aiden
/
suricata
mirror of https://github.com/OISF/suricata
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

replace all Signature->umatch instances in the engine with Signature->sm_lists[DETECT_SM_LIST_UMATCH]

Browse Source
remotes/origin/master-1.1.x
Anoop Saldanha 15 years ago committed by Victor Julien
parent e54358a9e1
commit e0476242c6
17 changed files with 136 additions and 136 deletions
Show Stats Download Patch File Download Diff File

2
src/detect-content.c
Unescape Escape View File

@ -379,7 +379,7 @@ SigMatch *SigMatchGetLastPattern(Signature *s) {
BUG_ON(s == NULL);
SigMatch *co_sm = DetectContentGetLastPattern(s->sm_lists_tail[DETECT_SM_LIST_PMATCH]);
SigMatch *ur_sm = SigMatchGetLastSM(s->umatch_tail, DETECT_URICONTENT);
SigMatch *ur_sm = SigMatchGetLastSM(s->sm_lists_tail[DETECT_SM_LIST_UMATCH], DETECT_URICONTENT);
SigMatch *sm = NULL;
if (co_sm != NULL && ur_sm != NULL) {

2
src/detect-depth.c
Unescape Escape View File

@ -85,7 +85,7 @@ static int DetectDepthSetup (DetectEngineCtx *de_ctx, Signature *s, char *depths
default:
pm = SigMatchGetLastSMFromLists(s, 4,
DETECT_CONTENT, s->sm_lists_tail[DETECT_SM_LIST_PMATCH],
DETECT_URICONTENT, s->umatch_tail);
DETECT_URICONTENT, s->sm_lists_tail[DETECT_SM_LIST_UMATCH]);
if (pm == NULL) {
SCLogError(SC_ERR_DEPTH_MISSING_CONTENT, "depth needs "
"preceeding content or uricontent option");

2
src/detect-distance.c
Unescape Escape View File

@ -165,7 +165,7 @@ static int DetectDistanceSetup (DetectEngineCtx *de_ctx, Signature *s,
} else {
pm = SigMatchGetLastSMFromLists(s, 4,
DETECT_CONTENT, s->sm_lists_tail[DETECT_SM_LIST_PMATCH],
DETECT_URICONTENT, s->umatch_tail);
DETECT_URICONTENT, s->sm_lists_tail[DETECT_SM_LIST_UMATCH]);
if (pm == NULL) {
SCLogError(SC_ERR_WITHIN_MISSING_CONTENT, "within needs"
"preceeding content or uricontent option");

12
src/detect-engine-mpm.c
Unescape Escape View File

@ -1097,7 +1097,7 @@ static int PatternMatchPreprarePopulateMpmUri(DetectEngineCtx *de_ctx, SigGroupH
/* get the total no of patterns in this Signature, as well as find out
* if we have a fast_pattern set in this Signature */
for (sm = s->umatch; sm != NULL; sm = sm->next) {
for (sm = s->sm_lists[DETECT_SM_LIST_UMATCH]; sm != NULL; sm = sm->next) {
if (sm->type != DETECT_URICONTENT)
continue;
@ -1132,7 +1132,7 @@ static int PatternMatchPreprarePopulateMpmUri(DetectEngineCtx *de_ctx, SigGroupH
continue;
}
#endif
for (sm = s->umatch; sm != NULL; sm = sm->next) {
for (sm = s->sm_lists[DETECT_SM_LIST_UMATCH]; sm != NULL; sm = sm->next) {
if (sm->type != DETECT_URICONTENT)
continue;
@ -1171,13 +1171,13 @@ static int PatternMatchPreprarePopulateMpmUri(DetectEngineCtx *de_ctx, SigGroupH
/* now determine which one to add to the mpm phase */
for (sig = 0; sig < sgh->sig_cnt; sig++) {
Signature *s = sgh->match_array[sig];
if (s == NULL || s->umatch == NULL)
if (s == NULL || s->sm_lists[DETECT_SM_LIST_UMATCH] == NULL)
continue;
UricontentHash *mpm_ch = NULL;
SigMatch *sm = NULL;
for (sm = s->umatch; sm != NULL; sm = sm->next) {
for (sm = s->sm_lists[DETECT_SM_LIST_UMATCH]; sm != NULL; sm = sm->next) {
if (sm->type != DETECT_URICONTENT)
continue;
@ -1333,7 +1333,7 @@ int PatternMatchPrepareGroup(DetectEngineCtx *de_ctx, SigGroupHead *sh)
has_co_stream = 1;
}
for (sm = s->umatch; sm != NULL; sm = sm->next) {
for (sm = s->sm_lists[DETECT_SM_LIST_UMATCH]; sm != NULL; sm = sm->next) {
if (sm->type == DETECT_URICONTENT) {
has_co_uri = 1;
}
@ -1492,7 +1492,7 @@ int PatternMatchPrepareGroup(DetectEngineCtx *de_ctx, SigGroupHead *sh)
!(sh->flags & SIG_GROUP_HEAD_MPM_URI_COPY))
{
/* determine the length of the longest pattern */
for (sm = s->umatch; sm != NULL; sm = sm->next) {
for (sm = s->sm_lists[DETECT_SM_LIST_UMATCH]; sm != NULL; sm = sm->next) {
if (sm->type != DETECT_URICONTENT)
continue;

2
src/detect-engine-siggroup.c
Unescape Escape View File

@ -1388,7 +1388,7 @@ int SigGroupHeadLoadUricontent(DetectEngineCtx *de_ctx, SigGroupHead *sgh)
if (!(s->flags & SIG_FLAG_MPM_URI))
continue;
sm = s->umatch;
sm = s->sm_lists[DETECT_SM_LIST_UMATCH];
if (sm == NULL)
continue;

4
src/detect-engine-state.c
Unescape Escape View File

@ -306,7 +306,7 @@ int DeStateDetectStartDetection(ThreadVars *tv, DetectEngineCtx *de_ctx,
/* Check the uricontent keywords here. */
if (alproto == ALPROTO_HTTP && (flags & STREAM_TOSERVER)) {
if (s->umatch != NULL) {
if (s->sm_lists[DETECT_SM_LIST_UMATCH] != NULL) {
uinspect = 1;
SCLogDebug("inspecting uri");
@ -477,7 +477,7 @@ int DeStateDetectContinueDetection(ThreadVars *tv, DetectEngineCtx *de_ctx, Dete
/* first, check uricontent */
if (alproto == ALPROTO_HTTP && (flags & STREAM_TOSERVER)) {
if (s->umatch != NULL) {
if (s->sm_lists[DETECT_SM_LIST_UMATCH] != NULL) {
if (!(item->flags & DE_STATE_FLAG_URI_MATCH)) {
SCLogDebug("inspecting uri");
uinspect = 1;

