aiden
/
suricata
mirror of https://github.com/OISF/suricata
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

unifying content structure - uricontent now uses DetectContentData

Browse Source
remotes/origin/master-1.1.x
Anoop Saldanha 16 years ago committed by Victor Julien
parent 3b0a9ca97e
commit 4883efd0f6
19 changed files with 329 additions and 372 deletions
Show Stats Download Patch File Download Diff File

6
src/detect-bytejump.c
Unescape Escape View File

@ -597,7 +597,7 @@ int DetectBytejumpSetup(DetectEngineCtx *de_ctx, Signature *s, char *optstr)
}
DetectContentData *cd = NULL;
DetectUricontentData *ud = NULL;
DetectContentData *ud = NULL;
DetectPcreData *pe = NULL;
switch (prev_sm->type) {
@ -615,13 +615,13 @@ int DetectBytejumpSetup(DetectEngineCtx *de_ctx, Signature *s, char *optstr)
case DETECT_URICONTENT:
/* Set the relative next flag on the prev sigmatch */
ud = (DetectUricontentData *)prev_sm->ctx;
ud = (DetectContentData *)prev_sm->ctx;
if (ud == NULL) {
SCLogError(SC_ERR_INVALID_SIGNATURE, "Unknown previous-"
"previous keyword!");
return -1;
}
ud->flags |= DETECT_URICONTENT_RELATIVE_NEXT;
ud->flags |= DETECT_CONTENT_RELATIVE_NEXT;
break;

6
src/detect-bytetest.c
Unescape Escape View File

@ -627,7 +627,7 @@ int DetectBytetestSetup(DetectEngineCtx *de_ctx, Signature *s, char *optstr)
}
DetectContentData *cd = NULL;
DetectUricontentData *ud = NULL;
DetectContentData *ud = NULL;
DetectPcreData *pe = NULL;
switch (prev_sm->type) {
@ -645,13 +645,13 @@ int DetectBytetestSetup(DetectEngineCtx *de_ctx, Signature *s, char *optstr)
case DETECT_URICONTENT:
/* Set the relative next flag on the prev sigmatch */
ud = (DetectUricontentData *)prev_sm->ctx;
ud = (DetectContentData *)prev_sm->ctx;
if (ud == NULL) {
SCLogError(SC_ERR_INVALID_SIGNATURE, "Unknown previous-"
"previous keyword!");
return -1;
}
ud->flags |= DETECT_URICONTENT_RELATIVE_NEXT;
ud->flags |= DETECT_CONTENT_RELATIVE_NEXT;
break;

8
src/detect-content.h
Unescape Escape View File

@ -51,14 +51,12 @@
#include "util-spm-bm.h"
typedef struct DetectContentData_ {
uint8_t *content; /**< ptr to chunk of memory containing the pattern */
uint8_t content_len;/**< length of the pattern (and size of the memory) */
uint8_t *content;
uint8_t content_len;
uint16_t flags;
PatIntId id; /**< unique pattern id */
PatIntId id;
uint16_t depth;
uint16_t offset;
/** distance from the last match this match should start.
* Can be negative */
int32_t distance;
int32_t within;
BmCtx *bm_ctx; /**< Boyer Moore context (for spm search) */

12
src/detect-depth.c
Unescape Escape View File

@ -57,7 +57,7 @@ static int DetectDepthSetup (DetectEngineCtx *de_ctx, Signature *s, char *depths
char dubbed = 0;
SigMatch *pm = NULL;
DetectContentData *cd = NULL;
DetectUricontentData *ud = NULL;
DetectContentData *ud = NULL;
/* strip "'s */
if (depthstr[0] == '\"' && depthstr[strlen(depthstr)-1] == '\"') {
@ -99,7 +99,7 @@ static int DetectDepthSetup (DetectEngineCtx *de_ctx, Signature *s, char *depths
switch (pm->type) {
case DETECT_URICONTENT:
ud = (DetectUricontentData *)pm->ctx;
ud = (DetectContentData *)pm->ctx;
if (ud == NULL) {
SCLogError(SC_ERR_INVALID_ARGUMENT, "invalid argument");
if (dubbed)
@ -107,14 +107,14 @@ static int DetectDepthSetup (DetectEngineCtx *de_ctx, Signature *s, char *depths
return -1;
}
if (ud->flags & DETECT_URICONTENT_NEGATED) {
if (ud->flags & DETECT_URICONTENT_FAST_PATTERN) {
if (ud->flags & DETECT_CONTENT_NEGATED) {
if (ud->flags & DETECT_CONTENT_FAST_PATTERN) {
SCLogError(SC_ERR_INVALID_SIGNATURE, "You can't have a relative "
"negated keyword set along with a fast_pattern");
goto error;
}
} else {
if (ud->flags & DETECT_URICONTENT_FAST_PATTERN_ONLY) {
if (ud->flags & DETECT_CONTENT_FAST_PATTERN_ONLY) {
SCLogError(SC_ERR_INVALID_SIGNATURE, "You can't have a relative "
"keyword set along with a fast_pattern:only;");
goto error;
@ -129,7 +129,7 @@ static int DetectDepthSetup (DetectEngineCtx *de_ctx, Signature *s, char *depths
}
/* Now update the real limit, as depth is relative to the offset */
ud->depth += ud->offset;
ud->flags |= DETECT_URICONTENT_DEPTH;
ud->flags |= DETECT_CONTENT_DEPTH;
break;

20
src/detect-distance.c
Unescape Escape View File

@ -175,27 +175,27 @@ static int DetectDistanceSetup (DetectEngineCtx *de_ctx, Signature *s,
}
}
DetectUricontentData *ud = NULL;
DetectContentData *ud = NULL;
DetectContentData *cd = NULL;
DetectPcreData *pe = NULL;
switch (pm->type) {
case DETECT_URICONTENT:
ud = (DetectUricontentData *)pm->ctx;
ud = (DetectContentData *)pm->ctx;
if (ud == NULL) {
SCLogError(SC_ERR_DISTANCE_MISSING_CONTENT, "distance needs two "
"preceeding content or uricontent options");
goto error;
}
if (ud->flags & DETECT_URICONTENT_NEGATED) {
if (ud->flags & DETECT_URICONTENT_FAST_PATTERN) {
if (ud->flags & DETECT_CONTENT_NEGATED) {
if (ud->flags & DETECT_CONTENT_FAST_PATTERN) {
SCLogError(SC_ERR_INVALID_SIGNATURE, "You can't have a relative "
"negated keyword set along with a fast_pattern");
goto error;
}
} else {
if (ud->flags & DETECT_URICONTENT_FAST_PATTERN_ONLY) {
if (ud->flags & DETECT_CONTENT_FAST_PATTERN_ONLY) {
SCLogError(SC_ERR_INVALID_SIGNATURE, "You can't have a relative "
"keyword set along with a fast_pattern:only;");
goto error;
@ -203,13 +203,13 @@ static int DetectDistanceSetup (DetectEngineCtx *de_ctx, Signature *s,
}
ud->distance = strtol(str, NULL, 10);
if (ud->flags & DETECT_URICONTENT_WITHIN) {
if (ud->flags & DETECT_CONTENT_WITHIN) {
if ((ud->distance + ud->content_len) > ud->within) {
ud->within = ud->distance + ud->content_len;
}
}
ud->flags |= DETECT_URICONTENT_DISTANCE;
ud->flags |= DETECT_CONTENT_DISTANCE;
pm = SigMatchGetLastSMFromLists(s, 6,
DETECT_URICONTENT, pm->prev,
@ -224,15 +224,15 @@ static int DetectDistanceSetup (DetectEngineCtx *de_ctx, Signature *s,
switch (pm->type) {
case DETECT_URICONTENT:
/* Set the relative next flag on the prev sigmatch */
ud = (DetectUricontentData *)pm->ctx;
ud = (DetectContentData *)pm->ctx;
if (ud == NULL) {
SCLogError(SC_ERR_INVALID_SIGNATURE, "Unknown previous-"
"previous keyword!");
goto error;
}
ud->flags |= DETECT_URICONTENT_RELATIVE_NEXT;
ud->flags |= DETECT_CONTENT_RELATIVE_NEXT;
if (ud->flags & DETECT_URICONTENT_FAST_PATTERN_ONLY) {
if (ud->flags & DETECT_CONTENT_FAST_PATTERN_ONLY) {
SCLogError(SC_ERR_INVALID_SIGNATURE, "Previous keyword "
"has a fast_pattern:only; set. You can't "
"have relative keywords around a fast_pattern "

