aiden
/
suricata
mirror of https://github.com/OISF/suricata
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

code cleanup - replace SigMatchGetLastSM with SigMatchGetLastSMFromLists

Browse Source
remotes/origin/master
Anoop Saldanha 14 years ago committed by Victor Julien
parent ab35b98f76
commit bbb9f35f26
7 changed files with 42 additions and 23 deletions
Show Stats Download Patch File Download Diff File

6
src/detect-detection-filter.c
Unescape Escape View File

@ -227,13 +227,15 @@ int DetectDetectionFilterSetup (DetectEngineCtx *de_ctx, Signature *s, char *raw
SigMatch *tmpm = NULL;
/* checks if there's a previous instance of threshold */
tmpm = SigMatchGetLastSM(s->sm_lists_tail[DETECT_SM_LIST_MATCH], DETECT_THRESHOLD);
tmpm = SigMatchGetLastSMFromLists(s, 2,
DETECT_THRESHOLD, s->sm_lists_tail[DETECT_SM_LIST_MATCH]);
if (tmpm != NULL) {
SCLogError(SC_ERR_INVALID_SIGNATURE, "\"detection_filter\" and \"threshold\" are not allowed in the same rule");
SCReturnInt(-1);
}
/* checks there's no previous instance of detection_filter */
tmpm = SigMatchGetLastSM(s->sm_lists_tail[DETECT_SM_LIST_MATCH], DETECT_DETECTION_FILTER);
tmpm = SigMatchGetLastSMFromLists(s, 2,
DETECT_DETECTION_FILTER, s->sm_lists_tail[DETECT_SM_LIST_MATCH]);
if (tmpm != NULL) {
SCLogError(SC_ERR_INVALID_SIGNATURE, "At most one \"detection_filter\" is allowed per rule");
SCReturnInt(-1);

5
src/detect-dsize.c
Unescape Escape View File

@ -275,8 +275,9 @@ static int DetectDsizeSetup (DetectEngineCtx *de_ctx, Signature *s, char *rawstr
DetectDsizeData *dd = NULL;
SigMatch *sm = NULL;
if (SigMatchGetLastSM(s->sm_lists_tail[DETECT_SM_LIST_MATCH],
DETECT_DSIZE) != NULL) {
if (SigMatchGetLastSMFromLists(s, 2,
DETECT_DSIZE,
s->sm_lists_tail[DETECT_SM_LIST_MATCH]) != NULL) {
SCLogError(SC_ERR_INVALID_SIGNATURE, "Can't use 2 or more dsizes in "
"the same sig. Invalidating signature.");
goto error;

3
src/detect-ftpbounce.c
Unescape Escape View File

@ -208,7 +208,8 @@ int DetectFtpbounceMatch(ThreadVars *t, DetectEngineThreadCtx *det_ctx,
if (!(PKT_IS_TCP(p)))
return 0;
SigMatch *sm = SigMatchGetLastSM(s->sm_lists_tail[DETECT_SM_LIST_PMATCH], DETECT_CONTENT);
SigMatch *sm = SigMatchGetLastSMFromLists(s, 2,
DETECT_CONTENT, s->sm_lists_tail[DETECT_SM_LIST_PMATCH]);
if (sm == NULL)
return 0;

2
src/detect-parse.c
Unescape Escape View File

@ -528,7 +528,7 @@ void SigMatchReplace(Signature *s, SigMatch *m, SigMatch *new) {
*
* \retval match Pointer to the last SigMatch instance of type 'type'.
*/
SigMatch *SigMatchGetLastSM(SigMatch *sm, uint8_t type)
static inline SigMatch *SigMatchGetLastSM(SigMatch *sm, uint8_t type)
{
while (sm != NULL) {
if (sm->type == type) {

1
src/detect-parse.h
Unescape Escape View File

@ -45,7 +45,6 @@ Signature *SigAlloc(void);
void SigFree(Signature *s);
Signature *SigInit(DetectEngineCtx *,char *sigstr);
Signature *SigInitReal(DetectEngineCtx *, char *);
SigMatch *SigMatchGetLastSM(SigMatch *, uint8_t);
SigMatch *SigMatchGetLastSMFromLists(Signature *, int, ...);
void SigMatchTransferSigMatchAcrossLists(SigMatch *sm,
SigMatch **, SigMatch **s,