4
src/detect-engine-uri.c
Unescape Escape View File

@ -410,7 +410,7 @@ int DetectEngineInspectPacketUris(DetectEngineCtx *de_ctx,
}
}
sm = s->umatch;
sm = s->sm_lists[DETECT_SM_LIST_UMATCH];
#ifdef DEBUG
DetectUricontentData *co = (DetectUricontentData *)sm->ctx;
@ -432,7 +432,7 @@ int DetectEngineInspectPacketUris(DetectEngineCtx *de_ctx,
/* Inspect all the uricontents fetched on each
* transaction at the app layer */
r = DoInspectPacketUri(de_ctx, det_ctx, s, s->umatch,
r = DoInspectPacketUri(de_ctx, det_ctx, s, s->sm_lists[DETECT_SM_LIST_UMATCH],
(uint8_t *) bstr_ptr(tx->request_uri_normalized),
bstr_len(tx->request_uri_normalized));

42
src/detect-fast-pattern.c
Unescape Escape View File

@ -107,7 +107,7 @@ static int DetectFastPatternSetup(DetectEngineCtx *de_ctx, Signature *s, char *a
DetectContentData *cd = NULL;
DetectUricontentData *ud = NULL;
if (s->sm_lists_tail[DETECT_SM_LIST_PMATCH] == NULL && s->umatch_tail == NULL) {
if (s->sm_lists_tail[DETECT_SM_LIST_PMATCH] == NULL && s->sm_lists_tail[DETECT_SM_LIST_UMATCH] == NULL) {
SCLogWarning(SC_WARN_COMPATIBILITY, "fast_pattern found inside the "
"rule, without a preceding content based keyword. "
"Currently we provide fast_pattern support for content "
@ -117,7 +117,7 @@ static int DetectFastPatternSetup(DetectEngineCtx *de_ctx, Signature *s, char *a
SigMatch *pm = SigMatchGetLastSMFromLists(s, 4,
DETECT_CONTENT, s->sm_lists_tail[DETECT_SM_LIST_PMATCH],
DETECT_URICONTENT, s->umatch_tail);
DETECT_URICONTENT, s->sm_lists_tail[DETECT_SM_LIST_UMATCH]);
if (pm == NULL) {
SCLogError(SC_ERR_INVALID_SIGNATURE, "fast_pattern found inside "
"the rule, without a content context. Please use a "
@ -2046,7 +2046,7 @@ int DetectFastPatternTest54(void)
goto end;
result = 0;
sm = de_ctx->sig_list->umatch;
sm = de_ctx->sig_list->sm_lists[DETECT_SM_LIST_UMATCH];
while (sm != NULL) {
if (sm->type == DETECT_URICONTENT) {
if ( ((DetectUricontentData *)sm->ctx)->flags &
@ -2087,7 +2087,7 @@ int DetectFastPatternTest55(void)
goto end;
result = 0;
sm = de_ctx->sig_list->umatch;
sm = de_ctx->sig_list->sm_lists[DETECT_SM_LIST_UMATCH];
while (sm != NULL) {
if (sm->type == DETECT_URICONTENT) {
if ( ((DetectUricontentData *)sm->ctx)->flags &
@ -2124,7 +2124,7 @@ int DetectFastPatternTest56(void)
goto end;
result = 0;
sm = de_ctx->sig_list->umatch;
sm = de_ctx->sig_list->sm_lists[DETECT_SM_LIST_UMATCH];
DetectUricontentData *ud = sm->ctx;
if (sm != NULL && sm->type == DETECT_URICONTENT) {
if (ud->flags & DETECT_URICONTENT_FAST_PATTERN &&
@ -2160,7 +2160,7 @@ int DetectFastPatternTest57(void)
goto end;
result = 0;
sm = de_ctx->sig_list->umatch;
sm = de_ctx->sig_list->sm_lists[DETECT_SM_LIST_UMATCH];
DetectUricontentData *ud = sm->ctx;
if (sm != NULL && sm->type == DETECT_URICONTENT) {
if (ud->flags & DETECT_URICONTENT_FAST_PATTERN &&
@ -2392,7 +2392,7 @@ int DetectFastPatternTest67(void)
if (de_ctx->sig_list == NULL)
goto end;
DetectUricontentData *ud = de_ctx->sig_list->umatch_tail->ctx;
DetectUricontentData *ud = de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_UMATCH]->ctx;
if (ud->flags & DETECT_URICONTENT_FAST_PATTERN &&
ud->flags & DETECT_URICONTENT_FAST_PATTERN_ONLY &&
!(ud->flags & ud->flags & DETECT_URICONTENT_FAST_PATTERN_CHOP) &&
@ -2422,7 +2422,7 @@ int DetectFastPatternTest68(void)
"(uricontent:one; uricontent:two; within:30; uricontent:two; fast_pattern:only; sid:1;)");
if (de_ctx->sig_list == NULL)
goto end;
DetectUricontentData *ud = de_ctx->sig_list->umatch_tail->ctx;
DetectUricontentData *ud = de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_UMATCH]->ctx;
if (ud->flags & DETECT_URICONTENT_FAST_PATTERN &&
ud->flags & DETECT_URICONTENT_FAST_PATTERN_ONLY &&
!(ud->flags & ud->flags & DETECT_URICONTENT_FAST_PATTERN_CHOP) &&
@ -2452,7 +2452,7 @@ int DetectFastPatternTest69(void)
"(uricontent:one; uricontent:two; offset:30; uricontent:two; fast_pattern:only; sid:1;)");
if (de_ctx->sig_list == NULL)
goto end;
DetectUricontentData *ud = de_ctx->sig_list->umatch_tail->ctx;
DetectUricontentData *ud = de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_UMATCH]->ctx;
if (ud->flags & DETECT_URICONTENT_FAST_PATTERN &&
ud->flags & DETECT_URICONTENT_FAST_PATTERN_ONLY &&
!(ud->flags & ud->flags & DETECT_URICONTENT_FAST_PATTERN_CHOP) &&
@ -2482,7 +2482,7 @@ int DetectFastPatternTest70(void)
"(uricontent:one; uricontent:two; depth:30; uricontent:two; fast_pattern:only; sid:1;)");
if (de_ctx->sig_list == NULL)
goto end;
DetectUricontentData *ud = de_ctx->sig_list->umatch_tail->ctx;
DetectUricontentData *ud = de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_UMATCH]->ctx;
if (ud->flags & DETECT_URICONTENT_FAST_PATTERN &&
ud->flags & DETECT_URICONTENT_FAST_PATTERN_ONLY &&
!(ud->flags & ud->flags & DETECT_URICONTENT_FAST_PATTERN_CHOP) &&
@ -2512,7 +2512,7 @@ int DetectFastPatternTest71(void)
"(uricontent:!one; fast_pattern; uricontent:two; sid:1;)");
if (de_ctx->sig_list == NULL)
goto end;
DetectUricontentData *ud = de_ctx->sig_list->umatch_tail->prev->ctx;
DetectUricontentData *ud = de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_UMATCH]->prev->ctx;
if (ud->flags & DETECT_URICONTENT_FAST_PATTERN &&
ud->flags & DETECT_URICONTENT_NEGATED &&
