From 4883efd0f66fc9431ea6b876431eabdf215ab5d3 Mon Sep 17 00:00:00 2001 From: Anoop Saldanha Date: Wed, 17 Nov 2010 22:47:58 +0530 Subject: [PATCH] unifying content structure - uricontent now uses DetectContentData --- src/detect-bytejump.c | 6 +- src/detect-bytetest.c | 6 +- src/detect-content.h | 8 +- src/detect-depth.c | 12 +- src/detect-distance.c | 20 +- src/detect-engine-mpm.c | 56 +++--- src/detect-engine-mpm.h | 2 +- src/detect-engine-siggroup.c | 4 +- src/detect-engine-uri.c | 28 +-- src/detect-fast-pattern.c | 346 +++++++++++++++++------------------ src/detect-http-uri.c | 36 ++-- src/detect-isdataat.c | 6 +- src/detect-nocase.c | 6 +- src/detect-offset.c | 12 +- src/detect-parse.c | 14 +- src/detect-pcre.c | 6 +- src/detect-uricontent.c | 68 +++---- src/detect-uricontent.h | 45 +---- src/detect-within.c | 20 +- 19 files changed, 329 insertions(+), 372 deletions(-) diff --git a/src/detect-bytejump.c b/src/detect-bytejump.c index 699039b9d0..29aa17cd3d 100644 --- a/src/detect-bytejump.c +++ b/src/detect-bytejump.c @@ -597,7 +597,7 @@ int DetectBytejumpSetup(DetectEngineCtx *de_ctx, Signature *s, char *optstr) } DetectContentData *cd = NULL; - DetectUricontentData *ud = NULL; + DetectContentData *ud = NULL; DetectPcreData *pe = NULL; switch (prev_sm->type) { @@ -615,13 +615,13 @@ int DetectBytejumpSetup(DetectEngineCtx *de_ctx, Signature *s, char *optstr) case DETECT_URICONTENT: /* Set the relative next flag on the prev sigmatch */ - ud = (DetectUricontentData *)prev_sm->ctx; + ud = (DetectContentData *)prev_sm->ctx; if (ud == NULL) { SCLogError(SC_ERR_INVALID_SIGNATURE, "Unknown previous-" "previous keyword!"); return -1; } - ud->flags |= DETECT_URICONTENT_RELATIVE_NEXT; + ud->flags |= DETECT_CONTENT_RELATIVE_NEXT; break; diff --git a/src/detect-bytetest.c b/src/detect-bytetest.c index 02bd5fc80b..ae57bcd57f 100644 --- a/src/detect-bytetest.c +++ b/src/detect-bytetest.c @@ -627,7 +627,7 @@ int DetectBytetestSetup(DetectEngineCtx *de_ctx, Signature *s, char *optstr) } DetectContentData *cd = NULL; - DetectUricontentData *ud = NULL; + DetectContentData *ud = NULL; DetectPcreData *pe = NULL; switch (prev_sm->type) { @@ -645,13 +645,13 @@ int DetectBytetestSetup(DetectEngineCtx *de_ctx, Signature *s, char *optstr) case DETECT_URICONTENT: /* Set the relative next flag on the prev sigmatch */ - ud = (DetectUricontentData *)prev_sm->ctx; + ud = (DetectContentData *)prev_sm->ctx; if (ud == NULL) { SCLogError(SC_ERR_INVALID_SIGNATURE, "Unknown previous-" "previous keyword!"); return -1; } - ud->flags |= DETECT_URICONTENT_RELATIVE_NEXT; + ud->flags |= DETECT_CONTENT_RELATIVE_NEXT; break; diff --git a/src/detect-content.h b/src/detect-content.h index 11ea1b393e..06ecb5e8fc 100644 --- a/src/detect-content.h +++ b/src/detect-content.h @@ -51,14 +51,12 @@ #include "util-spm-bm.h" typedef struct DetectContentData_ { - uint8_t *content; /**< ptr to chunk of memory containing the pattern */ - uint8_t content_len;/**< length of the pattern (and size of the memory) */ + uint8_t *content; + uint8_t content_len; uint16_t flags; - PatIntId id; /**< unique pattern id */ + PatIntId id; uint16_t depth; uint16_t offset; - /** distance from the last match this match should start. - * Can be negative */ int32_t distance; int32_t within; BmCtx *bm_ctx; /**< Boyer Moore context (for spm search) */ diff --git a/src/detect-depth.c b/src/detect-depth.c index 0fa6a1116c..53c7698bb0 100644 --- a/src/detect-depth.c +++ b/src/detect-depth.c @@ -57,7 +57,7 @@ static int DetectDepthSetup (DetectEngineCtx *de_ctx, Signature *s, char *depths char dubbed = 0; SigMatch *pm = NULL; DetectContentData *cd = NULL; - DetectUricontentData *ud = NULL; + DetectContentData *ud = NULL; /* strip "'s */ if (depthstr[0] == '\"' && depthstr[strlen(depthstr)-1] == '\"') { @@ -99,7 +99,7 @@ static int DetectDepthSetup (DetectEngineCtx *de_ctx, Signature *s, char *depths switch (pm->type) { case DETECT_URICONTENT: - ud = (DetectUricontentData *)pm->ctx; + ud = (DetectContentData *)pm->ctx; if (ud == NULL) { SCLogError(SC_ERR_INVALID_ARGUMENT, "invalid argument"); if (dubbed) @@ -107,14 +107,14 @@ static int DetectDepthSetup (DetectEngineCtx *de_ctx, Signature *s, char *depths return -1; } - if (ud->flags & DETECT_URICONTENT_NEGATED) { - if (ud->flags & DETECT_URICONTENT_FAST_PATTERN) { + if (ud->flags & DETECT_CONTENT_NEGATED) { + if (ud->flags & DETECT_CONTENT_FAST_PATTERN) { SCLogError(SC_ERR_INVALID_SIGNATURE, "You can't have a relative " "negated keyword set along with a fast_pattern"); goto error; } } else { - if (ud->flags & DETECT_URICONTENT_FAST_PATTERN_ONLY) { + if (ud->flags & DETECT_CONTENT_FAST_PATTERN_ONLY) { SCLogError(SC_ERR_INVALID_SIGNATURE, "You can't have a relative " "keyword set along with a fast_pattern:only;"); goto error; @@ -129,7 +129,7 @@ static int DetectDepthSetup (DetectEngineCtx *de_ctx, Signature *s, char *depths } /* Now update the real limit, as depth is relative to the offset */ ud->depth += ud->offset; - ud->flags |= DETECT_URICONTENT_DEPTH; + ud->flags |= DETECT_CONTENT_DEPTH; break; diff --git a/src/detect-distance.c b/src/detect-distance.c index 470f8eb0b2..1fc03e2771 100644 --- a/src/detect-distance.c +++ b/src/detect-distance.c @@ -175,27 +175,27 @@ static int DetectDistanceSetup (DetectEngineCtx *de_ctx, Signature *s, } } - DetectUricontentData *ud = NULL; + DetectContentData *ud = NULL; DetectContentData *cd = NULL; DetectPcreData *pe = NULL; switch (pm->type) { case DETECT_URICONTENT: - ud = (DetectUricontentData *)pm->ctx; + ud = (DetectContentData *)pm->ctx; if (ud == NULL) { SCLogError(SC_ERR_DISTANCE_MISSING_CONTENT, "distance needs two " "preceeding content or uricontent options"); goto error; } - if (ud->flags & DETECT_URICONTENT_NEGATED) { - if (ud->flags & DETECT_URICONTENT_FAST_PATTERN) { + if (ud->flags & DETECT_CONTENT_NEGATED) { + if (ud->flags & DETECT_CONTENT_FAST_PATTERN) { SCLogError(SC_ERR_INVALID_SIGNATURE, "You can't have a relative " "negated keyword set along with a fast_pattern"); goto error; } } else { - if (ud->flags & DETECT_URICONTENT_FAST_PATTERN_ONLY) { + if (ud->flags & DETECT_CONTENT_FAST_PATTERN_ONLY) { SCLogError(SC_ERR_INVALID_SIGNATURE, "You can't have a relative " "keyword set along with a fast_pattern:only;"); goto error; @@ -203,13 +203,13 @@ static int DetectDistanceSetup (DetectEngineCtx *de_ctx, Signature *s, } ud->distance = strtol(str, NULL, 10); - if (ud->flags & DETECT_URICONTENT_WITHIN) { + if (ud->flags & DETECT_CONTENT_WITHIN) { if ((ud->distance + ud->content_len) > ud->within) { ud->within = ud->distance + ud->content_len; } } - ud->flags |= DETECT_URICONTENT_DISTANCE; + ud->flags |= DETECT_CONTENT_DISTANCE; pm = SigMatchGetLastSMFromLists(s, 6, DETECT_URICONTENT, pm->prev, @@ -224,15 +224,15 @@ static int DetectDistanceSetup (DetectEngineCtx *de_ctx, Signature *s, switch (pm->type) { case DETECT_URICONTENT: /* Set the relative next flag on the prev sigmatch */ - ud = (DetectUricontentData *)pm->ctx; + ud = (DetectContentData *)pm->ctx; if (ud == NULL) { SCLogError(SC_ERR_INVALID_SIGNATURE, "Unknown previous-" "previous keyword!"); goto error; } - ud->flags |= DETECT_URICONTENT_RELATIVE_NEXT; + ud->flags |= DETECT_CONTENT_RELATIVE_NEXT; - if (ud->flags & DETECT_URICONTENT_FAST_PATTERN_ONLY) { + if (ud->flags & DETECT_CONTENT_FAST_PATTERN_ONLY) { SCLogError(SC_ERR_INVALID_SIGNATURE, "Previous keyword " "has a fast_pattern:only; set. You can't " "have relative keywords around a fast_pattern " diff --git a/src/detect-engine-mpm.c b/src/detect-engine-mpm.c index a75a2fe890..7522d42ff3 100644 --- a/src/detect-engine-mpm.c +++ b/src/detect-engine-mpm.c @@ -417,7 +417,7 @@ typedef struct ContentHash_ { } ContentHash; typedef struct UricontentHash_ { - DetectUricontentData *ptr; + DetectContentData *ptr; uint16_t cnt; uint8_t use; /* use no matter what */ } UricontentHash; @@ -437,7 +437,7 @@ uint32_t ContentHashFunc(HashTable *ht, void *data, uint16_t datalen) { uint32_t UricontentHashFunc(HashTable *ht, void *data, uint16_t datalen) { UricontentHash *ch = (UricontentHash *)data; - DetectUricontentData *ud = ch->ptr; + DetectContentData *ud = ch->ptr; uint32_t hash = 0; int i; for (i = 0; i < ud->content_len; i++) { @@ -465,11 +465,11 @@ char ContentHashCompareFunc(void *data1, uint16_t len1, void *data2, uint16_t le char UricontentHashCompareFunc(void *data1, uint16_t len1, void *data2, uint16_t len2) { UricontentHash *ch1 = (UricontentHash *)data1; UricontentHash *ch2 = (UricontentHash *)data2; - DetectUricontentData *ud1 = ch1->ptr; - DetectUricontentData *ud2 = ch2->ptr; + DetectContentData *ud1 = ch1->ptr; + DetectContentData *ud2 = ch2->ptr; if (ud1->content_len == ud2->content_len && - ((ud1->flags & DETECT_URICONTENT_NOCASE) == (ud2->flags & DETECT_URICONTENT_NOCASE)) && + ((ud1->flags & DETECT_CONTENT_NOCASE) == (ud2->flags & DETECT_CONTENT_NOCASE)) && SCMemcmp(ud1->content, ud2->content, ud1->content_len) == 0) return 1; @@ -488,7 +488,7 @@ ContentHash *ContentHashAlloc(DetectContentData *ptr) { return ch; } -UricontentHash *UricontentHashAlloc(DetectUricontentData *ptr) { +UricontentHash *UricontentHashAlloc(DetectContentData *ptr) { UricontentHash *ch = SCMalloc(sizeof(UricontentHash)); if (ch == NULL) return NULL; @@ -596,7 +596,7 @@ static int PatternMatchPreparePopulateMpm(DetectEngineCtx *de_ctx, * should have a much more compact function. Applies everywhere * else where we have used a switch like this */ DetectContentData *cd = NULL; - DetectUricontentData *ud = NULL; + DetectContentData *ud = NULL; switch (sm->type) { case DETECT_CONTENT: if (sig_has_no_pkt_and_stream_content || @@ -619,9 +619,9 @@ static int PatternMatchPreparePopulateMpm(DetectEngineCtx *de_ctx, !