From ddec92676d27ed68c9e767a178e7bd4685a083bf Mon Sep 17 00:00:00 2001 From: Ken Steele Date: Thu, 6 Feb 2014 10:12:24 -0500 Subject: [PATCH] Add a comment for DetectReplaceList Reworded a quote in PR 742 by Regit from Inliniac to explain why adding the head of the list (really a FIFO) is the correct behavior. --- src/detect-replace.c | 10 +++++++++- 1 file changed, 9 insertions(+), 1 deletion(-) diff --git a/src/detect-replace.c b/src/detect-replace.c index 0d1b272576..8e39004c63 100644 --- a/src/detect-replace.c +++ b/src/detect-replace.c @@ -1,4 +1,4 @@ -/* Copyright (C) 2011-2013 Open Information Security Foundation +/* Copyright (C) 2011-2014 Open Information Security Foundation * * You can copy, redistribute or modify this Program under the terms of * the GNU General Public License version 2 as published by the Free @@ -151,6 +151,14 @@ error: return -1; } +/* Add to the head of the replace-list. + * + * The first to add to the replace-list has the highest priority. So, + * adding the the head of the list results in the newest modifications + * of content being applied first, so later changes can over ride + * earlier changes. Thus the highest priority modifications should be + * applied last. + */ DetectReplaceList * DetectReplaceAddToList(DetectReplaceList *replist, uint8_t *found, DetectContentData *cd) { DetectReplaceList *newlist;