!(ud->flags & DETECT_URICONTENT_FAST_PATTERN_ONLY) &&
@ -2631,7 +2631,7 @@ int DetectFastPatternTest76(void)
"(uricontent:one; uricontent:two; fast_pattern:3,4; uricontent:three; sid:1;)");
if (de_ctx->sig_list == NULL)
goto end;
DetectUricontentData *ud = de_ctx->sig_list->umatch_tail->prev->ctx;
DetectUricontentData *ud = de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_UMATCH]->prev->ctx;
if (ud->flags & DETECT_URICONTENT_FAST_PATTERN &&
!(ud->flags & DETECT_URICONTENT_FAST_PATTERN_ONLY) &&
ud->flags & ud->flags & DETECT_URICONTENT_FAST_PATTERN_CHOP &&
@ -2661,7 +2661,7 @@ int DetectFastPatternTest77(void)
"(uricontent:one; uricontent:two; fast_pattern:3,4; uricontent:three; distance:30; sid:1;)");
if (de_ctx->sig_list == NULL)
goto end;
DetectUricontentData *ud = de_ctx->sig_list->umatch_tail->prev->ctx;
DetectUricontentData *ud = de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_UMATCH]->prev->ctx;
if (ud->flags & DETECT_URICONTENT_FAST_PATTERN &&
!(ud->flags & DETECT_URICONTENT_FAST_PATTERN_ONLY) &&
ud->flags & ud->flags & DETECT_URICONTENT_FAST_PATTERN_CHOP &&
@ -2691,7 +2691,7 @@ int DetectFastPatternTest78(void)
"(uricontent:one; uricontent:two; fast_pattern:3,4; uricontent:three; within:30; sid:1;)");
if (de_ctx->sig_list == NULL)
goto end;
DetectUricontentData *ud = de_ctx->sig_list->umatch_tail->prev->ctx;
DetectUricontentData *ud = de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_UMATCH]->prev->ctx;
if (ud->flags & DETECT_URICONTENT_FAST_PATTERN &&
!(ud->flags & DETECT_URICONTENT_FAST_PATTERN_ONLY) &&
ud->flags & ud->flags & DETECT_URICONTENT_FAST_PATTERN_CHOP &&
@ -2721,7 +2721,7 @@ int DetectFastPatternTest79(void)
"(uricontent:one; uricontent:two; fast_pattern:3,4; uricontent:three; offset:30; sid:1;)");
if (de_ctx->sig_list == NULL)
goto end;
DetectUricontentData *ud = de_ctx->sig_list->umatch_tail->prev->ctx;
DetectUricontentData *ud = de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_UMATCH]->prev->ctx;
if (ud->flags & DETECT_URICONTENT_FAST_PATTERN &&
!(ud->flags & DETECT_URICONTENT_FAST_PATTERN_ONLY) &&
ud->flags & ud->flags & DETECT_URICONTENT_FAST_PATTERN_CHOP &&
@ -2751,7 +2751,7 @@ int DetectFastPatternTest80(void)
"(uricontent:one; uricontent:two; fast_pattern:3,4; uricontent:three; depth:30; sid:1;)");
if (de_ctx->sig_list == NULL)
goto end;
DetectUricontentData *ud = de_ctx->sig_list->umatch_tail->prev->ctx;
DetectUricontentData *ud = de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_UMATCH]->prev->ctx;
if (ud->flags & DETECT_URICONTENT_FAST_PATTERN &&
!(ud->flags & DETECT_URICONTENT_FAST_PATTERN_ONLY) &&
ud->flags & ud->flags & DETECT_URICONTENT_FAST_PATTERN_CHOP &&
@ -2781,7 +2781,7 @@ int DetectFastPatternTest81(void)
"(uricontent:one; uricontent:two; distance:10; uricontent:three; fast_pattern:3,4; sid:1;)");
if (de_ctx->sig_list == NULL)
goto end;
DetectUricontentData *ud = de_ctx->sig_list->umatch_tail->ctx;
DetectUricontentData *ud = de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_UMATCH]->ctx;
if (ud->flags & DETECT_URICONTENT_FAST_PATTERN &&
!(ud->flags & DETECT_URICONTENT_FAST_PATTERN_ONLY) &&
ud->flags & ud->flags & DETECT_URICONTENT_FAST_PATTERN_CHOP &&
@ -2811,7 +2811,7 @@ int DetectFastPatternTest82(void)
"(uricontent:one; uricontent:two; within:10; uricontent:three; fast_pattern:3,4; sid:1;)");
if (de_ctx->sig_list == NULL)
goto end;
DetectUricontentData *ud = de_ctx->sig_list->umatch_tail->ctx;
DetectUricontentData *ud = de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_UMATCH]->ctx;
if (ud->flags & DETECT_URICONTENT_FAST_PATTERN &&
!(ud->flags & DETECT_URICONTENT_FAST_PATTERN_ONLY) &&
ud->flags & ud->flags & DETECT_URICONTENT_FAST_PATTERN_CHOP &&
@ -2841,7 +2841,7 @@ int DetectFastPatternTest83(void)
"(uricontent:one; uricontent:two; offset:10; uricontent:three; fast_pattern:3,4; sid:1;)");
if (de_ctx->sig_list == NULL)
goto end;
DetectUricontentData *ud = de_ctx->sig_list->umatch_tail->ctx;
DetectUricontentData *ud = de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_UMATCH]->ctx;
if (ud->flags & DETECT_URICONTENT_FAST_PATTERN &&
!(ud->flags & DETECT_URICONTENT_FAST_PATTERN_ONLY) &&
ud->flags & ud->flags & DETECT_URICONTENT_FAST_PATTERN_CHOP &&
@ -2871,7 +2871,7 @@ int DetectFastPatternTest84(void)
"(uricontent:one; uricontent:two; depth:10; uricontent:three; fast_pattern:3,4; sid:1;)");
if (de_ctx->sig_list == NULL)
goto end;
DetectUricontentData *ud = de_ctx->sig_list->umatch_tail->ctx;
DetectUricontentData *ud = de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_UMATCH]->ctx;
if (ud->flags & DETECT_URICONTENT_FAST_PATTERN &&
!(ud->flags & DETECT_URICONTENT_FAST_PATTERN_ONLY) &&
ud->flags & ud->flags & DETECT_URICONTENT_FAST_PATTERN_CHOP &&
@ -2970,7 +2970,7 @@ int DetectFastPatternTest88(void)
"(uricontent:one; uricontent:!two; fast_pattern:3,4; uricontent:three; sid:1;)");
if (de_ctx->sig_list == NULL)
goto end;
DetectUricontentData *ud = de_ctx->sig_list->umatch_tail->prev->ctx;
DetectUricontentData *ud = de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_UMATCH]->prev->ctx;
if (ud->flags & DETECT_URICONTENT_FAST_PATTERN &&
ud->flags & DETECT_URICONTENT_NEGATED &&
!(ud->flags & DETECT_URICONTENT_FAST_PATTERN_ONLY) &&

