Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Detect unify multi-buffer code #10462

Conversation

catenacyber
Copy link
Contributor

Link to redmine ticket:
https://redmine.openinfosecfoundation.org/issues/6575

Describe changes:

  • detect: unify multi-buffer code

#10425 with

  • longer commit message
  • style fixup

Preliminary work for #10334

Ticket: 6575

Multi buffers keywords now use a single registration function
DetectAppLayerMultiRegister with a GetBuffer argument.

This GetBuffer function pointer is similar to the ones used by
single-buffer keyword, except that it takes an additional
parameter which is the index of the buffer to get.
Under the hood, an anonymous union between these 2 functions
pointers types is used.

In the end, this deduplicates code, especially the calls to
DetectEngineContentInspection
@suricata-qa
Copy link

Information:

ERROR: QA failed on SURI_TLPW2_autofp_suri_time.

field baseline test %
SURI_TLPW2_autofp_stats_chk
.uptime 101 111 109.9%

Pipeline 18633

@catenacyber catenacyber changed the title Detect negated content absent buffer 2224 v12.5 Detect unify multi-buffer code Mar 21, 2024
@catenacyber
Copy link
Contributor Author

I notice that DetectEngineInspectBufferHttpHeader could be replaced with a DetectEngineInspectBufferGeneric + GetData

Other usages of DetectEngineContentInspection are files, and detect-http-client-body

@catenacyber
Copy link
Contributor Author

Rebased in #10897

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
needs rebase Needs rebase to master
3 participants