aiden
/
suricata
mirror of https://github.com/OISF/suricata
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

Fixing some naming convention issues and incorrect error messages

Browse Source
remotes/origin/master-1.0.x
Pablo Rincon 16 years ago committed by Victor Julien
parent b708d7f65d
commit c7350a8ac6
21 changed files with 40 additions and 83 deletions
Show Stats Download Patch File Download Diff File

2
src/detect-bytejump.c
Unescape Escape View File

@ -493,7 +493,7 @@ int DetectBytejumpSetup(DetectEngineCtx *de_ctx, Signature *s, char *optstr)
if (data->flags & DETECT_BYTEJUMP_RELATIVE) {
/** Search for the first previous DetectContent
* SigMatch (it can be the same as this one) */
SigMatch *pm = DetectContentFindPrevApplicableSM(s->pmatch_tail);
SigMatch *pm = DetectContentGetLastPattern(s->pmatch_tail);
if (pm == NULL) {
SCLogError(SC_ERR_BYTEJUMP_MISSING_CONTENT, "relative bytejump match needs a previous content option");
goto error;

2
src/detect-bytetest.c
Unescape Escape View File

@ -508,7 +508,7 @@ int DetectBytetestSetup(DetectEngineCtx *de_ctx, Signature *s, char *optstr)
if (data->flags & DETECT_BYTETEST_RELATIVE) {
/** Search for the first previous DetectContent
* SigMatch (it can be the same as this one) */
SigMatch *pm = DetectContentFindPrevApplicableSM(s->pmatch_tail);
SigMatch *pm = DetectContentGetLastPattern(s->pmatch_tail);
if (pm == NULL) {
SCLogError(SC_ERR_BYTETEST_MISSING_CONTENT, "relative bytetest match needs a previous content option");
goto error;

4
src/detect-content.c
Unescape Escape View File

@ -309,7 +309,7 @@ SigMatch *DetectContentHasPrevSMPattern(SigMatch *sm)
* \retval pointer to the SigMatch that has the previous SigMatch
* of type DetectContent
*/
SigMatch *DetectContentFindPrevApplicableSM(SigMatch *sm)
SigMatch *DetectContentGetLastPattern(SigMatch *sm)
{
if (sm == NULL)
return NULL;
@ -338,7 +338,7 @@ SigMatch *SigMatchGetLastPattern(Signature *s) {
BUG_ON(s == NULL);
SigMatch *co_sm = DetectContentFindPrevApplicableSM(s->pmatch_tail);
SigMatch *co_sm = DetectContentGetLastPattern(s->pmatch_tail);
SigMatch *ur_sm = SigMatchGetLastSM(s->umatch_tail, DETECT_URICONTENT);
SigMatch *sm = NULL;

2
src/detect-content.h
Unescape Escape View File

@ -46,7 +46,7 @@ void DetectContentPrint(DetectContentData *);
/** This function search backwards the first applicable SigMatch holding
* a DETECT_CONTENT context (If it belongs to a chunk group, the first chunk
* of the group will be returned). Modifiers must call this */
SigMatch *DetectContentFindPrevApplicableSM(SigMatch *);
SigMatch *DetectContentGetLastPattern(SigMatch *);
/** This function search forwards the first applicable SigMatch holding
* a DETECT_CONTENT context. The Match process call this */

2
src/detect-depth.c
Unescape Escape View File

@ -39,7 +39,7 @@ static int DetectDepthSetup (DetectEngineCtx *de_ctx, Signature *s, char *depths
/** Search for the first previous DetectContent or uricontent
* SigMatch (it can be the same as this one) */
SigMatch *pm = SignatureGetLastModifiableSM(s);
SigMatch *pm = SigMatchGetLastPattern(s);
if (pm == NULL) {
SCLogError(SC_ERR_DEPTH_MISSING_CONTENT, "depth needs a preceeding content option");
if (dubbed) SCFree(str);