56
src/detect-engine-mpm.c
Unescape Escape View File

@ -417,7 +417,7 @@ typedef struct ContentHash_ {
} ContentHash;
typedef struct UricontentHash_ {
DetectUricontentData *ptr;
DetectContentData *ptr;
uint16_t cnt;
uint8_t use; /* use no matter what */
} UricontentHash;
@ -437,7 +437,7 @@ uint32_t ContentHashFunc(HashTable *ht, void *data, uint16_t datalen) {
uint32_t UricontentHashFunc(HashTable *ht, void *data, uint16_t datalen) {
UricontentHash *ch = (UricontentHash *)data;
DetectUricontentData *ud = ch->ptr;
DetectContentData *ud = ch->ptr;
uint32_t hash = 0;
int i;
for (i = 0; i < ud->content_len; i++) {
@ -465,11 +465,11 @@ char ContentHashCompareFunc(void *data1, uint16_t len1, void *data2, uint16_t le
char UricontentHashCompareFunc(void *data1, uint16_t len1, void *data2, uint16_t len2) {
UricontentHash *ch1 = (UricontentHash *)data1;
UricontentHash *ch2 = (UricontentHash *)data2;
DetectUricontentData *ud1 = ch1->ptr;
DetectUricontentData *ud2 = ch2->ptr;
DetectContentData *ud1 = ch1->ptr;
DetectContentData *ud2 = ch2->ptr;
if (ud1->content_len == ud2->content_len &&
((ud1->flags & DETECT_URICONTENT_NOCASE) == (ud2->flags & DETECT_URICONTENT_NOCASE)) &&
((ud1->flags & DETECT_CONTENT_NOCASE) == (ud2->flags & DETECT_CONTENT_NOCASE)) &&
SCMemcmp(ud1->content, ud2->content, ud1->content_len) == 0)
return 1;
@ -488,7 +488,7 @@ ContentHash *ContentHashAlloc(DetectContentData *ptr) {
return ch;
}
UricontentHash *UricontentHashAlloc(DetectUricontentData *ptr) {
UricontentHash *UricontentHashAlloc(DetectContentData *ptr) {
UricontentHash *ch = SCMalloc(sizeof(UricontentHash));
if (ch == NULL)
return NULL;
@ -596,7 +596,7 @@ static int PatternMatchPreparePopulateMpm(DetectEngineCtx *de_ctx,
* should have a much more compact function. Applies everywhere
* else where we have used a switch like this */
DetectContentData *cd = NULL;
DetectUricontentData *ud = NULL;
DetectContentData *ud = NULL;
switch (sm->type) {
case DETECT_CONTENT:
if (sig_has_no_pkt_and_stream_content ||
@ -619,9 +619,9 @@ static int PatternMatchPreparePopulateMpm(DetectEngineCtx *de_ctx,
!(sgh->flags & SIG_GROUP_HEAD_MPM_URI_COPY))) {
break;
}
ud = (DetectUricontentData *)sm->ctx;
ud = (DetectContentData *)sm->ctx;
/* special handling of fast pattern keyword */
if (ud->flags & DETECT_URICONTENT_FAST_PATTERN) {
if (ud->flags & DETECT_CONTENT_FAST_PATTERN) {
fast_pattern[sig] = 1;
}
@ -670,7 +670,7 @@ static int PatternMatchPreparePopulateMpm(DetectEngineCtx *de_ctx,
* 2. we have a smaller content than mpm_content_maxlen */
if (fast_pattern[sig]) {
DetectContentData *cd = NULL;
DetectUricontentData *ud = NULL;
DetectContentData *ud = NULL;
switch (sm->type) {
case DETECT_CONTENT:
cd = (DetectContentData *)sm->ctx;
@ -683,8 +683,8 @@ static int PatternMatchPreparePopulateMpm(DetectEngineCtx *de_ctx,
break;
case DETECT_URICONTENT:
ud = (DetectUricontentData *)sm->ctx;
if (!(ud->flags & DETECT_URICONTENT_FAST_PATTERN)) {
ud = (DetectContentData *)sm->ctx;
if (!(ud->flags & DETECT_CONTENT_FAST_PATTERN)) {
SCLogDebug("not a fast pattern %"PRIu32"", co->id);
continue;
}
@ -694,7 +694,7 @@ static int PatternMatchPreparePopulateMpm(DetectEngineCtx *de_ctx,
} /* switch (sm->type) */
} else {
DetectContentData *cd = NULL;
DetectUricontentData *ud = NULL;
DetectContentData *ud = NULL;
switch (sm->type) {
case DETECT_CONTENT:
if (sig_has_no_pkt_and_stream_content ||
@ -715,7 +715,7 @@ static int PatternMatchPreparePopulateMpm(DetectEngineCtx *de_ctx,
!(sgh->flags & SIG_GROUP_HEAD_MPM_URI_COPY))) {
continue;
}
ud = (DetectUricontentData *)sm->ctx;
ud = (DetectContentData *)sm->ctx;
if (ud->content_len < sgh->mpm_uricontent_maxlen)
continue;
@ -752,7 +752,7 @@ static int PatternMatchPreparePopulateMpm(DetectEngineCtx *de_ctx,
uint8_t flags = 0;
DetectContentData *cd = NULL;
DetectUricontentData *ud = NULL;
DetectContentData *ud = NULL;
switch (mpm_sm->type) {
case DETECT_CONTENT:
{
@ -878,10 +878,10 @@ static int PatternMatchPreparePopulateMpm(DetectEngineCtx *de_ctx,
} /* case DETECT_CONTENT */
case DETECT_URICONTENT:
{
ud = (DetectUricontentData *)mpm_sm->ctx;
if (ud->flags & DETECT_URICONTENT_FAST_PATTERN_CHOP) {
ud = (DetectContentData *)mpm_sm->ctx;
if (ud->flags & DETECT_CONTENT_FAST_PATTERN_CHOP) {
/* add the content to the "uri" mpm */
if (ud->flags & DETECT_URICONTENT_NOCASE) {
if (ud->flags & DETECT_CONTENT_NOCASE) {
mpm_table[sgh->mpm_ctx->mpm_type].
AddPatternNocase(sgh->mpm_ctx,
ud->content + ud->fp_chop_offset,
@ -932,7 +932,7 @@ static int PatternMatchPreparePopulateMpm(DetectEngineCtx *de_ctx,
/* tell matcher we are inspecting uri */
s->flags |= SIG_FLAG_MPM_URICONTENT;
s->mpm_uripattern_id = ud->id;
if (ud->flags & DETECT_URICONTENT_NEGATED)
if (ud->flags & DETECT_CONTENT_NEGATED)
s->flags |= SIG_FLAG_MPM_URICONTENT_NEG;
break;
@ -1512,14 +1512,14 @@ static int PatternMatchPreparePopulateMpm(DetectEngineCtx *de_ctx,
// if (sm->type != DETECT_URICONTENT)
// continue;
//
// DetectUricontentData *ud = (DetectUricontentData *)sm->ctx;
// DetectContentData *ud = (DetectContentData *)sm->ctx;
// if (ud == NULL)
// continue;
//
// cnt++;
//#if 0
// /* special handling of fast pattern keyword */
// if (co->flags & DETECT_URICONTENT_FAST_PATTERN) {
// if (co->flags & DETECT_CONTENT_FAST_PATTERN) {
// fast_pattern[sig] = 1;
// SCLogDebug("sig %"PRIu32" has a fast pattern, id %"PRIu32"", s->id, co->id);
//
@ -1547,7 +1547,7 @@ static int PatternMatchPreparePopulateMpm(DetectEngineCtx *de_ctx,
// if (sm->type != DETECT_URICONTENT)
// continue;
//
// DetectUricontentData *ud = (DetectUricontentData *)sm->ctx;
// DetectContentData *ud = (DetectContentData *)sm->ctx;
// if (ud == NULL)
// continue;
//
@ -1592,7 +1592,7 @@ static int PatternMatchPreparePopulateMpm(DetectEngineCtx *de_ctx,
// if (sm->type != DETECT_URICONTENT)
// continue;
//
// DetectUricontentData *ud = (DetectUricontentData *)sm->ctx;
// DetectContentData *ud = (DetectContentData *)sm->ctx;
// if (ud == NULL)
// continue;
//
@ -1651,7 +1651,7 @@ static int PatternMatchPreparePopulateMpm(DetectEngineCtx *de_ctx,
//
// /* now add the mpm_ch to the mpm ctx */
// if (mpm_ch != NULL) {
// DetectUricontentData *ud = mpm_ch->ptr;
// DetectContentData *ud = mpm_ch->ptr;
// uint8_t flags = 0;
//#if 0
// /* see if our content is actually negated */
@ -1673,7 +1673,7 @@ static int PatternMatchPreparePopulateMpm(DetectEngineCtx *de_ctx,
// }
//#endif
// /* add the content to the "packet" mpm */
// if (ud->flags & DETECT_URICONTENT_NOCASE) {
// if (ud->flags & DETECT_CONTENT_NOCASE) {
// mpm_table[sgh->mpm_uri_ctx->mpm_type].AddPatternNocase(sgh->mpm_uri_ctx,
// ud->content, ud->content_len, 0, 0, ud->id, s->num, flags);
// } else {
@ -1907,7 +1907,7 @@ int PatternMatchPrepareGroup(DetectEngineCtx *de_ctx, SigGroupHead *sh)
if (sm->type != DETECT_URICONTENT)
continue;
DetectUricontentData *ud = (DetectUricontentData *)sm->ctx;
DetectContentData *ud = (DetectContentData *)sm->ctx;
if (ud == NULL)
continue;
@ -2177,7 +2177,7 @@ uint32_t DetectContentGetId(MpmPatternIdStore *ht, DetectContentData *co) {
*
* \retval id pattern id
*/
uint32_t DetectUricontentGetId(MpmPatternIdStore *ht, DetectUricontentData *co) {
uint32_t DetectUricontentGetId(MpmPatternIdStore *ht, DetectContentData *co) {
SCEnter();
BUG_ON(ht == NULL || ht->hash == NULL);
@ -2254,7 +2254,7 @@ uint32_t DetectPatternGetId(MpmPatternIdStore *ht, void *ctx, uint8_t sm_type)
/* if uricontent had used content and content_len as its struct members
* we wouldn't have needed this if/else here */
if (sm_type == DETECT_URICONTENT) {
DetectUricontentData *ud = ctx;
DetectContentData *ud = ctx;
e->pattern = SCMalloc(ud->content_len);
if (e->pattern == NULL) {
SCLogError(SC_ERR_MEM_ALLOC, "Error allocating memory");

2
src/detect-engine-mpm.h
Unescape Escape View File

@ -60,7 +60,7 @@ MpmPatternIdStore *MpmPatternIdTableInitHash(void);
void MpmPatternIdTableFreeHash(MpmPatternIdStore *);
uint32_t MpmPatternIdStoreGetMaxId(MpmPatternIdStore *);
uint32_t DetectContentGetId(MpmPatternIdStore *, DetectContentData *);
uint32_t DetectUricontentGetId(MpmPatternIdStore *, DetectUricontentData *);
uint32_t DetectUricontentGetId(MpmPatternIdStore *, DetectContentData *);
uint32_t DetectPatternGetId(MpmPatternIdStore *, void *, uint8_t);
#endif /* __DETECT_ENGINE_MPM_H__ */

4
src/detect-engine-siggroup.c
Unescape Escape View File

@ -1362,7 +1362,7 @@ int SigGroupHeadLoadUricontent(DetectEngineCtx *de_ctx, SigGroupHead *sgh)
Signature *s = NULL;
SigMatch *sm = NULL;
uint32_t sig = 0;
DetectUricontentData *co = NULL;
DetectContentData *co = NULL;
if (sgh == NULL)
return 0;
@ -1394,7 +1394,7 @@ int SigGroupHeadLoadUricontent(DetectEngineCtx *de_ctx, SigGroupHead *sgh)
for ( ;sm != NULL; sm = sm->next) {
if (sm->type == DETECT_URICONTENT) {
co = (DetectUricontentData *)sm->ctx;
co = (DetectContentData *)sm->ctx;
sgh->init->uri_content_array[co->id / 8] |= 1 << (co->id % 8);
}

28
src/detect-engine-uri.c
Unescape Escape View File

@ -97,8 +97,8 @@ static int DoInspectPacketUri(DetectEngineCtx *de_ctx,
SCReturnInt(0);
}
DetectUricontentData *ud = NULL;
ud = (DetectUricontentData *)sm->ctx;
DetectContentData *ud = NULL;
ud = (DetectContentData *)sm->ctx;
SCLogDebug("inspecting content %"PRIu32" payload_len %"PRIu32, ud->id, payload_len);
/* rule parsers should take care of this */
@ -113,14 +113,14 @@ static int DoInspectPacketUri(DetectEngineCtx *de_ctx,
uint32_t prev_payload_offset = det_ctx->payload_offset;
do {
if (ud->flags & DETECT_URICONTENT_DISTANCE ||
ud->flags & DETECT_URICONTENT_WITHIN) {
if (ud->flags & DETECT_CONTENT_DISTANCE ||
ud->flags & DETECT_CONTENT_WITHIN) {
SCLogDebug("prev_payload_offset %"PRIu32, prev_payload_offset);
offset = prev_payload_offset;
depth = payload_len;
if (ud->flags & DETECT_URICONTENT_DISTANCE) {
if (ud->flags & DETECT_CONTENT_DISTANCE) {
if (ud->distance < 0 && (uint32_t)(abs(ud->distance)) > offset)
offset = 0;
else
@ -130,7 +130,7 @@ static int DoInspectPacketUri(DetectEngineCtx *de_ctx,
ud->distance, offset, depth);
}
if (ud->flags & DETECT_URICONTENT_WITHIN) {
if (ud->flags & DETECT_CONTENT_WITHIN) {
if ((int32_t)depth > (int32_t)(prev_payload_offset + ud->within)) {
depth = prev_payload_offset + ud->within;
}
@ -176,7 +176,7 @@ static int DoInspectPacketUri(DetectEngineCtx *de_ctx,
/* if offset is bigger than depth we can never match on a pattern.
* We can however, "match" on a negated pattern. */
if (offset > depth || depth == 0) {
if (ud->flags & DETECT_URICONTENT_NEGATED) {
if (ud->flags & DETECT_CONTENT_NEGATED) {
goto match;
} else {
SCReturnInt(0);
@ -194,7 +194,7 @@ static int DoInspectPacketUri(DetectEngineCtx *de_ctx,
/* If we got no matches from the mpm, avoid searching (just check if negated) */
if (det_ctx->de_have_httpuri == TRUE) {
/* do the actual search with boyer moore precooked ctx */
if (ud->flags & DETECT_URICONTENT_NOCASE)
if (ud->flags & DETECT_CONTENT_NOCASE)
found = BoyerMooreNocase(ud->content, ud->content_len, spayload, spayload_len, ud->bm_ctx->bmGs, ud->bm_ctx->bmBc);
else
found = BoyerMoore(ud->content, ud->content_len, spayload, spayload_len, ud->bm_ctx->bmGs, ud->bm_ctx->bmBc);
@ -204,13 +204,13 @@ static int DoInspectPacketUri(DetectEngineCtx *de_ctx,
/* next we evaluate the result in combination with the
* negation flag. */
SCLogDebug("found %p ud negated %s", found, ud->flags & DETECT_URICONTENT_NEGATED ? "true" : "false");
SCLogDebug("found %p ud negated %s", found, ud->flags & DETECT_CONTENT_NEGATED ? "true" : "false");
if (found == NULL && !(ud->flags & DETECT_URICONTENT_NEGATED)) {
if (found == NULL && !(ud->flags & DETECT_CONTENT_NEGATED)) {
SCReturnInt(0);
} else if (found == NULL && ud->flags & DETECT_URICONTENT_NEGATED) {
} else if (found == NULL && ud->flags & DETECT_CONTENT_NEGATED) {
goto match;
} else if (found != NULL && ud->flags & DETECT_URICONTENT_NEGATED) {
} else if (found != NULL && ud->flags & DETECT_CONTENT_NEGATED) {
SCLogDebug("uricontent %"PRIu32" matched at offset %"PRIu32", but negated so no match", ud->id, match_offset);
det_ctx->discontinue_matching = 1;
SCReturnInt(0);
@ -219,7 +219,7 @@ static int DoInspectPacketUri(DetectEngineCtx *de_ctx,
SCLogDebug("uricontent %"PRIu32" matched at offset %"PRIu32"", ud->id, match_offset);
det_ctx->payload_offset = match_offset;
if (!(ud->flags & DETECT_URICONTENT_RELATIVE_NEXT)) {
if (!(ud->flags & DETECT_CONTENT_RELATIVE_NEXT)) {
SCLogDebug("no relative match coming up, so this is a match");
goto match;
}
@ -413,7 +413,7 @@ int DetectEngineInspectPacketUris(DetectEngineCtx *de_ctx,
sm = s->sm_lists[DETECT_SM_LIST_UMATCH];
#ifdef DEBUG
DetectUricontentData *co = (DetectUricontentData *)sm->ctx;
DetectContentData *co = (DetectContentData *)sm->ctx;
SCLogDebug("co->id %"PRIu32, co->id);
#endif