3
src/detect-threshold.c
Unescape Escape View File

@ -242,7 +242,8 @@ static int DetectThresholdSetup (DetectEngineCtx *de_ctx, Signature *s, char *ra
SigMatch *tmpm = NULL;
/* checks if there is a previous instance of detection_filter */
tmpm = SigMatchGetLastSM(s->sm_lists[DETECT_SM_LIST_MATCH], DETECT_DETECTION_FILTER);
tmpm = SigMatchGetLastSMFromLists(s, 2,
DETECT_DETECTION_FILTER, s->sm_lists[DETECT_SM_LIST_MATCH]);
if (tmpm != NULL) {
SCLogError(SC_ERR_INVALID_SIGNATURE, "\"detection_filter\" and \"threshold\" are not allowed in the same rule");
SCReturnInt(-1);

45
src/util-threshold-config.c
Unescape Escape View File

@ -513,12 +513,14 @@ int SCThresholdConfAddThresholdtype(char *rawstr, DetectEngineCtx *de_ctx)
ns = s->next;
m = SigMatchGetLastSM(s->sm_lists[DETECT_SM_LIST_THRESHOLD], DETECT_THRESHOLD);
m = SigMatchGetLastSMFromLists(s, 2,
DETECT_THRESHOLD, s->sm_lists[DETECT_SM_LIST_THRESHOLD]);
if(m != NULL)
goto end;
m = SigMatchGetLastSM(s->sm_lists[DETECT_SM_LIST_THRESHOLD], DETECT_DETECTION_FILTER);
m = SigMatchGetLastSMFromLists(s, 2,
DETECT_DETECTION_FILTER, s->sm_lists[DETECT_SM_LIST_THRESHOLD]);
if(m != NULL)
goto end;
@ -582,12 +584,14 @@ int SCThresholdConfAddThresholdtype(char *rawstr, DetectEngineCtx *de_ctx)
if(s->gid == gid) {
m = SigMatchGetLastSM(s->sm_lists[DETECT_SM_LIST_THRESHOLD], DETECT_THRESHOLD);
m = SigMatchGetLastSMFromLists(s, 2,
DETECT_THRESHOLD, s->sm_lists[DETECT_SM_LIST_THRESHOLD]);
if(m != NULL)
goto end;
m = SigMatchGetLastSM(s->sm_lists[DETECT_SM_LIST_THRESHOLD], DETECT_DETECTION_FILTER);
m = SigMatchGetLastSMFromLists(s, 2,
DETECT_DETECTION_FILTER, s->sm_lists[DETECT_SM_LIST_THRESHOLD]);
if(m != NULL)
goto end;
@ -653,12 +657,14 @@ int SCThresholdConfAddThresholdtype(char *rawstr, DetectEngineCtx *de_ctx)
goto end;
}
m = SigMatchGetLastSM(sig->sm_lists[DETECT_SM_LIST_THRESHOLD], DETECT_THRESHOLD);
m = SigMatchGetLastSMFromLists(sig, 2,
DETECT_THRESHOLD, sig->sm_lists[DETECT_SM_LIST_THRESHOLD]);
if(m != NULL)
goto end;
m = SigMatchGetLastSM(sig->sm_lists[DETECT_SM_LIST_THRESHOLD], DETECT_DETECTION_FILTER);
m = SigMatchGetLastSMFromLists(sig, 2,
DETECT_DETECTION_FILTER, sig->sm_lists[DETECT_SM_LIST_THRESHOLD]);
if(m != NULL)
goto end;
@ -1132,7 +1138,8 @@ int SCThresholdConfTest01(void)
fd = SCThresholdConfGenerateValidDummyFD01();
SCThresholdConfInitContext(de_ctx,fd);
m = SigMatchGetLastSM(sig->sm_lists[DETECT_SM_LIST_THRESHOLD], DETECT_THRESHOLD);
m = SigMatchGetLastSMFromLists(sig, 2,
DETECT_THRESHOLD, sig->sm_lists[DETECT_SM_LIST_THRESHOLD]);
if(m != NULL) {
de = (DetectThresholdData *)m->ctx;
@ -1176,7 +1183,8 @@ int SCThresholdConfTest02(void)
fd = SCThresholdConfGenerateValidDummyFD01();
SCThresholdConfInitContext(de_ctx,fd);
m = SigMatchGetLastSM(sig->sm_lists[DETECT_SM_LIST_THRESHOLD], DETECT_THRESHOLD);