14
src/detect-distance.c
Unescape Escape View File

@ -39,9 +39,9 @@ static int DetectDistanceSetup (DetectEngineCtx *de_ctx, Signature *s, char *dis
/** Search for the first previous DetectContent
* SigMatch (it can be the same as this one) */
SigMatch *pm = SignatureGetLastModifiableSM(s);
SigMatch *pm = SigMatchGetLastPattern(s);
if (pm == NULL) {
SCLogError(SC_ERR_WITHIN_MISSING_CONTENT, "depth needs two preceeding content (or uricontent) options");
SCLogError(SC_ERR_DISTANCE_MISSING_CONTENT, "depth needs two preceeding content (or uricontent) options");
if (dubbed) SCFree(str);
return -1;
}
@ -53,7 +53,7 @@ static int DetectDistanceSetup (DetectEngineCtx *de_ctx, Signature *s, char *dis
case DETECT_URICONTENT:
ud = (DetectUricontentData *)pm->ctx;
if (ud == NULL) {
printf("DetectWithinSetup: Unknown previous keyword!\n");
SCLogError(SC_ERR_DISTANCE_MISSING_CONTENT, "Unknown previous keyword!\n");
goto error;
}
@ -65,7 +65,7 @@ static int DetectDistanceSetup (DetectEngineCtx *de_ctx, Signature *s, char *dis
}
}
pm = DetectUricontentFindPrevApplicableSM(s->umatch_tail->prev);
pm = DetectUriGetLastPattern(s->umatch_tail->prev);
if (pm == NULL) {
SCLogError(SC_ERR_DISTANCE_MISSING_CONTENT, "distance needs two preceeding content options");
goto error;
@ -83,7 +83,7 @@ static int DetectDistanceSetup (DetectEngineCtx *de_ctx, Signature *s, char *dis
case DETECT_CONTENT:
cd = (DetectContentData *)pm->ctx;
if (cd == NULL) {
printf("DetectWithinSetup: Unknown previous keyword!\n");
SCLogError(SC_ERR_DISTANCE_MISSING_CONTENT, "Unknown previous keyword!\n");
goto error;
}
@ -95,7 +95,7 @@ static int DetectDistanceSetup (DetectEngineCtx *de_ctx, Signature *s, char *dis
}
}
pm = DetectContentFindPrevApplicableSM(s->pmatch_tail->prev);
pm = DetectContentGetLastPattern(s->pmatch_tail->prev);
if (pm == NULL) {
SCLogError(SC_ERR_DISTANCE_MISSING_CONTENT, "distance needs two preceeding content options");
goto error;
@ -111,7 +111,7 @@ static int DetectDistanceSetup (DetectEngineCtx *de_ctx, Signature *s, char *dis
break;
default:
SCLogError(SC_ERR_WITHIN_MISSING_CONTENT, "within needs two preceeding content (or uricontent) options");
SCLogError(SC_ERR_DISTANCE_MISSING_CONTENT, "distance needs two preceeding content (or uricontent) options");
if (dubbed) SCFree(str);
return -1;
break;

10
src/detect-engine-uricontent.c
Unescape Escape View File

@ -50,7 +50,7 @@
* \retval 0 no match
* \retval 1 match
*/
static inline int DoInspectPacketUricontentPayload(DetectEngineCtx *de_ctx,
static inline int DoInspectPacketUris(DetectEngineCtx *de_ctx,
DetectEngineThreadCtx *det_ctx, Signature *s, SigMatch *sm,
Packet *p, uint8_t *payload, uint32_t payload_len)
{
@ -191,7 +191,7 @@ static inline int DoInspectPacketUricontentPayload(DetectEngineCtx *de_ctx,
/* see if the next payload keywords match. If not, we will
* search for another occurence of this uricontent and see
* if the others match then until we run out of matches */
int r = DoInspectPacketUricontentPayload(de_ctx,det_ctx,s,sm->next, p, payload, payload_len);
int r = DoInspectPacketUris(de_ctx,det_ctx,s,sm->next, p, payload, payload_len);
if (r == 1) {
SCReturnInt(1);
}
@ -212,7 +212,7 @@ match:
/* this sigmatch matched, inspect the next one. If it was the last,
* the payload portion of the signature matched. */
if (sm->next != NULL) {
int r = DoInspectPacketUricontentPayload(de_ctx,det_ctx,s,sm->next, p, payload, payload_len);
int r = DoInspectPacketUris(de_ctx,det_ctx,s,sm->next, p, payload, payload_len);
SCReturnInt(r);
} else {
SCReturnInt(1);
@ -233,7 +233,7 @@ match:
* \retval 0 no match
* \retval 1 match
*/
int DetectEngineInspectPacketUricontentPayload(DetectEngineCtx *de_ctx,
int DetectEngineInspectPacketUris(DetectEngineCtx *de_ctx,
DetectEngineThreadCtx *det_ctx, Signature *s, Flow *f, uint8_t flags,
void *alstate, Packet *p)
{
@ -277,7 +277,7 @@ int DetectEngineInspectPacketUricontentPayload(DetectEngineCtx *de_ctx,
continue;
/* Inspect all the uricontents fetched on each transaction at the app layer */
r = DoInspectPacketUricontentPayload(de_ctx, det_ctx, s, s->umatch, p, (uint8_t *) bstr_ptr(tx->request_uri_normalized), bstr_len(tx->request_uri_normalized));
r = DoInspectPacketUris(de_ctx, det_ctx, s, s->umatch, p, (uint8_t *) bstr_ptr(tx->request_uri_normalized), bstr_len(tx->request_uri_normalized));
if (r == 1) {
break;

