Skip to content

Commit

Permalink
detect/entropy: Use entropy matching when needed
Browse files Browse the repository at this point in the history
This commit causes the content inspection engine to recognize and
invoke the entropy "match" function when the entropy keyword is used.

Issue: 4162
  • Loading branch information
jlucovsky committed Feb 7, 2025
1 parent 1ce091c commit 9f33c94
Showing 1 changed file with 6 additions and 0 deletions.
6 changes: 6 additions & 0 deletions src/detect-engine-content-inspection.c
Original file line number Diff line number Diff line change
Expand Up @@ -41,6 +41,7 @@
#include "detect-bytemath.h"
#include "detect-bytejump.h"
#include "detect-byte-extract.h"
#include "detect-entropy.h"
#include "detect-replace.h"
#include "detect-engine-content-inspection.h"
#include "detect-uricontent.h"
Expand Down Expand Up @@ -482,6 +483,11 @@ static int DetectEngineContentInspectionInternal(DetectEngineThreadCtx *det_ctx,
det_ctx->pcre_match_start_offset = prev_offset;
} while (1);

} else if (smd->type == DETECT_ENTROPY) {
if (!DetectEntropyDoMatch(det_ctx, s, smd->ctx, buffer, buffer_len)) {
goto no_match;
}
goto match;
} else if (smd->type == DETECT_BYTETEST) {
const DetectBytetestData *btd = (const DetectBytetestData *)smd->ctx;
uint16_t btflags = btd->flags;
Expand Down

0 comments on commit 9f33c94

Please sign in to comment.