(sgh->flags & SIG_GROUP_HEAD_MPM_URI_COPY))) { break; } - ud = (DetectUricontentData *)sm->ctx; + ud = (DetectContentData *)sm->ctx; /* special handling of fast pattern keyword */ - if (ud->flags & DETECT_URICONTENT_FAST_PATTERN) { + if (ud->flags & DETECT_CONTENT_FAST_PATTERN) { fast_pattern[sig] = 1; } @@ -670,7 +670,7 @@ static int PatternMatchPreparePopulateMpm(DetectEngineCtx *de_ctx, * 2. we have a smaller content than mpm_content_maxlen */ if (fast_pattern[sig]) { DetectContentData *cd = NULL; - DetectUricontentData *ud = NULL; + DetectContentData *ud = NULL; switch (sm->type) { case DETECT_CONTENT: cd = (DetectContentData *)sm->ctx; @@ -683,8 +683,8 @@ static int PatternMatchPreparePopulateMpm(DetectEngineCtx *de_ctx, break; case DETECT_URICONTENT: - ud = (DetectUricontentData *)sm->ctx; - if (!(ud->flags & DETECT_URICONTENT_FAST_PATTERN)) { + ud = (DetectContentData *)sm->ctx; + if (!(ud->flags & DETECT_CONTENT_FAST_PATTERN)) { SCLogDebug("not a fast pattern %"PRIu32"", co->id); continue; } @@ -694,7 +694,7 @@ static int PatternMatchPreparePopulateMpm(DetectEngineCtx *de_ctx, } /* switch (sm->type) */ } else { DetectContentData *cd = NULL; - DetectUricontentData *ud = NULL; + DetectContentData *ud = NULL; switch (sm->type) { case DETECT_CONTENT: if (sig_has_no_pkt_and_stream_content || @@ -715,7 +715,7 @@ static int PatternMatchPreparePopulateMpm(DetectEngineCtx *de_ctx, !(sgh->flags & SIG_GROUP_HEAD_MPM_URI_COPY))) { continue; } - ud = (DetectUricontentData *)sm->ctx; + ud = (DetectContentData *)sm->ctx; if (ud->content_len < sgh->mpm_uricontent_maxlen) continue; @@ -752,7 +752,7 @@ static int PatternMatchPreparePopulateMpm(DetectEngineCtx *de_ctx, uint8_t flags = 0; DetectContentData *cd = NULL; - DetectUricontentData *ud = NULL; + DetectContentData *ud = NULL; switch (mpm_sm->type) { case DETECT_CONTENT: { @@ -878,10 +878,10 @@ static int PatternMatchPreparePopulateMpm(DetectEngineCtx *de_ctx, } /* case DETECT_CONTENT */ case DETECT_URICONTENT: { - ud = (DetectUricontentData *)mpm_sm->ctx; - if (ud->flags & DETECT_URICONTENT_FAST_PATTERN_CHOP) { + ud = (DetectContentData *)mpm_sm->ctx; + if (ud->flags & DETECT_CONTENT_FAST_PATTERN_CHOP) { /* add the content to the "uri" mpm */ - if (ud->flags & DETECT_URICONTENT_NOCASE) { + if (ud->flags & DETECT_CONTENT_NOCASE) { mpm_table[sgh->mpm_ctx->mpm_type]. AddPatternNocase(sgh->mpm_ctx, ud->content + ud->fp_chop_offset, @@ -932,7 +932,7 @@ static int PatternMatchPreparePopulateMpm(DetectEngineCtx *de_ctx, /* tell matcher we are inspecting uri */ s->flags |= SIG_FLAG_MPM_URICONTENT; s->mpm_uripattern_id = ud->id; - if (ud->flags & DETECT_URICONTENT_NEGATED) + if (ud->flags & DETECT_CONTENT_NEGATED) s->flags |= SIG_FLAG_MPM_URICONTENT_NEG; break; @@ -1512,14 +1512,14 @@ static int PatternMatchPreparePopulateMpm(DetectEngineCtx *de_ctx, // if (sm->type != DETECT_URICONTENT) // continue; // -// DetectUricontentData *ud = (DetectUricontentData *)sm->ctx; +// DetectContentData *ud = (DetectContentData *)sm->ctx; // if (ud == NULL) // continue; // // cnt++; //#if 0 // /* special handling of fast pattern keyword */ -// if (co->flags & DETECT_URICONTENT_FAST_PATTERN) { +// if (co->flags & DETECT_CONTENT_FAST_PATTERN) { // fast_pattern[sig] = 1; // SCLogDebug("sig %"PRIu32" has a fast pattern, id %"PRIu32"", s->id, co->id); // @@ -1547,7 +1547,7 @@ static int PatternMatchPreparePopulateMpm(DetectEngineCtx *de_ctx, // if (sm->type != DETECT_URICONTENT) // continue; // -// DetectUricontentData *ud = (DetectUricontentData *)sm->ctx; +// DetectContentData *ud = (DetectContentData *)sm->ctx; // if (ud == NULL) // continue; // @@ -1592,7 +1592,7 @@ static int PatternMatchPreparePopulateMpm(DetectEngineCtx *de_ctx, // if (sm->type != DETECT_URICONTENT) // continue; // -// DetectUricontentData *ud = (DetectUricontentData *)sm->ctx; +// DetectContentData *ud = (DetectContentData *)sm->ctx; // if (ud == NULL) // continue; // @@ -1651,7 +1651,7 @@ static int PatternMatchPreparePopulateMpm(DetectEngineCtx *de_ctx, // // /* now add the mpm_ch to the mpm ctx */ // if (mpm_ch != NULL) { -// DetectUricontentData *ud = mpm_ch->ptr; +// DetectContentData *ud = mpm_ch->ptr; // uint8_t flags = 0; //#if 0 // /* see if our content is actually negated */ @@ -1673,7 +1673,7 @@ static int PatternMatchPreparePopulateMpm(DetectEngineCtx *de_ctx, // } //#endif // /* add the content to the "packet" mpm */ -// if (ud->flags & DETECT_URICONTENT_NOCASE) { +// if (ud->flags & DETECT_CONTENT_NOCASE) { // mpm_table[sgh->mpm_uri_ctx->mpm_type].AddPatternNocase(sgh->mpm_uri_ctx, // ud->content, ud->content_len, 0, 0, ud->id, s->num, flags); // } else { @@ -1907,7 +1907,7 @@ int PatternMatchPrepareGroup(DetectEngineCtx *de_ctx, SigGroupHead *sh) if (sm->type != DETECT_URICONTENT) continue; - DetectUricontentData *ud = (DetectUricontentData *)sm->ctx; + DetectContentData *ud = (DetectContentData *)sm->ctx; if (ud == NULL) continue; @@ -2177,7 +2177,7 @@ uint32_t DetectContentGetId(MpmPatternIdStore *ht, DetectContentData *co) { * * \retval id pattern id */ -uint32_t DetectUricontentGetId(MpmPatternIdStore *ht, DetectUricontentData *co) { +uint32_t DetectUricontentGetId(MpmPatternIdStore *ht, DetectContentData *co) { SCEnter(); BUG_ON(ht == NULL || ht->hash == NULL); @@ -2254,7 +2254,7 @@ uint32_t DetectPatternGetId(MpmPatternIdStore *ht, void *ctx, uint8_t sm_type) /* if uricontent had used content and content_len as its struct members * we wouldn't have needed this if/else here */ if (sm_type == DETECT_URICONTENT) { - DetectUricontentData *ud = ctx; + DetectContentData *ud = ctx; e->pattern = SCMalloc(ud->content_len); if (e->pattern == NULL) { SCLogError(SC_ERR_MEM_ALLOC, "Error allocating memory"); diff --git a/src/detect-engine-mpm.h b/src/detect-engine-mpm.h index 76f599a7dc..2287e1dda7 100644 --- a/src/detect-engine-mpm.h +++ b/src/detect-engine-mpm.h @@ -60,7 +60,7 @@ MpmPatternIdStore *MpmPatternIdTableInitHash(void); void MpmPatternIdTableFreeHash(MpmPatternIdStore *); uint32_t MpmPatternIdStoreGetMaxId(MpmPatternIdStore *); uint32_t DetectContentGetId(MpmPatternIdStore *, DetectContentData *); -uint32_t DetectUricontentGetId(MpmPatternIdStore *, DetectUricontentData *); +uint32_t DetectUricontentGetId(MpmPatternIdStore *, DetectContentData *); uint32_t DetectPatternGetId(MpmPatternIdStore *, void *, uint8_t); #endif /* __DETECT_ENGINE_MPM_H__ */ diff --git a/src/detect-engine-siggroup.c b/src/detect-engine-siggroup.c index 42a90c3b84..8f916f9aed 100644 --- a/src/detect-engine-siggroup.c +++ b/src/detect-engine-siggroup.c @@ -1362,7 +1362,7 @@ int SigGroupHeadLoadUricontent(DetectEngineCtx *de_ctx, SigGroupHead *sgh) Signature *s = NULL; SigMatch *sm = NULL; uint32_t sig = 0; - DetectUricontentData *co = NULL; + DetectContentData *co = NULL; if (sgh == NULL) return 0; @@ -1394,7 +1394,7 @@ int SigGroupHeadLoadUricontent(DetectEngineCtx *de_ctx, SigGroupHead *sgh) for ( ;sm != NULL; sm = sm->next) { if (sm->type == DETECT_URICONTENT) { - co = (DetectUricontentData *)sm->ctx; + co = (DetectContentData *)sm->ctx; sgh->init->uri_content_array[co->id / 8] |= 1 << (co->id % 8); } diff --git a/src/detect-engine-uri.c b/src/detect-engine-uri.c index 696d5263f7..5be162e765 100644 --- a/src/detect-engine-uri.c +++ b/src/detect-engine-uri.c @@ -97,8 +97,8 @@ static int DoInspectPacketUri(DetectEngineCtx *de_ctx, SCReturnInt(0); } - DetectUricontentData *ud = NULL; - ud = (DetectUricontentData *)sm->ctx; + DetectContentData *ud = NULL; + ud = (DetectContentData *)sm->ctx; SCLogDebug("inspecting content %"PRIu32" payload_len %"PRIu32, ud->id, payload_len); /* rule parsers should take care of this */ @@ -113,14 +113,14 @@ static int DoInspectPacketUri(DetectEngineCtx *de_ctx, uint32_t prev_payload_offset = det_ctx->payload_offset; do { - if (ud->flags & DETECT_URICONTENT_DISTANCE || - ud->flags & DETECT_URICONTENT_WITHIN) { + if (ud->flags & DETECT_CONTENT_DISTANCE || + ud->flags & DETECT_CONTENT_WITHIN) { SCLogDebug("prev_payload_offset %"PRIu32, prev_payload_offset); offset = prev_payload_offset; depth = payload_len; - if (ud->flags & DETECT_URICONTENT_DISTANCE) { + if (ud->flags & DETECT_CONTENT_DISTANCE) { if (ud->distance < 0 && (uint32_t)(abs(ud->distance)) > offset) offset = 0; else @@ -130,7 +130,7 @@ static int DoInspectPacketUri(DetectEngineCtx *de_ctx, ud->distance, offset, depth); } - if (ud->flags & DETECT_URICONTENT_WITHIN) { + if (ud->flags & DETECT_CONTENT_WITHIN) { if ((int32_t)depth > (int32_t)(prev_payload_offset + ud->within)) { depth = prev_payload_offset + ud->within; } @@ -176,7 +176,7 @@ static int DoInspectPacketUri(DetectEngineCtx *de_ctx, /* if offset is bigger than depth we can never match on a pattern. * We can however, "match" on a negated pattern. */ if (offset > depth || depth == 0) { - if (ud->flags & DETECT_URICONTENT_NEGATED) { + if (ud->flags & DETECT_CONTENT_NEGATED) { goto match; } else { SCReturnInt(0); @@ -194,7 +194,7 @@ static int DoInspectPacketUri(DetectEngineCtx *de_ctx, /* If we got no matches from the mpm, avoid searching (just check if negated) */ if (det_ctx->de_have_httpuri == TRUE) { /* do the actual search with boyer moore precooked ctx */ - if (ud->flags & DETECT_URICONTENT_NOCASE) + if (ud->flags & DETECT_CONTENT_NOCASE) found = BoyerMooreNocase(ud->content, ud->content_len, spayload, spayload_len, ud->bm_ctx->bmGs, ud->bm_ctx->bmBc); else found = BoyerMoore(ud->content, ud->content_len, spayload, spayload_len, ud->bm_ctx->bmGs, ud->bm_ctx->bmBc); @@ -204,13 +204,13 @@ static int DoInspectPacketUri(DetectEngineCtx *de_ctx, /* next we evaluate the result in combination with the * negation flag. */ - SCLogDebug("found %p ud negated %s", found, ud->flags & DETECT_URICONTENT_NEGATED ? "true" : "false"); + SCLogDebug("found %p ud negated %s", found, ud->flags & DETECT_CONTENT_NEGATED ? "true" : "false"); - if (found == NULL && !(ud->flags & DETECT_URICONTENT_NEGATED)) { + if (found == NULL && !(ud->flags & DETECT_CONTENT_NEGATED)) { SCReturnInt(0); - } else if (found == NULL && ud->flags & DETECT_URICONTENT_NEGATED) { + } else if (found == NULL && ud->flags & DETECT_CONTENT_NEGATED) { goto match; - } else if (found != NULL && ud->flags & DETECT_URICONTENT_NEGATED) { + } else if (found != NULL && ud->flags & DETECT_CONTENT_NEGATED) { SCLogDebug("uricontent %"PRIu32" matched at offset %"PRIu32", but negated so no match", ud->id, match_offset); det_ctx->discontinue_matching = 1; SCReturnInt(0); @@ -219,7 +219,7 @@ static int DoInspectPacketUri(DetectEngineCtx *de_ctx, SCLogDebug("uricontent %"PRIu32" matched at offset %"PRIu32"", ud->id, match_offset); det_ctx->payload_offset = match_offset; - if (!