2
src/detect-engine-uricontent.h
Unescape Escape View File

@ -1,7 +1,7 @@
#ifndef __DETECT_ENGINE_URICONTENT_H__
#define __DETECT_ENGINE_URICONTENT_H__
int DetectEngineInspectPacketUricontentPayload(DetectEngineCtx *,
int DetectEngineInspectPacketUris(DetectEngineCtx *,
DetectEngineThreadCtx *, Signature *, Flow *, uint8_t,
void *, Packet *);

2
src/detect-fast-pattern.c
Unescape Escape View File

@ -58,7 +58,7 @@ static int DetectFastPatternSetup(DetectEngineCtx *de_ctx, Signature *s, char *n
return -1;
}
SigMatch *pm = DetectContentFindPrevApplicableSM(s->pmatch_tail);
SigMatch *pm = DetectContentGetLastPattern(s->pmatch_tail);
if (pm == NULL) {
SCLogError(SC_ERR_INVALID_SIGNATURE, "fast_pattern found inside "
"the rule, without a content context. Please use a "

2
src/detect-http-cookie.c
Unescape Escape View File

@ -165,7 +165,7 @@ static int DetectHttpCookieSetup (DetectEngineCtx *de_ctx, Signature *s, char *s
return -1;
}
SigMatch *pm = DetectContentFindPrevApplicableSM(s->pmatch_tail);
SigMatch *pm = DetectContentGetLastPattern(s->pmatch_tail);
if (pm == NULL) {
SCLogWarning(SC_ERR_INVALID_SIGNATURE, "fast_pattern found inside "
"the rule, without a content context. Please use a "

2
src/detect-http-method.c
Unescape Escape View File

@ -148,7 +148,7 @@ static int DetectHttpMethodSetup(DetectEngineCtx *de_ctx, Signature *s, char *st
SCReturnInt(-1);
}
SigMatch *pm = DetectContentFindPrevApplicableSM(s->pmatch_tail);
SigMatch *pm = DetectContentGetLastPattern(s->pmatch_tail);
if (pm == NULL) {
SCLogError(SC_ERR_INVALID_SIGNATURE,
"http_method modifies \"content\", but none was found");

2
src/detect-isdataat.c
Unescape Escape View File

@ -230,7 +230,7 @@ int DetectIsdataatSetup (DetectEngineCtx *de_ctx, Signature *s, char *isdataatst
SigMatch *pm = NULL;
/** Search for the first previous DetectContent
* SigMatch (it can be the same as this one) */
pm = DetectContentFindPrevApplicableSM(s->pmatch_tail);
pm = DetectContentGetLastPattern(s->pmatch_tail);
if (pm == NULL) {
SCLogError(SC_ERR_INVALID_SIGNATURE, "Unknown previous keyword!");
return -1;

6
src/detect-nocase.c
Unescape Escape View File

@ -45,9 +45,9 @@ static int DetectNocaseSetup (DetectEngineCtx *de_ctx, Signature *s, char *nulls
}
/** Search for the first previous DetectContent or uricontent
* SigMatch (it can be the same as this one) */
SigMatch *pm = SignatureGetLastModifiableSM(s);
SigMatch *pm = SigMatchGetLastPattern(s);
if (pm == NULL) {
SCLogError(SC_ERR_DEPTH_MISSING_CONTENT, "depth needs a preceeding content option");
SCLogError(SC_ERR_NOCASE_MISSING_PATTERN, "nocase needs a preceeding content option");
SCReturnInt(-1);
}
@ -73,7 +73,7 @@ static int DetectNocaseSetup (DetectEngineCtx *de_ctx, Signature *s, char *nulls
break;
default:
SCLogError(SC_ERR_DEPTH_MISSING_CONTENT, "depth needs a preceeding content (or uricontent) option");
SCLogError(SC_ERR_NOCASE_MISSING_PATTERN, "nocase needs a preceeding content (or uricontent) option");
SCReturnInt(-1);
break;
}

