uricontent simplified to use the existing content + http_uri infrastructure.

pull/325/head
Anoop Saldanha 13 years ago committed by Victor Julien
parent 0b5d277254
commit 434bdca9e2

@ -87,7 +87,7 @@ void DetectHttpUriRegister (void) {
* \retval -1 On failure
*/
int DetectHttpUriSetup (DetectEngineCtx *de_ctx, Signature *s, char *str)
int DetectHttpUriSetup(DetectEngineCtx *de_ctx, Signature *s, char *str)
{
SigMatch *sm = NULL;
int ret = -1;

@ -27,6 +27,7 @@
/* prototypes */
void DetectHttpUriRegister (void);
int DetectHttpUriSetup(DetectEngineCtx *de_ctx, Signature *s, char *str);
int DetectHttpUriDoMatch(DetectEngineThreadCtx *det_ctx, Signature *s,
SigMatch *sm, Flow *f, uint8_t flags, void *state);

@ -28,6 +28,7 @@
#include "decode.h"
#include "detect.h"
#include "detect-content.h"
#include "detect-http-uri.h"
#include "detect-uricontent.h"
#include "detect-engine-mpm.h"
#include "detect-parse.h"
@ -156,7 +157,7 @@ void DetectUricontentPrint(DetectContentData *cd)
* the rule set.
* \param contentstr Pointer to the string which has been defined in the rule
*/
DetectContentData *DoDetectUricontentSetup (char *contentstr)
DetectContentData *DoDetectUricontentSetup(char *contentstr)
{
DetectContentData *cd = NULL;
char *str = NULL;
@ -206,45 +207,18 @@ DetectContentData *DoDetectUricontentSetup (char *contentstr)
*
* \retval 0 on success, -1 on failure
*/
int DetectUricontentSetup (DetectEngineCtx *de_ctx, Signature *s, char *contentstr)
int DetectUricontentSetup(DetectEngineCtx *de_ctx, Signature *s, char *contentstr)
{
SCEnter();
DetectContentData *cd = NULL;
SigMatch *sm = NULL;
if (s->alproto != ALPROTO_UNKNOWN && s->alproto != ALPROTO_HTTP) {
SCLogError(SC_ERR_CONFLICTING_RULE_KEYWORDS, "rule contains "
"conflicting keywords.");
goto error;
}
cd = DoDetectUricontentSetup(contentstr);
if (cd == NULL)
if (DetectContentSetup(de_ctx, s, contentstr) < 0)
goto error;
sm = SigMatchAlloc();
if (sm == NULL)
if (DetectHttpUriSetup(de_ctx, s, NULL) < 0)
goto error;
sm->type = DETECT_CONTENT;
sm->ctx = (void *)cd;
/* Flagged the signature as to inspect the app layer data */
s->flags |= SIG_FLAG_APPLAYER;
s->alproto = ALPROTO_HTTP;
cd->id = DetectUricontentGetId(de_ctx->mpm_pattern_id_store, cd);
SigMatchAppendSMToList(s, sm, DETECT_SM_LIST_UMATCH);
SCReturnInt(0);
error:
if (cd != NULL)
SCFree(cd);
if (sm != NULL)
SCFree(sm);
SCReturnInt(-1);
}

Loading…
Cancel
Save