From c7350a8ac60ec868c9c4e801e890d8e4bdee096e Mon Sep 17 00:00:00 2001 From: Pablo Rincon Date: Wed, 7 Apr 2010 19:45:20 +0200 Subject: [PATCH] Fixing some naming convention issues and incorrect error messages --- src/detect-bytejump.c | 2 +- src/detect-bytetest.c | 2 +- src/detect-content.c | 4 ++-- src/detect-content.h | 2 +- src/detect-depth.c | 2 +- src/detect-distance.c | 14 ++++++------ src/detect-engine-uricontent.c | 10 ++++---- src/detect-engine-uricontent.h | 2 +- src/detect-fast-pattern.c | 2 +- src/detect-http-cookie.c | 2 +- src/detect-http-method.c | 2 +- src/detect-isdataat.c | 2 +- src/detect-nocase.c | 6 ++--- src/detect-offset.c | 6 ++--- src/detect-parse.c | 42 ---------------------------------- src/detect-parse.h | 1 - src/detect-rawbytes.c | 2 +- src/detect-uricontent.c | 2 +- src/detect-uricontent.h | 2 +- src/detect-within.c | 14 ++++++------ src/detect.c | 2 +- 21 files changed, 40 insertions(+), 83 deletions(-) diff --git a/src/detect-bytejump.c b/src/detect-bytejump.c index 23b72435a4..efa5a3915a 100644 --- a/src/detect-bytejump.c +++ b/src/detect-bytejump.c @@ -493,7 +493,7 @@ int DetectBytejumpSetup(DetectEngineCtx *de_ctx, Signature *s, char *optstr) if (data->flags & DETECT_BYTEJUMP_RELATIVE) { /** Search for the first previous DetectContent * SigMatch (it can be the same as this one) */ - SigMatch *pm = DetectContentFindPrevApplicableSM(s->pmatch_tail); + SigMatch *pm = DetectContentGetLastPattern(s->pmatch_tail); if (pm == NULL) { SCLogError(SC_ERR_BYTEJUMP_MISSING_CONTENT, "relative bytejump match needs a previous content option"); goto error; diff --git a/src/detect-bytetest.c b/src/detect-bytetest.c index 3a90ea5183..1e0a369bf0 100644 --- a/src/detect-bytetest.c +++ b/src/detect-bytetest.c @@ -508,7 +508,7 @@ int DetectBytetestSetup(DetectEngineCtx *de_ctx, Signature *s, char *optstr) if (data->flags & DETECT_BYTETEST_RELATIVE) { /** Search for the first previous DetectContent * SigMatch (it can be the same as this one) */ - SigMatch *pm = DetectContentFindPrevApplicableSM(s->pmatch_tail); + SigMatch *pm = DetectContentGetLastPattern(s->pmatch_tail); if (pm == NULL) { SCLogError(SC_ERR_BYTETEST_MISSING_CONTENT, "relative bytetest match needs a previous content option"); goto error; diff --git a/src/detect-content.c b/src/detect-content.c index 583e66244f..31e1e8a637 100644 --- a/src/detect-content.c +++ b/src/detect-content.c @@ -309,7 +309,7 @@ SigMatch *DetectContentHasPrevSMPattern(SigMatch *sm) * \retval pointer to the SigMatch that has the previous SigMatch * of type DetectContent */ -SigMatch *DetectContentFindPrevApplicableSM(SigMatch *sm) +SigMatch *DetectContentGetLastPattern(SigMatch *sm) { if (sm == NULL) return NULL; @@ -338,7 +338,7 @@ SigMatch *SigMatchGetLastPattern(Signature *s) { BUG_ON(s == NULL); - SigMatch *co_sm = DetectContentFindPrevApplicableSM(s->pmatch_tail); + SigMatch *co_sm = DetectContentGetLastPattern(s->pmatch_tail); SigMatch *ur_sm = SigMatchGetLastSM(s->umatch_tail, DETECT_URICONTENT); SigMatch *sm = NULL; diff --git a/src/detect-content.h b/src/detect-content.h index 19169c3f38..6e7e475f3c 100644 --- a/src/detect-content.h +++ b/src/detect-content.h @@ -46,7 +46,7 @@ void DetectContentPrint(DetectContentData *); /** This function search backwards the first applicable SigMatch holding * a