6
src/detect-offset.c
Unescape Escape View File

@ -39,9 +39,9 @@ int DetectOffsetSetup (DetectEngineCtx *de_ctx, Signature *s, char *offsetstr)
/** Search for the first previous DetectContent or uricontent
* SigMatch (it can be the same as this one) */
SigMatch *pm = SignatureGetLastModifiableSM(s);
SigMatch *pm = SigMatchGetLastPattern(s);
if (pm == NULL) {
SCLogError(SC_ERR_DEPTH_MISSING_CONTENT, "depth needs a preceeding content option");
SCLogError(SC_ERR_OFFSET_MISSING_CONTENT, "offset needs a preceeding content option");
if (dubbed) SCFree(str);
return -1;
}
@ -78,7 +78,7 @@ int DetectOffsetSetup (DetectEngineCtx *de_ctx, Signature *s, char *offsetstr)
break;
default:
SCLogError(SC_ERR_DEPTH_MISSING_CONTENT, "depth needs a preceeding content (or uricontent) option");
SCLogError(SC_ERR_OFFSET_MISSING_CONTENT, "offset needs a preceeding content (or uricontent) option");
if (dubbed) SCFree(str);
return -1;
break;

42
src/detect-parse.c
Unescape Escape View File

@ -285,48 +285,6 @@ SigMatch *SigMatchGetLastSM(SigMatch *sm, uint8_t type)
return NULL;
}
/**
* \brief Returns a pointer to the last SigMatch instance that apply to Modifiers
* (atm: DETECT_CONTENT and DETECT_URICONTENT)
*
* \param s Pointer to the signature (it will search at pmatch and umatch)
*
* \retval match Pointer to the last SigMatch instance.
*/
SigMatch *SignatureGetLastModifiableSM(Signature *s)
{
SigMatch *pm = s->pmatch_tail;
SigMatch *um = s->umatch_tail;
while (pm != NULL) {
if (pm->type == DETECT_CONTENT) {
break;
}
pm = pm->prev;
}
while (um != NULL) {
if (um->type == DETECT_URICONTENT) {
break;
}
um = um->prev;
}
if (um == NULL)
return pm;
if (pm == NULL)
return um;
/* Now we should have the latest content and uricontent.
* Let's see which one is more recent */
if (um->idx > pm->idx)
return um;
else
return pm;
return NULL;
}
void SigParsePrepare(void) {
char *regexstr = CONFIG_PCRE;
const char *eb;

1
src/detect-parse.h
Unescape Escape View File

@ -22,7 +22,6 @@ Signature *SigAlloc(void);
void SigFree(Signature *s);
Signature *SigInit(DetectEngineCtx *,char *sigstr);
SigMatch *SigMatchGetLastSM(SigMatch *, uint8_t);
SigMatch *SignatureGetLastModifiableSM(Signature *);
void SigParsePrepare(void);
void SigParseRegisterTests(void);

2
src/detect-rawbytes.c
Unescape Escape View File

@ -33,7 +33,7 @@ static int DetectRawbytesSetup (DetectEngineCtx *de_ctx, Signature *s, char *nul
return -1;
}
SigMatch *pm = DetectContentFindPrevApplicableSM(s->pmatch_tail);
SigMatch *pm = DetectContentGetLastPattern(s->pmatch_tail);
if (pm == NULL) {
SCLogError(SC_ERR_RAWBYTES_MISSING_CONTENT, "\"rawbytes\" needs a preceeding content option");
SCReturnInt(-1);

2
src/detect-uricontent.c
Unescape Escape View File

@ -118,7 +118,7 @@ void DetectUricontentPrint(DetectUricontentData *cd)
* \retval pointer to the SigMatch that has the previous SigMatch
* of type DetectUricontent
*/
SigMatch *DetectUricontentFindPrevApplicableSM(SigMatch *sm)
SigMatch *DetectUriGetLastPattern(SigMatch *sm)
{
if (sm == NULL)
return NULL;

