From 531594a35f241fc70a262adeb06610cee93b7314 Mon Sep 17 00:00:00 2001
From: Victor Julien <victor@inliniac.net>
Date: Fri, 16 Apr 2010 15:40:10 +0200
Subject: [PATCH] Small error message and comment update to the nocase keyword.

---
 src/detect-nocase.c | 19 ++++++++++++-------
 1 file changed, 12 insertions(+), 7 deletions(-)

diff --git a/src/detect-nocase.c b/src/detect-nocase.c
index a4194d07bf..ff67905a9e 100644
--- a/src/detect-nocase.c
+++ b/src/detect-nocase.c
@@ -29,9 +29,10 @@ void DetectNocaseRegister (void) {
     sigmatch_table[DETECT_NOCASE].flags |= SIGMATCH_PAYLOAD;
 }
 
-/** \internal
+/**
+ *  \internal
  *  \brief get the last pattern sigmatch that supports nocase:
- *         content, uricontent, http_client_body
+ *         content, uricontent, http_client_body, http_cookie
  *
  *  \param s signature
  *
@@ -90,6 +91,7 @@ static SigMatch *SigMatchGetLastNocasePattern(Signature *s) {
     if (sm_list_count == 0)
         SCReturnPtr(NULL, "SigMatch");
 
+    /* find the highest idx sm, so we apply to the last sm that we support */
     int i = 0, j = 0;
     int swapped = 1;
     while (swapped) {
@@ -111,7 +113,8 @@ static SigMatch *SigMatchGetLastNocasePattern(Signature *s) {
     SCReturnPtr(temp_sm, "SigMatch");
 }
 
-/** \internal
+/**
+ *  \internal
  *  \brief Apply the nocase keyword to the last pattern match, either content or uricontent
  *  \param det_ctx detection engine ctx
  *  \param s signature
@@ -127,11 +130,12 @@ static int DetectNocaseSetup (DetectEngineCtx *de_ctx, Signature *s, char *nulls
         SCLogError(SC_ERR_INVALID_VALUE, "nocase has no value");
         SCReturnInt(-1);
     }
-    /** Search for the first previous DetectContent or uricontent
-     * SigMatch (it can be the same as this one) */
+
+    /* Search for the first previous SigMatch that supports nocase */
     SigMatch *pm = SigMatchGetLastNocasePattern(s);
     if (pm == NULL) {
-        SCLogError(SC_ERR_NOCASE_MISSING_PATTERN, "nocase needs a preceeding content option");
+        SCLogError(SC_ERR_NOCASE_MISSING_PATTERN, "nocase needs a preceeding "
+                "content, uricontent, http_client_body or http_cookie option");
         SCReturnInt(-1);
     }
 
@@ -163,7 +167,8 @@ static int DetectNocaseSetup (DetectEngineCtx *de_ctx, Signature *s, char *nulls
             break;
             /* should never happen */
         default:
-            SCLogError(SC_ERR_NOCASE_MISSING_PATTERN, "nocase needs a preceeding content (or uricontent) option");
+            SCLogError(SC_ERR_NOCASE_MISSING_PATTERN, "nocase needs a preceeding "
+                    "content, uricontent, http_client_body or http_cookie option");
             SCReturnInt(-1);
             break;
     }