4
src/detect-http-cookie.c
Unescape Escape View File

@ -462,12 +462,12 @@ int DetectHttpCookieTest06(void)
if (s->amatch->type != DETECT_AL_HTTP_COOKIE)
goto end;
if (s->umatch == NULL) {
if (s->sm_lists[DETECT_SM_LIST_UMATCH] == NULL) {
printf("expected another SigMatch, got NULL: ");
goto end;
}
if (s->umatch->type != DETECT_URICONTENT) {
if (s->sm_lists[DETECT_SM_LIST_UMATCH]->type != DETECT_URICONTENT) {
goto end;
}

50
src/detect-http-uri.c
Unescape Escape View File

@ -259,7 +259,7 @@ int DetectHttpUriTest03(void)
goto end;
}
sm = de_ctx->sig_list->umatch;
sm = de_ctx->sig_list->sm_lists[DETECT_SM_LIST_UMATCH];
if (sm == NULL) {
printf("no sigmatch(es): ");
goto end;
@ -327,16 +327,16 @@ int DetectHttpUriTest05(void)
printf("sig failed to parse\n");
goto end;
}
if (s->umatch == NULL)
if (s->sm_lists[DETECT_SM_LIST_UMATCH] == NULL)
goto end;
if (s->umatch->type != DETECT_URICONTENT) {
if (s->sm_lists[DETECT_SM_LIST_UMATCH]->type != DETECT_URICONTENT) {
printf("wrong type\n");
goto end;
}
char *str = "we are testing http_uri keyword";
int uricomp = memcmp((const char *)((DetectUricontentData*) s->umatch->ctx)->uricontent, str, strlen(str)-1);
int urilen = ((DetectUricontentData*) s->umatch_tail->ctx)->uricontent_len;
int uricomp = memcmp((const char *)((DetectUricontentData*) s->sm_lists[DETECT_SM_LIST_UMATCH]->ctx)->uricontent, str, strlen(str)-1);
int urilen = ((DetectUricontentData*) s->sm_lists_tail[DETECT_SM_LIST_UMATCH]->ctx)->uricontent_len;
if (uricomp != 0 ||
urilen != strlen("we are testing http_uri keyword")) {
printf("sig failed to parse, content not setup properly\n");
@ -371,13 +371,13 @@ int DetectHttpUriTest06(void)
goto end;
}
if (de_ctx->sig_list->umatch == NULL) {
printf("de_ctx->sig_list->umatch == NULL\n");
if (de_ctx->sig_list->sm_lists[DETECT_SM_LIST_UMATCH] == NULL) {
printf("de_ctx->sig_list->sm_lists[DETECT_SM_LIST_UMATCH] == NULL\n");
goto end;
}
DetectContentData *cd = de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_PMATCH]->ctx;
DetectUricontentData *ud = de_ctx->sig_list->umatch_tail->ctx;
DetectUricontentData *ud = de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_UMATCH]->ctx;
if (cd->id == ud->id)
goto end;
@ -410,13 +410,13 @@ int DetectHttpUriTest07(void)
goto end;
}
if (de_ctx->sig_list->umatch == NULL) {
printf("de_ctx->sig_list->umatch == NULL\n");
if (de_ctx->sig_list->sm_lists[DETECT_SM_LIST_UMATCH] == NULL) {
printf("de_ctx->sig_list->sm_lists[DETECT_SM_LIST_UMATCH] == NULL\n");
goto end;
}
DetectContentData *cd = de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_PMATCH]->ctx;
DetectUricontentData *ud = de_ctx->sig_list->umatch_tail->ctx;
DetectUricontentData *ud = de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_UMATCH]->ctx;
if (cd->id == ud->id)
goto end;
@ -449,13 +449,13 @@ int DetectHttpUriTest08(void)
goto end;
}
if (de_ctx->sig_list->umatch == NULL) {
printf("de_ctx->sig_list->umatch == NULL\n");
if (de_ctx->sig_list->sm_lists[DETECT_SM_LIST_UMATCH] == NULL) {
printf("de_ctx->sig_list->sm_lists[DETECT_SM_LIST_UMATCH] == NULL\n");
goto end;
}
DetectContentData *cd = de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_PMATCH]->ctx;
DetectUricontentData *ud = de_ctx->sig_list->umatch_tail->ctx;
DetectUricontentData *ud = de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_UMATCH]->ctx;
if (cd->id != 0 || ud->id != 1)
goto end;
@ -488,13 +488,13 @@ int DetectHttpUriTest09(void)
goto end;
}
if (de_ctx->sig_list->umatch == NULL) {
printf("de_ctx->sig_list->umatch == NULL\n");
if (de_ctx->sig_list->sm_lists[DETECT_SM_LIST_UMATCH] == NULL) {
printf("de_ctx->sig_list->sm_lists[DETECT_SM_LIST_UMATCH] == NULL\n");
goto end;
}
DetectContentData *cd = de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_PMATCH]->ctx;
DetectUricontentData *ud = de_ctx->sig_list->umatch_tail->ctx;
DetectUricontentData *ud = de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_UMATCH]->ctx;
if (cd->id != 1 || ud->id != 0)
goto end;
@ -528,14 +528,14 @@ int DetectHttpUriTest10(void)
goto end;
}
if (de_ctx->sig_list->umatch == NULL) {
printf("de_ctx->sig_list->umatch == NULL\n");
if (de_ctx->sig_list->sm_lists[DETECT_SM_LIST_UMATCH] == NULL) {
printf("de_ctx->sig_list->sm_lists[DETECT_SM_LIST_UMATCH] == NULL\n");
goto end;
}
DetectContentData *cd = de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_PMATCH]->ctx;
DetectUricontentData *ud1 = de_ctx->sig_list->umatch_tail->ctx;
DetectUricontentData *ud2 = de_ctx->sig_list->umatch_tail->prev->ctx;
DetectUricontentData *ud1 = de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_UMATCH]->ctx;
DetectUricontentData *ud2 = de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_UMATCH]->prev->ctx;
if (cd->id != 1 || ud1->id != 0 || ud2->id != 0)
goto end;
@ -569,14 +569,14 @@ int DetectHttpUriTest11(void)
goto end;
}
if (de_ctx->sig_list->umatch == NULL) {
printf("de_ctx->sig_list->umatch == NULL\n");
if (de_ctx->sig_list->sm_lists[DETECT_SM_LIST_UMATCH] == NULL) {
printf("de_ctx->sig_list->sm_lists[DETECT_SM_LIST_UMATCH] == NULL\n");
goto end;
}
DetectContentData *cd = de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_PMATCH]->ctx;
DetectUricontentData *ud1 = de_ctx->sig_list->umatch_tail->ctx;
DetectUricontentData *ud2 = de_ctx->sig_list->umatch_tail->prev->ctx;
DetectUricontentData *ud1 = de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_UMATCH]->ctx;
DetectUricontentData *ud2 = de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_UMATCH]->prev->ctx;
if (cd->id != 2 || ud1->id != 0 || ud2->id != 0)
goto end;