DETECT_CONTENT context (If it belongs to a chunk group, the first chunk * of the group will be returned). Modifiers must call this */ -SigMatch *DetectContentFindPrevApplicableSM(SigMatch *); +SigMatch *DetectContentGetLastPattern(SigMatch *); /** This function search forwards the first applicable SigMatch holding * a DETECT_CONTENT context. The Match process call this */ diff --git a/src/detect-depth.c b/src/detect-depth.c index 965416053b..b74ddabd9f 100644 --- a/src/detect-depth.c +++ b/src/detect-depth.c @@ -39,7 +39,7 @@ static int DetectDepthSetup (DetectEngineCtx *de_ctx, Signature *s, char *depths /** Search for the first previous DetectContent or uricontent * SigMatch (it can be the same as this one) */ - SigMatch *pm = SignatureGetLastModifiableSM(s); + SigMatch *pm = SigMatchGetLastPattern(s); if (pm == NULL) { SCLogError(SC_ERR_DEPTH_MISSING_CONTENT, "depth needs a preceeding content option"); if (dubbed) SCFree(str); diff --git a/src/detect-distance.c b/src/detect-distance.c index 7ece0e825a..dc3b462b79 100644 --- a/src/detect-distance.c +++ b/src/detect-distance.c @@ -39,9 +39,9 @@ static int DetectDistanceSetup (DetectEngineCtx *de_ctx, Signature *s, char *dis /** Search for the first previous DetectContent * SigMatch (it can be the same as this one) */ - SigMatch *pm = SignatureGetLastModifiableSM(s); + SigMatch *pm = SigMatchGetLastPattern(s); if (pm == NULL) { - SCLogError(SC_ERR_WITHIN_MISSING_CONTENT, "depth needs two preceeding content (or uricontent) options"); + SCLogError(SC_ERR_DISTANCE_MISSING_CONTENT, "depth needs two preceeding content (or uricontent) options"); if (dubbed) SCFree(str); return -1; } @@ -53,7 +53,7 @@ static int DetectDistanceSetup (DetectEngineCtx *de_ctx, Signature *s, char *dis case DETECT_URICONTENT: ud = (DetectUricontentData *)pm->ctx; if (ud == NULL) { - printf("DetectWithinSetup: Unknown previous keyword!\n"); + SCLogError(SC_ERR_DISTANCE_MISSING_CONTENT, "Unknown previous keyword!\n"); goto error; } @@ -65,7 +65,7 @@ static int DetectDistanceSetup (DetectEngineCtx *de_ctx, Signature *s, char *dis } } - pm = DetectUricontentFindPrevApplicableSM(s->umatch_tail->prev); + pm = DetectUriGetLastPattern(s->umatch_tail->prev); if (pm == NULL) { SCLogError(SC_ERR_DISTANCE_MISSING_CONTENT, "distance needs two preceeding content options"); goto error; @@ -83,7 +83,7 @@ static int DetectDistanceSetup (DetectEngineCtx *de_ctx, Signature *s, char *dis case DETECT_CONTENT: cd = (DetectContentData *)pm->ctx; if (cd == NULL) { - printf("DetectWithinSetup: Unknown previous keyword!\n"); + SCLogError(SC_ERR_DISTANCE_MISSING_CONTENT, "Unknown previous keyword!\n"); goto error; } @@ -95,7 +95,7 @@ static int DetectDistanceSetup (DetectEngineCtx *de_ctx, Signature *s, char *dis } } - pm = DetectContentFindPrevApplicableSM(s->pmatch_tail->prev); + pm = DetectContentGetLastPattern(s->pmatch_tail->prev); if (pm == NULL) { SCLogError(SC_ERR_DISTANCE_MISSING_CONTENT, "distance needs two preceeding content options"); goto error; @@ -111,7 +111,7 @@ static int DetectDistanceSetup (DetectEngineCtx *de_ctx, Signature *s, char *dis break; default: - SCLogError(SC_ERR_WITHIN_MISSING_CONTENT, "within needs two preceeding content (or uricontent) options"); + SCLogError(SC_ERR_DISTANCE_MISSING_CONTENT, "distance needs two preceeding content (or