346
src/detect-fast-pattern.c
Unescape Escape View File

@ -188,7 +188,7 @@ static int DetectFastPatternSetup(DetectEngineCtx *de_ctx, Signature *s, char *a
int ov[MAX_SUBSTRINGS];
const char *arg_substr = NULL;
DetectContentData *cd = NULL;
DetectUricontentData *ud = NULL;
DetectContentData *ud = NULL;
if (s->sm_lists_tail[DETECT_SM_LIST_PMATCH] == NULL && s->sm_lists_tail[DETECT_SM_LIST_UMATCH] == NULL) {
SCLogWarning(SC_WARN_COMPATIBILITY, "fast_pattern found inside the "
@ -218,7 +218,7 @@ static int DetectFastPatternSetup(DetectEngineCtx *de_ctx, Signature *s, char *a
if (pm->type == DETECT_CONTENT) {
cd->flags |= DETECT_CONTENT_FAST_PATTERN;
} else if (pm->type == DETECT_URICONTENT) {
ud->flags |= DETECT_URICONTENT_FAST_PATTERN;
ud->flags |= DETECT_CONTENT_FAST_PATTERN;
}
return 0;
}
@ -236,11 +236,11 @@ static int DetectFastPatternSetup(DetectEngineCtx *de_ctx, Signature *s, char *a
goto error;
}
} else if (pm->type == DETECT_URICONTENT) {
if (ud->flags & DETECT_URICONTENT_NEGATED &&
(ud->flags & DETECT_URICONTENT_DISTANCE ||
ud->flags & DETECT_URICONTENT_WITHIN ||
ud->flags & DETECT_URICONTENT_OFFSET ||
ud->flags & DETECT_URICONTENT_DEPTH)) {
if (ud->flags & DETECT_CONTENT_NEGATED &&
(ud->flags & DETECT_CONTENT_DISTANCE ||
ud->flags & DETECT_CONTENT_WITHIN ||
ud->flags & DETECT_CONTENT_OFFSET ||
ud->flags & DETECT_CONTENT_DEPTH)) {
/* we can't have any of these if we are having "only" */
SCLogError(SC_ERR_INVALID_SIGNATURE, "fast_pattern; cannot be "
@ -270,18 +270,18 @@ static int DetectFastPatternSetup(DetectEngineCtx *de_ctx, Signature *s, char *a
}
cd->flags |= DETECT_CONTENT_FAST_PATTERN_ONLY;
} else if (pm->type == DETECT_URICONTENT) {
if (ud->flags & DETECT_URICONTENT_NEGATED ||
ud->flags & DETECT_URICONTENT_DISTANCE ||
ud->flags & DETECT_URICONTENT_WITHIN ||
ud->flags & DETECT_URICONTENT_OFFSET ||
ud->flags & DETECT_URICONTENT_DEPTH) {
if (ud->flags & DETECT_CONTENT_NEGATED ||
ud->flags & DETECT_CONTENT_DISTANCE ||
ud->flags & DETECT_CONTENT_WITHIN ||
ud->flags & DETECT_CONTENT_OFFSET ||
ud->flags & DETECT_CONTENT_DEPTH) {
/* we can't have any of these if we are having "only" */
SCLogError(SC_ERR_INVALID_SIGNATURE, "fast_pattern: only; cannot be "
"used with negated uricontent");
goto error;
}
ud->flags |= DETECT_URICONTENT_FAST_PATTERN_ONLY;
ud->flags |= DETECT_CONTENT_FAST_PATTERN_ONLY;
} else {
printf("we will never hit else");
}
@ -327,7 +327,7 @@ static int DetectFastPatternSetup(DetectEngineCtx *de_ctx, Signature *s, char *a
} else if (pm->type == DETECT_URICONTENT) {
ud->fp_chop_offset = offset;
ud->fp_chop_len = length;
ud->flags |= DETECT_URICONTENT_FAST_PATTERN_CHOP;
ud->flags |= DETECT_CONTENT_FAST_PATTERN_CHOP;
}
} else {
SCLogError(SC_ERR_PCRE_PARSE, "parse error, ret %" PRId32
@ -352,7 +352,7 @@ static int DetectFastPatternSetup(DetectEngineCtx *de_ctx, Signature *s, char *a
if (pm->type == DETECT_CONTENT) {
cd->flags |= DETECT_CONTENT_FAST_PATTERN;
} else if (pm->type == DETECT_URICONTENT) {
ud->flags |= DETECT_URICONTENT_FAST_PATTERN;
ud->flags |= DETECT_CONTENT_FAST_PATTERN;
}
return 0;
@ -2130,8 +2130,8 @@ int DetectFastPatternTest54(void)
sm = de_ctx->sig_list->sm_lists[DETECT_SM_LIST_UMATCH];
while (sm != NULL) {
if (sm->type == DETECT_URICONTENT) {
if ( ((DetectUricontentData *)sm->ctx)->flags &
DETECT_URICONTENT_FAST_PATTERN) {
if ( ((DetectContentData *)sm->ctx)->flags &
DETECT_CONTENT_FAST_PATTERN) {
result = 1;
break;
} else {
@ -2171,8 +2171,8 @@ int DetectFastPatternTest55(void)
sm = de_ctx->sig_list->sm_lists[DETECT_SM_LIST_UMATCH];
while (sm != NULL) {
if (sm->type == DETECT_URICONTENT) {
if ( ((DetectUricontentData *)sm->ctx)->flags &
DETECT_URICONTENT_FAST_PATTERN) {
if ( ((DetectContentData *)sm->ctx)->flags &
DETECT_CONTENT_FAST_PATTERN) {
result = 1;
break;
} else {
@ -2206,11 +2206,11 @@ int DetectFastPatternTest56(void)
result = 0;
sm = de_ctx->sig_list->sm_lists[DETECT_SM_LIST_UMATCH];
DetectUricontentData *ud = sm->ctx;
DetectContentData *ud = sm->ctx;
if (sm != NULL && sm->type == DETECT_URICONTENT) {
if (ud->flags & DETECT_URICONTENT_FAST_PATTERN &&
ud->flags & DETECT_URICONTENT_FAST_PATTERN_ONLY &&
!(ud->flags & ud->flags & DETECT_URICONTENT_FAST_PATTERN_CHOP) &&
if (ud->flags & DETECT_CONTENT_FAST_PATTERN &&
ud->flags & DETECT_CONTENT_FAST_PATTERN_ONLY &&
!(ud->flags & ud->flags & DETECT_CONTENT_FAST_PATTERN_CHOP) &&
ud->fp_chop_offset == 0 &&
ud->fp_chop_len == 0) {
result = 1;
@ -2242,11 +2242,11 @@ int DetectFastPatternTest57(void)
result = 0;
sm = de_ctx->sig_list->sm_lists[DETECT_SM_LIST_UMATCH];
DetectUricontentData *ud = sm->ctx;
DetectContentData *ud = sm->ctx;
if (sm != NULL && sm->type == DETECT_URICONTENT) {
if (ud->flags & DETECT_URICONTENT_FAST_PATTERN &&
!(ud->flags & DETECT_URICONTENT_FAST_PATTERN_ONLY) &&
ud->flags & ud->flags & DETECT_URICONTENT_FAST_PATTERN_CHOP &&
if (ud->flags & DETECT_CONTENT_FAST_PATTERN &&
!(ud->flags & DETECT_CONTENT_FAST_PATTERN_ONLY) &&
ud->flags & ud->flags & DETECT_CONTENT_FAST_PATTERN_CHOP &&
ud->fp_chop_offset == 3 &&
ud->fp_chop_len == 4) {
result = 1;
@ -2473,10 +2473,10 @@ int DetectFastPatternTest67(void)
if (de_ctx->sig_list == NULL)
goto end;
DetectUricontentData *ud = de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_UMATCH]->ctx;
if (ud->flags & DETECT_URICONTENT_FAST_PATTERN &&
ud->flags & DETECT_URICONTENT_FAST_PATTERN_ONLY &&
!(ud->flags & ud->flags & DETECT_URICONTENT_FAST_PATTERN_CHOP) &&
DetectContentData *ud = de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_UMATCH]->ctx;
if (ud->flags & DETECT_CONTENT_FAST_PATTERN &&
ud->flags & DETECT_CONTENT_FAST_PATTERN_ONLY &&
!(ud->flags & ud->flags & DETECT_CONTENT_FAST_PATTERN_CHOP) &&
ud->fp_chop_offset == 0 &&
ud->fp_chop_len == 0) {
result = 1;
@ -2503,10 +2503,10 @@ int DetectFastPatternTest68(void)
"(uricontent:one; uricontent:two; within:30; uricontent:two; fast_pattern:only; sid:1;)");
if (de_ctx->sig_list == NULL)
goto end;
DetectUricontentData *ud = de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_UMATCH]->ctx;
if (ud->flags & DETECT_URICONTENT_FAST_PATTERN &&
ud->flags & DETECT_URICONTENT_FAST_PATTERN_ONLY &&
!(ud->flags & ud->flags & DETECT_URICONTENT_FAST_PATTERN_CHOP) &&
DetectContentData *ud = de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_UMATCH]->ctx;
if (ud->flags & DETECT_CONTENT_FAST_PATTERN &&
ud->flags & DETECT_CONTENT_FAST_PATTERN_ONLY &&
!(ud->flags & ud->flags & DETECT_CONTENT_FAST_PATTERN_CHOP) &&
ud->fp_chop_offset == 0 &&
ud->fp_chop_len == 0) {
result = 1;
@ -2533,10 +2533,10 @@ int DetectFastPatternTest69(void)
"(uricontent:one; uricontent:two; offset:30; uricontent:two; fast_pattern:only; sid:1;)");
if (de_ctx->sig_list == NULL)
goto end;
DetectUricontentData *ud = de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_UMATCH]->ctx;
if (ud->flags & DETECT_URICONTENT_FAST_PATTERN &&
ud->flags & DETECT_URICONTENT_FAST_PATTERN_ONLY &&
!(ud->flags & ud->flags & DETECT_URICONTENT_FAST_PATTERN_CHOP) &&
DetectContentData *ud = de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_UMATCH]->ctx;
if (ud->flags & DETECT_CONTENT_FAST_PATTERN &&
ud->flags & DETECT_CONTENT_FAST_PATTERN_ONLY &&
!(ud->flags & ud->flags & DETECT_CONTENT_FAST_PATTERN_CHOP) &&
ud->fp_chop_offset == 0 &&
ud->fp_chop_len == 0) {
result = 1;
@ -2563,10 +2563,10 @@ int DetectFastPatternTest70(void)
"(uricontent:one; uricontent:two; depth:30; uricontent:two; fast_pattern:only; sid:1;)");
if (de_ctx->sig_list == NULL)
goto end;
DetectUricontentData *ud = de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_UMATCH]->ctx;
if (ud->flags & DETECT_URICONTENT_FAST_PATTERN &&
ud->flags & DETECT_URICONTENT_FAST_PATTERN_ONLY &&
!(ud->flags & ud->flags & DETECT_URICONTENT_FAST_PATTERN_CHOP) &&
DetectContentData *ud = de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_UMATCH]->ctx;
if (ud->flags & DETECT_CONTENT_FAST_PATTERN &&
ud->flags & DETECT_CONTENT_FAST_PATTERN_ONLY &&
!(ud->flags & ud->flags & DETECT_CONTENT_FAST_PATTERN_CHOP) &&
ud->fp_chop_offset == 0 &&
ud->fp_chop_len == 0) {
result = 1;
@ -2593,11 +2593,11 @@ int DetectFastPatternTest71(void)
"(uricontent:!one; fast_pattern; uricontent:two; sid:1;)");
if (de_ctx->sig_list == NULL)
goto end;
DetectUricontentData *ud = de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_UMATCH]->prev->ctx;
if (ud->flags & DETECT_URICONTENT_FAST_PATTERN &&
ud->flags & DETECT_URICONTENT_NEGATED &&
!(ud->flags & DETECT_URICONTENT_FAST_PATTERN_ONLY) &&
!(ud->flags & ud->flags & DETECT_URICONTENT_FAST_PATTERN_CHOP) &&
DetectContentData *ud = de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_UMATCH]->prev->ctx;
if (ud->flags & DETECT_CONTENT_FAST_PATTERN &&
ud->flags & DETECT_CONTENT_NEGATED &&
!(ud->flags & DETECT_CONTENT_FAST_PATTERN_ONLY) &&
!(ud->flags & ud->flags & DETECT_CONTENT_FAST_PATTERN_CHOP) &&
ud->fp_chop_offset == 0 &&
ud->fp_chop_len == 0) {
result = 1;
@ -2712,10 +2712,10 @@ int DetectFastPatternTest76(void)
"(uricontent:one; uricontent:two; fast_pattern:3,4; uricontent:three; sid:1;)");
if (de_ctx->sig_list == NULL)
goto end;
DetectUricontentData *ud = de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_UMATCH]->prev->ctx;
if (ud->flags & DETECT_URICONTENT_FAST_PATTERN &&
!(ud->flags & DETECT_URICONTENT_FAST_PATTERN_ONLY) &&
ud->flags & ud->flags & DETECT_URICONTENT_FAST_PATTERN_CHOP &&
DetectContentData *ud = de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_UMATCH]->prev->ctx;
if (ud->flags & DETECT_CONTENT_FAST_PATTERN &&
!(ud->flags & DETECT_CONTENT_FAST_PATTERN_ONLY) &&
ud->flags & ud->flags & DETECT_CONTENT_FAST_PATTERN_CHOP &&
ud->fp_chop_offset == 3 &&
ud->fp_chop_len == 4) {
result = 1;
@ -2742,10 +2742,10 @@ int DetectFastPatternTest77(void)
"(uricontent:one; uricontent:two; fast_pattern:3,4; uricontent:three; distance:30; sid:1;)");
if (de_ctx->sig_list == NULL)
goto end;
DetectUricontentData *ud = de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_UMATCH]->prev->ctx;
if (ud->flags & DETECT_URICONTENT_FAST_PATTERN &&
!(ud->flags & DETECT_URICONTENT_FAST_PATTERN_ONLY) &&
ud->flags & ud->flags & DETECT_URICONTENT_FAST_PATTERN_CHOP &&
DetectContentData *ud = de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_UMATCH]->prev->ctx;
if (ud->flags & DETECT_CONTENT_FAST_PATTERN &&
!(ud->flags & DETECT_CONTENT_FAST_PATTERN_ONLY) &&
ud->flags & ud->flags & DETECT_CONTENT_FAST_PATTERN_CHOP &&
ud->fp_chop_offset == 3 &&
ud->fp_chop_len == 4) {
result = 1;
@ -2772,10 +2772,10 @@ int DetectFastPatternTest78(void)
"(uricontent:one; uricontent:two; fast_pattern:3,4; uricontent:three; within:30; sid:1;)");
if (de_ctx->sig_list == NULL)
goto end;
DetectUricontentData *ud = de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_UMATCH]->prev->ctx;