(ud->flags & DETECT_URICONTENT_RELATIVE_NEXT)) { + if (!(ud->flags & DETECT_CONTENT_RELATIVE_NEXT)) { SCLogDebug("no relative match coming up, so this is a match"); goto match; } @@ -413,7 +413,7 @@ int DetectEngineInspectPacketUris(DetectEngineCtx *de_ctx, sm = s->sm_lists[DETECT_SM_LIST_UMATCH]; #ifdef DEBUG - DetectUricontentData *co = (DetectUricontentData *)sm->ctx; + DetectContentData *co = (DetectContentData *)sm->ctx; SCLogDebug("co->id %"PRIu32, co->id); #endif diff --git a/src/detect-fast-pattern.c b/src/detect-fast-pattern.c index 715d752238..39e99dbe68 100644 --- a/src/detect-fast-pattern.c +++ b/src/detect-fast-pattern.c @@ -188,7 +188,7 @@ static int DetectFastPatternSetup(DetectEngineCtx *de_ctx, Signature *s, char *a int ov[MAX_SUBSTRINGS]; const char *arg_substr = NULL; DetectContentData *cd = NULL; - DetectUricontentData *ud = NULL; + DetectContentData *ud = NULL; if (s->sm_lists_tail[DETECT_SM_LIST_PMATCH] == NULL && s->sm_lists_tail[DETECT_SM_LIST_UMATCH] == NULL) { SCLogWarning(SC_WARN_COMPATIBILITY, "fast_pattern found inside the " @@ -218,7 +218,7 @@ static int DetectFastPatternSetup(DetectEngineCtx *de_ctx, Signature *s, char *a if (pm->type == DETECT_CONTENT) { cd->flags |= DETECT_CONTENT_FAST_PATTERN; } else if (pm->type == DETECT_URICONTENT) { - ud->flags |= DETECT_URICONTENT_FAST_PATTERN; + ud->flags |= DETECT_CONTENT_FAST_PATTERN; } return 0; } @@ -236,11 +236,11 @@ static int DetectFastPatternSetup(DetectEngineCtx *de_ctx, Signature *s, char *a goto error; } } else if (pm->type == DETECT_URICONTENT) { - if (ud->flags & DETECT_URICONTENT_NEGATED && - (ud->flags & DETECT_URICONTENT_DISTANCE || - ud->flags & DETECT_URICONTENT_WITHIN || - ud->flags & DETECT_URICONTENT_OFFSET || - ud->flags & DETECT_URICONTENT_DEPTH)) { + if (ud->flags & DETECT_CONTENT_NEGATED && + (ud->flags & DETECT_CONTENT_DISTANCE || + ud->flags & DETECT_CONTENT_WITHIN || + ud->flags & DETECT_CONTENT_OFFSET || + ud->flags & DETECT_CONTENT_DEPTH)) { /* we can't have any of these if we are having "only" */ SCLogError(SC_ERR_INVALID_SIGNATURE, "fast_pattern; cannot be " @@ -270,18 +270,18 @@ static int DetectFastPatternSetup(DetectEngineCtx *de_ctx, Signature *s, char *a } cd->flags |= DETECT_CONTENT_FAST_PATTERN_ONLY; } else if (pm->type == DETECT_URICONTENT) { - if (ud->flags & DETECT_URICONTENT_NEGATED || - ud->flags & DETECT_URICONTENT_DISTANCE || - ud->flags & DETECT_URICONTENT_WITHIN || - ud->flags & DETECT_URICONTENT_OFFSET || - ud->flags & DETECT_URICONTENT_DEPTH) { + if (ud->flags & DETECT_CONTENT_NEGATED || + ud->flags & DETECT_CONTENT_DISTANCE || + ud->flags & DETECT_CONTENT_WITHIN || + ud->flags & DETECT_CONTENT_OFFSET || + ud->flags & DETECT_CONTENT_DEPTH) { /* we can't have any of these if we are having "only" */ SCLogError(SC_ERR_INVALID_SIGNATURE, "fast_pattern: only; cannot be " "used with negated uricontent"); goto error; } - ud->flags |= DETECT_URICONTENT_FAST_PATTERN_ONLY; + ud->flags |= DETECT_CONTENT_FAST_PATTERN_ONLY; } else { printf("we will never hit else"); } @@ -327,7 +327,7 @@ static int DetectFastPatternSetup(DetectEngineCtx *de_ctx, Signature *s, char *a } else if (pm->type == DETECT_URICONTENT) { ud->fp_chop_offset = offset; ud->fp_chop_len = length; - ud->flags |= DETECT_URICONTENT_FAST_PATTERN_CHOP; + ud->flags |= DETECT_CONTENT_FAST_PATTERN_CHOP; } } else { SCLogError(SC_ERR_PCRE_PARSE, "parse error, ret %" PRId32 @@ -352,7 +352,7 @@ static int DetectFastPatternSetup(DetectEngineCtx *de_ctx, Signature *s, char *a if (pm->type == DETECT_CONTENT) { cd->flags |= DETECT_CONTENT_FAST_PATTERN; } else if (pm->type == DETECT_URICONTENT) { - ud->flags |= DETECT_URICONTENT_FAST_PATTERN; + ud->flags |= DETECT_CONTENT_FAST_PATTERN; } return 0; @@ -2130,8 +2130,8 @@ int DetectFastPatternTest54(void) sm = de_ctx->sig_list->sm_lists[DETECT_SM_LIST_UMATCH]; while (sm != NULL) { if (sm->type == DETECT_URICONTENT) { - if ( ((DetectUricontentData *)sm->ctx)->flags & - DETECT_URICONTENT_FAST_PATTERN) { + if ( ((DetectContentData *)sm->ctx)->flags & + DETECT_CONTENT_FAST_PATTERN) { result = 1; break; } else { @@ -2171,8 +2171,8 @@ int DetectFastPatternTest55(void) sm = de_ctx->sig_list->sm_lists[DETECT_SM_LIST_UMATCH]; while (sm != NULL) { if (sm->type == DETECT_URICONTENT) { - if ( ((DetectUricontentData *)sm->ctx)->flags & - DETECT_URICONTENT_FAST_PATTERN) { + if ( ((DetectContentData *)sm->ctx)->flags & + DETECT_CONTENT_FAST_PATTERN) { result = 1; break; } else { @@ -2206,11 +2206,11 @@ int DetectFastPatternTest56(void) result = 0; sm = de_ctx->sig_list->sm_lists[DETECT_SM_LIST_UMATCH]; - DetectUricontentData *ud = sm->ctx; + DetectContentData *ud = sm->ctx; if (sm != NULL && sm->type == DETECT_URICONTENT) { - if (ud->flags & DETECT_URICONTENT_FAST_PATTERN && - ud->flags & DETECT_URICONTENT_FAST_PATTERN_ONLY && - !(ud->flags & ud->flags & DETECT_URICONTENT_FAST_PATTERN_CHOP) && + if (ud->flags & DETECT_CONTENT_FAST_PATTERN && + ud->flags & DETECT_CONTENT_FAST_PATTERN_ONLY && + !(ud->flags & ud->flags & DETECT_CONTENT_FAST_PATTERN_CHOP) && ud->fp_chop_offset == 0 && ud->fp_chop_len == 0) { result = 1; @@ -2242,11 +2242,11 @@ int DetectFastPatternTest57(void) result = 0; sm = de_ctx->sig_list->sm_lists[DETECT_SM_LIST_UMATCH]; - DetectUricontentData *ud = sm->ctx; + DetectContentData *ud = sm->ctx; if (sm != NULL && sm->type == DETECT_URICONTENT) { - if (ud->flags & DETECT_URICONTENT_FAST_PATTERN && - !(ud->flags & DETECT_URICONTENT_FAST_PATTERN_ONLY) && - ud->flags & ud->flags & DETECT_URICONTENT_FAST_PATTERN_CHOP && + if (ud->flags & DETECT_CONTENT_FAST_PATTERN && + !(ud->flags & DETECT_CONTENT_FAST_PATTERN_ONLY) && + ud->flags & ud->flags & DETECT_CONTENT_FAST_PATTERN_CHOP && ud->fp_chop_offset == 3 && ud->fp_chop_len == 4) { result = 1; @@ -2473,10 +2473,10 @@ int DetectFastPatternTest67(void) if (de_ctx->sig_list == NULL) goto end; - DetectUricontentData *ud = de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_UMATCH]->ctx; - if (ud->flags & DETECT_URICONTENT_FAST_PATTERN && - ud->flags & DETECT_URICONTENT_FAST_PATTERN_ONLY && - !(ud->flags & ud->flags & DETECT_URICONTENT_FAST_PATTERN_CHOP) && + DetectContentData *ud = de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_UMATCH]->ctx; + if (ud->flags & DETECT_CONTENT_FAST_PATTERN && + ud->flags & DETECT_CONTENT_FAST_PATTERN_ONLY && + !(ud->flags & ud->flags & DETECT_CONTENT_FAST_PATTERN_CHOP) && ud->fp_chop_offset == 0 && ud->fp_chop_len == 0) { result = 1; @@ -2503,10 +2503,10 @@ int DetectFastPatternTest68(void) "(uricontent:one; uricontent:two; within:30; uricontent:two; fast_pattern:only; sid:1;)"); if (de_ctx->sig_list == NULL) goto end; - DetectUricontentData *ud = de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_UMATCH]->ctx; - if (ud->flags & DETECT_URICONTENT_FAST_PATTERN && - ud->flags & DETECT_URICONTENT_FAST_PATTERN_ONLY && - !(ud->flags & ud->flags & DETECT_URICONTENT_FAST_PATTERN_CHOP) && + DetectContentData *ud = de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_UMATCH]->ctx; + if (ud->flags & DETECT_CONTENT_FAST_PATTERN && + ud->flags & DETECT_CONTENT_FAST_PATTERN_ONLY && + !(ud->flags & ud->flags & DETECT_CONTENT_FAST_PATTERN_CHOP) && ud->fp_chop_offset == 0 && ud->fp_chop_len == 0) { result = 1; @@ -2533,10 +2533,10 @@ int DetectFastPatternTest69(void) "(uricontent:one; uricontent:two; offset:30; uricontent:two; fast_pattern:only; sid:1;)"); if (de_ctx->sig_list == NULL) goto end; - DetectUricontentData *ud = de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_UMATCH]->ctx; - if (ud->flags & DETECT_URICONTENT_FAST_PATTERN && - ud->flags & DETECT_URICONTENT_FAST_PATTERN_ONLY && - !(ud->flags & ud->flags & DETECT_URICONTENT_FAST_PATTERN_CHOP) && + DetectContentData *ud = de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_UMATCH]->ctx; + if (ud->flags & DETECT_CONTENT_FAST_PATTERN && + ud->flags & DETECT_CONTENT_FAST_PATTERN_ONLY && + !(ud->flags & ud->flags & DETECT_CONTENT_FAST_PATTERN_CHOP) && ud->fp_chop_offset == 0 && ud->fp_chop_len == 0) { result = 1; @@ -2563,10 +2563,10 @@ int DetectFastPatternTest70(void) "(uricontent:one; uricontent:two; depth:30; uricontent:two; fast_pattern:only; sid:1;)"); if (de_ctx->sig_list == NULL) goto end; - DetectUricontentData *ud = de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_UMATCH]->ctx; - if (ud->flags & DETECT_URICONTENT_FAST_PATTERN && - ud->flags & DETECT_URICONTENT_FAST_PATTERN_ONLY && - !(ud->flags & ud->flags & DETECT_URICONTENT_FAST_PATTERN_CHOP) && + DetectContentData *ud = de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_UMATCH]->ctx; + if (ud->flags & DETECT_CONTENT_FAST_PATTERN && + ud->flags & DETECT_CONTENT_FAST_PATTERN_ONLY && + !(ud->flags & ud->flags & DETECT_CONTENT_FAST_PATTERN_CHOP) && ud->fp_chop_offset == 0 && ud->fp_chop_len == 0) { result = 1; @@ -2593,11 +2593,11 @@ int DetectFastPatternTest71(void) "(uricontent:!one; fast_pattern; uricontent:two; sid:1;)"); if (de_ctx->sig_list == NULL) goto end; - DetectUricontentData *ud = de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_UMATCH]->prev->ctx; - if (ud->flags & DETECT_URICONTENT_FAST_PATTERN && - ud->flags & DETECT_URICONTENT_NEGATED && - !(ud->flags & DETECT_URICONTENT_FAST_PATTERN_ONLY) && - !(ud->flags & ud->flags & DETECT_URICONTENT_FAST_PATTERN_CHOP) && + DetectContentData *ud = de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_UMATCH]->prev->ctx; + if (ud->flags & DETECT_CONTENT_FAST_PATTERN && + ud->flags & DETECT_CONTENT_NEGATED && + !(ud->flags & DETECT_CONTENT_FAST_PATTERN_ONLY) && + !(ud->flags & ud->flags & DETECT_CONTENT_FAST_PATTERN_CHOP) && ud->fp_chop_offset == 0 && ud->fp_chop_len == 0) { result = 1; @@ -2712,10 +2712,10 @@ int DetectFastPatternTest76(void) "(uricontent:one; uricontent:two; fast_pattern:3,4; uricontent:three; sid:1;)"); if (de_ctx->sig_list == NULL) goto end; - DetectUricontentData *ud = de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_UMATCH]->prev->ctx; - if (ud->flags & DETECT_URICONTENT_FAST_PATTERN && - !