detect/content: pretty print pattern directly

pull/14618/head
Victor Julien 2 years ago
parent 374c191268
commit c20c7c1dfa

@ -740,18 +740,19 @@ static inline bool NeedsAsHex(uint8_t c)
return false; return false;
} }
void DetectContentPatternPrettyPrint(const DetectContentData *cd, char *str, size_t str_len) void DetectContentPatternPrettyPrint(
const uint8_t *pat, const uint16_t pat_len, char *str, size_t str_len)
{ {
bool hex = false; bool hex = false;
for (uint16_t i = 0; i < cd->content_len; i++) { for (uint16_t i = 0; i < pat_len; i++) {
if (NeedsAsHex(cd->content[i])) { if (NeedsAsHex(pat[i])) {
char hex_str[4]; char hex_str[4];
snprintf(hex_str, sizeof(hex_str), "%s%02X", !hex ? "|" : " ", cd->content[i]); snprintf(hex_str, sizeof(hex_str), "%s%02X", !hex ? "|" : " ", pat[i]);
strlcat(str, hex_str, str_len); strlcat(str, hex_str, str_len);
hex = true; hex = true;
} else { } else {
char p_str[3]; char p_str[3];
snprintf(p_str, sizeof(p_str), "%s%c", hex ? "|" : "", cd->content[i]); snprintf(p_str, sizeof(p_str), "%s%c", hex ? "|" : "", pat[i]);
strlcat(str, p_str, str_len); strlcat(str, p_str, str_len);
hex = false; hex = false;
} }

@ -129,7 +129,8 @@ void DetectContentFree(DetectEngineCtx *, void *);
bool DetectContentPMATCHValidateCallback(const Signature *s); bool DetectContentPMATCHValidateCallback(const Signature *s);
void DetectContentPropagateLimits(Signature *s); void DetectContentPropagateLimits(Signature *s);
void DetectContentPatternPrettyPrint(const DetectContentData *cd, char *str, size_t str_len); void DetectContentPatternPrettyPrint(
const uint8_t *pat, const uint16_t pat_len, char *str, size_t str_len);
void SigParseRequiredContentSize( void SigParseRequiredContentSize(
const Signature *s, const uint64_t max, const SigMatch *sm, int *len, int *offset); const Signature *s, const uint64_t max, const SigMatch *sm, int *len, int *offset);
int DetectContentConvertToNocase(DetectEngineCtx *de_ctx, DetectContentData *cd); int DetectContentConvertToNocase(DetectEngineCtx *de_ctx, DetectContentData *cd);

@ -694,7 +694,7 @@ static bool LooksLikeHTTPUA(const uint8_t *buf, uint16_t len)
static void DumpContent(SCJsonBuilder *js, const DetectContentData *cd) static void DumpContent(SCJsonBuilder *js, const DetectContentData *cd)
{ {
char pattern_str[1024] = ""; char pattern_str[1024] = "";
DetectContentPatternPrettyPrint(cd, pattern_str, sizeof(pattern_str)); DetectContentPatternPrettyPrint(cd->content, cd->content_len, pattern_str, sizeof(pattern_str));
SCJbSetString(js, "pattern", pattern_str); SCJbSetString(js, "pattern", pattern_str);
SCJbSetUint(js, "length", cd->content_len); SCJbSetUint(js, "length", cd->content_len);
@ -1569,7 +1569,7 @@ void DumpPatterns(DetectEngineCtx *de_ctx)
htb != NULL; htb = HashListTableGetListNext(htb)) { htb != NULL; htb = HashListTableGetListNext(htb)) {
char str[1024] = ""; char str[1024] = "";
DetectPatternTracker *p = HashListTableGetListData(htb); DetectPatternTracker *p = HashListTableGetListData(htb);
DetectContentPatternPrettyPrint(p->cd, str, sizeof(str)); DetectContentPatternPrettyPrint(p->cd->content, p->cd->content_len, str, sizeof(str));
SCJsonBuilder *jb = arrays[p->sm_list]; SCJsonBuilder *jb = arrays[p->sm_list];
if (arrays[p->sm_list] == NULL) { if (arrays[p->sm_list] == NULL) {

Loading…
Cancel
Save