next/217/20231207/v1

src/detect-base64-data.c

@@ -61,19 +61,6 @@ static int DetectBase64DataSetup(DetectEngineCtx *de_ctx, Signature *s,
     return 0;
 }
 
-int DetectBase64DataDoMatch(DetectEngineCtx *de_ctx,
-    DetectEngineThreadCtx *det_ctx, const Signature *s, Flow *f)
-{
-    if (det_ctx->base64_decoded_len) {
-        return DetectEngineContentInspectionInternal(de_ctx, det_ctx, s,
-                s->sm_arrays[DETECT_SM_LIST_BASE64_DATA], NULL, f, det_ctx->base64_decoded,
-                det_ctx->base64_decoded_len, 0, DETECT_CI_FLAGS_SINGLE,
-                DETECT_ENGINE_CONTENT_INSPECTION_MODE_STATE);
-    }
-
-    return 0;
-}
-
 #ifdef UNITTESTS
 
 static int g_file_data_buffer_id = 0;

src/detect-base64-data.h

@@ -19,7 +19,5 @@
 #define __DETECT_BASE64_DATA_H__
 
 void DetectBase64DataRegister(void);
-int DetectBase64DataDoMatch(DetectEngineCtx *, DetectEngineThreadCtx *,
-        const Signature *, Flow *);
 
 #endif /* __DETECT_BASE64_DATA_H__ */

src/detect-byte.c

@@ -22,10 +22,11 @@
  */
 
 #include "suricata-common.h"
+#include "rust.h"
 #include "detect-byte.h"
 #include "detect-byte-extract.h"
 #include "detect-bytemath.h"
-#include "rust.h"
+
 /**
  * \brief Used to retrieve args from BM.
  *

src/detect-bytemath.c

@@ -29,21 +29,23 @@
 #include "threads.h"
 #include "decode.h"
 
+#include "app-layer-parser.h"
+#include "app-layer-protos.h"
+
 #include "detect.h"
 #include "detect-parse.h"
 #include "detect-engine.h"
 #include "detect-engine-mpm.h"
 #include "detect-engine-state.h"
 #include "detect-engine-build.h"
+
+#include "rust-bindings.h"
+
 #include "detect-content.h"
 #include "detect-pcre.h"
 #include "detect-byte.h"
 #include "detect-bytemath.h"
 
-#include "app-layer-parser.h"
-#include "app-layer-protos.h"
-#include "rust-bindings.h"
-
 #include "flow.h"
 #include "flow-var.h"
 #include "flow-util.h"
@@ -82,11 +84,10 @@ static inline bool DetectByteMathValidateNbytesOnly(const DetectByteMathData *da
            (((data->flags & DETECT_BYTEMATH_FLAG_STRING) && nbytes <= 10) || (nbytes <= 4));
 }
 
-int DetectByteMathDoMatch(DetectEngineThreadCtx *det_ctx, const SigMatchData *smd,
+int DetectByteMathDoMatch(DetectEngineThreadCtx *det_ctx, const DetectByteMathData *data,
         const Signature *s, const uint8_t *payload, uint16_t payload_len, uint8_t nbytes,
         uint64_t rvalue, uint64_t *value, uint8_t endian)
 {
-    const DetectByteMathData *data = (DetectByteMathData *)smd->ctx;
     if (payload_len == 0) {
         return 0;
     }

src/detect-bytemath.h

@@ -27,7 +27,7 @@
 void DetectBytemathRegister(void);
 
 SigMatch *DetectByteMathRetrieveSMVar(const char *, const Signature *);
-int DetectByteMathDoMatch(DetectEngineThreadCtx *, const SigMatchData *, const Signature *,
+int DetectByteMathDoMatch(DetectEngineThreadCtx *, const DetectByteMathData *, const Signature *,
         const uint8_t *, uint16_t, uint8_t, uint64_t, uint64_t *, uint8_t);
 
 #endif /* __DETECT_BYTEMATH_H__ */

src/detect-dns-query.c

@@ -1,4 +1,4 @@
-/* Copyright (C) 2013-2018 Open Information Security Foundation
+/* Copyright (C) 2013-2023 Open Information Security Foundation
  *
  * You can copy, redistribute or modify this Program under the terms of
  * the GNU General Public License version 2 as published by the Free
@@ -92,6 +92,7 @@ static InspectionBuffer *DnsQueryGetData(DetectEngineThreadCtx *det_ctx,
         return NULL;
     }
     InspectionBufferSetupMulti(buffer, transforms, data, data_len);
+    buffer->flags = DETECT_CI_FLAGS_SINGLE;
 
     SCReturnPtr(buffer, "InspectionBuffer");
 }
@@ -114,9 +115,8 @@ static uint8_t DetectEngineInspectDnsQuery(DetectEngineCtx *de_ctx, DetectEngine
         if (buffer == NULL || buffer->inspect == NULL)
             break;
 
-        const bool match = DetectEngineContentInspection(de_ctx, det_ctx, s, engine->smd, NULL, f,
-                (uint8_t *)buffer->inspect, buffer->inspect_len, buffer->inspect_offset,
-                DETECT_CI_FLAGS_SINGLE, DETECT_ENGINE_CONTENT_INSPECTION_MODE_STATE);
+        const bool match = DetectEngineContentInspectionBuffer(de_ctx, det_ctx, s, engine->smd,
+                NULL, f, buffer, DETECT_ENGINE_CONTENT_INSPECTION_MODE_STATE);
         if (match) {
             return DETECT_ENGINE_INSPECT_SIG_MATCH;
         }