Skip to content

Commit

Permalink
detect/flowbits: remove DETECT_FLOWBITS_CMD_NOALERT
Browse files Browse the repository at this point in the history
DETECT_FLOWBITS_CMD_NOALERT is misleading as it gives an impression that
noalert is a flowbit specific command that'll be used and dealt with at
some point but as soon as noalert is found in the rule lang, signature
flag for noalert is set and control is returned. It never gets added to
cmd of the flowbits object.
  • Loading branch information
inashivb authored and victorjulien committed Dec 11, 2023
1 parent 3485880 commit 75471dd
Show file tree
Hide file tree
Showing 2 changed files with 6 additions and 10 deletions.
13 changes: 5 additions & 8 deletions src/detect-flowbits.c
Original file line number Diff line number Diff line change
Expand Up @@ -285,7 +285,10 @@ int DetectFlowbitSetup (DetectEngineCtx *de_ctx, Signature *s, const char *rawst
}

if (strcmp(fb_cmd_str,"noalert") == 0) {
fb_cmd = DETECT_FLOWBITS_CMD_NOALERT;
if (strlen(fb_name) != 0)
goto error;
s->flags |= SIG_FLAG_NOALERT;
return 0;
} else if (strcmp(fb_cmd_str,"isset") == 0) {
fb_cmd = DETECT_FLOWBITS_CMD_ISSET;
} else if (strcmp(fb_cmd_str,"isnotset") == 0) {
Expand All @@ -302,11 +305,6 @@ int DetectFlowbitSetup (DetectEngineCtx *de_ctx, Signature *s, const char *rawst
}

switch (fb_cmd) {
case DETECT_FLOWBITS_CMD_NOALERT:
if (strlen(fb_name) != 0)
goto error;
s->flags |= SIG_FLAG_NOALERT;
return 0;
case DETECT_FLOWBITS_CMD_ISNOTSET:
case DETECT_FLOWBITS_CMD_ISSET:
case DETECT_FLOWBITS_CMD_SET:
Expand Down Expand Up @@ -340,8 +338,7 @@ int DetectFlowbitSetup (DetectEngineCtx *de_ctx, Signature *s, const char *rawst
* and put it in the Signature. */

switch (fb_cmd) {
/* case DETECT_FLOWBITS_CMD_NOALERT can't happen here */

/* noalert can't happen here */
case DETECT_FLOWBITS_CMD_ISNOTSET:
case DETECT_FLOWBITS_CMD_ISSET:
/* checks, so packet list */
Expand Down
3 changes: 1 addition & 2 deletions src/detect-flowbits.h
Original file line number Diff line number Diff line change
Expand Up @@ -30,8 +30,7 @@
#define DETECT_FLOWBITS_CMD_UNSET 2
#define DETECT_FLOWBITS_CMD_ISNOTSET 3
#define DETECT_FLOWBITS_CMD_ISSET 4
#define DETECT_FLOWBITS_CMD_NOALERT 5
#define DETECT_FLOWBITS_CMD_MAX 6
#define DETECT_FLOWBITS_CMD_MAX 5

typedef struct DetectFlowbitsData_ {
uint32_t idx;
Expand Down

0 comments on commit 75471dd

Please sign in to comment.