if (ud->flags & DETECT_URICONTENT_FAST_PATTERN &&
!(ud->flags & DETECT_URICONTENT_FAST_PATTERN_ONLY) &&
ud->flags & ud->flags & DETECT_URICONTENT_FAST_PATTERN_CHOP &&
DetectContentData *ud = de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_UMATCH]->prev->ctx;
if (ud->flags & DETECT_CONTENT_FAST_PATTERN &&
!(ud->flags & DETECT_CONTENT_FAST_PATTERN_ONLY) &&
ud->flags & ud->flags & DETECT_CONTENT_FAST_PATTERN_CHOP &&
ud->fp_chop_offset == 3 &&
ud->fp_chop_len == 4) {
result = 1;
@ -2802,10 +2802,10 @@ int DetectFastPatternTest79(void)
"(uricontent:one; uricontent:two; fast_pattern:3,4; uricontent:three; offset:30; sid:1;)");
if (de_ctx->sig_list == NULL)
goto end;
DetectUricontentData *ud = de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_UMATCH]->prev->ctx;
if (ud->flags & DETECT_URICONTENT_FAST_PATTERN &&
!(ud->flags & DETECT_URICONTENT_FAST_PATTERN_ONLY) &&
ud->flags & ud->flags & DETECT_URICONTENT_FAST_PATTERN_CHOP &&
DetectContentData *ud = de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_UMATCH]->prev->ctx;
if (ud->flags & DETECT_CONTENT_FAST_PATTERN &&
!(ud->flags & DETECT_CONTENT_FAST_PATTERN_ONLY) &&
ud->flags & ud->flags & DETECT_CONTENT_FAST_PATTERN_CHOP &&
ud->fp_chop_offset == 3 &&
ud->fp_chop_len == 4) {
result = 1;
@ -2832,10 +2832,10 @@ int DetectFastPatternTest80(void)
"(uricontent:one; uricontent:two; fast_pattern:3,4; uricontent:three; depth:30; sid:1;)");
if (de_ctx->sig_list == NULL)
goto end;
DetectUricontentData *ud = de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_UMATCH]->prev->ctx;
if (ud->flags & DETECT_URICONTENT_FAST_PATTERN &&
!(ud->flags & DETECT_URICONTENT_FAST_PATTERN_ONLY) &&
ud->flags & ud->flags & DETECT_URICONTENT_FAST_PATTERN_CHOP &&
DetectContentData *ud = de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_UMATCH]->prev->ctx;
if (ud->flags & DETECT_CONTENT_FAST_PATTERN &&
!(ud->flags & DETECT_CONTENT_FAST_PATTERN_ONLY) &&
ud->flags & ud->flags & DETECT_CONTENT_FAST_PATTERN_CHOP &&
ud->fp_chop_offset == 3 &&
ud->fp_chop_len == 4) {
result = 1;
@ -2862,10 +2862,10 @@ int DetectFastPatternTest81(void)
"(uricontent:one; uricontent:two; distance:10; uricontent:three; fast_pattern:3,4; sid:1;)");
if (de_ctx->sig_list == NULL)
goto end;
DetectUricontentData *ud = de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_UMATCH]->ctx;
if (ud->flags & DETECT_URICONTENT_FAST_PATTERN &&
!(ud->flags & DETECT_URICONTENT_FAST_PATTERN_ONLY) &&
ud->flags & ud->flags & DETECT_URICONTENT_FAST_PATTERN_CHOP &&
DetectContentData *ud = de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_UMATCH]->ctx;
if (ud->flags & DETECT_CONTENT_FAST_PATTERN &&
!(ud->flags & DETECT_CONTENT_FAST_PATTERN_ONLY) &&
ud->flags & ud->flags & DETECT_CONTENT_FAST_PATTERN_CHOP &&
ud->fp_chop_offset == 3 &&
ud->fp_chop_len == 4) {
result = 1;
@ -2892,10 +2892,10 @@ int DetectFastPatternTest82(void)
"(uricontent:one; uricontent:two; within:10; uricontent:three; fast_pattern:3,4; sid:1;)");
if (de_ctx->sig_list == NULL)
goto end;
DetectUricontentData *ud = de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_UMATCH]->ctx;
if (ud->flags & DETECT_URICONTENT_FAST_PATTERN &&
!(ud->flags & DETECT_URICONTENT_FAST_PATTERN_ONLY) &&
ud->flags & ud->flags & DETECT_URICONTENT_FAST_PATTERN_CHOP &&
DetectContentData *ud = de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_UMATCH]->ctx;
if (ud->flags & DETECT_CONTENT_FAST_PATTERN &&
!(ud->flags & DETECT_CONTENT_FAST_PATTERN_ONLY) &&
ud->flags & ud->flags & DETECT_CONTENT_FAST_PATTERN_CHOP &&
ud->fp_chop_offset == 3 &&
ud->fp_chop_len == 4) {
result = 1;
@ -2922,10 +2922,10 @@ int DetectFastPatternTest83(void)
"(uricontent:one; uricontent:two; offset:10; uricontent:three; fast_pattern:3,4; sid:1;)");
if (de_ctx->sig_list == NULL)
goto end;
DetectUricontentData *ud = de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_UMATCH]->ctx;
if (ud->flags & DETECT_URICONTENT_FAST_PATTERN &&
!(ud->flags & DETECT_URICONTENT_FAST_PATTERN_ONLY) &&
ud->flags & ud->flags & DETECT_URICONTENT_FAST_PATTERN_CHOP &&
DetectContentData *ud = de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_UMATCH]->ctx;
if (ud->flags & DETECT_CONTENT_FAST_PATTERN &&
!(ud->flags & DETECT_CONTENT_FAST_PATTERN_ONLY) &&
ud->flags & ud->flags & DETECT_CONTENT_FAST_PATTERN_CHOP &&
ud->fp_chop_offset == 3 &&
ud->fp_chop_len == 4) {
result = 1;
@ -2952,10 +2952,10 @@ int DetectFastPatternTest84(void)
"(uricontent:one; uricontent:two; depth:10; uricontent:three; fast_pattern:3,4; sid:1;)");
if (de_ctx->sig_list == NULL)
goto end;
DetectUricontentData *ud = de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_UMATCH]->ctx;
if (ud->flags & DETECT_URICONTENT_FAST_PATTERN &&
!(ud->flags & DETECT_URICONTENT_FAST_PATTERN_ONLY) &&
ud->flags & ud->flags & DETECT_URICONTENT_FAST_PATTERN_CHOP &&
DetectContentData *ud = de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_UMATCH]->ctx;
if (ud->flags & DETECT_CONTENT_FAST_PATTERN &&
!(ud->flags & DETECT_CONTENT_FAST_PATTERN_ONLY) &&
ud->flags & ud->flags & DETECT_CONTENT_FAST_PATTERN_CHOP &&
ud->fp_chop_offset == 3 &&
ud->fp_chop_len == 4) {
result = 1;
@ -3051,11 +3051,11 @@ int DetectFastPatternTest88(void)
"(uricontent:one; uricontent:!two; fast_pattern:3,4; uricontent:three; sid:1;)");
if (de_ctx->sig_list == NULL)
goto end;
DetectUricontentData *ud = de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_UMATCH]->prev->ctx;
if (ud->flags & DETECT_URICONTENT_FAST_PATTERN &&
ud->flags & DETECT_URICONTENT_NEGATED &&
!(ud->flags & DETECT_URICONTENT_FAST_PATTERN_ONLY) &&
ud->flags & ud->flags & DETECT_URICONTENT_FAST_PATTERN_CHOP &&
DetectContentData *ud = de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_UMATCH]->prev->ctx;
if (ud->flags & DETECT_CONTENT_FAST_PATTERN &&
ud->flags & DETECT_CONTENT_NEGATED &&
!(ud->flags & DETECT_CONTENT_FAST_PATTERN_ONLY) &&
ud->flags & ud->flags & DETECT_CONTENT_FAST_PATTERN_CHOP &&
ud->fp_chop_offset == 3 &&
ud->fp_chop_len == 4) {
result = 1;
@ -3170,11 +3170,11 @@ int DetectFastPatternTest93(void)
"(uricontent:one; content:!two; fast_pattern:3,4; http_uri; uricontent:three; sid:1;)");
if (de_ctx->sig_list == NULL)
goto end;
DetectUricontentData *ud = de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_UMATCH]->prev->ctx;
if (ud->flags & DETECT_URICONTENT_FAST_PATTERN &&
ud->flags & DETECT_URICONTENT_NEGATED &&
!(ud->flags & DETECT_URICONTENT_FAST_PATTERN_ONLY) &&
ud->flags & ud->flags & DETECT_URICONTENT_FAST_PATTERN_CHOP &&
DetectContentData *ud = de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_UMATCH]->prev->ctx;
if (ud->flags & DETECT_CONTENT_FAST_PATTERN &&
ud->flags & DETECT_CONTENT_NEGATED &&
!(ud->flags & DETECT_CONTENT_FAST_PATTERN_ONLY) &&
ud->flags & ud->flags & DETECT_CONTENT_FAST_PATTERN_CHOP &&
ud->fp_chop_offset == 3 &&
ud->fp_chop_len == 4) {
result = 1;
@ -3211,8 +3211,8 @@ int DetectFastPatternTest94(void)
sm = de_ctx->sig_list->sm_lists[DETECT_SM_LIST_UMATCH];
while (sm != NULL) {
if (sm->type == DETECT_URICONTENT) {
if ( ((DetectUricontentData *)sm->ctx)->flags &
DETECT_URICONTENT_FAST_PATTERN) {
if ( ((DetectContentData *)sm->ctx)->flags &
DETECT_CONTENT_FAST_PATTERN) {
result = 1;
break;
} else {
@ -3252,8 +3252,8 @@ int DetectFastPatternTest95(void)
sm = de_ctx->sig_list->sm_lists[DETECT_SM_LIST_UMATCH];
while (sm != NULL) {
if (sm->type == DETECT_URICONTENT) {
if ( ((DetectUricontentData *)sm->ctx)->flags &
DETECT_URICONTENT_FAST_PATTERN) {
if ( ((DetectContentData *)sm->ctx)->flags &
DETECT_CONTENT_FAST_PATTERN) {
result = 1;
break;
} else {
@ -3287,11 +3287,11 @@ int DetectFastPatternTest96(void)
result = 0;
sm = de_ctx->sig_list->sm_lists[DETECT_SM_LIST_UMATCH];
DetectUricontentData *ud = sm->ctx;
DetectContentData *ud = sm->ctx;
if (sm != NULL && sm->type == DETECT_URICONTENT) {
if (ud->flags & DETECT_URICONTENT_FAST_PATTERN &&
ud->flags & DETECT_URICONTENT_FAST_PATTERN_ONLY &&
!(ud->flags & ud->flags & DETECT_URICONTENT_FAST_PATTERN_CHOP) &&
if (ud->flags & DETECT_CONTENT_FAST_PATTERN &&
ud->flags & DETECT_CONTENT_FAST_PATTERN_ONLY &&
!(ud->flags & ud->flags & DETECT_CONTENT_FAST_PATTERN_CHOP) &&
ud->fp_chop_offset == 0 &&
ud->fp_chop_len == 0) {
result = 1;
@ -3323,11 +3323,11 @@ int DetectFastPatternTest97(void)
result = 0;
sm = de_ctx->sig_list->sm_lists[DETECT_SM_LIST_UMATCH];
DetectUricontentData *ud = sm->ctx;
DetectContentData *ud = sm->ctx;
if (sm != NULL && sm->type == DETECT_URICONTENT) {
if (ud->flags & DETECT_URICONTENT_FAST_PATTERN &&
!(ud->flags & DETECT_URICONTENT_FAST_PATTERN_ONLY) &&
ud->flags & ud->flags & DETECT_URICONTENT_FAST_PATTERN_CHOP &&
if (ud->flags & DETECT_CONTENT_FAST_PATTERN &&
!(ud->flags & DETECT_CONTENT_FAST_PATTERN_ONLY) &&
ud->flags & ud->flags & DETECT_CONTENT_FAST_PATTERN_CHOP &&
ud->fp_chop_offset == 3 &&
ud->fp_chop_len == 4) {
result = 1;
@ -3554,10 +3554,10 @@ int DetectFastPatternTest107(void)
if (de_ctx->sig_list == NULL)
goto end;
DetectUricontentData *ud = de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_UMATCH]->ctx;
if (ud->flags & DETECT_URICONTENT_FAST_PATTERN &&
ud->flags & DETECT_URICONTENT_FAST_PATTERN_ONLY &&
!(ud->flags & ud->flags & DETECT_URICONTENT_FAST_PATTERN_CHOP) &&
DetectContentData *ud = de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_UMATCH]->ctx;
if (ud->flags & DETECT_CONTENT_FAST_PATTERN &&
ud->flags & DETECT_CONTENT_FAST_PATTERN_ONLY &&
!(ud->flags & ud->flags & DETECT_CONTENT_FAST_PATTERN_CHOP) &&
ud->fp_chop_offset == 0 &&
ud->fp_chop_len == 0) {
result = 1;
@ -3584,10 +3584,10 @@ int DetectFastPatternTest108(void)
"(uricontent:one; uricontent:two; within:30; content:two; fast_pattern:only; http_uri; sid:1;)");
if (de_ctx->sig_list == NULL)
goto end;
DetectUricontentData *ud = de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_UMATCH]->ctx;
if (ud->flags & DETECT_URICONTENT_FAST_PATTERN &&
ud->flags & DETECT_URICONTENT_FAST_PATTERN_ONLY &&
!(ud->flags & ud->flags & DETECT_URICONTENT_FAST_PATTERN_CHOP) &&
DetectContentData *ud = de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_UMATCH]->ctx;
if (ud->flags & DETECT_CONTENT_FAST_PATTERN &&
ud->flags & DETECT_CONTENT_FAST_PATTERN_ONLY &&
!(ud->flags & ud->flags & DETECT_CONTENT_FAST_PATTERN_CHOP) &&
ud->fp_chop_offset == 0 &&
ud->fp_chop_len == 0) {
result = 1;
@ -3614,10 +3614,10 @@ int DetectFastPatternTest109(void)
"(uricontent:one; uricontent:two; offset:30; content:two; fast_pattern:only; http_uri; sid:1;)");
if (de_ctx->sig_list == NULL)
goto end;
DetectUricontentData *ud = de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_UMATCH]->ctx;
if (ud->flags & DETECT_URICONTENT_FAST_PATTERN &&
ud->flags & DETECT_URICONTENT_FAST_PATTERN_ONLY &&
!(ud->flags & ud->flags & DETECT_URICONTENT_FAST_PATTERN_CHOP) &&
