Bug #3006: improve rule keyword alproto registration - Suricata - Open Information Security Foundation

Actions

Copy link

Bug #3006

closed

improve rule keyword alproto registration

Added by Victor Julien over 5 years ago. Updated about 5 years ago.

Status:

Closed

Priority:

Normal

Assignee:

Shivani Bhardwaj

Target version:

5.0rc1

Affected Versions:

Effort:

Difficulty:

Label:

Description

Improve DetectSignatureSetAppProto by setting the WARN_UNUSED macro on the function prototype and fix the warnings.

Replace all direct 'sets' of Signature::alproto from keyword registration.

Actions

Copy link

Updated by Shivani Bhardwaj over 5 years ago

Status changed from New to Assigned
Assignee changed from OISF Dev to Shivani Bhardwaj

Actions

Copy link

Updated by Shivani Bhardwaj about 5 years ago

I'm unable to understand the statement, "direct 'sets' of Signature::alproto from keyword registration", could you please make it clearer?

Actions

Copy link

Updated by Victor Julien about 5 years ago

With direct 'sets' I mean code like:

static int DetectHttpUriSetupSticky(DetectEngineCtx *de_ctx, Signature *s, const char *str)
{
    DetectBufferSetActiveList(s, g_http_uri_buffer_id);
    s->alproto = ALPROTO_HTTP;
    return 0;
}

Where Signature::alproto is set explicitly.

These cases should be replaced by calls to DetectSignatureSetAppProto. E.g.:

static int DetectHttpMethodSetupSticky(DetectEngineCtx *de_ctx, Signature *s, const char *str)
{
    if (DetectBufferSetActiveList(s, g_http_method_buffer_id) < 0)
        return -1;

    if (DetectSignatureSetAppProto(s, ALPROTO_HTTP) < 0)
        return -1;

    return 0;
}