(ud->flags & DETECT_URICONTENT_FAST_PATTERN_ONLY) && - ud->flags & ud->flags & DETECT_URICONTENT_FAST_PATTERN_CHOP && + DetectContentData *ud = de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_UMATCH]->prev->ctx; + if (ud->flags & DETECT_CONTENT_FAST_PATTERN && + !(ud->flags & DETECT_CONTENT_FAST_PATTERN_ONLY) && + ud->flags & ud->flags & DETECT_CONTENT_FAST_PATTERN_CHOP && ud->fp_chop_offset == 3 && ud->fp_chop_len == 4) { result = 1; @@ -2742,10 +2742,10 @@ int DetectFastPatternTest77(void) "(uricontent:one; uricontent:two; fast_pattern:3,4; uricontent:three; distance:30; sid:1;)"); if (de_ctx->sig_list == NULL) goto end; - DetectUricontentData *ud = de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_UMATCH]->prev->ctx; - if (ud->flags & DETECT_URICONTENT_FAST_PATTERN && - !(ud->flags & DETECT_URICONTENT_FAST_PATTERN_ONLY) && - ud->flags & ud->flags & DETECT_URICONTENT_FAST_PATTERN_CHOP && + DetectContentData *ud = de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_UMATCH]->prev->ctx; + if (ud->flags & DETECT_CONTENT_FAST_PATTERN && + !(ud->flags & DETECT_CONTENT_FAST_PATTERN_ONLY) && + ud->flags & ud->flags & DETECT_CONTENT_FAST_PATTERN_CHOP && ud->fp_chop_offset == 3 && ud->fp_chop_len == 4) { result = 1; @@ -2772,10 +2772,10 @@ int DetectFastPatternTest78(void) "(uricontent:one; uricontent:two; fast_pattern:3,4; uricontent:three; within:30; sid:1;)"); if (de_ctx->sig_list == NULL) goto end; - DetectUricontentData *ud = de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_UMATCH]->prev->ctx; - if (ud->flags & DETECT_URICONTENT_FAST_PATTERN && - !(ud->flags & DETECT_URICONTENT_FAST_PATTERN_ONLY) && - ud->flags & ud->flags & DETECT_URICONTENT_FAST_PATTERN_CHOP && + DetectContentData *ud = de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_UMATCH]->prev->ctx; + if (ud->flags & DETECT_CONTENT_FAST_PATTERN && + !(ud->flags & DETECT_CONTENT_FAST_PATTERN_ONLY) && + ud->flags & ud->flags & DETECT_CONTENT_FAST_PATTERN_CHOP && ud->fp_chop_offset == 3 && ud->fp_chop_len == 4) { result = 1; @@ -2802,10 +2802,10 @@ int DetectFastPatternTest79(void) "(uricontent:one; uricontent:two; fast_pattern:3,4; uricontent:three; offset:30; sid:1;)"); if (de_ctx->sig_list == NULL) goto end; - DetectUricontentData *ud = de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_UMATCH]->prev->ctx; - if (ud->flags & DETECT_URICONTENT_FAST_PATTERN && - !(ud->flags & DETECT_URICONTENT_FAST_PATTERN_ONLY) && - ud->flags & ud->flags & DETECT_URICONTENT_FAST_PATTERN_CHOP && + DetectContentData *ud = de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_UMATCH]->prev->ctx; + if (ud->flags & DETECT_CONTENT_FAST_PATTERN && + !(ud->flags & DETECT_CONTENT_FAST_PATTERN_ONLY) && + ud->flags & ud->flags & DETECT_CONTENT_FAST_PATTERN_CHOP && ud->fp_chop_offset == 3 && ud->fp_chop_len == 4) { result = 1; @@ -2832,10 +2832,10 @@ int DetectFastPatternTest80(void) "(uricontent:one; uricontent:two; fast_pattern:3,4; uricontent:three; depth:30; sid:1;)"); if (de_ctx->sig_list == NULL) goto end; - DetectUricontentData *ud = de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_UMATCH]->prev->ctx; - if (ud->flags & DETECT_URICONTENT_FAST_PATTERN && - !(ud->flags & DETECT_URICONTENT_FAST_PATTERN_ONLY) && - ud->flags & ud->flags & DETECT_URICONTENT_FAST_PATTERN_CHOP && + DetectContentData *ud = de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_UMATCH]->prev->ctx; + if (ud->flags & DETECT_CONTENT_FAST_PATTERN && + !(ud->flags & DETECT_CONTENT_FAST_PATTERN_ONLY) && + ud->flags & ud->flags & DETECT_CONTENT_FAST_PATTERN_CHOP && ud->fp_chop_offset == 3 && ud->fp_chop_len == 4) { result = 1; @@ -2862,10 +2862,10 @@ int DetectFastPatternTest81(void) "(uricontent:one; uricontent:two; distance:10; uricontent:three; fast_pattern:3,4; sid:1;)"); if (de_ctx->sig_list == NULL) goto end; - DetectUricontentData *ud = de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_UMATCH]->ctx; - if (ud->flags & DETECT_URICONTENT_FAST_PATTERN && - !(ud->flags & DETECT_URICONTENT_FAST_PATTERN_ONLY) && - ud->flags & ud->flags & DETECT_URICONTENT_FAST_PATTERN_CHOP && + DetectContentData *ud = de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_UMATCH]->ctx; + if (ud->flags & DETECT_CONTENT_FAST_PATTERN && + !(ud->flags & DETECT_CONTENT_FAST_PATTERN_ONLY) && + ud->flags & ud->flags & DETECT_CONTENT_FAST_PATTERN_CHOP && ud->fp_chop_offset == 3 && ud->fp_chop_len == 4) { result = 1; @@ -2892,10 +2892,10 @@ int DetectFastPatternTest82(void) "(uricontent:one; uricontent:two; within:10; uricontent:three; fast_pattern:3,4; sid:1;)"); if (de_ctx->sig_list == NULL) goto end; - DetectUricontentData *ud = de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_UMATCH]->ctx; - if (ud->flags & DETECT_URICONTENT_FAST_PATTERN && - !(ud->flags & DETECT_URICONTENT_FAST_PATTERN_ONLY) && - ud->flags & ud->flags & DETECT_URICONTENT_FAST_PATTERN_CHOP && + DetectContentData *ud = de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_UMATCH]->ctx; + if (ud->flags & DETECT_CONTENT_FAST_PATTERN && + !(ud->flags & DETECT_CONTENT_FAST_PATTERN_ONLY) && + ud->flags & ud->flags & DETECT_CONTENT_FAST_PATTERN_CHOP && ud->fp_chop_offset == 3 && ud->fp_chop_len == 4) { result = 1; @@ -2922,10 +2922,10 @@ int DetectFastPatternTest83(void) "(uricontent:one; uricontent:two; offset:10; uricontent:three; fast_pattern:3,4; sid:1;)"); if (de_ctx->sig_list == NULL) goto end; - DetectUricontentData *ud = de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_UMATCH]->ctx; - if (ud->flags & DETECT_URICONTENT_FAST_PATTERN && - !(ud->flags & DETECT_URICONTENT_FAST_PATTERN_ONLY) && - ud->flags & ud->flags & DETECT_URICONTENT_FAST_PATTERN_CHOP && + DetectContentData *ud = de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_UMATCH]->ctx; + if (ud->flags & DETECT_CONTENT_FAST_PATTERN && + !(ud->flags & DETECT_CONTENT_FAST_PATTERN_ONLY) && + ud->flags & ud->flags & DETECT_CONTENT_FAST_PATTERN_CHOP && ud->fp_chop_offset == 3 && ud->fp_chop_len == 4) { result = 1; @@ -2952,10 +2952,10 @@ int DetectFastPatternTest84(void) "(uricontent:one; uricontent:two; depth:10; uricontent:three; fast_pattern:3,4; sid:1;)"); if (de_ctx->sig_list == NULL) goto end; - DetectUricontentData *ud = de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_UMATCH]->ctx; - if (ud->flags & DETECT_URICONTENT_FAST_PATTERN && - !(ud->flags & DETECT_URICONTENT_FAST_PATTERN_ONLY) && - ud->flags & ud->flags & DETECT_URICONTENT_FAST_PATTERN_CHOP && + DetectContentData *ud = de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_UMATCH]->ctx; + if (ud->flags & DETECT_CONTENT_FAST_PATTERN && + !(ud->flags & DETECT_CONTENT_FAST_PATTERN_ONLY) && + ud->flags & ud->flags & DETECT_CONTENT_FAST_PATTERN_CHOP && ud->fp_chop_offset == 3 && ud->fp_chop_len == 4) { result = 1; @@ -3051,11 +3051,11 @@ int DetectFastPatternTest88(void) "(uricontent:one; uricontent:!two; fast_pattern:3,4; uricontent:three; sid:1;)"); if (de_ctx->sig_list == NULL) goto end; - DetectUricontentData *ud = de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_UMATCH]->prev->ctx; - if (ud->flags & DETECT_URICONTENT_FAST_PATTERN && - ud->flags & DETECT_URICONTENT_NEGATED && - !(ud->flags & DETECT_URICONTENT_FAST_PATTERN_ONLY) && - ud->flags & ud->flags & DETECT_URICONTENT_FAST_PATTERN_CHOP && + DetectContentData *ud = de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_UMATCH]->prev->ctx; + if (ud->flags & DETECT_CONTENT_FAST_PATTERN && + ud->flags & DETECT_CONTENT_NEGATED && + !(ud->flags & DETECT_CONTENT_FAST_PATTERN_ONLY) && + ud->flags & ud->flags & DETECT_CONTENT_FAST_PATTERN_CHOP && ud->fp_chop_offset == 3 && ud->fp_chop_len == 4) { result = 1; @@ -3170,11 +3170,11 @@ int DetectFastPatternTest93(void) "(uricontent:one; content:!two; fast_pattern:3,4; http_uri; uricontent:three; sid:1;)"); if (de_ctx->sig_list == NULL) goto end; - DetectUricontentData *ud = de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_UMATCH]->prev->ctx; - if (ud->flags & DETECT_URICONTENT_FAST_PATTERN && - ud->flags & DETECT_URICONTENT_NEGATED && - !(ud->flags & DETECT_URICONTENT_FAST_PATTERN_ONLY) && - ud->flags & ud->flags & DETECT_URICONTENT_FAST_PATTERN_CHOP && + DetectContentData *ud = de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_UMATCH]->prev->ctx; + if (ud->flags & DETECT_CONTENT_FAST_PATTERN && + ud->flags & DETECT_CONTENT_NEGATED && + !(ud->flags & DETECT_CONTENT_FAST_PATTERN_ONLY) && + ud->flags & ud->flags & DETECT_CONTENT_FAST_PATTERN_CHOP && ud->fp_chop_offset == 3 && ud->fp_chop_len == 4) { result = 1; @@ -3211,8 +3211,8 @@ int DetectFastPatternTest94(void) sm = de_ctx->sig_list->sm_lists[DETECT_SM_LIST_UMATCH]; while (sm != NULL) { if (sm->type == DETECT_URICONTENT) { - if ( ((DetectUricontentData *)sm->ctx)->flags & - DETECT_URICONTENT_FAST_PATTERN) { + if ( ((DetectContentData *)sm->ctx)->flags & + DETECT_CONTENT_FAST_PATTERN) { result = 1; break; } else { @@ -3252,8 +3252,8 @@ int DetectFastPatternTest95(void) sm = de_ctx->sig_list->sm_lists[DETECT_SM_LIST_UMATCH]; while (sm != NULL) { if (sm->type == DETECT_URICONTENT) { - if ( ((DetectUricontentData *)sm->ctx)->flags & - DETECT_URICONTENT_FAST_PATTERN) { + if ( ((DetectContentData *)sm->ctx)->flags & + DETECT_CONTENT_FAST_PATTERN) { result = 1; break; } else { @@ -3287,11 +3287,11 @@ int DetectFastPatternTest96(void) result = 0; sm = de_ctx->sig_list->sm_lists[DETECT_SM_LIST_UMATCH]; - DetectUricontentData *ud = sm->ctx; + DetectContentData *ud = sm->ctx; if (sm != NULL && sm->type == DETECT_URICONTENT) { - if (ud->flags & DETECT_URICONTENT_FAST_PATTERN && - ud->flags & DETECT_URICONTENT_FAST_PATTERN_ONLY && - !(ud->flags & ud->flags & DETECT_URICONTENT_FAST_PATTERN_CHOP) && + if (ud->flags & DETECT_CONTENT_FAST_PATTERN && + ud->flags & DETECT_CONTENT_FAST_PATTERN_ONLY && + !(ud->flags & ud->flags & DETECT_CONTENT_FAST_PATTERN_CHOP) && ud->fp_chop_offset == 0 && ud->fp_chop_len == 0) { result = 1; @@ -3323,11 +3323,11 @@ int DetectFastPatternTest97(void) result = 0; sm = de_ctx->sig_list->sm_lists[DETECT_SM_LIST_UMATCH]; - DetectUricontentData *ud = sm->ctx; + DetectContentData *ud = sm->ctx; if (sm != NULL && sm->type == DETECT_URICONTENT) { - if (ud->flags & DETECT_URICONTENT_FAST_PATTERN && - !