Skip to content
Closed
Show file tree
Hide file tree
Changes from 2 commits
Commits
File filter

Filter by extension

Filter by extension

Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
8 changes: 7 additions & 1 deletion rust/derive/src/applayerevent.rs
Original file line number Diff line number Diff line change
Expand Up @@ -111,14 +111,19 @@ pub fn derive_app_layer_event(input: TokenStream) -> TokenStream {
/// Transform names such as "OneTwoThree" to "one_two_three".
pub fn transform_name(in_name: &str) -> String {
let mut out = String::new();
let mut lower = false;
for (i, c) in in_name.chars().enumerate() {
if i == 0 {
out.push_str(&c.to_lowercase().to_string());
} else if c.is_uppercase() {
out.push('_');
if lower {
out.push('_');
lower = false;
}
out.push_str(&c.to_lowercase().to_string());
} else {
out.push(c);
lower = true;
}
}
out
Expand Down Expand Up @@ -159,5 +164,6 @@ mod test {
transform_name("UnassignedMsgType"),
"unassigned_msg_type".to_string()
);
assert_eq!(transform_name("SAMECASE"), "samecase".to_string());
Copy link
Copy Markdown
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Fine in a test.

}
}
26 changes: 26 additions & 0 deletions src/detect-engine-helper.c
Original file line number Diff line number Diff line change
Expand Up @@ -28,6 +28,7 @@
#include "detect-engine-mpm.h"
#include "detect-engine-prefilter.h"
#include "detect-parse.h"
#include "detect-engine-content-inspection.h"

int DetectHelperBufferRegister(const char *name, AppProto alproto, bool toclient, bool toserver)
{
Expand Down Expand Up @@ -105,3 +106,28 @@ int DetectHelperKeywordRegister(const SCSigTableElmt *kw)
DETECT_TBLSIZE_IDX++;
return DETECT_TBLSIZE_IDX - 1;
}

InspectionBuffer *DetectHelperGetMultiData(struct DetectEngineThreadCtx_ *det_ctx,
const DetectEngineTransforms *transforms, Flow *f, const uint8_t flow_flags, void *txv,
const int list_id, uint32_t index,
bool (*GetBuf)(void *txv, const uint8_t flow_flags, uint32_t index, const uint8_t **buf, uint32_t *buf_len))
{
InspectionBuffer *buffer = InspectionBufferMultipleForListGet(det_ctx, list_id, index);
if (buffer == NULL) {
return NULL;
}
if (buffer->initialized) {
return buffer;
}

const uint8_t *data = NULL;
uint32_t data_len = 0;

if (!GetBuf(txv, flow_flags, index, &data, &data_len)) {
InspectionBufferSetupMultiEmpty(buffer);
return NULL;
}
InspectionBufferSetupMulti(buffer, transforms, data, data_len);
buffer->flags = DETECT_CI_FLAGS_SINGLE;
return buffer;
}
4 changes: 4 additions & 0 deletions src/detect-engine-helper.h
Original file line number Diff line number Diff line change
Expand Up @@ -32,10 +32,14 @@ int DetectHelperKeywordRegister(const SCSigTableElmt *kw);
int DetectHelperBufferRegister(const char *name, AppProto alproto, bool toclient, bool toserver);

typedef bool (*SimpleGetTxBuffer)(void *, uint8_t, const uint8_t **, uint32_t *);
typedef bool (*MultiGetTxBuffer)(void *, uint8_t, uint32_t, const uint8_t **, uint32_t *);
InspectionBuffer *DetectHelperGetData(struct DetectEngineThreadCtx_ *det_ctx,
const DetectEngineTransforms *transforms, Flow *f, const uint8_t flow_flags, void *txv,
const int list_id, SimpleGetTxBuffer GetBuf);
int DetectHelperBufferMpmRegister(const char *name, const char *desc, AppProto alproto,
bool toclient, bool toserver, InspectionBufferGetDataPtr GetData);
InspectionBuffer *DetectHelperGetMultiData(struct DetectEngineThreadCtx_ *det_ctx,
const DetectEngineTransforms *transforms, Flow *f, const uint8_t flow_flags, void *txv,
const int list_id, uint32_t index, MultiGetTxBuffer GetBuf);

#endif /* SURICATA_DETECT_ENGINE_HELPER_H */
26 changes: 2 additions & 24 deletions src/detect-http2.c
Original file line number Diff line number Diff line change
Expand Up @@ -33,6 +33,7 @@
#include "detect-engine-mpm.h"
#include "detect-engine-prefilter.h"
#include "detect-engine-content-inspection.h"
#include "detect-engine-helper.h"

#include "detect-http2.h"
#include "util-byte.h"
Expand Down Expand Up @@ -102,30 +103,7 @@ static InspectionBuffer *GetHttp2HNameData(DetectEngineThreadCtx *det_ctx,
const DetectEngineTransforms *transforms, Flow *_f, const uint8_t flags, void *txv,
int list_id, uint32_t local_id)
{
SCEnter();

InspectionBuffer *buffer = InspectionBufferMultipleForListGet(det_ctx, list_id, local_id);
if (buffer == NULL)
return NULL;
if (buffer->initialized)
return buffer;

uint32_t b_len = 0;
const uint8_t *b = NULL;

if (rs_http2_tx_get_header_name(txv, flags, local_id, &b, &b_len) != 1) {
InspectionBufferSetupMultiEmpty(buffer);
return NULL;
}
if (b == NULL || b_len == 0) {
InspectionBufferSetupMultiEmpty(buffer);
return NULL;
}

InspectionBufferSetupMulti(buffer, transforms, b, b_len);
buffer->flags = DETECT_CI_FLAGS_SINGLE;

SCReturnPtr(buffer, "InspectionBuffer");
return DetectHelperGetMultiData(det_ctx, transforms, _f, flags, txv, list_id, local_id, (MultiGetTxBuffer) rs_http2_tx_get_header_name);
}

void DetectHttp2Register(void)
Expand Down