table[DETECT_AL_URILEN].Match = NULL;
sigmatch_table[DETECT_AL_URILEN].alproto = ALPROTO_HTTP; sigmatch_table[DETECT_AL_URILEN].alproto = ALPROTO_HTTP;
sigmatch_table[DETECT_AL_URILEN].AppLayerMatch = DetectUrilenMatch; sigmatch_table[DETECT_AL_URILEN].AppLayerMatch = NULL /**< We handle this at detect-engine-uri.c now */;
sigmatch_table[DETECT_AL_URILEN].Setup = DetectUrilenSetup; sigmatch_table[DETECT_AL_URILEN].Setup = DetectUrilenSetup;
sigmatch_table[DETECT_AL_URILEN].Free = DetectUrilenFree; sigmatch_table[DETECT_AL_URILEN].Free = DetectUrilenFree;
sigmatch_table[DETECT_AL_URILEN].RegisterTests = DetectUrilenRegisterTests; sigmatch_table[DETECT_AL_URILEN].RegisterTests = DetectUrilenRegisterTests;
@ -301,7 +301,7 @@ static int DetectUrilenSetup (DetectEngineCtx *de_ctx, Signature *s, char *urile
sm->type = DETECT_AL_URILEN; sm->type = DETECT_AL_URILEN;
sm->ctx = (void *)urilend; sm->ctx = (void *)urilend;
SigMatchAppendAppLayer(s, sm); SigMatchAppendUricontent(s,sm);
/* Flagged the signature as to inspect the app layer data */ /* Flagged the signature as to inspect the app layer data */
s->flags |= SIG_FLAG_APPLAYER; s->flags |= SIG_FLAG_APPLAYER;

@ -35,6 +35,8 @@ typedef struct DetectUrilenData_ {
uint8_t mode; /**< operator used in the signature */ uint8_t mode; /**< operator used in the signature */
}DetectUrilenData; }DetectUrilenData;
int DetectUrilenMatch (ThreadVars *, DetectEngineThreadCtx *, Flow *,
uint8_t, void *, Signature *, SigMatch *);
void DetectUrilenRegister(void); void DetectUrilenRegister(void);
#endif /* _DETECT_URILEN_H */ #endif /* _DETECT_URILEN_H */

Loading…
Cancel
Save