Project

General

Profile

Actions
Copy link

Feature #531

closed

API for file inspecting keywords

Added by Victor Julien about 12 years ago. Updated about 12 years ago.

Status:
Closed
Priority:
Normal
Assignee:
Victor Julien
Target version:
1.4beta1
Effort:
Difficulty:
Label:

Description

Currently the file inspecting keywords (like filename, fileext, filemagic, etc) use the AppLayerMatch keyword API. Since locking is done on a different level and the "state" ptr is abused to pass the "file" ptr, a new API call is needed.

Actions
Copy link
 #1

Updated by Victor Julien about 12 years ago

  • Tracker changed from Bug to Feature
Actions
Copy link
 #2

Updated by Victor Julien about 12 years ago

  • Status changed from Assigned to Closed
  • % Done changed from 0 to 100

Added in current master.

SigTableElmt now has a FileMatch function pointer that takes a "File " instead of the generic "void *state". Also added comments to indicate this function pointer expects a *LOCKED flow.

Actions
Copy link

Also available in: Atom PDF