DetectContentData *ud = de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_UMATCH]->ctx;
if (ud->flags & DETECT_CONTENT_FAST_PATTERN &&
ud->flags & DETECT_CONTENT_FAST_PATTERN_ONLY &&
!(ud->flags & ud->flags & DETECT_CONTENT_FAST_PATTERN_CHOP) &&
ud->fp_chop_offset == 0 &&
ud->fp_chop_len == 0) {
result = 1;
@ -3644,10 +3644,10 @@ int DetectFastPatternTest110(void)
"(uricontent:one; uricontent:two; depth:30; content:two; fast_pattern:only; http_uri; sid:1;)");
if (de_ctx->sig_list == NULL)
goto end;
DetectUricontentData *ud = de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_UMATCH]->ctx;
if (ud->flags & DETECT_URICONTENT_FAST_PATTERN &&
ud->flags & DETECT_URICONTENT_FAST_PATTERN_ONLY &&
!(ud->flags & ud->flags & DETECT_URICONTENT_FAST_PATTERN_CHOP) &&
DetectContentData *ud = de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_UMATCH]->ctx;
if (ud->flags & DETECT_CONTENT_FAST_PATTERN &&
ud->flags & DETECT_CONTENT_FAST_PATTERN_ONLY &&
!(ud->flags & ud->flags & DETECT_CONTENT_FAST_PATTERN_CHOP) &&
ud->fp_chop_offset == 0 &&
ud->fp_chop_len == 0) {
result = 1;
@ -3674,11 +3674,11 @@ int DetectFastPatternTest111(void)
"(content:!one; fast_pattern; http_uri; uricontent:two; sid:1;)");
if (de_ctx->sig_list == NULL)
goto end;
DetectUricontentData *ud = de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_UMATCH]->prev->ctx;
if (ud->flags & DETECT_URICONTENT_FAST_PATTERN &&
ud->flags & DETECT_URICONTENT_NEGATED &&
!(ud->flags & DETECT_URICONTENT_FAST_PATTERN_ONLY) &&
!(ud->flags & ud->flags & DETECT_URICONTENT_FAST_PATTERN_CHOP) &&
DetectContentData *ud = de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_UMATCH]->prev->ctx;
if (ud->flags & DETECT_CONTENT_FAST_PATTERN &&
ud->flags & DETECT_CONTENT_NEGATED &&
!(ud->flags & DETECT_CONTENT_FAST_PATTERN_ONLY) &&
!(ud->flags & ud->flags & DETECT_CONTENT_FAST_PATTERN_CHOP) &&
ud->fp_chop_offset == 0 &&
ud->fp_chop_len == 0) {
result = 1;
@ -3793,10 +3793,10 @@ int DetectFastPatternTest116(void)
"(uricontent:one; content:two; fast_pattern:3,4; http_uri; uricontent:three; sid:1;)");
if (de_ctx->sig_list == NULL)
goto end;
DetectUricontentData *ud = de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_UMATCH]->prev->ctx;
if (ud->flags & DETECT_URICONTENT_FAST_PATTERN &&
!(ud->flags & DETECT_URICONTENT_FAST_PATTERN_ONLY) &&
ud->flags & ud->flags & DETECT_URICONTENT_FAST_PATTERN_CHOP &&
DetectContentData *ud = de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_UMATCH]->prev->ctx;
if (ud->flags & DETECT_CONTENT_FAST_PATTERN &&
!(ud->flags & DETECT_CONTENT_FAST_PATTERN_ONLY) &&
ud->flags & ud->flags & DETECT_CONTENT_FAST_PATTERN_CHOP &&
ud->fp_chop_offset == 3 &&
ud->fp_chop_len == 4) {
result = 1;
@ -3823,10 +3823,10 @@ int DetectFastPatternTest117(void)
"(uricontent:one; content:two; fast_pattern:3,4; http_uri; uricontent:three; distance:30; sid:1;)");
if (de_ctx->sig_list == NULL)
goto end;
DetectUricontentData *ud = de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_UMATCH]->prev->ctx;
if (ud->flags & DETECT_URICONTENT_FAST_PATTERN &&
!(ud->flags & DETECT_URICONTENT_FAST_PATTERN_ONLY) &&
ud->flags & ud->flags & DETECT_URICONTENT_FAST_PATTERN_CHOP &&
DetectContentData *ud = de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_UMATCH]->prev->ctx;
if (ud->flags & DETECT_CONTENT_FAST_PATTERN &&
!(ud->flags & DETECT_CONTENT_FAST_PATTERN_ONLY) &&
ud->flags & ud->flags & DETECT_CONTENT_FAST_PATTERN_CHOP &&
ud->fp_chop_offset == 3 &&
ud->fp_chop_len == 4) {
result = 1;
@ -3853,10 +3853,10 @@ int DetectFastPatternTest118(void)
"(uricontent:one; content:two; fast_pattern:3,4; http_uri; uricontent:three; within:30; sid:1;)");
if (de_ctx->sig_list == NULL)
goto end;
DetectUricontentData *ud = de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_UMATCH]->prev->ctx;
if (ud->flags & DETECT_URICONTENT_FAST_PATTERN &&
!(ud->flags & DETECT_URICONTENT_FAST_PATTERN_ONLY) &&
ud->flags & ud->flags & DETECT_URICONTENT_FAST_PATTERN_CHOP &&
DetectContentData *ud = de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_UMATCH]->prev->ctx;
if (ud->flags & DETECT_CONTENT_FAST_PATTERN &&
!(ud->flags & DETECT_CONTENT_FAST_PATTERN_ONLY) &&
ud->flags & ud->flags & DETECT_CONTENT_FAST_PATTERN_CHOP &&
ud->fp_chop_offset == 3 &&
ud->fp_chop_len == 4) {
result = 1;
@ -3883,10 +3883,10 @@ int DetectFastPatternTest119(void)
"(uricontent:one; content:two; fast_pattern:3,4; http_uri; uricontent:three; offset:30; sid:1;)");
if (de_ctx->sig_list == NULL)
goto end;
DetectUricontentData *ud = de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_UMATCH]->prev->ctx;
if (ud->flags & DETECT_URICONTENT_FAST_PATTERN &&
!(ud->flags & DETECT_URICONTENT_FAST_PATTERN_ONLY) &&
ud->flags & ud->flags & DETECT_URICONTENT_FAST_PATTERN_CHOP &&
DetectContentData *ud = de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_UMATCH]->prev->ctx;
if (ud->flags & DETECT_CONTENT_FAST_PATTERN &&
!(ud->flags & DETECT_CONTENT_FAST_PATTERN_ONLY) &&
ud->flags & ud->flags & DETECT_CONTENT_FAST_PATTERN_CHOP &&
ud->fp_chop_offset == 3 &&
ud->fp_chop_len == 4) {
result = 1;
@ -3913,10 +3913,10 @@ int DetectFastPatternTest120(void)
"(uricontent:one; content:two; fast_pattern:3,4; http_uri; uricontent:three; depth:30; sid:1;)");
if (de_ctx->sig_list == NULL)
goto end;
DetectUricontentData *ud = de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_UMATCH]->prev->ctx;
if (ud->flags & DETECT_URICONTENT_FAST_PATTERN &&
!(ud->flags & DETECT_URICONTENT_FAST_PATTERN_ONLY) &&
ud->flags & ud->flags & DETECT_URICONTENT_FAST_PATTERN_CHOP &&
DetectContentData *ud = de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_UMATCH]->prev->ctx;
if (ud->flags & DETECT_CONTENT_FAST_PATTERN &&
!(ud->flags & DETECT_CONTENT_FAST_PATTERN_ONLY) &&
ud->flags & ud->flags & DETECT_CONTENT_FAST_PATTERN_CHOP &&
ud->fp_chop_offset == 3 &&
ud->fp_chop_len == 4) {
result = 1;
@ -3943,10 +3943,10 @@ int DetectFastPatternTest121(void)
"(uricontent:one; uricontent:two; distance:10; content:three; fast_pattern:3,4; http_uri; sid:1;)");
if (de_ctx->sig_list == NULL)
goto end;
DetectUricontentData *ud = de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_UMATCH]->ctx;
if (ud->flags & DETECT_URICONTENT_FAST_PATTERN &&
!(ud->flags & DETECT_URICONTENT_FAST_PATTERN_ONLY) &&
ud->flags & ud->flags & DETECT_URICONTENT_FAST_PATTERN_CHOP &&
DetectContentData *ud = de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_UMATCH]->ctx;
if (ud->flags & DETECT_CONTENT_FAST_PATTERN &&
!(ud->flags & DETECT_CONTENT_FAST_PATTERN_ONLY) &&
ud->flags & ud->flags & DETECT_CONTENT_FAST_PATTERN_CHOP &&
ud->fp_chop_offset == 3 &&
ud->fp_chop_len == 4) {
result = 1;
@ -3973,10 +3973,10 @@ int DetectFastPatternTest122(void)
"(uricontent:one; uricontent:two; within:10; content:three; fast_pattern:3,4; http_uri; sid:1;)");
if (de_ctx->sig_list == NULL)
goto end;
DetectUricontentData *ud = de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_UMATCH]->ctx;
if (ud->flags & DETECT_URICONTENT_FAST_PATTERN &&
!(ud->flags & DETECT_URICONTENT_FAST_PATTERN_ONLY) &&
ud->flags & ud->flags & DETECT_URICONTENT_FAST_PATTERN_CHOP &&
DetectContentData *ud = de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_UMATCH]->ctx;
if (ud->flags & DETECT_CONTENT_FAST_PATTERN &&
!(ud->flags & DETECT_CONTENT_FAST_PATTERN_ONLY) &&
ud->flags & ud->flags & DETECT_CONTENT_FAST_PATTERN_CHOP &&
ud->fp_chop_offset == 3 &&
ud->fp_chop_len == 4) {
result = 1;
@ -4003,10 +4003,10 @@ int DetectFastPatternTest123(void)
"(uricontent:one; uricontent:two; offset:10; content:three; fast_pattern:3,4; http_uri; sid:1;)");
if (de_ctx->sig_list == NULL)
goto end;
DetectUricontentData *ud = de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_UMATCH]->ctx;
if (ud->flags & DETECT_URICONTENT_FAST_PATTERN &&
!(ud->flags & DETECT_URICONTENT_FAST_PATTERN_ONLY) &&
ud->flags & ud->flags & DETECT_URICONTENT_FAST_PATTERN_CHOP &&
DetectContentData *ud = de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_UMATCH]->ctx;
if (ud->flags & DETECT_CONTENT_FAST_PATTERN &&
!(ud->flags & DETECT_CONTENT_FAST_PATTERN_ONLY) &&
ud->flags & ud->flags & DETECT_CONTENT_FAST_PATTERN_CHOP &&
ud->fp_chop_offset == 3 &&
ud->fp_chop_len == 4) {
result = 1;
@ -4033,10 +4033,10 @@ int DetectFastPatternTest124(void)
"(uricontent:one; uricontent:two; depth:10; content:three; fast_pattern:3,4; http_uri; sid:1;)");
if (de_ctx->sig_list == NULL)
goto end;
DetectUricontentData *ud = de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_UMATCH]->ctx;
if (ud->flags & DETECT_URICONTENT_FAST_PATTERN &&
!(ud->flags & DETECT_URICONTENT_FAST_PATTERN_ONLY) &&
ud->flags & ud->flags & DETECT_URICONTENT_FAST_PATTERN_CHOP &&
DetectContentData *ud = de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_UMATCH]->ctx;
if (ud->flags & DETECT_CONTENT_FAST_PATTERN &&
!(ud->flags & DETECT_CONTENT_FAST_PATTERN_ONLY) &&
ud->flags & ud->flags & DETECT_CONTENT_FAST_PATTERN_CHOP &&
ud->fp_chop_offset == 3 &&
ud->fp_chop_len == 4) {
result = 1;
@ -4132,11 +4132,11 @@ int DetectFastPatternTest128(void)
"(uricontent:one; content:!two; fast_pattern:3,4; http_uri; uricontent:three; sid:1;)");
if (de_ctx->sig_list == NULL)
goto end;
DetectUricontentData *ud = de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_UMATCH]->prev->ctx;
if (ud->flags & DETECT_URICONTENT_FAST_PATTERN &&
ud->flags & DETECT_URICONTENT_NEGATED &&
!(ud->flags & DETECT_URICONTENT_FAST_PATTERN_ONLY) &&
ud->flags & ud->flags & DETECT_URICONTENT_FAST_PATTERN_CHOP &&
DetectContentData *ud = de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_UMATCH]->prev->ctx;
if (ud->flags & DETECT_CONTENT_FAST_PATTERN &&
ud->flags & DETECT_CONTENT_NEGATED &&
!(ud->flags & DETECT_CONTENT_FAST_PATTERN_ONLY) &&
ud->flags & ud->flags & DETECT_CONTENT_FAST_PATTERN_CHOP &&
ud->fp_chop_offset == 3 &&
ud->fp_chop_len == 4) {
result = 1;
@ -4251,11 +4251,11 @@ int DetectFastPatternTest133(void)
"(uricontent:one; content:!two; fast_pattern:3,4; http_uri; uricontent:three; sid:1;)");
if (de_ctx->sig_list == NULL)
goto end;
DetectUricontentData *ud = de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_UMATCH]->prev->ctx;
if (ud->flags & DETECT_URICONTENT_FAST_PATTERN &&
ud->flags & DETECT_URICONTENT_NEGATED &&
!(ud->flags & DETECT_URICONTENT_FAST_PATTERN_ONLY) &&
ud->flags & ud->flags & DETECT_URICONTENT_FAST_PATTERN_CHOP &&
DetectContentData *ud = de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_UMATCH]->prev->ctx;
if (ud->flags & DETECT_CONTENT_FAST_PATTERN &&
ud->flags & DETECT_CONTENT_NEGATED &&
!(ud->flags & DETECT_CONTENT_FAST_PATTERN_ONLY) &&
ud->flags & ud->flags & DETECT_CONTENT_FAST_PATTERN_CHOP &&
ud->fp_chop_offset == 3 &&
ud->fp_chop_len == 4) {
result = 1;