(ud->flags & DETECT_URICONTENT_FAST_PATTERN_ONLY) && - ud->flags & ud->flags & DETECT_URICONTENT_FAST_PATTERN_CHOP && + if (ud->flags & DETECT_CONTENT_FAST_PATTERN && + !(ud->flags & DETECT_CONTENT_FAST_PATTERN_ONLY) && + ud->flags & ud->flags & DETECT_CONTENT_FAST_PATTERN_CHOP && ud->fp_chop_offset == 3 && ud->fp_chop_len == 4) { result = 1; @@ -3554,10 +3554,10 @@ int DetectFastPatternTest107(void) if (de_ctx->sig_list == NULL) goto end; - DetectUricontentData *ud = de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_UMATCH]->ctx; - if (ud->flags & DETECT_URICONTENT_FAST_PATTERN && - ud->flags & DETECT_URICONTENT_FAST_PATTERN_ONLY && - !(ud->flags & ud->flags & DETECT_URICONTENT_FAST_PATTERN_CHOP) && + DetectContentData *ud = de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_UMATCH]->ctx; + if (ud->flags & DETECT_CONTENT_FAST_PATTERN && + ud->flags & DETECT_CONTENT_FAST_PATTERN_ONLY && + !(ud->flags & ud->flags & DETECT_CONTENT_FAST_PATTERN_CHOP) && ud->fp_chop_offset == 0 && ud->fp_chop_len == 0) { result = 1; @@ -3584,10 +3584,10 @@ int DetectFastPatternTest108(void) "(uricontent:one; uricontent:two; within:30; content:two; fast_pattern:only; http_uri; sid:1;)"); if (de_ctx->sig_list == NULL) goto end; - DetectUricontentData *ud = de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_UMATCH]->ctx; - if (ud->flags & DETECT_URICONTENT_FAST_PATTERN && - ud->flags & DETECT_URICONTENT_FAST_PATTERN_ONLY && - !(ud->flags & ud->flags & DETECT_URICONTENT_FAST_PATTERN_CHOP) && + DetectContentData *ud = de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_UMATCH]->ctx; + if (ud->flags & DETECT_CONTENT_FAST_PATTERN && + ud->flags & DETECT_CONTENT_FAST_PATTERN_ONLY && + !(ud->flags & ud->flags & DETECT_CONTENT_FAST_PATTERN_CHOP) && ud->fp_chop_offset == 0 && ud->fp_chop_len == 0) { result = 1; @@ -3614,10 +3614,10 @@ int DetectFastPatternTest109(void) "(uricontent:one; uricontent:two; offset:30; content:two; fast_pattern:only; http_uri; sid:1;)"); if (de_ctx->sig_list == NULL) goto end; - DetectUricontentData *ud = de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_UMATCH]->ctx; - if (ud->flags & DETECT_URICONTENT_FAST_PATTERN && - ud->flags & DETECT_URICONTENT_FAST_PATTERN_ONLY && - !(ud->flags & ud->flags & DETECT_URICONTENT_FAST_PATTERN_CHOP) && + DetectContentData *ud = de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_UMATCH]->ctx; + if (ud->flags & DETECT_CONTENT_FAST_PATTERN && + ud->flags & DETECT_CONTENT_FAST_PATTERN_ONLY && + !(ud->flags & ud->flags & DETECT_CONTENT_FAST_PATTERN_CHOP) && ud->fp_chop_offset == 0 && ud->fp_chop_len == 0) { result = 1; @@ -3644,10 +3644,10 @@ int DetectFastPatternTest110(void) "(uricontent:one; uricontent:two; depth:30; content:two; fast_pattern:only; http_uri; sid:1;)"); if (de_ctx->sig_list == NULL) goto end; - DetectUricontentData *ud = de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_UMATCH]->ctx; - if (ud->flags & DETECT_URICONTENT_FAST_PATTERN && - ud->flags & DETECT_URICONTENT_FAST_PATTERN_ONLY && - !(ud->flags & ud->flags & DETECT_URICONTENT_FAST_PATTERN_CHOP) && + DetectContentData *ud = de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_UMATCH]->ctx; + if (ud->flags & DETECT_CONTENT_FAST_PATTERN && + ud->flags & DETECT_CONTENT_FAST_PATTERN_ONLY && + !(ud->flags & ud->flags & DETECT_CONTENT_FAST_PATTERN_CHOP) && ud->fp_chop_offset == 0 && ud->fp_chop_len == 0) { result = 1; @@ -3674,11 +3674,11 @@ int DetectFastPatternTest111(void) "(content:!one; fast_pattern; http_uri; uricontent:two; sid:1;)"); if (de_ctx->sig_list == NULL) goto end; - DetectUricontentData *ud = de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_UMATCH]->prev->ctx; - if (ud->flags & DETECT_URICONTENT_FAST_PATTERN && - ud->flags & DETECT_URICONTENT_NEGATED && - !(ud->flags & DETECT_URICONTENT_FAST_PATTERN_ONLY) && - !(ud->flags & ud->flags & DETECT_URICONTENT_FAST_PATTERN_CHOP) && + DetectContentData *ud = de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_UMATCH]->prev->ctx; + if (ud->flags & DETECT_CONTENT_FAST_PATTERN && + ud->flags & DETECT_CONTENT_NEGATED && + !(ud->flags & DETECT_CONTENT_FAST_PATTERN_ONLY) && + !(ud->flags & ud->flags & DETECT_CONTENT_FAST_PATTERN_CHOP) && ud->fp_chop_offset == 0 && ud->fp_chop_len == 0) { result = 1; @@ -3793,10 +3793,10 @@ int DetectFastPatternTest116(void) "(uricontent:one; content:two; fast_pattern:3,4; http_uri; uricontent:three; sid:1;)"); if (de_ctx->sig_list == NULL) goto end; - DetectUricontentData *ud = de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_UMATCH]->prev->ctx; - if (ud->flags & DETECT_URICONTENT_FAST_PATTERN && - !(ud->flags & DETECT_URICONTENT_FAST_PATTERN_ONLY) && - ud->flags & ud->flags & DETECT_URICONTENT_FAST_PATTERN_CHOP && + DetectContentData *ud = de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_UMATCH]->prev->ctx; + if (ud->flags & DETECT_CONTENT_FAST_PATTERN && + !(ud->flags & DETECT_CONTENT_FAST_PATTERN_ONLY) && + ud->flags & ud->flags & DETECT_CONTENT_FAST_PATTERN_CHOP && ud->fp_chop_offset == 3 && ud->fp_chop_len == 4) { result = 1; @@ -3823,10 +3823,10 @@ int DetectFastPatternTest117(void) "(uricontent:one; content:two; fast_pattern:3,4; http_uri; uricontent:three; distance:30; sid:1;)"); if (de_ctx->sig_list == NULL) goto end; - DetectUricontentData *ud = de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_UMATCH]->prev->ctx; - if (ud->flags & DETECT_URICONTENT_FAST_PATTERN && - !(ud->flags & DETECT_URICONTENT_FAST_PATTERN_ONLY) && - ud->flags & ud->flags & DETECT_URICONTENT_FAST_PATTERN_CHOP && + DetectContentData *ud = de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_UMATCH]->prev->ctx; + if (ud->flags & DETECT_CONTENT_FAST_PATTERN && + !(ud->flags & DETECT_CONTENT_FAST_PATTERN_ONLY) && + ud->flags & ud->flags & DETECT_CONTENT_FAST_PATTERN_CHOP && ud->fp_chop_offset == 3 && ud->fp_chop_len == 4) { result = 1; @@ -3853,10 +3853,10 @@ int DetectFastPatternTest118(void) "(uricontent:one; content:two; fast_pattern:3,4; http_uri; uricontent:three; within:30; sid:1;)"); if (de_ctx->sig_list == NULL) goto end; - DetectUricontentData *ud = de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_UMATCH]->prev->ctx; - if (ud->flags & DETECT_URICONTENT_FAST_PATTERN && - !(ud->flags & DETECT_URICONTENT_FAST_PATTERN_ONLY) && - ud->flags & ud->flags & DETECT_URICONTENT_FAST_PATTERN_CHOP && + DetectContentData *ud = de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_UMATCH]->prev->ctx; + if (ud->flags & DETECT_CONTENT_FAST_PATTERN && + !(ud->flags & DETECT_CONTENT_FAST_PATTERN_ONLY) && + ud->flags & ud->flags & DETECT_CONTENT_FAST_PATTERN_CHOP && ud->fp_chop_offset == 3 && ud->fp_chop_len == 4) { result = 1; @@ -3883,10 +3883,10 @@ int DetectFastPatternTest119(void) "(uricontent:one; content:two; fast_pattern:3,4; http_uri; uricontent:three; offset:30; sid:1;)"); if (de_ctx->sig_list == NULL) goto end; - DetectUricontentData *ud = de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_UMATCH]->prev->ctx; - if (ud->flags & DETECT_URICONTENT_FAST_PATTERN && - !(ud->flags & DETECT_URICONTENT_FAST_PATTERN_ONLY) && - ud->flags & ud->flags & DETECT_URICONTENT_FAST_PATTERN_CHOP && + DetectContentData *ud = de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_UMATCH]->prev->ctx; + if (ud->flags & DETECT_CONTENT_FAST_PATTERN && + !(ud->flags & DETECT_CONTENT_FAST_PATTERN_ONLY) && + ud->flags & ud->flags & DETECT_CONTENT_FAST_PATTERN_CHOP && ud->fp_chop_offset == 3 && ud->fp_chop_len == 4) { result = 1; @@ -3913,10 +3913,10 @@ int DetectFastPatternTest120(void) "(uricontent:one; content:two; fast_pattern:3,4; http_uri; uricontent:three; depth:30; sid:1;)"); if (de_ctx->sig_list == NULL) goto end; - DetectUricontentData *ud = de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_UMATCH]->prev->ctx; - if (ud->flags & DETECT_URICONTENT_FAST_PATTERN && - !(ud->flags & DETECT_URICONTENT_FAST_PATTERN_ONLY) && - ud->flags & ud->flags & DETECT_URICONTENT_FAST_PATTERN_CHOP && + DetectContentData *ud = de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_UMATCH]->prev->ctx; + if (ud->flags & DETECT_CONTENT_FAST_PATTERN && + !(ud->flags & DETECT_CONTENT_FAST_PATTERN_ONLY) && + ud->flags & ud->flags & DETECT_CONTENT_FAST_PATTERN_CHOP && ud->fp_chop_offset == 3 && ud->fp_chop_len == 4) { result = 1; @@ -3943,10 +3943,10 @@ int DetectFastPatternTest121(void) "(uricontent:one; uricontent:two; distance:10; content:three; fast_pattern:3,4; http_uri; sid:1;)"); if (de_ctx->sig_list == NULL) goto end; - DetectUricontentData *ud = de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_UMATCH]->ctx; - if (ud->flags & DETECT_URICONTENT_FAST_PATTERN && - !(ud->flags & DETECT_URICONTENT_FAST_PATTERN_ONLY) && - ud->flags & ud->flags & DETECT_URICONTENT_FAST_PATTERN_CHOP && + DetectContentData *ud = de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_UMATCH]->ctx; + if (ud->flags & DETECT_CONTENT_FAST_PATTERN && + !(ud->flags & DETECT_CONTENT_FAST_PATTERN_ONLY) && + ud->flags & ud->flags & DETECT_CONTENT_FAST_PATTERN_CHOP && ud->fp_chop_offset == 3 && ud->fp_chop_len == 4) { result = 1; @@ -3973,10 +3973,10 @@ int DetectFastPatternTest122(void) "(uricontent:one; uricontent:two; within:10; content:three; fast_pattern:3,4; http_uri; sid:1;)"); if (de_ctx->sig_list == NULL) goto end; - DetectUricontentData *ud = de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_UMATCH]->ctx; - if (ud->flags & DETECT_URICONTENT_FAST_PATTERN && - !(ud->flags & DETECT_URICONTENT_FAST_PATTERN_ONLY) && - ud->flags & ud->flags & DETECT_URICONTENT_FAST_PATTERN_CHOP && + DetectContentData *ud = de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_UMATCH]->ctx; + if (ud->flags & DETECT_CONTENT_FAST_PATTERN && + !(ud->flags & DETECT_CONTENT_FAST_PATTERN_ONLY) && + ud->flags & ud->flags & DETECT_CONTENT_FAST_PATTERN_CHOP && ud->fp_chop_offset == 3 && ud->fp_chop_len == 4) { result = 1; @@ -4003,10 +4003,10 @@ int DetectFastPatternTest123(void) "(uricontent:one; uricontent:two; offset:10; content:three; fast_pattern:3,4; http_uri; sid:1;)"); if (de_ctx->sig_list == NULL) goto end; - DetectUricontentData *ud = de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_UMATCH]->ctx; - if (ud->flags & DETECT_URICONTENT_FAST_PATTERN && - !