2
src/detect-nocase.c
Unescape Escape View File

@ -71,7 +71,7 @@ static SigMatch *SigMatchGetLastNocasePattern(Signature *s) {
BUG_ON(s == NULL);
SigMatch *co_sm = DetectContentGetLastPattern(s->sm_lists_tail[DETECT_SM_LIST_PMATCH]);
SigMatch *ur_sm = SigMatchGetLastSM(s->umatch_tail, DETECT_URICONTENT);
SigMatch *ur_sm = SigMatchGetLastSM(s->sm_lists_tail[DETECT_SM_LIST_UMATCH], DETECT_URICONTENT);
/* http client body SigMatch */
SigMatch *hcbd_sm = SigMatchGetLastSM(s->amatch_tail, DETECT_AL_HTTP_CLIENT_BODY);
/* http cookie SigMatch */

2
src/detect-offset.c
Unescape Escape View File

@ -82,7 +82,7 @@ int DetectOffsetSetup (DetectEngineCtx *de_ctx, Signature *s, char *offsetstr)
default:
pm = SigMatchGetLastSMFromLists(s, 4,
DETECT_CONTENT, s->sm_lists_tail[DETECT_SM_LIST_PMATCH],
DETECT_URICONTENT, s->umatch_tail);
DETECT_URICONTENT, s->sm_lists_tail[DETECT_SM_LIST_UMATCH]);
if (pm == NULL) {
SCLogError(SC_ERR_WITHIN_MISSING_CONTENT, "distance needs"
"preceeding content or uricontent option");

36
src/detect-parse.c
Unescape Escape View File

@ -175,17 +175,17 @@ void SigMatchAppendAppLayer(Signature *s, SigMatch *new) {
* \param new pointer to the SigMatch of type uricontent to be appended
*/
void SigMatchAppendUricontent(Signature *s, SigMatch *new) {
if (s->umatch == NULL) {
s->umatch = new;
s->umatch_tail = new;
if (s->sm_lists[DETECT_SM_LIST_UMATCH] == NULL) {
s->sm_lists[DETECT_SM_LIST_UMATCH] = new;
s->sm_lists_tail[DETECT_SM_LIST_UMATCH] = new;
new->next = NULL;
new->prev = NULL;
} else {
SigMatch *cur = s->umatch_tail;
SigMatch *cur = s->sm_lists_tail[DETECT_SM_LIST_UMATCH];
cur->next = new;
new->prev = cur;
new->next = NULL;
s->umatch_tail = new;
s->sm_lists_tail[DETECT_SM_LIST_UMATCH] = new;
}
new->idx = s->sm_cnt;
@ -388,20 +388,20 @@ void SigMatchReplaceContentToUricontent(Signature *s, SigMatch *old, SigMatch *n
/* finally append the "new" sig match to the app layer list */
/** \todo if the app layer gets it's own list, adapt this code */
if (s->umatch == NULL) {
s->umatch = new;
s->umatch_tail = new;
if (s->sm_lists[DETECT_SM_LIST_UMATCH] == NULL) {
s->sm_lists[DETECT_SM_LIST_UMATCH] = new;
s->sm_lists_tail[DETECT_SM_LIST_UMATCH] = new;
new->next = NULL;
new->prev = NULL;
} else {
SigMatch *cur = s->umatch;
SigMatch *cur = s->sm_lists[DETECT_SM_LIST_UMATCH];
for ( ; cur->next != NULL; cur = cur->next);
cur->next = new;
new->next = NULL;
new->prev = cur;
s->umatch_tail = new;
s->sm_lists_tail[DETECT_SM_LIST_UMATCH] = new;
}
/* move over the idx */
@ -1058,7 +1058,7 @@ void SigFree(Signature *s) {
sm = nsm;
}
sm = s->umatch;
sm = s->sm_lists[DETECT_SM_LIST_UMATCH];
while (sm != NULL) {
nsm = sm->next;
SigMatchFree(sm);
@ -1288,7 +1288,7 @@ Signature *SigInit(DetectEngineCtx *de_ctx, char *sigstr) {
sig->flags |= SIG_FLAG_MPM;
}
}
for (sm = sig->umatch; sm != NULL; sm = sm->next) {
for (sm = sig->sm_lists[DETECT_SM_LIST_UMATCH]; sm != NULL; sm = sm->next) {
if (sm->type == DETECT_URICONTENT) {
DetectUricontentData *ud = (DetectUricontentData *)sm->ctx;
if (ud == NULL)
@ -1324,7 +1324,7 @@ Signature *SigInit(DetectEngineCtx *de_ctx, char *sigstr) {
if (sig->flags & SIG_FLAG_MPM_URI) {
sig->mpm_uricontent_maxlen = 0;
for (sm = sig->umatch; sm != NULL; sm = sm->next) {
for (sm = sig->sm_lists[DETECT_SM_LIST_UMATCH]; sm != NULL; sm = sm->next) {
if (sm->type == DETECT_URICONTENT) {
DetectUricontentData *ud = (DetectUricontentData *)sm->ctx;
if (ud == NULL)
@ -1355,7 +1355,7 @@ Signature *SigInit(DetectEngineCtx *de_ctx, char *sigstr) {
}
}
if (sig->umatch)
if (sig->sm_lists[DETECT_SM_LIST_UMATCH])
sig->flags |= SIG_FLAG_UMATCH;
if (sig->dmatch)
sig->flags |= SIG_FLAG_AMATCH;
@ -1430,7 +1430,7 @@ Signature *SigInitReal(DetectEngineCtx *de_ctx, char *sigstr) {
sig->flags |= SIG_FLAG_MPM;
}
}
for (sm = sig->umatch; sm != NULL; sm = sm->next) {
for (sm = sig->sm_lists[DETECT_SM_LIST_UMATCH]; sm != NULL; sm = sm->next) {
if (sm->type == DETECT_URICONTENT) {
DetectUricontentData *ud = (DetectUricontentData *)sm->ctx;
if (ud == NULL)
@ -1466,7 +1466,7 @@ Signature *SigInitReal(DetectEngineCtx *de_ctx, char *sigstr) {
if (sig->flags & SIG_FLAG_MPM_URI) {
sig->mpm_uricontent_maxlen = 0;
for (sm = sig->umatch; sm != NULL; sm = sm->next) {
for (sm = sig->sm_lists[DETECT_SM_LIST_UMATCH]; sm != NULL; sm = sm->next) {
if (sm->type == DETECT_URICONTENT) {
DetectUricontentData *ud = (DetectUricontentData *)sm->ctx;
if (ud == NULL)
@ -1515,7 +1515,7 @@ Signature *SigInitReal(DetectEngineCtx *de_ctx, char *sigstr) {
if (sig->next->flags & SIG_FLAG_MPM_URI) {
sig->next->mpm_uricontent_maxlen = 0;
for (sm = sig->next->umatch; sm != NULL; sm = sm->next) {
for (sm = sig->next->sm_lists[DETECT_SM_LIST_UMATCH]; sm != NULL; sm = sm->next) {
if (sm->type == DETECT_URICONTENT) {
DetectUricontentData *ud = (DetectUricontentData *)sm->ctx;
if (ud == NULL)
@ -1547,7 +1547,7 @@ Signature *SigInitReal(DetectEngineCtx *de_ctx, char *sigstr) {
}
}
if (sig->umatch)
if (sig->sm_lists[DETECT_SM_LIST_UMATCH])
sig->flags |= SIG_FLAG_UMATCH;
if (sig->dmatch)
sig->flags |= SIG_FLAG_AMATCH;

