Commit graph

5 commits

Author SHA1 Message Date
Arne Welzel
04872d4e78 signatures: Add data_end_offset to signature_match() and custom events
This change tracks the current offset (number of bytes fed into matchers)
on the top-level RuleEndpointState such that we can compute the relative ending
for matched texts individually.

Additionally, it adds the data_end_offset as a new optional parameter to
signature_match().
2024-10-30 13:29:58 +01:00
Arne Welzel
fa9dc159a2 rule-parse: Remove id_to_str() lookup to squelch coverity warning
Coverity didn't like that id_to_str() allocates memory and we didn't
free it. Remote its usage wholesale.
2024-08-09 09:49:43 +02:00
Tim Wojtulewicz
9142a48725 Remove deprecated signature definition format 2024-08-07 11:58:22 -07:00
Arne Welzel
f3470843d6 rule-parse: Remove [event_name] syntax, deprecate msg as identifier
As suggested by Robin. Thanks.
2023-12-14 10:16:35 +01:00
Arne Welzel
a7b077aa17 signatures: Support custom event via [event_name] syntax
This change allows to specify a per signature specific event, overriding
the default signature_match event. It further removes the message
parameter from such events if not provided in the signature.

This also tracks the message as StringValPtr directly to avoid
allocating the same StringVal for every DoAction() call.

Closes #3403
2023-12-05 15:28:21 +01:00