detect/firewall: support hook LTE mode for built-in hooks

LTE support depended on registered hook names, but did not support the
built-in names. This commit adds the support.

Ticket: #8645.
pull/15601/head
Victor Julien 5 months ago
parent b02fa53134
commit d154484cc6

@ -945,10 +945,11 @@ static int SetupNonPrefilter(DetectEngineCtx *de_ctx, SigGroupHead *sgh)
for (uint8_t state = 0; state < s->app_progress_hook; state++) { for (uint8_t state = 0; state < s->app_progress_hook; state++) {
SCLogDebug("handle HOOK %u LTE", state); SCLogDebug("handle HOOK %u LTE", state);
const int dir = (s->flags & SIG_FLAG_TOSERVER) ? 0 : 1; const int dir = (s->flags & SIG_FLAG_TOSERVER) ? 0 : 1;
const char *pname = AppLayerParserGetStateNameById(IPPROTO_TCP, // TODO const char *pname = DetectEngineAppHookToName(
s->alproto, state, dir == 0 ? STREAM_TOSERVER : STREAM_TOCLIENT); s->alproto, state, dir == 0 ? STREAM_TOSERVER : STREAM_TOCLIENT);
if (pname == NULL) if (pname == NULL) {
goto error; goto error;
}
const int sm_list = DetectEngineAppHookToSmlist( const int sm_list = DetectEngineAppHookToSmlist(
s->alproto, state, dir == 0 ? STREAM_TOSERVER : STREAM_TOCLIENT); s->alproto, state, dir == 0 ? STREAM_TOSERVER : STREAM_TOCLIENT);
if (TxNonPFAddSig(de_ctx, tx_engines_hash, s->alproto, dir, (int16_t)state, sm_list, if (TxNonPFAddSig(de_ctx, tx_engines_hash, s->alproto, dir, (int16_t)state, sm_list,

@ -849,10 +849,11 @@ int DetectEngineAppHookToSmlist(const AppProto p, const uint8_t state, const int
if (strcmp(app_proto, "http") == 0) if (strcmp(app_proto, "http") == 0)
app_proto = "http1"; app_proto = "http1";
const char *name = AppLayerParserGetStateNameById( const char *name =
IPPROTO_TCP, p, state, direction & (STREAM_TOSERVER | STREAM_TOCLIENT)); DetectEngineAppHookToName(p, state, direction & (STREAM_TOSERVER | STREAM_TOCLIENT));
if (name == NULL) if (name == NULL) {
return -1; return -1;
}
char generic_hook_name[256]; char generic_hook_name[256];
snprintf(generic_hook_name, sizeof(generic_hook_name), "%s:%s:generic", app_proto, name); snprintf(generic_hook_name, sizeof(generic_hook_name), "%s:%s:generic", app_proto, name);

Loading…
Cancel
Save