detect/content: pretty print pattern directly

pull/14618/head
Victor Julien 2 years ago
parent 374c191268
commit c20c7c1dfa

@ -740,18 +740,19 @@ static inline bool NeedsAsHex(uint8_t c)
return false;
}
void DetectContentPatternPrettyPrint(const DetectContentData *cd, char *str, size_t str_len)
void DetectContentPatternPrettyPrint(
const uint8_t *pat, const uint16_t pat_len, char *str, size_t str_len)
{
bool hex = false;
for (uint16_t i = 0; i < cd->content_len; i++) {
if (NeedsAsHex(cd->content[i])) {
for (uint16_t i = 0; i < pat_len; i++) {
if (NeedsAsHex(pat[i])) {
char hex_str[4];
snprintf(hex_str, sizeof(hex_str), "%s%02X", !hex ? "|" : " ", cd->content[i]);
snprintf(hex_str, sizeof(hex_str), "%s%02X", !hex ? "|" : " ", pat[i]);
strlcat(str, hex_str, str_len);
hex = true;
} else {
char p_str[3];
snprintf(p_str, sizeof(p_str), "%s%c", hex ? "|" : "", cd->content[i]);
snprintf(p_str, sizeof(p_str), "%s%c", hex ? "|" : "", pat[i]);
strlcat(str, p_str, str_len);
hex = false;
}

@ -129,7 +129,8 @@ void DetectContentFree(DetectEngineCtx *, void *);
bool DetectContentPMATCHValidateCallback(const Signature *s);
void DetectContentPropagateLimits(Signature *s);
void DetectContentPatternPrettyPrint(const DetectContentData *cd, char *str, size_t str_len);
void DetectContentPatternPrettyPrint(
const uint8_t *pat, const uint16_t pat_len, char *str, size_t str_len);
void SigParseRequiredContentSize(
const Signature *s, const uint64_t max, const SigMatch *sm, int *len, int *offset);
int DetectContentConvertToNocase(DetectEngineCtx *de_ctx, DetectContentData *cd);

@ -694,7 +694,7 @@ static bool LooksLikeHTTPUA(const uint8_t *buf, uint16_t len)
static void DumpContent(SCJsonBuilder *js, const DetectContentData *cd)
{
char pattern_str[1024] = "";
DetectContentPatternPrettyPrint(cd, pattern_str, sizeof(pattern_str));
DetectContentPatternPrettyPrint(cd->content, cd->content_len, pattern_str, sizeof(pattern_str));
SCJbSetString(js, "pattern", pattern_str);
SCJbSetUint(js, "length", cd->content_len);
@ -1569,7 +1569,7 @@ void DumpPatterns(DetectEngineCtx *de_ctx)
htb != NULL; htb = HashListTableGetListNext(htb)) {
char str[1024] = "";
DetectPatternTracker *p = HashListTableGetListData(htb);
DetectContentPatternPrettyPrint(p->cd, str, sizeof(str));
DetectContentPatternPrettyPrint(p->cd->content, p->cd->content_len, str, sizeof(str));
SCJsonBuilder *jb = arrays[p->sm_list];
if (arrays[p->sm_list] == NULL) {

Loading…
Cancel
Save