|
|
|
|
@ -198,32 +198,6 @@ void SigMatchAppendThreshold(Signature *s, SigMatch *new) {
|
|
|
|
|
SigMatchAppendSMToList(s, new, DETECT_SM_LIST_THRESHOLD);
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
/** \brief Append a sig match to the signatures post-match list
|
|
|
|
|
*
|
|
|
|
|
* \param s signature
|
|
|
|
|
* \param new sigmatch to append
|
|
|
|
|
*/
|
|
|
|
|
void SigMatchAppendPostMatch(Signature *s, SigMatch *new) {
|
|
|
|
|
if (s->sm_lists[DETECT_SM_LIST_POSTMATCH] == NULL) {
|
|
|
|
|
s->sm_lists[DETECT_SM_LIST_POSTMATCH] = new;
|
|
|
|
|
s->sm_lists_tail[DETECT_SM_LIST_POSTMATCH] = new;
|
|
|
|
|
new->next = NULL;
|
|
|
|
|
new->prev = NULL;
|
|
|
|
|
} else {
|
|
|
|
|
SigMatch *cur = s->sm_lists[DETECT_SM_LIST_POSTMATCH];
|
|
|
|
|
|
|
|
|
|
for ( ; cur->next != NULL; cur = cur->next);
|
|
|
|
|
|
|
|
|
|
cur->next = new;
|
|
|
|
|
new->next = NULL;
|
|
|
|
|
new->prev = cur;
|
|
|
|
|
s->sm_lists_tail[DETECT_SM_LIST_POSTMATCH] = new;
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
new->idx = s->sm_cnt;
|
|
|
|
|
s->sm_cnt++;
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
/** \brief Pull a content 'old' from the pmatch list, append 'new' to amatch list.
|
|
|
|
|
* Used for replacing contents that have http_cookie, etc modifiers.
|
|
|
|
|
*/
|
|
|
|
|
|