diff options
Diffstat (limited to 'framework/src/suricata/src/detect.c')
| -rw-r--r-- | framework/src/suricata/src/detect.c | 12 |
1 files changed, 12 insertions, 0 deletions
diff --git a/framework/src/suricata/src/detect.c b/framework/src/suricata/src/detect.c index a1516200..e0b5bfd3 100644 --- a/framework/src/suricata/src/detect.c +++ b/framework/src/suricata/src/detect.c @@ -156,6 +156,7 @@ #include "detect-dns-query.h" #include "detect-app-layer-protocol.h" #include "detect-template.h" +#include "detect-template-buffer.h" #include "util-rule-vars.h" @@ -163,6 +164,7 @@ #include "app-layer-protos.h" #include "app-layer-htp.h" #include "app-layer-smtp.h" +#include "app-layer-template.h" #include "detect-tls.h" #include "detect-tls-version.h" #include "detect-ssh-proto-version.h" @@ -2431,6 +2433,10 @@ PacketCreateMask(Packet *p, SignatureMask *mask, AppProto alproto, int has_state SCLogDebug("packet/flow has smtp state"); (*mask) |= SIG_MASK_REQUIRE_SMTP_STATE; break; + case ALPROTO_TEMPLATE: + SCLogDebug("packet/flow has template state"); + (*mask) |= SIG_MASK_REQUIRE_TEMPLATE_STATE; + break; default: SCLogDebug("packet/flow has other state"); break; @@ -2668,6 +2674,10 @@ static int SignatureCreateMask(Signature *s) s->mask |= SIG_MASK_REQUIRE_SMTP_STATE; SCLogDebug("sig requires smtp state"); } + if (s->alproto == ALPROTO_TEMPLATE) { + s->mask |= SIG_MASK_REQUIRE_TEMPLATE_STATE; + SCLogDebug("sig requires template state"); + } if ((s->mask & SIG_MASK_REQUIRE_DCE_STATE) || (s->mask & SIG_MASK_REQUIRE_HTTP_STATE) || @@ -2675,6 +2685,7 @@ static int SignatureCreateMask(Signature *s) (s->mask & SIG_MASK_REQUIRE_DNS_STATE) || (s->mask & SIG_MASK_REQUIRE_FTP_STATE) || (s->mask & SIG_MASK_REQUIRE_SMTP_STATE) || + (s->mask & SIG_MASK_REQUIRE_TEMPLATE_STATE) || (s->mask & SIG_MASK_REQUIRE_TLS_STATE)) { s->mask |= SIG_MASK_REQUIRE_FLOW; @@ -5238,6 +5249,7 @@ void SigTableSetup(void) DetectModbusRegister(); DetectAppLayerProtocolRegister(); DetectTemplateRegister(); + DetectTemplateBufferRegister(); } void SigTableRegisterTests(void) |