mirror of https://github.com/OISF/suricata
You cannot select more than 25 topics
Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.
7bc883ef93
A transform that derives its key material from a runtime byte_extract or byte_math variable cannot have its buffer precomputed at load time, so the content of that buffer is unusable as a fast_pattern. Add the engine plumbing to recognise such transforms and keep them out of prefilter/MPM. SignatureInitData gains a var_transform flag. RetrieveFPForSig bails out for any signature that sets it, so the signature falls back to full inspection rather than contributing an MPM pattern that can't be built ahead of time. New helpers support a transform consuming a variable: - SCSignatureSetVarTransform() raises the disqualification flag. - SCDetectByteVarResolve() resolves a byte_extract or byte_math variable by name to its runtime slot, and for a byte_extract reports its natural key width (a byte_math result has none). - SCDetectEngineThreadCtxGetByteVar() reads a byte_* variable's runtime value from the thread context. The helpers are declared in detect-engine-buffer.h so the bindgen run picks them up; the Rust bindings are regenerated to match. Issue: 7847 |
3 months ago | |
|---|---|---|
| .. | ||
| src | 3 months ago | |
| Cargo.toml.in | 2 years ago | |
| Makefile.am | 2 years ago | |