36
src/detect-http-uri.c
Unescape Escape View File

@ -83,7 +83,7 @@ void DetectHttpUriRegister (void) {
static int DetectHttpUriSetup (DetectEngineCtx *de_ctx, Signature *s, char *str)
{
DetectUricontentData *duc = NULL;
DetectContentData *duc = NULL;
SigMatch *sm = NULL;
/** new sig match to replace previous content */
@ -121,10 +121,10 @@ static int DetectHttpUriSetup (DetectEngineCtx *de_ctx, Signature *s, char *str)
goto error;
/* Setup the uricontent data from content data structure */
duc = SCMalloc(sizeof(DetectUricontentData));
duc = SCMalloc(sizeof(DetectContentData));
if (duc == NULL)
goto error;
memset(duc, 0, sizeof(DetectUricontentData));
memset(duc, 0, sizeof(DetectContentData));
duc->content_len = ((DetectContentData *)pm->ctx)->content_len;
if ((duc->content = SCMalloc(duc->content_len)) == NULL)
@ -132,15 +132,15 @@ static int DetectHttpUriSetup (DetectEngineCtx *de_ctx, Signature *s, char *str)
memcpy(duc->content, ((DetectContentData *)pm->ctx)->content, duc->content_len);
duc->flags |= (((DetectContentData *)pm->ctx)->flags & DETECT_CONTENT_NOCASE) ?
DETECT_URICONTENT_NOCASE : 0;
DETECT_CONTENT_NOCASE : 0;
duc->flags |= (((DetectContentData *)pm->ctx)->flags & DETECT_CONTENT_NEGATED) ?
DETECT_URICONTENT_NEGATED : 0;
DETECT_CONTENT_NEGATED : 0;
duc->flags |= (((DetectContentData *)pm->ctx)->flags & DETECT_CONTENT_FAST_PATTERN) ?
DETECT_URICONTENT_FAST_PATTERN : 0;
DETECT_CONTENT_FAST_PATTERN : 0;
duc->flags |= (((DetectContentData *)pm->ctx)->flags & DETECT_CONTENT_FAST_PATTERN_ONLY) ?
DETECT_URICONTENT_FAST_PATTERN_ONLY : 0;
DETECT_CONTENT_FAST_PATTERN_ONLY : 0;
if (((DetectContentData *)pm->ctx)->flags & DETECT_CONTENT_FAST_PATTERN_CHOP) {
duc->flags |= DETECT_URICONTENT_FAST_PATTERN_CHOP;
duc->flags |= DETECT_CONTENT_FAST_PATTERN_CHOP;
duc->fp_chop_offset = ((DetectContentData *)pm->ctx)->fp_chop_offset;
duc->fp_chop_len = ((DetectContentData *)pm->ctx)->fp_chop_len;
}
@ -336,8 +336,8 @@ int DetectHttpUriTest05(void)
}
char *str = "we are testing http_uri keyword";
int uricomp = memcmp((const char *)((DetectUricontentData*) s->sm_lists[DETECT_SM_LIST_UMATCH]->ctx)->content, str, strlen(str)-1);
int urilen = ((DetectUricontentData*) s->sm_lists_tail[DETECT_SM_LIST_UMATCH]->ctx)->content_len;
int uricomp = memcmp((const char *)((DetectContentData*) s->sm_lists[DETECT_SM_LIST_UMATCH]->ctx)->content, str, strlen(str)-1);
int urilen = ((DetectContentData*) s->sm_lists_tail[DETECT_SM_LIST_UMATCH]->ctx)->content_len;
if (uricomp != 0 ||
urilen != strlen("we are testing http_uri keyword")) {
printf("sig failed to parse, content not setup properly\n");
@ -378,7 +378,7 @@ int DetectHttpUriTest06(void)
}
DetectContentData *cd = de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_PMATCH]->ctx;
DetectUricontentData *ud = de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_UMATCH]->ctx;
DetectContentData *ud = de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_UMATCH]->ctx;
if (cd->id == ud->id)
goto end;
@ -417,7 +417,7 @@ int DetectHttpUriTest07(void)
}
DetectContentData *cd = de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_PMATCH]->ctx;
DetectUricontentData *ud = de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_UMATCH]->ctx;
DetectContentData *ud = de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_UMATCH]->ctx;
if (cd->id == ud->id)
goto end;
@ -456,7 +456,7 @@ int DetectHttpUriTest08(void)
}
DetectContentData *cd = de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_PMATCH]->ctx;
DetectUricontentData *ud = de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_UMATCH]->ctx;
DetectContentData *ud = de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_UMATCH]->ctx;
if (cd->id != 0 || ud->id != 1)
goto end;
@ -495,7 +495,7 @@ int DetectHttpUriTest09(void)
}
DetectContentData *cd = de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_PMATCH]->ctx;
DetectUricontentData *ud = de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_UMATCH]->ctx;
DetectContentData *ud = de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_UMATCH]->ctx;
if (cd->id != 1 || ud->id != 0)
goto end;
@ -535,8 +535,8 @@ int DetectHttpUriTest10(void)
}
DetectContentData *cd = de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_PMATCH]->ctx;
DetectUricontentData *ud1 = de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_UMATCH]->ctx;
DetectUricontentData *ud2 = de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_UMATCH]->prev->ctx;
DetectContentData *ud1 = de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_UMATCH]->ctx;
DetectContentData *ud2 = de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_UMATCH]->prev->ctx;
if (cd->id != 1 || ud1->id != 0 || ud2->id != 0)
goto end;
@ -576,8 +576,8 @@ int DetectHttpUriTest11(void)
}
DetectContentData *cd = de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_PMATCH]->ctx;
DetectUricontentData *ud1 = de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_UMATCH]->ctx;
DetectUricontentData *ud2 = de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_UMATCH]->prev->ctx;
DetectContentData *ud1 = de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_UMATCH]->ctx;
DetectContentData *ud2 = de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_UMATCH]->prev->ctx;
if (cd->id != 2 || ud1->id != 0 || ud2->id != 0)
goto end;

6
src/detect-isdataat.c
Unescape Escape View File

@ -295,7 +295,7 @@ int DetectIsdataatSetup (DetectEngineCtx *de_ctx, Signature *s, char *isdataatst
}
DetectContentData *cd = NULL;
DetectUricontentData *ud = NULL;
DetectContentData *ud = NULL;
DetectPcreData *pe = NULL;
switch (prev_sm->type) {
@ -313,13 +313,13 @@ int DetectIsdataatSetup (DetectEngineCtx *de_ctx, Signature *s, char *isdataatst
case DETECT_URICONTENT:
/* Set the relative next flag on the prev sigmatch */
ud = (DetectUricontentData *)prev_sm->ctx;
ud = (DetectContentData *)prev_sm->ctx;
if (ud == NULL) {
SCLogError(SC_ERR_INVALID_SIGNATURE, "Unknown previous-"
"previous keyword!");
return -1;
}
ud->flags |= DETECT_URICONTENT_RELATIVE_NEXT;
ud->flags |= DETECT_CONTENT_RELATIVE_NEXT;
break;

