diff --git a/src/detect-http-cookie.c b/src/detect-http-cookie.c index 0338de66b0..7d750e235b 100644 --- a/src/detect-http-cookie.c +++ b/src/detect-http-cookie.c @@ -68,7 +68,7 @@ int DetectHttpCookieMatch (ThreadVars *t, DetectEngineThreadCtx *det_ctx, Flow *f, uint8_t flags, void *state, Signature *s, SigMatch *m) { - DetectContentData *co = (DetectContentData *)m->ctx; + DetectHttpCookieData *co = (DetectHttpCookieData *)m->ctx; HtpState *htp_state = (HtpState *)state; if (htp_state == NULL) { SCLogDebug("No HTTP layer state has been received, so no match!!"); @@ -87,8 +87,8 @@ int DetectHttpCookieMatch (ThreadVars *t, DetectEngineThreadCtx *det_ctx, } - if (BinSearch(bstr_ptr(h->value), bstr_size(h->value), co->content, - co->content_len) != NULL) + if (BinSearch(bstr_ptr(h->value), bstr_size(h->value), co->data, + co->data_len) != NULL) { SCLogDebug("Match has been found in received request and given http_" "cookie rule\n"); @@ -169,8 +169,6 @@ int DetectHttpCookieSetup (DetectEngineCtx *de_ctx, Signature *s, SigMatch *m, } memcpy(hd->data, ((DetectContentData *)m->ctx)->content, hd->data_len); - hd->flags |= DETECT_CONTENT_HTTP_COOKIE; - sm = SigMatchAlloc(); if (sm == NULL) goto error; @@ -275,13 +273,10 @@ int DetectHttpCookieTest03(void) sm = de_ctx->sig_list->match; while (sm != NULL) { if (sm->type == DETECT_AL_HTTP_COOKIE) { - if (((DetectHttpCookieData *)sm->ctx)->flags & - DETECT_CONTENT_HTTP_COOKIE) { result = 1; - } else { - result = 0; - break; - } + } else { + result = 0; + break; } sm = sm->next; } diff --git a/src/detect-http-cookie.h b/src/detect-http-cookie.h index 56eae79229..8b3a4041d1 100644 --- a/src/detect-http-cookie.h +++ b/src/detect-http-cookie.h @@ -10,28 +10,6 @@ typedef struct DetectHttpCookieData_ { uint8_t *data; uint8_t data_len; - uint32_t id; - uint8_t negated; - - uint16_t depth; - uint16_t offset; - uint32_t isdataat; - int32_t distance; - int32_t within; - uint16_t flags; - - /** The group this chunk belongs to, relative to the signature - * It start from 1, and the last SigMatch of the list should be - * also the total number of DetectContent "Real" Patterns loaded - * from the Signature */ - uint8_t chunk_group_id; - /** The id number for this chunk in the current group of chunks - * Starts from 0, and a chunk with chunk_id == 0 should be the - * of the current chunk group where real modifiers are set before - * propagation */ - uint8_t chunk_id; - /** For modifier propagations (the new flags) */ - uint8_t chunk_flags; } DetectHttpCookieData; /* prototypes */