Feature #531
closed
API for file inspecting keywords
Added by Victor Julien over 11 years ago.
Updated over 11 years ago.
Description
Currently the file inspecting keywords (like filename, fileext, filemagic, etc) use the AppLayerMatch keyword API. Since locking is done on a different level and the "state" ptr is abused to pass the "file" ptr, a new API call is needed.
- Tracker changed from Bug to Feature
- Status changed from Assigned to Closed
- % Done changed from 0 to 100
Added in current master.
SigTableElmt now has a FileMatch function pointer that takes a "File " instead of the generic "void *state". Also added comments to indicate this function pointer expects a *LOCKED flow.
Also available in: Atom
PDF