6
src/detect-nocase.c
Unescape Escape View File

@ -187,7 +187,7 @@ static int DetectNocaseSetup (DetectEngineCtx *de_ctx, Signature *s, char *nulls
SCReturnInt(-1);
}
DetectUricontentData *ud = NULL;
DetectContentData *ud = NULL;
DetectContentData *cd = NULL;
DetectHttpClientBodyData *dhcb = NULL;
DetectHttpCookieData *dhcd = NULL;
@ -196,12 +196,12 @@ static int DetectNocaseSetup (DetectEngineCtx *de_ctx, Signature *s, char *nulls
switch (pm->type) {
case DETECT_URICONTENT:
ud = (DetectUricontentData *)pm->ctx;
ud = (DetectContentData *)pm->ctx;
if (ud == NULL) {
SCLogError(SC_ERR_INVALID_ARGUMENT, "invalid argument");
SCReturnInt(-1);
}
ud->flags |= DETECT_URICONTENT_NOCASE;
ud->flags |= DETECT_CONTENT_NOCASE;
/* Recreate the context with nocase chars */
BoyerMooreCtxToNocase(ud->bm_ctx, ud->content, ud->content_len);
break;

12
src/detect-offset.c
Unescape Escape View File

@ -94,11 +94,11 @@ int DetectOffsetSetup (DetectEngineCtx *de_ctx, Signature *s, char *offsetstr)
break;
}
DetectUricontentData *ud = NULL;
DetectContentData *ud = NULL;
DetectContentData *cd = NULL;
switch (pm->type) {
case DETECT_URICONTENT:
ud = (DetectUricontentData *)pm->ctx;
ud = (DetectContentData *)pm->ctx;
if (ud == NULL) {
SCLogError(SC_ERR_INVALID_ARGUMENT, "invalid argument");
if (dubbed)
@ -106,14 +106,14 @@ int DetectOffsetSetup (DetectEngineCtx *de_ctx, Signature *s, char *offsetstr)
return -1;
}
if (ud->flags & DETECT_URICONTENT_NEGATED) {
if (ud->flags & DETECT_URICONTENT_FAST_PATTERN) {
if (ud->flags & DETECT_CONTENT_NEGATED) {
if (ud->flags & DETECT_CONTENT_FAST_PATTERN) {
SCLogError(SC_ERR_INVALID_SIGNATURE, "You can't have a relative "
"negated keyword set along with a fast_pattern");
goto error;
}
} else {
if (ud->flags & DETECT_URICONTENT_FAST_PATTERN_ONLY) {
if (ud->flags & DETECT_CONTENT_FAST_PATTERN_ONLY) {
SCLogError(SC_ERR_INVALID_SIGNATURE, "You can't have a relative "
"keyword set along with a fast_pattern:only;");
goto error;
@ -131,7 +131,7 @@ int DetectOffsetSetup (DetectEngineCtx *de_ctx, Signature *s, char *offsetstr)
ud->depth += ud->offset;
}
ud->flags |= DETECT_URICONTENT_OFFSET;
ud->flags |= DETECT_CONTENT_OFFSET;
break;

14
src/detect-parse.c
Unescape Escape View File

@ -1290,13 +1290,13 @@ Signature *SigInit(DetectEngineCtx *de_ctx, char *sigstr) {
}
for (sm = sig->sm_lists[DETECT_SM_LIST_UMATCH]; sm != NULL; sm = sm->next) {
if (sm->type == DETECT_URICONTENT) {
DetectUricontentData *ud = (DetectUricontentData *)sm->ctx;
DetectContentData *ud = (DetectContentData *)sm->ctx;
if (ud == NULL)
continue;
sig->flags |= SIG_FLAG_MPM_URI;
if (ud->flags & DETECT_URICONTENT_NEGATED) {
if (ud->flags & DETECT_CONTENT_NEGATED) {
sig->flags |= SIG_FLAG_MPM_URI_NEG;
}
}
@ -1326,7 +1326,7 @@ Signature *SigInit(DetectEngineCtx *de_ctx, char *sigstr) {
for (sm = sig->sm_lists[DETECT_SM_LIST_UMATCH]; sm != NULL; sm = sm->next) {
if (sm->type == DETECT_URICONTENT) {
DetectUricontentData *ud = (DetectUricontentData *)sm->ctx;
DetectContentData *ud = (DetectContentData *)sm->ctx;
if (ud == NULL)
continue;
@ -1432,13 +1432,13 @@ Signature *SigInitReal(DetectEngineCtx *de_ctx, char *sigstr) {
}
for (sm = sig->sm_lists[DETECT_SM_LIST_UMATCH]; sm != NULL; sm = sm->next) {
if (sm->type == DETECT_URICONTENT) {
DetectUricontentData *ud = (DetectUricontentData *)sm->ctx;
DetectContentData *ud = (DetectContentData *)sm->ctx;
if (ud == NULL)
continue;
sig->flags |= SIG_FLAG_MPM_URI;
if (ud->flags & DETECT_URICONTENT_NEGATED) {
if (ud->flags & DETECT_CONTENT_NEGATED) {
sig->flags |= SIG_FLAG_MPM_URI_NEG;
}
}
@ -1468,7 +1468,7 @@ Signature *SigInitReal(DetectEngineCtx *de_ctx, char *sigstr) {
for (sm = sig->sm_lists[DETECT_SM_LIST_UMATCH]; sm != NULL; sm = sm->next) {
if (sm->type == DETECT_URICONTENT) {
DetectUricontentData *ud = (DetectUricontentData *)sm->ctx;
DetectContentData *ud = (DetectContentData *)sm->ctx;
if (ud == NULL)
continue;
if (sig->mpm_uricontent_maxlen == 0)
@ -1517,7 +1517,7 @@ Signature *SigInitReal(DetectEngineCtx *de_ctx, char *sigstr) {
for (sm = sig->next->sm_lists[DETECT_SM_LIST_UMATCH]; sm != NULL; sm = sm->next) {
if (sm->type == DETECT_URICONTENT) {
DetectUricontentData *ud = (DetectUricontentData *)sm->ctx;
DetectContentData *ud = (DetectContentData *)sm->ctx;
if (ud == NULL)
continue;

6
src/detect-pcre.c
Unescape Escape View File

@ -1391,7 +1391,7 @@ static int DetectPcreSetup (DetectEngineCtx *de_ctx, Signature *s, char *regexst
}
DetectContentData *cd = NULL;
DetectUricontentData *ud = NULL;
DetectContentData *ud = NULL;
DetectPcreData *pe = NULL;
switch (prev_sm->type) {
@ -1408,12 +1408,12 @@ static int DetectPcreSetup (DetectEngineCtx *de_ctx, Signature *s, char *regexst
case DETECT_URICONTENT:
/* Set the relative next flag on the prev sigmatch */
ud = (DetectUricontentData *)prev_sm->ctx;
ud = (DetectContentData *)prev_sm->ctx;
if (ud == NULL) {
SCLogError(SC_ERR_INVALID_SIGNATURE, "uricontent not setup properly");
SCReturnInt(-1);
}
ud->flags |= DETECT_URICONTENT_RELATIVE_NEXT;
ud->flags |= DETECT_CONTENT_RELATIVE_NEXT;
break;

