mirror of https://github.com/OISF/suricata
You cannot select more than 25 topics
Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.
09a525659c
Extend the xor transform to take its key either as a literal hex string (xor:"<hex>") or as a byte_extract or byte_math variable (xor:var <name> [<nbytes>]) resolved at inspection time. For a variable key, setup resolves the variable to its runtime slot and marks the signature so it stays out of prefilter. At inspection the transform reads the value from the thread context and renders the low <nbytes> bytes of that value big-endian, regardless of the keyword's own endianness. The optional <nbytes> sets the key width. For a byte_extract variable read in the default (non-string) mode it defaults to the read width and may be omitted. A byte_math result, or a string-mode byte_extract, has no inherent value width, so the width is required there. The buffer-dedup id carries a leading discriminant so static and variable keys never share an inspection buffer. The key option is now optionally quoted (SIGMATCH_QUOTES_OPTIONAL) so the unquoted 'var <name>' form is accepted alongside the quoted hex key. Issue: 7847 |
3 months ago | |
|---|---|---|
| .. | ||
| .cargo | 2 years ago | |
| derive | 6 months ago | |
| ffi | 4 months ago | |
| htp | 4 months ago | |
| src | 3 months ago | |
| suricatactl | 8 months ago | |
| suricatasc | 7 months ago | |
| sys | 3 months ago | |
| .gitignore | 2 years ago | |
| Cargo.lock.in | 4 months ago | |
| Cargo.toml.in | 5 months ago | |
| Makefile.am | 5 months ago | |
| cbindgen.toml | 4 months ago | |
| rustfmt.toml | 3 years ago | |