uricontent) options"); if (dubbed) SCFree(str); return -1; break; diff --git a/src/detect-engine-uricontent.c b/src/detect-engine-uricontent.c index c651a48175..74949ab069 100644 --- a/src/detect-engine-uricontent.c +++ b/src/detect-engine-uricontent.c @@ -50,7 +50,7 @@ * \retval 0 no match * \retval 1 match */ -static inline int DoInspectPacketUricontentPayload(DetectEngineCtx *de_ctx, +static inline int DoInspectPacketUris(DetectEngineCtx *de_ctx, DetectEngineThreadCtx *det_ctx, Signature *s, SigMatch *sm, Packet *p, uint8_t *payload, uint32_t payload_len) { @@ -191,7 +191,7 @@ static inline int DoInspectPacketUricontentPayload(DetectEngineCtx *de_ctx, /* see if the next payload keywords match. If not, we will * search for another occurence of this uricontent and see * if the others match then until we run out of matches */ - int r = DoInspectPacketUricontentPayload(de_ctx,det_ctx,s,sm->next, p, payload, payload_len); + int r = DoInspectPacketUris(de_ctx,det_ctx,s,sm->next, p, payload, payload_len); if (r == 1) { SCReturnInt(1); } @@ -212,7 +212,7 @@ match: /* this sigmatch matched, inspect the next one. If it was the last, * the payload portion of the signature matched. */ if (sm->next != NULL) { - int r = DoInspectPacketUricontentPayload(de_ctx,det_ctx,s,sm->next, p, payload, payload_len); + int r = DoInspectPacketUris(de_ctx,det_ctx,s,sm->next, p, payload, payload_len); SCReturnInt(r); } else { SCReturnInt(1); @@ -233,7 +233,7 @@ match: * \retval 0 no match * \retval 1 match */ -int DetectEngineInspectPacketUricontentPayload(DetectEngineCtx *de_ctx, +int DetectEngineInspectPacketUris(DetectEngineCtx *de_ctx, DetectEngineThreadCtx *det_ctx, Signature *s, Flow *f, uint8_t flags, void *alstate, Packet *p) { @@ -277,7 +277,7 @@ int DetectEngineInspectPacketUricontentPayload(DetectEngineCtx *de_ctx, continue; /* Inspect all the uricontents fetched on each transaction at the app layer */ - r = DoInspectPacketUricontentPayload(de_ctx, det_ctx, s, s->umatch, p, (uint8_t *) bstr_ptr(tx->request_uri_normalized), bstr_len(tx->request_uri_normalized)); + r = DoInspectPacketUris(de_ctx, det_ctx, s, s->umatch, p, (uint8_t *) bstr_ptr(tx->request_uri_normalized), bstr_len(tx->request_uri_normalized)); if (r == 1) { break; diff --git a/src/detect-engine-uricontent.h b/src/detect-engine-uricontent.h index 7c49ccb688..64c0f35fc7 100644 --- a/src/detect-engine-uricontent.h +++ b/src/detect-engine-uricontent.h @@ -1,7 +1,7 @@ #ifndef __DETECT_ENGINE_URICONTENT_H__ #define __DETECT_ENGINE_URICONTENT_H__ -int DetectEngineInspectPacketUricontentPayload(DetectEngineCtx *, +int DetectEngineInspectPacketUris(DetectEngineCtx *, DetectEngineThreadCtx *, Signature *, Flow *, uint8_t, void *, Packet *); diff --git a/src/detect-fast-pattern.c b/src/detect-fast-pattern.c index cffabd80cf..d690013bc5 100644 --- a/src/detect-fast-pattern.c +++ b/src/detect-fast-pattern.c @@ -58,7 +58,7 @@ static int DetectFastPatternSetup(DetectEngineCtx *de_ctx, Signature *s, char *n return -1; } - SigMatch *pm = DetectContentFindPrevApplicableSM(s->pmatch_tail); + SigMatch *pm = DetectContentGetLastPattern(s->pmatch_tail); if (pm == NULL) { SCLogError(SC_ERR_INVALID_SIGNATURE, "fast_pattern found inside " "the rule, without a content context. Please use a " diff --git a/src/detect-http-cookie.c b/src/detect-http-cookie.c