|
|
|
@ -336,13 +336,13 @@ static int DetectDceIfaceSetup(DetectEngineCtx *de_ctx, Signature *s, char *arg)
|
|
|
|
sm->type = DETECT_DCE_IFACE;
|
|
|
|
sm->type = DETECT_DCE_IFACE;
|
|
|
|
sm->ctx = (void *)did;
|
|
|
|
sm->ctx = (void *)did;
|
|
|
|
|
|
|
|
|
|
|
|
SigMatchAppendSMToList(s, sm, DETECT_SM_LIST_AMATCH);
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
if (s->alproto != ALPROTO_UNKNOWN && s->alproto != ALPROTO_DCERPC) {
|
|
|
|
if (s->alproto != ALPROTO_UNKNOWN && s->alproto != ALPROTO_DCERPC) {
|
|
|
|
SCLogError(SC_ERR_CONFLICTING_RULE_KEYWORDS, "rule contains conflicting keywords.");
|
|
|
|
SCLogError(SC_ERR_CONFLICTING_RULE_KEYWORDS, "rule contains conflicting keywords.");
|
|
|
|
goto error;
|
|
|
|
goto error;
|
|
|
|
}
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
SigMatchAppendSMToList(s, sm, DETECT_SM_LIST_AMATCH);
|
|
|
|
|
|
|
|
|
|
|
|
s->alproto = ALPROTO_DCERPC;
|
|
|
|
s->alproto = ALPROTO_DCERPC;
|
|
|
|
/* Flagged the signature as to inspect the app layer data */
|
|
|
|
/* Flagged the signature as to inspect the app layer data */
|
|
|
|
s->flags |= SIG_FLAG_APPLAYER;
|
|
|
|
s->flags |= SIG_FLAG_APPLAYER;
|
|
|
|
|