signature: adds file flag for file_data keyword

So that SigValidate can check if a protocol not supporting
files was set after this keyword
pull/5059/head
Philippe Antoine 5 years ago committed by Victor Julien
parent baf5f52f22
commit e5d4332ede

@ -189,6 +189,7 @@ static int DetectFiledataSetup (DetectEngineCtx *de_ctx, Signature *s, const cha
if (DetectBufferSetActiveList(s, DetectBufferTypeGetByName("file_data")) < 0) if (DetectBufferSetActiveList(s, DetectBufferTypeGetByName("file_data")) < 0)
return -1; return -1;
s->init_data->init_flags |= SIG_FLAG_INIT_FILEDATA;
SetupDetectEngineConfig(de_ctx); SetupDetectEngineConfig(de_ctx);
return 0; return 0;
} }

@ -1845,7 +1845,8 @@ static int SigValidate(DetectEngineCtx *de_ctx, Signature *s)
} }
#endif #endif
if ((s->flags & SIG_FLAG_FILESTORE) || s->file_flags != 0) { if ((s->flags & SIG_FLAG_FILESTORE) || s->file_flags != 0 ||
(s->init_data->init_flags & SIG_FLAG_INIT_FILEDATA)) {
if (s->alproto != ALPROTO_UNKNOWN && if (s->alproto != ALPROTO_UNKNOWN &&
!AppLayerParserSupportsFiles(IPPROTO_TCP, s->alproto)) !AppLayerParserSupportsFiles(IPPROTO_TCP, s->alproto))
{ {

@ -262,6 +262,7 @@ typedef struct DetectPort_ {
#define SIG_FLAG_INIT_STATE_MATCH BIT_U32(6) /**< signature has matches that require stateful inspection */ #define SIG_FLAG_INIT_STATE_MATCH BIT_U32(6) /**< signature has matches that require stateful inspection */
#define SIG_FLAG_INIT_NEED_FLUSH BIT_U32(7) #define SIG_FLAG_INIT_NEED_FLUSH BIT_U32(7)
#define SIG_FLAG_INIT_PRIO_EXPLICT BIT_U32(8) /**< priority is explicitly set by the priority keyword */ #define SIG_FLAG_INIT_PRIO_EXPLICT BIT_U32(8) /**< priority is explicitly set by the priority keyword */
#define SIG_FLAG_INIT_FILEDATA BIT_U32(9) /**< signature has filedata keyword */
/* signature mask flags */ /* signature mask flags */
/** \note: additions should be added to the rule analyzer as well */ /** \note: additions should be added to the rule analyzer as well */

Loading…
Cancel
Save