From e28e98bcaaf42b50a4cf71584eb332c1d7ce1e88 Mon Sep 17 00:00:00 2001 From: Victor Julien Date: Fri, 23 Sep 2016 08:45:29 +0200 Subject: [PATCH] tls_cert_subject: register inspect engine from keyword --- src/detect-engine.c | 6 ------ src/detect-tls-cert-subject.c | 5 +++++ src/detect-tls-cert-validity.c | 5 +++++ 3 files changed, 10 insertions(+), 6 deletions(-) diff --git a/src/detect-engine.c b/src/detect-engine.c index 7b1238f45c..a9455499f4 100644 --- a/src/detect-engine.c +++ b/src/detect-engine.c @@ -157,12 +157,6 @@ void DetectEngineRegisterAppInspectionEngines(void) { ALPROTO_TLS, DETECT_SM_LIST_TLSISSUER_MATCH, DetectEngineInspectTlsIssuer }, - { ALPROTO_TLS, - DETECT_SM_LIST_TLSSUBJECT_MATCH, - DetectEngineInspectTlsSubject }, - { ALPROTO_TLS, - DETECT_SM_LIST_TLSVALIDITY_MATCH, - DetectEngineInspectTlsValidity }, /* Template. */ { ALPROTO_TEMPLATE, DETECT_SM_LIST_TEMPLATE_BUFFER_MATCH, diff --git a/src/detect-tls-cert-subject.c b/src/detect-tls-cert-subject.c index 9a3d4b464f..f6d62f438a 100644 --- a/src/detect-tls-cert-subject.c +++ b/src/detect-tls-cert-subject.c @@ -75,6 +75,11 @@ void DetectTlsSubjectRegister(void) DetectMpmAppLayerRegister("tls_cert_subject", SIG_FLAG_TOCLIENT, DETECT_SM_LIST_TLSSUBJECT_MATCH, 2, PrefilterTxTlsSubjectRegister); + + DetectAppLayerInspectEngineRegister(ALPROTO_TLS, SIG_FLAG_TOCLIENT, + DETECT_SM_LIST_TLSSUBJECT_MATCH, + DetectEngineInspectTlsSubject); + } /** diff --git a/src/detect-tls-cert-validity.c b/src/detect-tls-cert-validity.c index 47f009cce1..08d0122263 100644 --- a/src/detect-tls-cert-validity.c +++ b/src/detect-tls-cert-validity.c @@ -35,6 +35,7 @@ #include "detect-content.h" #include "detect-pcre.h" #include "detect-tls-cert-validity.h" +#include "detect-engine-tls.h" #include "flow.h" #include "flow-util.h" @@ -93,6 +94,10 @@ void DetectTlsValidityRegister (void) sigmatch_table[DETECT_AL_TLS_NOTAFTER].RegisterTests = TlsNotAfterRegisterTests; DetectSetupParseRegexes(PARSE_REGEX, &parse_regex, &parse_regex_study); + + DetectAppLayerInspectEngineRegister(ALPROTO_TLS, SIG_FLAG_TOCLIENT, + DETECT_SM_LIST_TLSVALIDITY_MATCH, + DetectEngineInspectTlsValidity); } /**