Project

General

Profile

Actions

Bug #3006

closed

improve rule keyword alproto registration

Added by Victor Julien almost 5 years ago. Updated over 4 years ago.

Status:
Closed
Priority:
Normal
Target version:
Affected Versions:
Effort:
Difficulty:
Label:

Description

Improve DetectSignatureSetAppProto by setting the WARN_UNUSED macro on the function prototype and fix the warnings.

Replace all direct 'sets' of Signature::alproto from keyword registration.

Actions #1

Updated by Shivani Bhardwaj over 4 years ago

  • Status changed from New to Assigned
  • Assignee changed from OISF Dev to Shivani Bhardwaj
Actions #2

Updated by Shivani Bhardwaj over 4 years ago

I'm unable to understand the statement, "direct 'sets' of Signature::alproto from keyword registration", could you please make it clearer?

Actions #3

Updated by Victor Julien over 4 years ago

With direct 'sets' I mean code like:

static int DetectHttpUriSetupSticky(DetectEngineCtx *de_ctx, Signature *s, const char *str)
{
    DetectBufferSetActiveList(s, g_http_uri_buffer_id);
    s->alproto = ALPROTO_HTTP;
    return 0;
}

Where Signature::alproto is set explicitly.

These cases should be replaced by calls to DetectSignatureSetAppProto. E.g.:

static int DetectHttpMethodSetupSticky(DetectEngineCtx *de_ctx, Signature *s, const char *str)
{
    if (DetectBufferSetActiveList(s, g_http_method_buffer_id) < 0)
        return -1;

    if (DetectSignatureSetAppProto(s, ALPROTO_HTTP) < 0)
        return -1;

    return 0;
}
Actions #4

Updated by Shivani Bhardwaj over 4 years ago

  • Status changed from Assigned to Feedback
Actions

Also available in: Atom PDF