88
src/detect-uricontent.c
Unescape Escape View File

@ -804,9 +804,9 @@ int DetectUriSigTest01(void)
SigGroupBuild(de_ctx);
DetectEngineThreadCtxInit(&th_v, (void *)de_ctx, (void *)&det_ctx);
BUG_ON(de_ctx->sig_list == NULL);
BUG_ON(de_ctx->sig_list->sm_lists[DETECT_SM_LIST_UMATCH] == NULL);
sm = de_ctx->sig_list->umatch;
sm = de_ctx->sig_list->sm_lists[DETECT_SM_LIST_UMATCH];
if (sm->type == DETECT_URICONTENT) {
result = 1;
} else {
@ -1073,7 +1073,7 @@ static int DetectUriSigTest04(void) {
"\" Test uricontent\"; "
"uricontent:\"foo\"; sid:1;)");
if (s == NULL ||
s->umatch == NULL ||
s->sm_lists[DETECT_SM_LIST_UMATCH] == NULL ||
s->sm_lists[DETECT_SM_LIST_PMATCH] != NULL ||
s->sm_lists[DETECT_SM_LIST_MATCH] != NULL)
{
@ -1085,7 +1085,7 @@ static int DetectUriSigTest04(void) {
"\" Test uricontent and content\"; "
"uricontent:\"foo\"; content:\"bar\";sid:1;)");
if (s == NULL ||
s->umatch == NULL ||
s->sm_lists[DETECT_SM_LIST_UMATCH] == NULL ||
s->sm_lists[DETECT_SM_LIST_PMATCH] == NULL ||
s->sm_lists[DETECT_SM_LIST_MATCH] != NULL)
{
@ -1098,7 +1098,7 @@ static int DetectUriSigTest04(void) {
"uricontent:\"foo\"; content:\"bar\";"
" depth:10; offset: 5; sid:1;)");
if (s == NULL ||
s->umatch == NULL ||
s->sm_lists[DETECT_SM_LIST_UMATCH] == NULL ||
s->sm_lists[DETECT_SM_LIST_PMATCH] == NULL ||
((DetectContentData *)s->sm_lists[DETECT_SM_LIST_PMATCH]->ctx)->depth != 15 ||
((DetectContentData *)s->sm_lists[DETECT_SM_LIST_PMATCH]->ctx)->offset != 5 ||
@ -1113,10 +1113,10 @@ static int DetectUriSigTest04(void) {
"content:\"foo\"; uricontent:\"bar\";"
" depth:10; offset: 5; sid:1;)");
if (s == NULL ||
s->umatch == NULL ||
s->sm_lists[DETECT_SM_LIST_UMATCH] == NULL ||
s->sm_lists[DETECT_SM_LIST_PMATCH] == NULL ||
((DetectUricontentData *)s->umatch->ctx)->depth != 15 ||
((DetectUricontentData *)s->umatch->ctx)->offset != 5 ||
((DetectUricontentData *)s->sm_lists[DETECT_SM_LIST_UMATCH]->ctx)->depth != 15 ||
((DetectUricontentData *)s->sm_lists[DETECT_SM_LIST_UMATCH]->ctx)->offset != 5 ||
s->sm_lists[DETECT_SM_LIST_MATCH] != NULL)
{
printf("sig 4 failed to parse: ");
@ -1148,7 +1148,7 @@ static int DetectUriSigTest04(void) {
"\"two_contents\"; within:30; sid:1;)");
if (s == NULL) {
goto end;
} else if (s->umatch == NULL ||
} else if (s->sm_lists[DETECT_SM_LIST_UMATCH] == NULL ||
s->sm_lists[DETECT_SM_LIST_PMATCH] == NULL ||
((DetectContentData*) s->sm_lists[DETECT_SM_LIST_PMATCH]->ctx)->depth != 15 ||
((DetectContentData*) s->sm_lists[DETECT_SM_LIST_PMATCH]->ctx)->offset != 5 ||
@ -1167,15 +1167,15 @@ static int DetectUriSigTest04(void) {
"\"two_uricontents\"; within:30; sid:1;)");
if (s == NULL) {
goto end;
} else if (s->umatch == NULL ||
} else if (s->sm_lists[DETECT_SM_LIST_UMATCH] == NULL ||
s->sm_lists[DETECT_SM_LIST_PMATCH] == NULL ||
((DetectContentData*) s->sm_lists[DETECT_SM_LIST_PMATCH]->ctx)->depth != 15 ||
((DetectContentData*) s->sm_lists[DETECT_SM_LIST_PMATCH]->ctx)->offset != 5 ||
((DetectUricontentData*) s->umatch_tail->ctx)->within != 30 ||
((DetectUricontentData*) s->sm_lists_tail[DETECT_SM_LIST_UMATCH]->ctx)->within != 30 ||
s->sm_lists[DETECT_SM_LIST_MATCH] != NULL)
{
printf("sig 8 failed to parse: ");
DetectUricontentPrint((DetectUricontentData*) s->umatch_tail->ctx);
DetectUricontentPrint((DetectUricontentData*) s->sm_lists_tail[DETECT_SM_LIST_UMATCH]->ctx);
goto end;
}
@ -1187,7 +1187,7 @@ static int DetectUriSigTest04(void) {
if (s == NULL) {
goto end;
} else if (
s->umatch == NULL ||
s->sm_lists[DETECT_SM_LIST_UMATCH] == NULL ||
s->sm_lists[DETECT_SM_LIST_PMATCH] == NULL ||
((DetectContentData*) s->sm_lists[DETECT_SM_LIST_PMATCH]->ctx)->depth != 15 ||
((DetectContentData*) s->sm_lists[DETECT_SM_LIST_PMATCH]->ctx)->offset != 5 ||
@ -1207,15 +1207,15 @@ static int DetectUriSigTest04(void) {
if (s == NULL) {
goto end;
} else if (
s->umatch == NULL ||
s->sm_lists[DETECT_SM_LIST_UMATCH] == NULL ||
s->sm_lists[DETECT_SM_LIST_PMATCH] == NULL ||
((DetectContentData*) s->sm_lists[DETECT_SM_LIST_PMATCH]->ctx)->depth != 15 ||
((DetectContentData*) s->sm_lists[DETECT_SM_LIST_PMATCH]->ctx)->offset != 5 ||
((DetectUricontentData*) s->umatch_tail->ctx)->distance != 30 ||
((DetectUricontentData*) s->sm_lists_tail[DETECT_SM_LIST_UMATCH]->ctx)->distance != 30 ||
s->sm_lists[DETECT_SM_LIST_MATCH] != NULL)
{
printf("sig 10 failed to parse: ");
DetectUricontentPrint((DetectUricontentData*) s->umatch_tail->ctx);
DetectUricontentPrint((DetectUricontentData*) s->sm_lists_tail[DETECT_SM_LIST_UMATCH]->ctx);
goto end;
}
@ -1231,21 +1231,21 @@ static int DetectUriSigTest04(void) {
goto end;
}
if (s->umatch == NULL || s->sm_lists[DETECT_SM_LIST_PMATCH] == NULL) {
printf("umatch %p or pmatch %p: ", s->umatch, s->sm_lists[DETECT_SM_LIST_PMATCH]);
if (s->sm_lists[DETECT_SM_LIST_UMATCH] == NULL || s->sm_lists[DETECT_SM_LIST_PMATCH] == NULL) {
printf("umatch %p or pmatch %p: ", s->sm_lists[DETECT_SM_LIST_UMATCH], s->sm_lists[DETECT_SM_LIST_PMATCH]);
goto end;
}
if ( ((DetectContentData*) s->sm_lists[DETECT_SM_LIST_PMATCH]->ctx)->depth != 15 ||
((DetectContentData*) s->sm_lists[DETECT_SM_LIST_PMATCH]->ctx)->offset != 5 ||
((DetectUricontentData*) s->umatch_tail->ctx)->distance != 30 ||
((DetectUricontentData*) s->umatch_tail->ctx)->within != 60 ||
((DetectUricontentData*) s->sm_lists_tail[DETECT_SM_LIST_UMATCH]->ctx)->distance != 30 ||
((DetectUricontentData*) s->sm_lists_tail[DETECT_SM_LIST_UMATCH]->ctx)->within != 60 ||
((DetectContentData*) s->sm_lists_tail[DETECT_SM_LIST_PMATCH]->ctx)->distance != 45 ||
((DetectContentData*) s->sm_lists_tail[DETECT_SM_LIST_PMATCH]->ctx)->within != 70 ||
s->sm_lists[DETECT_SM_LIST_MATCH] != NULL) {
printf("sig 10 failed to parse, content not setup properly: ");
DetectContentPrint((DetectContentData*) s->sm_lists[DETECT_SM_LIST_PMATCH]->ctx);