68
src/detect-uricontent.c
Unescape Escape View File

@ -90,13 +90,13 @@ uint32_t DetectUricontentMaxId(DetectEngineCtx *de_ctx)
}
/**
* \brief this function will Free memory associated with DetectUricontentData
* \brief this function will Free memory associated with DetectContentData
*
* \param cd pointer to DetectUricotentData
*/
void DetectUricontentFree(void *ptr) {
SCEnter();
DetectUricontentData *cd = (DetectUricontentData *)ptr;
DetectContentData *cd = (DetectContentData *)ptr;
if (cd == NULL)
SCReturn;
@ -113,7 +113,7 @@ void DetectUricontentFree(void *ptr) {
/**
* \brief Helper function to print a DetectContentData
*/
void DetectUricontentPrint(DetectUricontentData *cd)
void DetectUricontentPrint(DetectContentData *cd)
{
int i = 0;
if (cd == NULL) {
@ -148,9 +148,9 @@ void DetectUricontentPrint(DetectUricontentData *cd)
SCLogDebug("Distance: %"PRIi32, cd->distance);
SCLogDebug("flags: %u ", cd->flags);
SCLogDebug("negated: %s ",
cd->flags & DETECT_URICONTENT_NEGATED ? "true" : "false");
cd->flags & DETECT_CONTENT_NEGATED ? "true" : "false");
SCLogDebug("relative match next: %s ",
cd->flags & DETECT_URICONTENT_RELATIVE_NEXT ? "true" : "false");
cd->flags & DETECT_CONTENT_RELATIVE_NEXT ? "true" : "false");
SCLogDebug("-----------");
}
@ -173,7 +173,7 @@ SigMatch *DetectUricontentGetLastPattern(SigMatch *sm)
if (sm == NULL)
return NULL;
DetectUricontentData *cd = (DetectUricontentData*) sm->ctx;
DetectContentData *cd = (DetectContentData*) sm->ctx;
if (cd == NULL)
return NULL;
@ -185,9 +185,9 @@ SigMatch *DetectUricontentGetLastPattern(SigMatch *sm)
* the rule set.
* \param contentstr Pointer to the string which has been defined in the rule
*/
DetectUricontentData *DoDetectUricontentSetup (char * contentstr)
DetectContentData *DoDetectUricontentSetup (char * contentstr)
{
DetectUricontentData *cd = NULL;
DetectContentData *cd = NULL;
char *temp = NULL;
char *str = NULL;
uint16_t len = 0;
@ -202,10 +202,10 @@ DetectUricontentData *DoDetectUricontentSetup (char * contentstr)
return NULL;
}
cd = SCMalloc(sizeof(DetectUricontentData));
cd = SCMalloc(sizeof(DetectContentData));
if (cd == NULL)
goto error;
memset(cd,0,sizeof(DetectUricontentData));
memset(cd,0,sizeof(DetectContentData));
/* skip the first spaces */
slen = strlen(temp);
@ -214,7 +214,7 @@ DetectUricontentData *DoDetectUricontentSetup (char * contentstr)
};
if (temp[pos] == '!') {
cd->flags |= DETECT_URICONTENT_NEGATED;
cd->flags |= DETECT_CONTENT_NEGATED;
pos++;
}
@ -365,7 +365,7 @@ int DetectUricontentSetup (DetectEngineCtx *de_ctx, Signature *s, char *contents
{
SCEnter();
DetectUricontentData *cd = NULL;
DetectContentData *cd = NULL;
SigMatch *sm = NULL;
if (s->alproto == ALPROTO_DCERPC) {
@ -1115,8 +1115,8 @@ static int DetectUriSigTest04(void) {
if (s == NULL ||
s->sm_lists[DETECT_SM_LIST_UMATCH] == NULL ||
s->sm_lists[DETECT_SM_LIST_PMATCH] == NULL ||
((DetectUricontentData *)s->sm_lists[DETECT_SM_LIST_UMATCH]->ctx)->depth != 15 ||
((DetectUricontentData *)s->sm_lists[DETECT_SM_LIST_UMATCH]->ctx)->offset != 5 ||
((DetectContentData *)s->sm_lists[DETECT_SM_LIST_UMATCH]->ctx)->depth != 15 ||
((DetectContentData *)s->sm_lists[DETECT_SM_LIST_UMATCH]->ctx)->offset != 5 ||
s->sm_lists[DETECT_SM_LIST_MATCH] != NULL)
{
printf("sig 4 failed to parse: ");
@ -1171,11 +1171,11 @@ static int DetectUriSigTest04(void) {
s->sm_lists[DETECT_SM_LIST_PMATCH] == NULL ||
((DetectContentData*) s->sm_lists[DETECT_SM_LIST_PMATCH]->ctx)->depth != 15 ||
((DetectContentData*) s->sm_lists[DETECT_SM_LIST_PMATCH]->ctx)->offset != 5 ||
((DetectUricontentData*) s->sm_lists_tail[DETECT_SM_LIST_UMATCH]->ctx)->within != 30 ||
((DetectContentData*) s->sm_lists_tail[DETECT_SM_LIST_UMATCH]->ctx)->within != 30 ||
s->sm_lists[DETECT_SM_LIST_MATCH] != NULL)
{
printf("sig 8 failed to parse: ");
DetectUricontentPrint((DetectUricontentData*) s->sm_lists_tail[DETECT_SM_LIST_UMATCH]->ctx);
DetectUricontentPrint((DetectContentData*) s->sm_lists_tail[DETECT_SM_LIST_UMATCH]->ctx);
goto end;
}
@ -1211,11 +1211,11 @@ static int DetectUriSigTest04(void) {
s->sm_lists[DETECT_SM_LIST_PMATCH] == NULL ||
((DetectContentData*) s->sm_lists[DETECT_SM_LIST_PMATCH]->ctx)->depth != 15 ||
((DetectContentData*) s->sm_lists[DETECT_SM_LIST_PMATCH]->ctx)->offset != 5 ||
((DetectUricontentData*) s->sm_lists_tail[DETECT_SM_LIST_UMATCH]->ctx)->distance != 30 ||
((DetectContentData*) s->sm_lists_tail[DETECT_SM_LIST_UMATCH]->ctx)->distance != 30 ||
s->sm_lists[DETECT_SM_LIST_MATCH] != NULL)
{
printf("sig 10 failed to parse: ");
DetectUricontentPrint((DetectUricontentData*) s->sm_lists_tail[DETECT_SM_LIST_UMATCH]->ctx);
DetectUricontentPrint((DetectContentData*) s->sm_lists_tail[DETECT_SM_LIST_UMATCH]->ctx);
goto end;
}
@ -1238,14 +1238,14 @@ static int DetectUriSigTest04(void) {
if ( ((DetectContentData*) s->sm_lists[DETECT_SM_LIST_PMATCH]->ctx)->depth != 15 ||
((DetectContentData*) s->sm_lists[DETECT_SM_LIST_PMATCH]->ctx)->offset != 5 ||
((DetectUricontentData*) s->sm_lists_tail[DETECT_SM_LIST_UMATCH]->ctx)->distance != 30 ||
((DetectUricontentData*) s->sm_lists_tail[DETECT_SM_LIST_UMATCH]->ctx)->within != 60 ||
((DetectContentData*) s->sm_lists_tail[DETECT_SM_LIST_UMATCH]->ctx)->distance != 30 ||
((DetectContentData*) s->sm_lists_tail[DETECT_SM_LIST_UMATCH]->ctx)->within != 60 ||
((DetectContentData*) s->sm_lists_tail[DETECT_SM_LIST_PMATCH]->ctx)->distance != 45 ||
((DetectContentData*) s->sm_lists_tail[DETECT_SM_LIST_PMATCH]->ctx)->within != 70 ||
s->sm_lists[DETECT_SM_LIST_MATCH] != NULL) {
printf("sig 10 failed to parse, content not setup properly: ");
DetectContentPrint((DetectContentData*) s->sm_lists[DETECT_SM_LIST_PMATCH]->ctx);
DetectUricontentPrint((DetectUricontentData*) s->sm_lists_tail[DETECT_SM_LIST_UMATCH]->ctx);
DetectUricontentPrint((DetectContentData*) s->sm_lists_tail[DETECT_SM_LIST_UMATCH]->ctx);
DetectContentPrint((DetectContentData*) s->sm_lists_tail[DETECT_SM_LIST_PMATCH]->ctx);
goto end;
}
@ -1757,7 +1757,7 @@ int DetectUriSigTest11(void)
int DetectUriSigTest12(void)
{
DetectEngineCtx *de_ctx = NULL;
DetectUricontentData *ud = 0;
DetectContentData *ud = 0;
Signature *s = NULL;
int result = 1;
@ -1781,7 +1781,7 @@ int DetectUriSigTest12(void)
goto end;
}
ud = (DetectUricontentData *)s->sm_lists_tail[DETECT_SM_LIST_UMATCH]->ctx;
ud = (DetectContentData *)s->sm_lists_tail[DETECT_SM_LIST_UMATCH]->ctx;
result = (strncmp("boo", (char *)ud->content, ud->content_len) == 0);
end:
@ -2139,7 +2139,7 @@ int DetectUricontentSigTest08(void)
}
DetectContentData *cd = de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_PMATCH]->ctx;
DetectUricontentData *ud = de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_UMATCH]->ctx;
DetectContentData *ud = de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_UMATCH]->ctx;
if (cd->id == ud->id)
goto end;
@ -2178,7 +2178,7 @@ int DetectUricontentSigTest09(void)
}
DetectContentData *cd = de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_PMATCH]->ctx;
DetectUricontentData *ud = de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_UMATCH]->ctx;
DetectContentData *ud = de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_UMATCH]->ctx;
if (cd->id == ud->id)
goto end;
@ -2220,8 +2220,8 @@ int DetectUricontentSigTest10(void)
DetectContentData *cd1 = de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_PMATCH]->prev->prev->ctx;
DetectContentData *cd2 = de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_PMATCH]->prev->ctx;
DetectContentData *cd3 = de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_PMATCH]->ctx;
DetectUricontentData *ud1 = de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_UMATCH]->prev->ctx;
DetectUricontentData *ud2 = de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_UMATCH]->ctx;
DetectContentData *ud1 = de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_UMATCH]->prev->ctx;
DetectContentData *ud2 = de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_UMATCH]->ctx;
if (cd1->id != 1 || cd2->id != 2 || cd3->id != 1 || ud1->id != 0 || ud2->id != 0)
goto end;
@ -2263,8 +2263,8 @@ int DetectUricontentSigTest11(void)
DetectContentData *cd1 = de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_PMATCH]->prev->prev->ctx;
DetectContentData *cd2 = de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_PMATCH]->prev->ctx;
DetectContentData *cd3 = de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_PMATCH]->ctx;
DetectUricontentData *ud1 = de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_UMATCH]->prev->ctx;
DetectUricontentData *ud2 = de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_UMATCH]->ctx;
DetectContentData *ud1 = de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_UMATCH]->prev->ctx;
DetectContentData *ud2 = de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_UMATCH]->ctx;
if (cd1->id != 1 || cd2->id != 2 || cd3->id != 1 || ud1->id != 0 || ud2->id != 0)
goto end;
@ -2310,11 +2310,11 @@ int DetectUricontentSigTest12(void)
DetectContentData *cd3 = de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_PMATCH]->prev->prev->ctx;
DetectContentData *cd4 = de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_PMATCH]->prev->ctx;
DetectContentData *cd5 = de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_PMATCH]->ctx;
DetectUricontentData *ud1 = de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_UMATCH]->prev->prev->prev->prev->ctx;
DetectUricontentData *ud2 = de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_UMATCH]->prev->prev->prev->ctx;
DetectUricontentData *ud3 = de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_UMATCH]->prev->prev->ctx;
DetectUricontentData *ud4 = de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_UMATCH]->prev->ctx;
DetectUricontentData *ud5 = de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_UMATCH]->ctx;
DetectContentData *ud1 = de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_UMATCH]->prev->prev->prev->prev->ctx;
DetectContentData *ud2 = de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_UMATCH]->prev->prev->prev->ctx;
DetectContentData *ud3 = de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_UMATCH]->prev->prev->ctx;
DetectContentData *ud4 = de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_UMATCH]->prev->ctx;
DetectContentData *ud5 = de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_UMATCH]->ctx;
if (cd1->id != 1 || cd2->id != 2 || cd3->id != 1 || cd4->id != 1 || cd5->id != 4 ||
ud1->id != 0 || ud2->id != 0 || ud3->id != 0 || ud4->id != 0 || ud5->id != 3) {
goto end;

45
src/detect-uricontent.h
Unescape Escape View File

@ -25,59 +25,18 @@
#ifndef __DETECT_URICONTENT_H__
#define __DETECT_URICONTENT_H__
#define DETECT_URICONTENT_NOCASE 0x0001
#define DETECT_URICONTENT_DISTANCE 0x0002
#define DETECT_URICONTENT_WITHIN 0x0004
#define DETECT_URICONTENT_OFFSET 0x0008
#define DETECT_URICONTENT_DEPTH 0x0010
#define DETECT_URICONTENT_DISTANCE_NEXT 0x0020
#define DETECT_URICONTENT_WITHIN_NEXT 0x0040
#define DETECT_URICONTENT_RAWBYTES 0x0080
#define DETECT_URICONTENT_NEGATED 0x0100
#define DETECT_URICONTENT_RELATIVE_NEXT 0x0200
#define DETECT_URICONTENT_FAST_PATTERN 0x0400
#define DETECT_URICONTENT_FAST_PATTERN_ONLY 0x0800
#define DETECT_URICONTENT_FAST_PATTERN_CHOP 0x1000
#define DETECT_URICONTENT_IS_SINGLE(c) (!((c)->flags & DETECT_URICONTENT_DISTANCE || \
(c)->flags & DETECT_URICONTENT_WITHIN || \
(c)->flags & DETECT_URICONTENT_RELATIVE || \
(c)->depth > 0 || \
(c)->within > 0))
#include "detect-content.h"
#include "util-spm-bm.h"
#include "app-layer-htp.h"
typedef struct DetectUricontentData_ {
uint8_t *content;
uint8_t content_len;
PatIntId id;
uint32_t flags;
uint16_t depth;
uint16_t offset;
int32_t distance;
int32_t within;
BmCtx *bm_ctx; /**< Boyer Moore context (for spm search) */
/* if someone wants to add an extra var to this structutre of size 1 byte
* you can reduce the below var to uint8_t. No problemo */
uint16_t avoid_double_check;
/* for chopped fast pattern, the offset */
uint16_t fp_chop_offset;
/* for chopped fast pattern, the length */
uint16_t fp_chop_len;
} DetectUricontentData;
/* prototypes */
void DetectUricontentRegister (void);
uint32_t DetectUricontentMaxId(DetectEngineCtx *);
//uint32_t DetectUricontentInspectMpm(DetectEngineThreadCtx *det_ctx, void *alstate);
SigMatch *DetectUricontentGetLastPattern(SigMatch *);
void DetectUricontentPrint(DetectUricontentData *);
void DetectUricontentPrint(DetectContentData *);
uint32_t DetectUricontentInspectMpm(DetectEngineThreadCtx *, Flow *, HtpState *);
#endif /* __DETECT_URICONTENT_H__ */

20
src/detect-within.c
Unescape Escape View File

@ -181,26 +181,26 @@ static int DetectWithinSetup (DetectEngineCtx *de_ctx, Signature *s, char *withi
}
}
DetectUricontentData *ud = NULL;
DetectContentData *ud = NULL;
DetectContentData *cd = NULL;
DetectPcreData *pe = NULL;
switch (pm->type) {
case DETECT_URICONTENT:
ud = (DetectUricontentData *)pm->ctx;
ud = (DetectContentData *)pm->ctx;
if (ud == NULL) {
SCLogError(SC_ERR_WITHIN_MISSING_CONTENT, "Unknown previous keyword!\n");
goto error;
}
if (ud->flags & DETECT_URICONTENT_NEGATED) {
if (ud->flags & DETECT_URICONTENT_FAST_PATTERN) {
if (ud->flags & DETECT_CONTENT_NEGATED) {
if (ud->flags & DETECT_CONTENT_FAST_PATTERN) {
SCLogError(SC_ERR_INVALID_SIGNATURE, "You can't have a relative "
"negated keyword set along with a fast_pattern");
goto error;
}
} else {
if (ud->flags & DETECT_URICONTENT_FAST_PATTERN_ONLY) {
if (ud->flags & DETECT_CONTENT_FAST_PATTERN_ONLY) {
SCLogError(SC_ERR_INVALID_SIGNATURE, "You can't have a relative "
"keyword set along with a fast_pattern:only;");
goto error;
@ -216,9 +216,9 @@ static int DetectWithinSetup (DetectEngineCtx *de_ctx, Signature *s, char *withi
goto error;
}
ud->flags |= DETECT_URICONTENT_WITHIN;
ud->flags |= DETECT_CONTENT_WITHIN;
if (ud->flags & DETECT_URICONTENT_DISTANCE) {
if (ud->flags & DETECT_CONTENT_DISTANCE) {
if ((ud->distance + ud->content_len) > ud->within) {
ud->within = ud->distance + ud->content_len;
}
@ -237,15 +237,15 @@ static int DetectWithinSetup (DetectEngineCtx *de_ctx, Signature *s, char *withi
switch (pm->type) {
case DETECT_URICONTENT:
/* Set the relative next flag on the prev sigmatch */
ud = (DetectUricontentData *)pm->ctx;
ud = (DetectContentData *)pm->ctx;
if (ud == NULL) {
SCLogError(SC_ERR_INVALID_SIGNATURE, "Unknown previous-"
"previous keyword!");
goto error;
}
ud->flags |= DETECT_URICONTENT_RELATIVE_NEXT;
ud->flags |= DETECT_CONTENT_RELATIVE_NEXT;
if (ud->flags & DETECT_URICONTENT_FAST_PATTERN_ONLY) {
if (ud->flags & DETECT_CONTENT_FAST_PATTERN_ONLY) {
SCLogError(SC_ERR_INVALID_SIGNATURE, "Previous keyword "
"has a fast_pattern:only; set. You can't "
"have relative keywords around a fast_pattern "

Write Preview
Loading…
Cancel
Save