2
src/detect-uricontent.h
Unescape Escape View File

@ -34,7 +34,7 @@ typedef struct DetectUricontentData_ {
void DetectUricontentRegister (void);
uint32_t DetectUricontentMaxId(DetectEngineCtx *);
uint32_t DetectUricontentInspectMpm(ThreadVars *th_v, DetectEngineThreadCtx *det_ctx, void *alstate);
SigMatch *DetectUricontentFindPrevApplicableSM(SigMatch *);
SigMatch *DetectUriGetLastPattern(SigMatch *);
void DetectUricontentPrint(DetectUricontentData *);
#endif /* __DETECT_URICONTENT_H__ */

14
src/detect-within.c
Unescape Escape View File

@ -50,7 +50,7 @@ static int DetectWithinSetup (DetectEngineCtx *de_ctx, Signature *s, char *withi
/** Search for the first previous DetectContent
* SigMatch (it can be the same as this one) */
SigMatch *pm = SignatureGetLastModifiableSM(s);
SigMatch *pm = SigMatchGetLastPattern(s);
if (pm == NULL) {
SCLogError(SC_ERR_WITHIN_MISSING_CONTENT, "depth needs two preceeding content (or uricontent) options");
if (dubbed) SCFree(str);
@ -64,7 +64,7 @@ static int DetectWithinSetup (DetectEngineCtx *de_ctx, Signature *s, char *withi
case DETECT_URICONTENT:
ud = (DetectUricontentData *)pm->ctx;
if (ud == NULL) {
printf("DetectWithinSetup: Unknown previous keyword!\n");
SCLogError(SC_ERR_WITHIN_MISSING_CONTENT, "Unknown previous keyword!\n");
goto error;
}
@ -85,7 +85,7 @@ static int DetectWithinSetup (DetectEngineCtx *de_ctx, Signature *s, char *withi
}
}
pm = DetectUricontentFindPrevApplicableSM(s->umatch_tail->prev);
pm = DetectUriGetLastPattern(s->umatch_tail->prev);
if (pm == NULL) {
SCLogError(SC_ERR_WITHIN_MISSING_CONTENT, "within needs two preceeding content options");
goto error;
@ -96,7 +96,7 @@ static int DetectWithinSetup (DetectEngineCtx *de_ctx, Signature *s, char *withi
ud = (DetectUricontentData *)pm->ctx;
ud->flags |= DETECT_URICONTENT_RELATIVE_NEXT;
} else {
printf("DetectWithinSetup: Unknown previous-previous keyword!\n");
SCLogError(SC_ERR_RULE_KEYWORD_UNKNOWN, "Unknown previous-previous keyword!\n");
goto error;
}
DetectUricontentPrint(ud);
@ -106,7 +106,7 @@ static int DetectWithinSetup (DetectEngineCtx *de_ctx, Signature *s, char *withi
case DETECT_CONTENT:
cd = (DetectContentData *)pm->ctx;
if (cd == NULL) {
printf("DetectWithinSetup: Unknown previous keyword!\n");
SCLogError(SC_ERR_RULE_KEYWORD_UNKNOWN, "Unknown previous keyword!\n");
goto error;
}
@ -127,7 +127,7 @@ static int DetectWithinSetup (DetectEngineCtx *de_ctx, Signature *s, char *withi
}
}
pm = DetectContentFindPrevApplicableSM(s->pmatch_tail->prev);
pm = DetectContentGetLastPattern(s->pmatch_tail->prev);
if (pm == NULL) {
SCLogError(SC_ERR_WITHIN_MISSING_CONTENT, "within needs two preceeding content options");
goto error;
@ -138,7 +138,7 @@ static int DetectWithinSetup (DetectEngineCtx *de_ctx, Signature *s, char *withi
cd = (DetectContentData *)pm->ctx;
cd->flags |= DETECT_CONTENT_RELATIVE_NEXT;
} else {
printf("DetectWithinSetup: Unknown previous-previous keyword!\n");
SCLogError(SC_ERR_RULE_KEYWORD_UNKNOWN, "Unknown previous-previous keyword!\n");
goto error;
}
break;

2
src/detect.c
Unescape Escape View File

@ -664,7 +664,7 @@ int SigMatchSignatures(ThreadVars *th_v, DetectEngineCtx *de_ctx, DetectEngineTh
/* Check the uricontent keywords here. */
if (s->umatch != NULL) {
if (DetectEngineInspectPacketUricontentPayload(de_ctx, det_ctx, s, p->flow, flags, alstate, p) != 1)
if (DetectEngineInspectPacketUris(de_ctx, det_ctx, s, p->flow, flags, alstate, p) != 1)
continue;
}

Write Preview
Loading…
Cancel
Save