diff --git a/src/detect-http-cookie.c b/src/detect-http-cookie.c index 8603ebbceb..8d3034be61 100644 --- a/src/detect-http-cookie.c +++ b/src/detect-http-cookie.c @@ -202,15 +202,11 @@ int DetectHttpCookieSetup (DetectEngineCtx *de_ctx, Signature *s, SigMatch *m, } memcpy(hd->data, ((DetectContentData *)m->ctx)->content, hd->data_len); - sm = SigMatchAlloc(); - if (sm == NULL) - goto error; - - sm->type = DETECT_AL_HTTP_COOKIE; - sm->ctx = (void *)hd; - /* Okay we need to replace the type to HTTP_COOKIE from CONTENT */ - SigMatchReplace(s, m, sm); + free(((DetectContentData *)m->ctx)->content); + free(m->ctx); + m->type = DETECT_AL_HTTP_COOKIE; + m->ctx = (void *)hd; /* Flagged the signature as to scan the app layer data */ s->flags |=SIG_FLAG_APPLAYER; @@ -370,6 +366,46 @@ int DetectHttpCookieTest05(void) return result; } +/** + * \test Checks if a http_cookie is registered in a Signature, when rawbytes is + * also specified in the signature + */ +int DetectHttpCookieTest06(void) +{ + DetectEngineCtx *de_ctx = NULL; + int result = 0; + + if ( (de_ctx = DetectEngineCtxInit()) == NULL) + goto end; + + de_ctx->flags |= DE_QUIET; + de_ctx->sig_list = SigInit(de_ctx, "alert tcp any any -> any any " + "(msg:\"Testing http_cookie\"; content:\"one\"; " + "http_cookie; uricontent:\"abc\"; sid:1;)"); + if (de_ctx->sig_list == NULL) + goto end; + + Signature *s = de_ctx->sig_list; + + if (s->match->type != DETECT_AL_HTTP_COOKIE) + goto end; + + if (s->match->next == NULL) { + printf("expected another SigMatch, got NULL: "); + goto end; + } + + if (s->match->next->type != DETECT_URICONTENT) { + goto end; + } + + result = 1; + end: + if (de_ctx != NULL) SigCleanSignatures(de_ctx); + if (de_ctx != NULL) DetectEngineCtxFree(de_ctx); + return result; +} + /** \test Check the signature working to alert when http_cookie is matched . */ static int DetectHttpCookieSigTest01(void) { int result = 0; @@ -555,6 +591,7 @@ void DetectHttpCookieRegisterTests (void) UtRegisterTest("DetectHttpCookieTest03", DetectHttpCookieTest03, 1); UtRegisterTest("DetectHttpCookieTest04", DetectHttpCookieTest04, 1); UtRegisterTest("DetectHttpCookieTest05", DetectHttpCookieTest05, 1); + UtRegisterTest("DetectHttpCookieTest06", DetectHttpCookieTest06, 1); UtRegisterTest("DetectHttpCookieSigTest01", DetectHttpCookieSigTest01, 1); UtRegisterTest("DetectHttpCookieSigTest02", DetectHttpCookieSigTest02, 1); #endif /* UNITTESTS */ diff --git a/src/detect-http-method.c b/src/detect-http-method.c index 97011b2f7f..c2bb356238 100755 --- a/src/detect-http-method.c +++ b/src/detect-http-method.c @@ -193,17 +193,11 @@ int DetectHttpMethodSetup(DetectEngineCtx *de_ctx, Signature *s, method = bstr_memdup((char *)data->content, data->content_len); data->method = htp_convert_method_to_number(method); - sm = SigMatchAlloc(); - if (sm == NULL) { - // XXX: Should we bother with an error - it may fail too? - goto error; - } - - sm->type = DETECT_AL_HTTP_METHOD; - sm->ctx = (void *)data; - - /* Replace the CONTENT sigmatch with HTTP_METHOD */ - SigMatchReplace(s, m, sm); + /* Okay we need to replace the type to HTTP_METHOD from CONTENT */ + free(((DetectContentData *)m->ctx)->content); + free(m->ctx); + m->type = DETECT_AL_HTTP_METHOD; + m->ctx = (void *)data; /* Flagged the signature as to scan the app layer data */ s->flags |=SIG_FLAG_APPLAYER; diff --git a/src/detect-uricontent.c b/src/detect-uricontent.c index a2f0082e6b..41b4d66e14 100644 --- a/src/detect-uricontent.c +++ b/src/detect-uricontent.c @@ -418,6 +418,8 @@ error: int DetectUricontentSetup (DetectEngineCtx *de_ctx, Signature *s, SigMatch *m, char *contentstr) { + SCEnter(); + SigMatch *sm = NULL; DetectUricontentData *cd = DoDetectUricontentSetup(contentstr); if (cd == NULL) @@ -440,11 +442,11 @@ int DetectUricontentSetup (DetectEngineCtx *de_ctx, Signature *s, SigMatch *m, /* Flagged the signature as to scan the app layer data */ s->flags |=SIG_FLAG_APPLAYER; - return 0; + SCReturnInt(0); error: if (cd) free(cd); - return -1; + SCReturnInt(-1); } /** diff --git a/src/detect.h b/src/detect.h index 1856149fbe..cd9279f1a0 100644 --- a/src/detect.h +++ b/src/detect.h @@ -488,10 +488,10 @@ enum { DETECT_REFERENCE, DETECT_TAG, DETECT_MSG, - DETECT_CONTENT, /* 8 */ - DETECT_URICONTENT, /* 9 */ - DETECT_PCRE, /* 10 */ - DETECT_PCRE_HTTPBODY, /* 11 */ + DETECT_CONTENT, + DETECT_URICONTENT, + DETECT_PCRE, + DETECT_PCRE_HTTPBODY, DETECT_ACK, DETECT_SEQ, DETECT_DEPTH,