m = SigMatchGetLastSMFromLists(sig, 2,
DETECT_THRESHOLD, sig->sm_lists[DETECT_SM_LIST_THRESHOLD]);
if(m != NULL) {
de = (DetectThresholdData *)m->ctx;
@ -1219,7 +1227,8 @@ int SCThresholdConfTest03(void)
fd = SCThresholdConfGenerateValidDummyFD01();
SCThresholdConfInitContext(de_ctx,fd);
m = SigMatchGetLastSM(sig->sm_lists[DETECT_SM_LIST_THRESHOLD], DETECT_THRESHOLD);
m = SigMatchGetLastSMFromLists(sig, 2,
DETECT_THRESHOLD, sig->sm_lists[DETECT_SM_LIST_THRESHOLD]);
if(m != NULL) {
de = (DetectThresholdData *)m->ctx;
@ -1262,7 +1271,8 @@ int SCThresholdConfTest04(void)
fd = SCThresholdConfGenerateInValidDummyFD02();
SCThresholdConfInitContext(de_ctx,fd);
m = SigMatchGetLastSM(sig->sm_lists[DETECT_SM_LIST_THRESHOLD], DETECT_THRESHOLD);
m = SigMatchGetLastSMFromLists(sig, 2,
DETECT_THRESHOLD, sig->sm_lists[DETECT_SM_LIST_THRESHOLD]);
if(m != NULL) {
de = (DetectThresholdData *)m->ctx;
@ -1323,7 +1333,8 @@ int SCThresholdConfTest05(void)
if(s->id == 1 || s->id == 10 || s->id == 100) {
m = SigMatchGetLastSM(s->sm_lists[DETECT_SM_LIST_THRESHOLD], DETECT_THRESHOLD);
m = SigMatchGetLastSMFromLists(s, 2,
DETECT_THRESHOLD, s->sm_lists[DETECT_SM_LIST_THRESHOLD]);
if(m == NULL) {
goto end;
@ -1376,7 +1387,8 @@ int SCThresholdConfTest06(void)
fd = SCThresholdConfGenerateValidDummyFD04();
SCThresholdConfInitContext(de_ctx,fd);
m = SigMatchGetLastSM(sig->sm_lists[DETECT_SM_LIST_THRESHOLD], DETECT_THRESHOLD);
m = SigMatchGetLastSMFromLists(sig, 2,
DETECT_THRESHOLD, sig->sm_lists[DETECT_SM_LIST_THRESHOLD]);
if(m != NULL) {
de = (DetectThresholdData *)m->ctx;
@ -1420,7 +1432,8 @@ int SCThresholdConfTest07(void)
fd = SCThresholdConfGenerateValidDummyFD05();
SCThresholdConfInitContext(de_ctx,fd);
m = SigMatchGetLastSM(sig->sm_lists[DETECT_SM_LIST_THRESHOLD], DETECT_DETECTION_FILTER);
m = SigMatchGetLastSMFromLists(sig, 2,
DETECT_DETECTION_FILTER, sig->sm_lists[DETECT_SM_LIST_THRESHOLD]);
if(m != NULL) {
de = (DetectThresholdData *)m->ctx;
@ -1465,7 +1478,8 @@ int SCThresholdConfTest08(void)
fd = SCThresholdConfGenerateValidDummyFD06();
SCThresholdConfInitContext(de_ctx,fd);
m = SigMatchGetLastSM(sig->sm_lists[DETECT_SM_LIST_THRESHOLD], DETECT_DETECTION_FILTER);
m = SigMatchGetLastSMFromLists(sig, 2,
DETECT_DETECTION_FILTER, sig->sm_lists[DETECT_SM_LIST_THRESHOLD]);
if(m != NULL) {
de = (DetectThresholdData *)m->ctx;
@ -1930,7 +1944,8 @@ int SCThresholdConfTest13(void)
fd = SCThresholdConfGenerateValidDummyFD11();
SCThresholdConfInitContext(de_ctx,fd);
m = SigMatchGetLastSM(sig->sm_lists[DETECT_SM_LIST_THRESHOLD], DETECT_THRESHOLD);
m = SigMatchGetLastSMFromLists(sig, 2,
DETECT_THRESHOLD, sig->sm_lists[DETECT_SM_LIST_THRESHOLD]);
if(m != NULL) {
de = (DetectThresholdData *)m->ctx;

Write Preview
Loading…
Cancel
Save