DetectUricontentPrint((DetectUricontentData*) s->umatch_tail->ctx);
DetectUricontentPrint((DetectUricontentData*) s->sm_lists_tail[DETECT_SM_LIST_UMATCH]->ctx);
DetectContentPrint((DetectContentData*) s->sm_lists_tail[DETECT_SM_LIST_PMATCH]->ctx);
goto end;
}
@ -1775,13 +1775,13 @@ int DetectUriSigTest12(void)
goto end;
}
if (s->umatch_tail == NULL && s->umatch_tail->ctx) {
if (s->sm_lists_tail[DETECT_SM_LIST_UMATCH] == NULL && s->sm_lists_tail[DETECT_SM_LIST_UMATCH]->ctx) {
printf("de_ctx->pmatch_tail == NULL && de_ctx->pmatch_tail->ctx\n");
result = 0;
goto end;
}
ud = (DetectUricontentData *)s->umatch_tail->ctx;
ud = (DetectUricontentData *)s->sm_lists_tail[DETECT_SM_LIST_UMATCH]->ctx;
result = (strncmp("boo", (char *)ud->uricontent, ud->uricontent_len) == 0);
end:
@ -2133,13 +2133,13 @@ int DetectUricontentSigTest08(void)
goto end;
}
if (de_ctx->sig_list->umatch == NULL) {
printf("de_ctx->sig_list->umatch == NULL\n");
if (de_ctx->sig_list->sm_lists[DETECT_SM_LIST_UMATCH] == NULL) {
printf("de_ctx->sig_list->sm_lists[DETECT_SM_LIST_UMATCH] == NULL\n");
goto end;
}
DetectContentData *cd = de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_PMATCH]->ctx;
DetectUricontentData *ud = de_ctx->sig_list->umatch_tail->ctx;
DetectUricontentData *ud = de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_UMATCH]->ctx;
if (cd->id == ud->id)
goto end;
@ -2172,13 +2172,13 @@ int DetectUricontentSigTest09(void)
goto end;
}
if (de_ctx->sig_list->umatch == NULL) {
printf("de_ctx->sig_list->umatch == NULL\n");
if (de_ctx->sig_list->sm_lists[DETECT_SM_LIST_UMATCH] == NULL) {
printf("de_ctx->sig_list->sm_lists[DETECT_SM_LIST_UMATCH] == NULL\n");
goto end;
}
DetectContentData *cd = de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_PMATCH]->ctx;
DetectUricontentData *ud = de_ctx->sig_list->umatch_tail->ctx;
DetectUricontentData *ud = de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_UMATCH]->ctx;
if (cd->id == ud->id)
goto end;
@ -2212,16 +2212,16 @@ int DetectUricontentSigTest10(void)
goto end;
}
if (de_ctx->sig_list->umatch == NULL) {
printf("de_ctx->sig_list->umatch == NULL\n");
if (de_ctx->sig_list->sm_lists[DETECT_SM_LIST_UMATCH] == NULL) {
printf("de_ctx->sig_list->sm_lists[DETECT_SM_LIST_UMATCH] == NULL\n");
goto end;
}
DetectContentData *cd1 = de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_PMATCH]->prev->prev->ctx;
DetectContentData *cd2 = de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_PMATCH]->prev->ctx;
DetectContentData *cd3 = de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_PMATCH]->ctx;
DetectUricontentData *ud1 = de_ctx->sig_list->umatch_tail->prev->ctx;
DetectUricontentData *ud2 = de_ctx->sig_list->umatch_tail->ctx;
DetectUricontentData *ud1 = de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_UMATCH]->prev->ctx;
DetectUricontentData *ud2 = de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_UMATCH]->ctx;
if (cd1->id != 1 || cd2->id != 2 || cd3->id != 1 || ud1->id != 0 || ud2->id != 0)
goto end;
@ -2255,16 +2255,16 @@ int DetectUricontentSigTest11(void)
goto end;
}
if (de_ctx->sig_list->umatch == NULL) {
printf("de_ctx->sig_list->umatch == NULL\n");
if (de_ctx->sig_list->sm_lists[DETECT_SM_LIST_UMATCH] == NULL) {
printf("de_ctx->sig_list->sm_lists[DETECT_SM_LIST_UMATCH] == NULL\n");
goto end;
}
DetectContentData *cd1 = de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_PMATCH]->prev->prev->ctx;
DetectContentData *cd2 = de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_PMATCH]->prev->ctx;
DetectContentData *cd3 = de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_PMATCH]->ctx;
DetectUricontentData *ud1 = de_ctx->sig_list->umatch_tail->prev->ctx;
DetectUricontentData *ud2 = de_ctx->sig_list->umatch_tail->ctx;
DetectUricontentData *ud1 = de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_UMATCH]->prev->ctx;
DetectUricontentData *ud2 = de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_UMATCH]->ctx;
if (cd1->id != 1 || cd2->id != 2 || cd3->id != 1 || ud1->id != 0 || ud2->id != 0)
goto end;
@ -2300,8 +2300,8 @@ int DetectUricontentSigTest12(void)
goto end;
}
if (de_ctx->sig_list->umatch == NULL) {
printf("de_ctx->sig_list->umatch == NULL\n");
if (de_ctx->sig_list->sm_lists[DETECT_SM_LIST_UMATCH] == NULL) {
printf("de_ctx->sig_list->sm_lists[DETECT_SM_LIST_UMATCH] == NULL\n");
goto end;
}
@ -2310,11 +2310,11 @@ int DetectUricontentSigTest12(void)
DetectContentData *cd3 = de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_PMATCH]->prev->prev->ctx;
DetectContentData *cd4 = de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_PMATCH]->prev->ctx;
DetectContentData *cd5 = de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_PMATCH]->ctx;
DetectUricontentData *ud1 = de_ctx->sig_list->umatch_tail->prev->prev->prev->prev->ctx;
DetectUricontentData *ud2 = de_ctx->sig_list->umatch_tail->prev->prev->prev->ctx;
DetectUricontentData *ud3 = de_ctx->sig_list->umatch_tail->prev->prev->ctx;
DetectUricontentData *ud4 = de_ctx->sig_list->umatch_tail->prev->ctx;
DetectUricontentData *ud5 = de_ctx->sig_list->umatch_tail->ctx;
DetectUricontentData *ud1 = de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_UMATCH]->prev->prev->prev->prev->ctx;
DetectUricontentData *ud2 = de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_UMATCH]->prev->prev->prev->ctx;
DetectUricontentData *ud3 = de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_UMATCH]->prev->prev->ctx;
DetectUricontentData *ud4 = de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_UMATCH]->prev->ctx;
DetectUricontentData *ud5 = de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_UMATCH]->ctx;
if (cd1->id != 1 || cd2->id != 2 || cd3->id != 1 || cd4->id != 1 || cd5->id != 4 ||
ud1->id != 0 || ud2->id != 0 || ud3->id != 0 || ud4->id != 0 || ud5->id != 3) {
goto end;