(ud->flags & DETECT_URICONTENT_FAST_PATTERN_ONLY) && - ud->flags & ud->flags & DETECT_URICONTENT_FAST_PATTERN_CHOP && + DetectContentData *ud = de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_UMATCH]->ctx; + if (ud->flags & DETECT_CONTENT_FAST_PATTERN && + !(ud->flags & DETECT_CONTENT_FAST_PATTERN_ONLY) && + ud->flags & ud->flags & DETECT_CONTENT_FAST_PATTERN_CHOP && ud->fp_chop_offset == 3 && ud->fp_chop_len == 4) { result = 1; @@ -4033,10 +4033,10 @@ int DetectFastPatternTest124(void) "(uricontent:one; uricontent:two; depth:10; content:three; fast_pattern:3,4; http_uri; sid:1;)"); if (de_ctx->sig_list == NULL) goto end; - DetectUricontentData *ud = de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_UMATCH]->ctx; - if (ud->flags & DETECT_URICONTENT_FAST_PATTERN && - !(ud->flags & DETECT_URICONTENT_FAST_PATTERN_ONLY) && - ud->flags & ud->flags & DETECT_URICONTENT_FAST_PATTERN_CHOP && + DetectContentData *ud = de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_UMATCH]->ctx; + if (ud->flags & DETECT_CONTENT_FAST_PATTERN && + !(ud->flags & DETECT_CONTENT_FAST_PATTERN_ONLY) && + ud->flags & ud->flags & DETECT_CONTENT_FAST_PATTERN_CHOP && ud->fp_chop_offset == 3 && ud->fp_chop_len == 4) { result = 1; @@ -4132,11 +4132,11 @@ int DetectFastPatternTest128(void) "(uricontent:one; content:!two; fast_pattern:3,4; http_uri; uricontent:three; sid:1;)"); if (de_ctx->sig_list == NULL) goto end; - DetectUricontentData *ud = de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_UMATCH]->prev->ctx; - if (ud->flags & DETECT_URICONTENT_FAST_PATTERN && - ud->flags & DETECT_URICONTENT_NEGATED && - !(ud->flags & DETECT_URICONTENT_FAST_PATTERN_ONLY) && - ud->flags & ud->flags & DETECT_URICONTENT_FAST_PATTERN_CHOP && + DetectContentData *ud = de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_UMATCH]->prev->ctx; + if (ud->flags & DETECT_CONTENT_FAST_PATTERN && + ud->flags & DETECT_CONTENT_NEGATED && + !(ud->flags & DETECT_CONTENT_FAST_PATTERN_ONLY) && + ud->flags & ud->flags & DETECT_CONTENT_FAST_PATTERN_CHOP && ud->fp_chop_offset == 3 && ud->fp_chop_len == 4) { result = 1; @@ -4251,11 +4251,11 @@ int DetectFastPatternTest133(void) "(uricontent:one; content:!two; fast_pattern:3,4; http_uri; uricontent:three; sid:1;)"); if (de_ctx->sig_list == NULL) goto end; - DetectUricontentData *ud = de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_UMATCH]->prev->ctx; - if (ud->flags & DETECT_URICONTENT_FAST_PATTERN && - ud->flags & DETECT_URICONTENT_NEGATED && - !(ud->flags & DETECT_URICONTENT_FAST_PATTERN_ONLY) && - ud->flags & ud->flags & DETECT_URICONTENT_FAST_PATTERN_CHOP && + DetectContentData *ud = de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_UMATCH]->prev->ctx; + if (ud->flags & DETECT_CONTENT_FAST_PATTERN && + ud->flags & DETECT_CONTENT_NEGATED && + !(ud->flags & DETECT_CONTENT_FAST_PATTERN_ONLY) && + ud->flags & ud->flags & DETECT_CONTENT_FAST_PATTERN_CHOP && ud->fp_chop_offset == 3 && ud->fp_chop_len == 4) { result = 1; diff --git a/src/detect-http-uri.c b/src/detect-http-uri.c index c6443e5ace..d9b00be604 100644 --- a/src/detect-http-uri.c +++ b/src/detect-http-uri.c @@ -83,7 +83,7 @@ void DetectHttpUriRegister (void) { static int DetectHttpUriSetup (DetectEngineCtx *de_ctx, Signature *s, char *str) { - DetectUricontentData *duc = NULL; + DetectContentData *duc = NULL; SigMatch *sm = NULL; /** new sig match to replace previous content */ @@ -121,10 +121,10 @@ static int DetectHttpUriSetup (DetectEngineCtx *de_ctx, Signature *s, char *str) goto error; /* Setup the uricontent data from content data structure */ - duc = SCMalloc(sizeof(DetectUricontentData)); + duc = SCMalloc(sizeof(DetectContentData)); if (duc == NULL) goto error; - memset(duc, 0, sizeof(DetectUricontentData)); + memset(duc, 0, sizeof(DetectContentData)); duc->content_len = ((DetectContentData *)pm->ctx)->content_len; if ((duc->content = SCMalloc(duc->content_len)) == NULL) @@ -132,15 +132,15 @@ static int DetectHttpUriSetup (DetectEngineCtx *de_ctx, Signature *s, char *str) memcpy(duc->content, ((DetectContentData *)pm->ctx)->content, duc->content_len); duc->flags |= (((DetectContentData *)pm->ctx)->flags & DETECT_CONTENT_NOCASE) ? - DETECT_URICONTENT_NOCASE : 0; + DETECT_CONTENT_NOCASE : 0; duc->flags |= (((DetectContentData *)pm->ctx)->flags & DETECT_CONTENT_NEGATED) ? - DETECT_URICONTENT_NEGATED : 0; + DETECT_CONTENT_NEGATED : 0; duc->flags |= (((DetectContentData *)pm->ctx)->flags & DETECT_CONTENT_FAST_PATTERN) ? - DETECT_URICONTENT_FAST_PATTERN : 0; + DETECT_CONTENT_FAST_PATTERN : 0; duc->flags |= (((DetectContentData *)pm->ctx)->flags & DETECT_CONTENT_FAST_PATTERN_ONLY) ? - DETECT_URICONTENT_FAST_PATTERN_ONLY : 0; + DETECT_CONTENT_FAST_PATTERN_ONLY : 0; if (((DetectContentData *)pm->ctx)->flags & DETECT_CONTENT_FAST_PATTERN_CHOP) { - duc->flags |= DETECT_URICONTENT_FAST_PATTERN_CHOP; + duc->flags |= DETECT_CONTENT_FAST_PATTERN_CHOP; duc->fp_chop_offset = ((DetectContentData *)pm->ctx)->fp_chop_offset; duc->fp_chop_len = ((DetectContentData *)pm->ctx)->fp_chop_len; } @@ -336,8 +336,8 @@ int DetectHttpUriTest05(void) } char *str = "we are testing http_uri keyword"; - int uricomp = memcmp((const char *)((DetectUricontentData*) s->sm_lists[DETECT_SM_LIST_UMATCH]->ctx)->content, str, strlen(str)-1); - int urilen = ((DetectUricontentData*) s->sm_lists_tail[DETECT_SM_LIST_UMATCH]->ctx)->content_len; + int uricomp = memcmp((const char *)((DetectContentData*) s->sm_lists[DETECT_SM_LIST_UMATCH]->ctx)->content, str, strlen(str)-1); + int urilen = ((DetectContentData*) s->sm_lists_tail[DETECT_SM_LIST_UMATCH]->ctx)->content_len; if (uricomp != 0 || urilen != strlen("we are testing http_uri keyword")) { printf("sig failed to parse, content not setup properly\n"); @@ -378,7 +378,7 @@ int DetectHttpUriTest06(void) } DetectContentData *cd = de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_PMATCH]->ctx; - DetectUricontentData *ud = de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_UMATCH]->ctx; + DetectContentData *ud = de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_UMATCH]->ctx; if (cd->id == ud->id) goto end; @@ -417,7 +417,7 @@ int DetectHttpUriTest07(void) } DetectContentData *cd = de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_PMATCH]->ctx; - DetectUricontentData *ud = de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_UMATCH]->ctx; + DetectContentData *ud = de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_UMATCH]->ctx; if (cd->id == ud->id) goto end; @@ -456,7 +456,7 @@ int DetectHttpUriTest08(void) } DetectContentData *cd = de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_PMATCH]->ctx; - DetectUricontentData *ud = de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_UMATCH]->ctx; + DetectContentData *ud = de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_UMATCH]->ctx; if (cd->id != 0 || ud->id != 1) goto end; @@ -495,7 +495,7 @@ int DetectHttpUriTest09(void) } DetectContentData *cd = de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_PMATCH]->ctx; - DetectUricontentData *ud = de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_UMATCH]->ctx; + DetectContentData *ud = de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_UMATCH]->ctx; if (cd->id != 1 || ud->id != 0) goto end; @@ -535,8 +535,8 @@ int DetectHttpUriTest10(void) } DetectContentData *cd = de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_PMATCH]->ctx; - DetectUricontentData *ud1 = de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_UMATCH]->ctx; - DetectUricontentData *ud2 = de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_UMATCH]->prev->ctx; + DetectContentData *ud1 = de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_UMATCH]->ctx; + DetectContentData *ud2 = de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_UMATCH]->prev->ctx; if (cd->id != 1 || ud1->id != 0 || ud2->id != 0) goto end; @@ -576,8 +576,8 @@ int DetectHttpUriTest11(void) } DetectContentData *cd = de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_PMATCH]->ctx; - DetectUricontentData *ud1 = de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_UMATCH]->ctx; - DetectUricontentData *ud2 = de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_UMATCH]->prev->ctx; + DetectContentData *ud1 = de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_UMATCH]->ctx; + DetectContentData *ud2 = de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_UMATCH]->prev->ctx; if (cd->id != 2 || ud1->id != 0 || ud2->id != 0) goto end; diff --git a/src/detect-isdataat.c b/src/detect-isdataat.c index f71d0dd217..b37d5c61b6 100644 --- a/src/detect-isdataat.c +++ b/src/detect-isdataat.c @@ -295,7 +295,7 @@ int DetectIsdataatSetup (DetectEngineCtx *de_ctx, Signature *s, char *isdataatst } DetectContentData *cd = NULL; - DetectUricontentData *ud = NULL; + DetectContentData *ud = NULL; DetectPcreData *pe = NULL; switch (prev_sm->type) { @@ -313,13 +313,13 @@ int DetectIsdataatSetup (DetectEngineCtx *de_ctx, Signature *s, char *isdataatst case DETECT_URICONTENT: /* Set the relative next flag on the prev sigmatch */ - ud = (DetectUricontentData *)prev_sm->ctx; + ud = (DetectContentData *)prev_sm->ctx; if (ud == NULL) { SCLogError(SC_ERR_INVALID_SIGNATURE, "Unknown previous-" "previous keyword!"); return -1; } - ud->flags |= DETECT_URICONTENT_RELATIVE_NEXT; + ud->flags |= DETECT_CONTENT_RELATIVE_NEXT; break; diff --git a/src/detect-nocase.c b/src/detect-nocase.c index 11fd47bd32..423ce74856 100644 --- a/src/detect-nocase.c +++ b/src/detect-nocase.c @@ -187,7 +187,7 @@ static int DetectNocaseSetup (DetectEngineCtx *de_ctx, Signature *s, char *nulls SCReturnInt(-1); } - DetectUricontentData *ud = NULL; + DetectContentData *ud = NULL; DetectContentData *cd = NULL; DetectHttpClientBodyData *dhcb = NULL; DetectHttpCookieData *dhcd = NULL; @@ -196,12 +196,12 @@ static int DetectNocaseSetup (DetectEngineCtx *de_ctx, Signature *s, char *nulls switch (pm->type) { case DETECT_URICONTENT: - ud = (DetectUricontentData *)pm->ctx; + ud = (DetectContentData *)pm->ctx; if (ud == NULL) { SCLogError(SC_ERR_INVALID_ARGUMENT, "invalid argument"); SCReturnInt(-1); } - ud->flags |= DETECT_URICONTENT_NOCASE; + ud->flags |= DETECT_CONTENT_NOCASE; /* Recreate the context with nocase chars */ BoyerMooreCtxToNocase(ud->bm_ctx, ud->content, ud->content_len); break; diff --git a/src/detect-offset.c b/src/detect-offset.c index 2345d64111..6db6a81cc3 100644 --- a/src/detect-offset.c +++ b/src/detect-offset.c @@ -94,11 +94,11 @@ int DetectOffsetSetup (DetectEngineCtx *de_ctx, Signature *s, char *offsetstr) break; } - DetectUricontentData *ud = NULL; + DetectContentData *ud = NULL; DetectContentData *cd = NULL; switch (pm->type) { case DETECT_URICONTENT: - ud = (DetectUricontentData *)pm->ctx; + ud = (DetectContentData *)pm->ctx; if (ud == NULL) { SCLogError(SC_ERR_INVALID_ARGUMENT, "invalid argument"); if (dubbed) @@ -106,14 +106,14 @@ int DetectOffsetSetup (DetectEngineCtx *de_ctx, Signature *s, char *offsetstr) return -1; } - if (ud->flags & DETECT_URICONTENT_NEGATED) { - if (ud->flags & DETECT_URICONTENT_FAST_PATTERN) { + if (ud->flags & DETECT_CONTENT_NEGATED) { + if (ud->flags & DETECT_CONTENT_FAST_PATTERN) { SCLogError(SC_ERR_INVALID_SIGNATURE, "You can't have a relative " "negated keyword set along with a fast_pattern"); goto error; } } else { - if (ud->flags & DETECT_URICONTENT_FAST_PATTERN_ONLY) { + if (ud->flags & DETECT_CONTENT_FAST_PATTERN_ONLY) { SCLogError(SC_ERR_INVALID_SIGNATURE, "You can't have a relative " "keyword set along with a fast_pattern:only;"); goto error; @@ -131,7 +131,7 @@ int DetectOffsetSetup (DetectEngineCtx *de_ctx, Signature *s, char *offsetstr) ud->depth += ud->offset; } - ud->flags |= DETECT_URICONTENT_OFFSET; + ud->flags |= DETECT_CONTENT_OFFSET; break; diff --git a/src/detect-parse.c b/src/detect-parse.c index c336f317d2..a9745ad8dc 100644 --- a/src/detect-parse.c +++ b/src/detect-parse.c @@ -1290,13 +1290,13 @@ Signature *SigInit(DetectEngineCtx *de_ctx, char *sigstr) { } for (sm = sig->sm_lists[DETECT_SM_LIST_UMATCH]; sm != NULL; sm = sm->next) { if (sm->type == DETECT_URICONTENT) { - DetectUricontentData *ud = (DetectUricontentData *)sm->ctx; + DetectContentData *ud = (DetectContentData *)sm->ctx; if (ud == NULL) continue; sig->flags |= SIG_FLAG_MPM_URI; - if (ud->flags & DETECT_URICONTENT_NEGATED) { + if (ud->flags & DETECT_CONTENT_NEGATED) { sig->flags |= SIG_FLAG_MPM_URI_NEG; } } @@ -1326,7 +1326,7 @@ Signature *SigInit(DetectEngineCtx *de_ctx, char *sigstr) { for (sm = sig->sm_lists[DETECT_SM_LIST_UMATCH]; sm != NULL; sm = sm->next) { if (sm->type == DETECT_URICONTENT) { - DetectUricontentData *ud = (DetectUricontentData *)sm->ctx; + DetectContentData *ud = (DetectContentData *)sm->ctx; if (ud == NULL) continue; @@ -1432,13 +1432,13 @@ Signature *SigInitReal(DetectEngineCtx *de_ctx, char *sigstr) { } for (sm = sig->sm_lists[DETECT_SM_LIST_UMATCH]; sm != NULL; sm = sm->next) { if (sm->type == DETECT_URICONTENT) { - DetectUricontentData *ud = (DetectUricontentData *)sm->ctx; + DetectContentData *ud = (DetectContentData *)sm->ctx; if (ud == NULL) continue; sig->flags |= SIG_FLAG_MPM_URI; - if (ud->flags & DETECT_URICONTENT_NEGATED) { + if (ud->flags & DETECT_CONTENT_NEGATED) { sig->flags |= SIG_FLAG_MPM_URI_NEG; } } @@ -1468,7 +1468,7 @@ Signature *SigInitReal(DetectEngineCtx *de_ctx, char *sigstr) { for (sm = sig->sm_lists[DETECT_SM_LIST_UMATCH]; sm != NULL; sm = sm->next) { if (sm->type == DETECT_URICONTENT) { - DetectUricontentData *ud = (DetectUricontentData *)sm->ctx; + DetectContentData *ud = (DetectContentData *)sm->ctx; if (ud == NULL) continue; if (sig->mpm_uricontent_maxlen == 0) @@ -1517,7 +1517,7 @@ Signature *SigInitReal(DetectEngineCtx *de_ctx, char *sigstr) { for (sm = sig->next->sm_lists[DETECT_SM_LIST_UMATCH]; sm != NULL; sm = sm->next) { if (sm->type == DETECT_URICONTENT) { - DetectUricontentData *ud = (DetectUricontentData *)sm->ctx; + DetectContentData *ud = (DetectContentData *)sm->ctx; if (ud == NULL) continue; diff --git a/src/detect-pcre.c b/src/detect-pcre.c index 4a7bf23003..c83b27c33f 100644 --- a/src/detect-pcre.c +++ b/src/detect-pcre.c @@ -1391,7 +1391,7 @@ static int DetectPcreSetup (DetectEngineCtx *de_ctx, Signature *s, char *regexst } DetectContentData *cd = NULL; - DetectUricontentData *ud = NULL; + DetectContentData *ud = NULL; DetectPcreData *pe = NULL; switch (prev_sm->type) { @@ -1408,12 +1408,12 @@ static int DetectPcreSetup (DetectEngineCtx *de_ctx, Signature *s, char *regexst case DETECT_URICONTENT: /* Set the relative next flag on the prev sigmatch */ - ud = (DetectUricontentData *)prev_sm->ctx; + ud = (DetectContentData *)prev_sm->ctx; if (ud == NULL) { SCLogError(SC_ERR_INVALID_SIGNATURE, "uricontent not setup properly"); SCReturnInt(-1); } - ud->flags |= DETECT_URICONTENT_RELATIVE_NEXT; + ud->flags |= DETECT_CONTENT_RELATIVE_NEXT; break; diff --git a/src/detect-uricontent.c b/src/detect-uricontent.c index ce384567da..8f0190b90a 100644 --- a/src/detect-uricontent.c +++ b/src/detect-uricontent.c @@ -90,13 +90,13 @@ uint32_t DetectUricontentMaxId(DetectEngineCtx *de_ctx) } /** - * \brief this function will Free memory associated with DetectUricontentData + * \brief this function will Free memory associated with DetectContentData * * \param cd pointer to DetectUricotentData */ void DetectUricontentFree(void *ptr) { SCEnter(); - DetectUricontentData *cd = (DetectUricontentData *)ptr; + DetectContentData *cd = (DetectContentData *)ptr; if (cd == NULL) SCReturn; @@ -113,7 +113,7 @@ void DetectUricontentFree(void *ptr) { /** * \brief Helper function to print a DetectContentData */ -void DetectUricontentPrint(DetectUricontentData *cd) +void DetectUricontentPrint(DetectContentData *cd) { int i = 0; if (cd == NULL) { @@ -148,9 +148,9 @@ void DetectUricontentPrint(DetectUricontentData *cd) SCLogDebug("Distance: %"PRIi32, cd->distance); SCLogDebug("flags: %u ", cd->flags); SCLogDebug("negated: %s ", - cd->flags & DETECT_URICONTENT_NEGATED ? "true" : "false"); + cd->flags & DETECT_CONTENT_NEGATED ? "true" : "false"); SCLogDebug("relative match next: %s ", - cd->flags & DETECT_URICONTENT_RELATIVE_NEXT ? "true" : "false"); + cd->flags & DETECT_CONTENT_RELATIVE_NEXT ? "true" : "false"); SCLogDebug("-----------"); } @@ -173,7 +173,7 @@ SigMatch *DetectUricontentGetLastPattern(SigMatch *sm) if (sm == NULL) return NULL; - DetectUricontentData *cd = (DetectUricontentData*) sm->ctx; + DetectContentData *cd = (DetectContentData*) sm->ctx; if (cd == NULL) return NULL; @@ -185,9 +185,9 @@ SigMatch *DetectUricontentGetLastPattern(SigMatch *sm) * the rule set. * \param contentstr Pointer to the string which has been defined in the rule */ -DetectUricontentData *DoDetectUricontentSetup (char * contentstr) +DetectContentData *DoDetectUricontentSetup (char * contentstr) { - DetectUricontentData *cd = NULL; + DetectContentData *cd = NULL; char *temp = NULL; char *str = NULL; uint16_t len = 0; @@ -202,10 +202,10 @@ DetectUricontentData *DoDetectUricontentSetup (char * contentstr) return NULL; } - cd = SCMalloc(sizeof(DetectUricontentData)); + cd = SCMalloc(sizeof(DetectContentData)); if (cd == NULL) goto error; - memset(cd,0,sizeof(DetectUricontentData)); + memset(cd,0,sizeof(DetectContentData)); /* skip the first spaces */ slen = strlen(temp); @@ -214,7 +214,7 @@ DetectUricontentData *DoDetectUricontentSetup (char * contentstr) }; if (temp[pos] == '!') { - cd->flags |= DETECT_URICONTENT_NEGATED; + cd->flags |= DETECT_CONTENT_NEGATED; pos++; } @@ -365,7 +365,7 @@ int DetectUricontentSetup (DetectEngineCtx *de_ctx, Signature *s, char *contents { SCEnter(); - DetectUricontentData *cd = NULL; + DetectContentData *cd = NULL; SigMatch *sm = NULL; if (s->alproto == ALPROTO_DCERPC) { @@ -1115,8 +1115,8 @@ static int DetectUriSigTest04(void) { if (s == NULL || s->sm_lists[DETECT_SM_LIST_UMATCH] == NULL || s->sm_lists[DETECT_SM_LIST_PMATCH] == NULL || - ((DetectUricontentData *)s->sm_lists[DETECT_SM_LIST_UMATCH]->ctx)->depth != 15 || - ((DetectUricontentData *)s->sm_lists[DETECT_SM_LIST_UMATCH]->ctx)->offset != 5 || + ((DetectContentData *)s->sm_lists[DETECT_SM_LIST_UMATCH]->ctx)->depth != 15 || + ((DetectContentData *)s->sm_lists[DETECT_SM_LIST_UMATCH]->ctx)->offset != 5 || s->sm_lists[DETECT_SM_LIST_MATCH] != NULL) { printf("sig 4 failed to parse: "); @@ -1171,11 +1171,11 @@ static int DetectUriSigTest04(void) { s->sm_lists[DETECT_SM_LIST_PMATCH] == NULL || ((DetectContentData*) s->sm_lists[DETECT_SM_LIST_PMATCH]->ctx)->depth != 15 || ((DetectContentData*) s->sm_lists[DETECT_SM_LIST_PMATCH]->ctx)->offset != 5 || - ((DetectUricontentData*) s->sm_lists_tail[DETECT_SM_LIST_UMATCH]->ctx)->within != 30 || + ((DetectContentData*) s->sm_lists_tail[DETECT_SM_LIST_UMATCH]->ctx)->within != 30 || s->sm_lists[DETECT_SM_LIST_MATCH] != NULL) { printf("sig 8 failed to parse: "); - DetectUricontentPrint((DetectUricontentData*) s->sm_lists_tail[DETECT_SM_LIST_UMATCH]->ctx); + DetectUricontentPrint((DetectContentData*) s->sm_lists_tail[DETECT_SM_LIST_UMATCH]->ctx); goto end; } @@ -1211,11 +1211,11 @@ static int DetectUriSigTest04(void) { s->sm_lists[DETECT_SM_LIST_PMATCH] == NULL || ((DetectContentData*) s->sm_lists[DETECT_SM_LIST_PMATCH]->ctx)->depth != 15 || ((DetectContentData*) s->sm_lists[DETECT_SM_LIST_PMATCH]->ctx)->offset != 5 || - ((DetectUricontentData*) s->sm_lists_tail[DETECT_SM_LIST_UMATCH]->ctx)->distance != 30 || + ((DetectContentData*) s->sm_lists_tail[DETECT_SM_LIST_UMATCH]->ctx)->distance != 30 || s->sm_lists[DETECT_SM_LIST_MATCH] != NULL) { printf("sig 10 failed to parse: "); - DetectUricontentPrint((DetectUricontentData*) s->sm_lists_tail[DETECT_SM_LIST_UMATCH]->ctx); + DetectUricontentPrint((DetectContentData*) s->sm_lists_tail[DETECT_SM_LIST_UMATCH]->ctx); goto end; } @@ -1238,14 +1238,14 @@ static int DetectUriSigTest04(void) { if ( ((DetectContentData*) s->sm_lists[DETECT_SM_LIST_PMATCH]->ctx)->depth != 15 || ((DetectContentData*) s->sm_lists[DETECT_SM_LIST_PMATCH]->ctx)->offset != 5 || - ((DetectUricontentData*) s->sm_lists_tail[DETECT_SM_LIST_UMATCH]->ctx)->distance != 30 || - ((DetectUricontentData*) s->sm_lists_tail[DETECT_SM_LIST_UMATCH]->ctx)->within != 60 || + ((DetectContentData*) s->sm_lists_tail[DETECT_SM_LIST_UMATCH]->ctx)->distance != 30 || + ((DetectContentData*) s->sm_lists_tail[DETECT_SM_LIST_UMATCH]->ctx)->within != 60 || ((DetectContentData*) s->sm_lists_tail[DETECT_SM_LIST_PMATCH]->ctx)->distance != 45 || ((DetectContentData*) s->sm_lists_tail[DETECT_SM_LIST_PMATCH]->ctx)->within != 70 || s->sm_lists[DETECT_SM_LIST_MATCH] != NULL) { printf("sig 10 failed to parse, content not setup properly: "); DetectContentPrint((DetectContentData*) s->sm_lists[DETECT_SM_LIST_PMATCH]->ctx); - DetectUricontentPrint((DetectUricontentData*) s->sm_lists_tail[DETECT_SM_LIST_UMATCH]->ctx); + DetectUricontentPrint((DetectContentData*) s->sm_lists_tail[DETECT_SM_LIST_UMATCH]->ctx); DetectContentPrint((DetectContentData*) s->sm_lists_tail[DETECT_SM_LIST_PMATCH]->ctx); goto end; } @@ -1757,7 +1757,7 @@ int DetectUriSigTest11(void) int DetectUriSigTest12(void) { DetectEngineCtx *de_ctx = NULL; - DetectUricontentData *ud = 0; + DetectContentData *ud = 0; Signature *s = NULL; int result = 1; @@ -1781,7 +1781,7 @@ int DetectUriSigTest12(void) goto end; } - ud = (DetectUricontentData *)s->sm_lists_tail[DETECT_SM_LIST_UMATCH]->ctx; + ud = (DetectContentData *)s->sm_lists_tail[DETECT_SM_LIST_UMATCH]->ctx; result = (strncmp("boo", (char *)ud->content, ud->content_len) == 0); end: @@ -2139,7 +2139,7 @@ int DetectUricontentSigTest08(void) } DetectContentData *cd = de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_PMATCH]->ctx; - DetectUricontentData *ud = de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_UMATCH]->ctx; + DetectContentData *ud = de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_UMATCH]->ctx; if (cd->id == ud->id) goto end; @@ -2178,7 +2178,7 @@ int DetectUricontentSigTest09(void) } DetectContentData *cd = de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_PMATCH]->ctx; - DetectUricontentData *ud = de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_UMATCH]->ctx; + DetectContentData *ud = de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_UMATCH]->ctx; if (cd->id == ud->id) goto end; @@ -2220,8 +2220,8 @@ int DetectUricontentSigTest10(void) DetectContentData *cd1 = de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_PMATCH]->prev->prev->ctx; DetectContentData *cd2 = de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_PMATCH]->prev->ctx; DetectContentData *cd3 = de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_PMATCH]->ctx; - DetectUricontentData *ud1 = de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_UMATCH]->prev->ctx; - DetectUricontentData *ud2 = de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_UMATCH]->ctx; + DetectContentData *ud1 = de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_UMATCH]->prev->ctx; + DetectContentData *ud2 = de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_UMATCH]->ctx; if (cd1->id != 1 || cd2->id != 2 || cd3->id != 1 || ud1->id != 0 || ud2->id != 0) goto end; @@ -2263,8 +2263,8 @@ int DetectUricontentSigTest11(void) DetectContentData *cd1 = de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_PMATCH]->prev->prev->ctx; DetectContentData *cd2 = de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_PMATCH]->prev->ctx; DetectContentData *cd3 = de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_PMATCH]->ctx; - DetectUricontentData *ud1 = de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_UMATCH]->prev->ctx; - DetectUricontentData *ud2 = de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_UMATCH]->ctx; + DetectContentData *ud1 = de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_UMATCH]->prev->ctx; + DetectContentData *ud2 = de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_UMATCH]->ctx; if (cd1->id != 1 || cd2->id != 2 || cd3->id != 1 || ud1->id != 0 || ud2->id != 0) goto end; @@ -2310,11 +2310,11 @@ int DetectUricontentSigTest12(void) DetectContentData *cd3 = de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_PMATCH]->prev->prev->ctx; DetectContentData *cd4 = de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_PMATCH]->prev->ctx; DetectContentData *cd5 = de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_PMATCH]->ctx; - DetectUricontentData *ud1 = de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_UMATCH]->prev->prev->prev->prev->ctx; - DetectUricontentData *ud2 = de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_UMATCH]->prev->prev->prev->ctx; - DetectUricontentData *ud3 = de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_UMATCH]->prev->prev->ctx; - DetectUricontentData *ud4 = de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_UMATCH]->prev->ctx; - DetectUricontentData *ud5 = de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_UMATCH]->ctx; + DetectContentData *ud1 = de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_UMATCH]->prev->prev->prev->prev->ctx; + DetectContentData *ud2 = de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_UMATCH]->prev->prev->prev->ctx; + DetectContentData *ud3 = de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_UMATCH]->prev->prev->ctx; + DetectContentData *ud4 = de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_UMATCH]->prev->ctx; + DetectContentData *ud5 = de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_UMATCH]->ctx; if (cd1->id != 1 || cd2->id != 2 || cd3->id != 1 || cd4->id != 1 || cd5->id != 4 || ud1->id != 0 || ud2->id != 0 || ud3->id != 0 || ud4->id != 0 || ud5->id != 3) { goto end; diff --git a/src/detect-uricontent.h b/src/detect-uricontent.h index 5eef280d2c..fb24cc825d 100644 --- a/src/detect-uricontent.h +++ b/src/detect-uricontent.h @@ -25,59 +25,18 @@ #ifndef __DETECT_URICONTENT_H__ #define __DETECT_URICONTENT_H__ -#define DETECT_URICONTENT_NOCASE 0x0001 -#define DETECT_URICONTENT_DISTANCE 0x0002 -#define DETECT_URICONTENT_WITHIN 0x0004 -#define DETECT_URICONTENT_OFFSET 0x0008 -#define DETECT_URICONTENT_DEPTH 0x0010 - -#define DETECT_URICONTENT_DISTANCE_NEXT 0x0020 -#define DETECT_URICONTENT_WITHIN_NEXT 0x0040 - -#define DETECT_URICONTENT_RAWBYTES 0x0080 -#define DETECT_URICONTENT_NEGATED 0x0100 -#define DETECT_URICONTENT_RELATIVE_NEXT 0x0200 - -#define DETECT_URICONTENT_FAST_PATTERN 0x0400 -#define DETECT_URICONTENT_FAST_PATTERN_ONLY 0x0800 -#define DETECT_URICONTENT_FAST_PATTERN_CHOP 0x1000 - -#define DETECT_URICONTENT_IS_SINGLE(c) (!((c)->flags & DETECT_URICONTENT_DISTANCE || \ - (c)->flags & DETECT_URICONTENT_WITHIN || \ - (c)->flags & DETECT_URICONTENT_RELATIVE || \ - (c)->depth > 0 || \ - (c)->within > 0)) +#include "detect-content.h" #include "util-spm-bm.h" #include "app-layer-htp.h" -typedef struct DetectUricontentData_ { - uint8_t *content; - uint8_t content_len; - PatIntId id; - uint32_t flags; - uint16_t depth; - uint16_t offset; - int32_t distance; - int32_t within; - BmCtx *bm_ctx; /**< Boyer Moore context (for spm search) */ - /* if someone wants to add an extra var to this structutre of size 1 byte - * you can reduce the below var to uint8_t. No problemo */ - uint16_t avoid_double_check; - /* for chopped fast pattern, the offset */ - uint16_t fp_chop_offset; - /* for chopped fast pattern, the length */ - uint16_t fp_chop_len; -} DetectUricontentData; - /* prototypes */ void DetectUricontentRegister (void); uint32_t DetectUricontentMaxId(DetectEngineCtx *); //uint32_t DetectUricontentInspectMpm(DetectEngineThreadCtx *det_ctx, void *alstate); SigMatch *DetectUricontentGetLastPattern(SigMatch *); -void DetectUricontentPrint(DetectUricontentData *); +void DetectUricontentPrint(DetectContentData *); uint32_t DetectUricontentInspectMpm(DetectEngineThreadCtx *, Flow *, HtpState *); #endif /* __DETECT_URICONTENT_H__ */ - diff --git a/src/detect-within.c b/src/detect-within.c index a82e121037..a7603d3a43 100644 --- a/src/detect-within.c +++ b/src/detect-within.c @@ -181,26 +181,26 @@ static int DetectWithinSetup (DetectEngineCtx *de_ctx, Signature *s, char *withi } } - DetectUricontentData *ud = NULL; + DetectContentData *ud = NULL; DetectContentData *cd = NULL; DetectPcreData *pe = NULL; switch (pm->type) { case DETECT_URICONTENT: - ud = (DetectUricontentData *)pm->ctx; + ud = (DetectContentData *)pm->ctx; if (ud == NULL) { SCLogError(SC_ERR_WITHIN_MISSING_CONTENT, "Unknown previous keyword!\n"); goto error; } - if (ud->flags & DETECT_URICONTENT_NEGATED) { - if (ud->flags & DETECT_URICONTENT_FAST_PATTERN) { + if (ud->flags & DETECT_CONTENT_NEGATED) { + if (ud->flags & DETECT_CONTENT_FAST_PATTERN) { SCLogError(SC_ERR_INVALID_SIGNATURE, "You can't have a relative " "negated keyword set along with a fast_pattern"); goto error; } } else { - if (ud->flags & DETECT_URICONTENT_FAST_PATTERN_ONLY) { + if (ud->flags & DETECT_CONTENT_FAST_PATTERN_ONLY) { SCLogError(SC_ERR_INVALID_SIGNATURE, "You can't have a relative " "keyword set along with a fast_pattern:only;"); goto error; @@ -216,9 +216,9 @@ static int DetectWithinSetup (DetectEngineCtx *de_ctx, Signature *s, char *withi goto error; } - ud->flags |= DETECT_URICONTENT_WITHIN; + ud->flags |= DETECT_CONTENT_WITHIN; - if (ud->flags & DETECT_URICONTENT_DISTANCE) { + if (ud->flags & DETECT_CONTENT_DISTANCE) { if ((ud->distance + ud->content_len) > ud->within) { ud->within = ud->distance + ud->content_len; } @@ -237,15 +237,15 @@ static int DetectWithinSetup (DetectEngineCtx *de_ctx, Signature *s, char *withi switch (pm->type) { case DETECT_URICONTENT: /* Set the relative next flag on the prev sigmatch */ - ud = (DetectUricontentData *)pm->ctx; + ud = (DetectContentData *)pm->ctx; if (ud == NULL) { SCLogError(SC_ERR_INVALID_SIGNATURE, "Unknown previous-" "previous keyword!"); goto error; } - ud->flags |= DETECT_URICONTENT_RELATIVE_NEXT; + ud->flags |= DETECT_CONTENT_RELATIVE_NEXT; - if (ud->flags & DETECT_URICONTENT_FAST_PATTERN_ONLY) { + if (ud->flags & DETECT_CONTENT_FAST_PATTERN_ONLY) { SCLogError(SC_ERR_INVALID_SIGNATURE, "Previous keyword " "has a fast_pattern:only; set. You can't " "have relative keywords around a fast_pattern "