index e1fed868c0..dd18ff6e1e 100644 --- a/src/detect-http-cookie.c +++ b/src/detect-http-cookie.c @@ -165,7 +165,7 @@ static int DetectHttpCookieSetup (DetectEngineCtx *de_ctx, Signature *s, char *s return -1; } - SigMatch *pm = DetectContentFindPrevApplicableSM(s->pmatch_tail); + SigMatch *pm = DetectContentGetLastPattern(s->pmatch_tail); if (pm == NULL) { SCLogWarning(SC_ERR_INVALID_SIGNATURE, "fast_pattern found inside " "the rule, without a content context. Please use a " diff --git a/src/detect-http-method.c b/src/detect-http-method.c index fa01610b8b..c105335281 100644 --- a/src/detect-http-method.c +++ b/src/detect-http-method.c @@ -148,7 +148,7 @@ static int DetectHttpMethodSetup(DetectEngineCtx *de_ctx, Signature *s, char *st SCReturnInt(-1); } - SigMatch *pm = DetectContentFindPrevApplicableSM(s->pmatch_tail); + SigMatch *pm = DetectContentGetLastPattern(s->pmatch_tail); if (pm == NULL) { SCLogError(SC_ERR_INVALID_SIGNATURE, "http_method modifies \"content\", but none was found"); diff --git a/src/detect-isdataat.c b/src/detect-isdataat.c index a778259495..59a6d87b59 100644 --- a/src/detect-isdataat.c +++ b/src/detect-isdataat.c @@ -230,7 +230,7 @@ int DetectIsdataatSetup (DetectEngineCtx *de_ctx, Signature *s, char *isdataatst SigMatch *pm = NULL; /** Search for the first previous DetectContent * SigMatch (it can be the same as this one) */ - pm = DetectContentFindPrevApplicableSM(s->pmatch_tail); + pm = DetectContentGetLastPattern(s->pmatch_tail); if (pm == NULL) { SCLogError(SC_ERR_INVALID_SIGNATURE, "Unknown previous keyword!"); return -1; diff --git a/src/detect-nocase.c b/src/detect-nocase.c index ea436888ee..d3d80f40e9 100644 --- a/src/detect-nocase.c +++ b/src/detect-nocase.c @@ -45,9 +45,9 @@ static int DetectNocaseSetup (DetectEngineCtx *de_ctx, Signature *s, char *nulls } /** Search for the first previous DetectContent or uricontent * SigMatch (it can be the same as this one) */ - SigMatch *pm = SignatureGetLastModifiableSM(s); + SigMatch *pm = SigMatchGetLastPattern(s); if (pm == NULL) { - SCLogError(SC_ERR_DEPTH_MISSING_CONTENT, "depth needs a preceeding content option"); + SCLogError(SC_ERR_NOCASE_MISSING_PATTERN, "nocase needs a preceeding content option"); SCReturnInt(-1); } @@ -73,7 +73,7 @@ static int DetectNocaseSetup (DetectEngineCtx *de_ctx, Signature *s, char *nulls break; default: - SCLogError(SC_ERR_DEPTH_MISSING_CONTENT, "depth needs a preceeding content (or uricontent) option"); + SCLogError(SC_ERR_NOCASE_MISSING_PATTERN, "nocase needs a preceeding content (or uricontent) option"); SCReturnInt(-1); break; } diff --git a/src/detect-offset.c b/src/detect-offset.c index c52104bc8f..ded7800c79 100644 --- a/src/detect-offset.c +++ b/src/detect-offset.c @@ -39,9 +39,9 @@ int DetectOffsetSetup (DetectEngineCtx *de_ctx, Signature *s, char *offsetstr) /** Search for the first previous DetectContent or uricontent * SigMatch (it can be the same as this one) */ - SigMatch *pm = SignatureGetLastModifiableSM(s); + SigMatch *pm = SigMatchGetLastPattern(s); if (pm == NULL) { - SCLogError(SC_ERR_DEPTH_MISSING_CONTENT, "depth needs a preceeding content option"); + SCLogError(SC_ERR_OFFSET_MISSING_CONTENT, "offset needs a preceeding content option"); if (dubbed) SCFree(str); return -1; } @@ -78,7 +78,7 @@ int DetectOffsetSetup (DetectEngineCtx *de_ctx, Signature *s, char *offsetstr) break; default: - SCLogError(SC_ERR_DEPTH_MISSING_CONTENT, "depth needs a preceeding content (or uricontent) option"); + SCLogError(SC_ERR_OFFSET_MISSING_CONTENT, "offset needs a preceeding content (or uricontent) option"); if (dubbed) SCFree(str); return -1; break; diff --git a/src/detect-parse.c b/src/detect-parse.c index 467ca2a563..96c147c941 100644 --- a/src/detect-parse.c +++ b/src/detect-parse.c @@ -285,48 +285,6 @@ SigMatch *SigMatchGetLastSM(SigMatch *sm, uint8_t type) return NULL; } -/** - * \brief Returns a pointer to the last SigMatch instance that apply to Modifiers - * (atm: DETECT_CONTENT and DETECT_URICONTENT) - * - * \param s Pointer to the signature (it will search at pmatch and umatch) - * - * \retval match Pointer to the last SigMatch instance. - */ -SigMatch *SignatureGetLastModifiableSM(Signature *s) -{ - SigMatch *pm = s->pmatch_tail; - SigMatch *um = s->umatch_tail; - while (pm != NULL) { - if (pm->type == DETECT_CONTENT) { - break; - } - pm = pm->prev; - } - - while (um != NULL) { - if (um->type == DETECT_URICONTENT) { - break; - } - um = um->prev; - } - - if (um == NULL) - return pm; - - if (pm == NULL) - return um; - - /* Now we should have the latest content and uricontent. - * Let's see which one is more recent */ - if (um->idx > pm->idx) - return um; - else - return pm; - - return NULL; -} - void SigParsePrepare(void) { char *regexstr = CONFIG_PCRE; const char *eb; diff --git a/src/detect-parse.h b/src/detect-parse.h index d0f75a64a7..12cd5b4f22 100644 --- a/src/detect-parse.h +++ b/src/detect-parse.h @@ -22,7 +22,6 @@ Signature *SigAlloc(void); void SigFree(Signature *s); Signature *SigInit(DetectEngineCtx *,char *sigstr); SigMatch *SigMatchGetLastSM(SigMatch *, uint8_t); -SigMatch *SignatureGetLastModifiableSM(Signature *); void SigParsePrepare(void); void SigParseRegisterTests(void); diff --git a/src/detect-rawbytes.c b/src/detect-rawbytes.c index 56569d2b08..4aa090e20e 100644 --- a/src/detect-rawbytes.c +++ b/src/detect-rawbytes.c @@ -33,7 +33,7 @@ static int DetectRawbytesSetup (DetectEngineCtx *de_ctx, Signature *s, char *nul return -1; } - SigMatch *pm = DetectContentFindPrevApplicableSM(s->pmatch_tail); + SigMatch *pm = DetectContentGetLastPattern(s->pmatch_tail); if (pm == NULL) { SCLogError(SC_ERR_RAWBYTES_MISSING_CONTENT, "\"rawbytes\" needs a preceeding content option"); SCReturnInt(-1); diff --git a/src/detect-uricontent.c b/src/detect-uricontent.c index c9791eee69..1c2628e635 100644 --- a/src/detect-uricontent.c +++ b/src/detect-uricontent.c @@ -118,7 +118,7 @@ void DetectUricontentPrint(DetectUricontentData *cd) * \retval pointer to the SigMatch that has the previous SigMatch * of type DetectUricontent */ -SigMatch *DetectUricontentFindPrevApplicableSM(SigMatch *sm) +SigMatch *DetectUriGetLastPattern(SigMatch *sm) { if (sm == NULL) return NULL; diff --git a/src/detect-uricontent.h b/src/detect-uricontent.h index f64edd7dbf..608335f76a 100644 --- a/src/detect-uricontent.h +++ b/src/detect-uricontent.h @@ -34,7 +34,7 @@ typedef struct DetectUricontentData_ { void DetectUricontentRegister (void); uint32_t DetectUricontentMaxId(DetectEngineCtx *); uint32_t DetectUricontentInspectMpm(ThreadVars *th_v, DetectEngineThreadCtx *det_ctx, void *alstate); -SigMatch *DetectUricontentFindPrevApplicableSM(SigMatch *); +SigMatch *DetectUriGetLastPattern(SigMatch *); void DetectUricontentPrint(DetectUricontentData *); #endif /* __DETECT_URICONTENT_H__ */ diff --git a/src/detect-within.c b/src/detect-within.c index 3c10279993..020363cc91 100644 --- a/src/detect-within.c +++ b/src/detect-within.c @@ -50,7 +50,7 @@ static int DetectWithinSetup (DetectEngineCtx *de_ctx, Signature *s, char *withi /** Search for the first previous DetectContent * SigMatch (it can be the same as this one) */ - SigMatch *pm = SignatureGetLastModifiableSM(s); + SigMatch *pm = SigMatchGetLastPattern(s); if (pm == NULL) { SCLogError(SC_ERR_WITHIN_MISSING_CONTENT, "depth needs two preceeding content (or uricontent) options"); if (dubbed) SCFree(str); @@ -64,7 +64,7 @@ static int DetectWithinSetup (DetectEngineCtx *de_ctx, Signature *s, char *withi case DETECT_URICONTENT: ud = (DetectUricontentData *)pm->ctx; if (ud == NULL) { - printf("DetectWithinSetup: Unknown previous keyword!\n"); + SCLogError(SC_ERR_WITHIN_MISSING_CONTENT, "Unknown previous keyword!\n"); goto error; } @@ -85,7 +85,7 @@ static int DetectWithinSetup (DetectEngineCtx *de_ctx, Signature *s, char *withi } } - pm = DetectUricontentFindPrevApplicableSM(s->umatch_tail->prev); + pm = DetectUriGetLastPattern(s->umatch_tail->prev); if (pm == NULL) { SCLogError(SC_ERR_WITHIN_MISSING_CONTENT, "within needs two preceeding content options"); goto error; @@ -96,7 +96,7 @@ static int DetectWithinSetup (DetectEngineCtx *de_ctx, Signature *s, char *withi ud = (DetectUricontentData *)pm->ctx; ud->flags |= DETECT_URICONTENT_RELATIVE_NEXT; } else { - printf("DetectWithinSetup: Unknown previous-previous keyword!\n"); + SCLogError(SC_ERR_RULE_KEYWORD_UNKNOWN, "Unknown previous-previous keyword!\n"); goto error; } DetectUricontentPrint(ud); @@ -106,7 +106,7 @@ static int DetectWithinSetup (DetectEngineCtx *de_ctx, Signature *s, char *withi case DETECT_CONTENT: cd = (DetectContentData *)pm->ctx; if (cd == NULL) { - printf("DetectWithinSetup: Unknown previous keyword!\n"); + SCLogError(SC_ERR_RULE_KEYWORD_UNKNOWN, "Unknown previous keyword!\n"); goto error; } @@ -127,7 +127,7 @@ static int DetectWithinSetup (DetectEngineCtx *de_ctx, Signature *s, char *withi } } - pm = DetectContentFindPrevApplicableSM(s->pmatch_tail->prev); + pm = DetectContentGetLastPattern(s->pmatch_tail->prev); if (pm == NULL) { SCLogError(SC_ERR_WITHIN_MISSING_CONTENT, "within needs two preceeding content options"); goto error; @@ -138,7 +138,7 @@ static int DetectWithinSetup (DetectEngineCtx *de_ctx, Signature *s, char *withi cd = (DetectContentData *)pm->ctx; cd->flags |= DETECT_CONTENT_RELATIVE_NEXT; } else { - printf("DetectWithinSetup: Unknown previous-previous keyword!\n"); + SCLogError(SC_ERR_RULE_KEYWORD_UNKNOWN, "Unknown previous-previous keyword!\n"); goto error; } break; diff --git a/src/detect.c b/src/detect.c index 739e67a01b..6da81f221f 100644 --- a/src/detect.c +++ b/src/detect.c @@ -664,7 +664,7 @@ int SigMatchSignatures(ThreadVars *th_v, DetectEngineCtx *de_ctx, DetectEngineTh /* Check the uricontent keywords here. */ if (s->umatch != NULL) { - if (DetectEngineInspectPacketUricontentPayload(de_ctx, det_ctx, s, p->flow, flags, alstate, p) != 1) + if (DetectEngineInspectPacketUris(de_ctx, det_ctx, s, p->flow, flags, alstate, p) != 1) continue; }