4
src/detect-within.c
Unescape Escape View File

@ -167,8 +167,8 @@ static int DetectWithinSetup (DetectEngineCtx *de_ctx, Signature *s, char *withi
}
} else {
pm = SigMatchGetLastSMFromLists(s, 4,
DETECT_CONTENT, s->sm_lists_tail[DETECT_SM_LIST_PMATCH],
DETECT_URICONTENT, s->umatch_tail);
DETECT_CONTENT, s->sm_lists_tail[DETECT_SM_LIST_PMATCH],
DETECT_URICONTENT, s->sm_lists_tail[DETECT_SM_LIST_UMATCH]);
if (pm == NULL) {
SCLogError(SC_ERR_WITHIN_MISSING_CONTENT, "within needs"
"preceeding content or uricontent option");

12
src/detect.c
Unescape Escape View File

@ -1141,10 +1141,10 @@ int SigMatchSignatures(ThreadVars *th_v, DetectEngineCtx *de_ctx, DetectEngineTh
}
}
SCLogDebug("s->amatch %p, s->umatch %p, s->dmatch %p",
s->amatch, s->umatch, s->dmatch);
SCLogDebug("s->amatch %p, s->sm_lists[DETECT_SM_LIST_UMATCH] %p, s->dmatch %p",
s->amatch, s->sm_lists[DETECT_SM_LIST_UMATCH], s->dmatch);
if (s->amatch != NULL || s->umatch != NULL || s->dmatch != NULL) {
if (s->amatch != NULL || s->sm_lists[DETECT_SM_LIST_UMATCH] != NULL || s->dmatch != NULL) {
if (alstate == NULL) {
SCLogDebug("state matches but no state, we can't match");
goto next;
@ -1448,7 +1448,7 @@ int SignatureIsIPOnly(DetectEngineCtx *de_ctx, Signature *s) {
if (s->sm_lists[DETECT_SM_LIST_PMATCH] != NULL)
return 0;
if (s->umatch != NULL)
if (s->sm_lists[DETECT_SM_LIST_UMATCH] != NULL)
return 0;
if (s->amatch != NULL)
@ -1516,7 +1516,7 @@ static int SignatureIsDEOnly(DetectEngineCtx *de_ctx, Signature *s) {
if (s->sm_lists[DETECT_SM_LIST_PMATCH] != NULL)
return 0;
if (s->umatch != NULL)
if (s->sm_lists[DETECT_SM_LIST_UMATCH] != NULL)
return 0;
if (s->amatch != NULL)
@ -1604,7 +1604,7 @@ static int SignatureCreateMask(Signature *s) {
SCLogDebug("sig requires dce state");
}
if (s->umatch != NULL) {
if (s->sm_lists[DETECT_SM_LIST_UMATCH] != NULL) {
s->mask |= SIG_MASK_REQUIRE_HTTP_STATE;
SCLogDebug("sig requires dce http state");
}

4
src/detect.h
Unescape Escape View File

@ -359,7 +359,7 @@ typedef struct Signature_ {
/** ptr to the SigMatch lists */
//struct SigMatch_ *pmatch; /* payload matches */
struct SigMatch_ *umatch; /* uricontent payload matches */
//struct SigMatch_ *umatch; /* uricontent payload matches */
struct SigMatch_ *amatch; /* general app layer matches */
struct SigMatch_ *dmatch; /* dce app layer matches */
//struct SigMatch_ *match; /* non-payload matches */
@ -413,7 +413,7 @@ typedef struct Signature_ {
//struct SigMatch_ *match_tail; /* non-payload matches, tail of the list */
//struct SigMatch_ *pmatch_tail; /* payload matches, tail of the list */
struct SigMatch_ *umatch_tail; /* uricontent payload matches, tail of the list */
//struct SigMatch_ *umatch_tail; /* uricontent payload matches, tail of the list */
struct SigMatch_ *amatch_tail; /* general app layer matches, tail of the list */
struct SigMatch_ *dmatch_tail; /* dce app layer matches, tail of the list */
struct SigMatch_ *tmatch_tail; /* tag matches, tail of the list */

Write Preview
Loading…
Cancel
Save