From e0476242c6799cb48f3525114e0662cf39d163df Mon Sep 17 00:00:00 2001 From: Anoop Saldanha Date: Fri, 12 Nov 2010 09:04:24 +0530 Subject: [PATCH] replace all Signature->umatch instances in the engine with Signature->sm_lists[DETECT_SM_LIST_UMATCH] --- src/detect-content.c | 2 +- src/detect-depth.c | 2 +- src/detect-distance.c | 2 +- src/detect-engine-mpm.c | 12 ++--- src/detect-engine-siggroup.c | 2 +- src/detect-engine-state.c | 4 +- src/detect-engine-uri.c | 4 +- src/detect-fast-pattern.c | 42 ++++++++--------- src/detect-http-cookie.c | 4 +- src/detect-http-uri.c | 50 ++++++++++---------- src/detect-nocase.c | 2 +- src/detect-offset.c | 2 +- src/detect-parse.c | 36 +++++++-------- src/detect-uricontent.c | 88 ++++++++++++++++++------------------ src/detect-within.c | 4 +- src/detect.c | 12 ++--- src/detect.h | 4 +- 17 files changed, 136 insertions(+), 136 deletions(-) diff --git a/src/detect-content.c b/src/detect-content.c index 70edbff58f..005d131d9e 100644 --- a/src/detect-content.c +++ b/src/detect-content.c @@ -379,7 +379,7 @@ SigMatch *SigMatchGetLastPattern(Signature *s) { BUG_ON(s == NULL); SigMatch *co_sm = DetectContentGetLastPattern(s->sm_lists_tail[DETECT_SM_LIST_PMATCH]); - SigMatch *ur_sm = SigMatchGetLastSM(s->umatch_tail, DETECT_URICONTENT); + SigMatch *ur_sm = SigMatchGetLastSM(s->sm_lists_tail[DETECT_SM_LIST_UMATCH], DETECT_URICONTENT); SigMatch *sm = NULL; if (co_sm != NULL && ur_sm != NULL) { diff --git a/src/detect-depth.c b/src/detect-depth.c index ca2276083c..095d473e35 100644 --- a/src/detect-depth.c +++ b/src/detect-depth.c @@ -85,7 +85,7 @@ static int DetectDepthSetup (DetectEngineCtx *de_ctx, Signature *s, char *depths default: pm = SigMatchGetLastSMFromLists(s, 4, DETECT_CONTENT, s->sm_lists_tail[DETECT_SM_LIST_PMATCH], - DETECT_URICONTENT, s->umatch_tail); + DETECT_URICONTENT, s->sm_lists_tail[DETECT_SM_LIST_UMATCH]); if (pm == NULL) { SCLogError(SC_ERR_DEPTH_MISSING_CONTENT, "depth needs " "preceeding content or uricontent option"); diff --git a/src/detect-distance.c b/src/detect-distance.c index a94716915a..78566f074a 100644 --- a/src/detect-distance.c +++ b/src/detect-distance.c @@ -165,7 +165,7 @@ static int DetectDistanceSetup (DetectEngineCtx *de_ctx, Signature *s, } else { pm = SigMatchGetLastSMFromLists(s, 4, DETECT_CONTENT, s->sm_lists_tail[DETECT_SM_LIST_PMATCH], - DETECT_URICONTENT, s->umatch_tail); + DETECT_URICONTENT, s->sm_lists_tail[DETECT_SM_LIST_UMATCH]); if (pm == NULL) { SCLogError(SC_ERR_WITHIN_MISSING_CONTENT, "within needs" "preceeding content or uricontent option"); diff --git a/src/detect-engine-mpm.c b/src/detect-engine-mpm.c index b2547020d8..3646606b44 100644 --- a/src/detect-engine-mpm.c +++ b/src/detect-engine-mpm.c @@ -1097,7 +1097,7 @@ static int PatternMatchPreprarePopulateMpmUri(DetectEngineCtx *de_ctx, SigGroupH /* get the total no of patterns in this Signature, as well as find out * if we have a fast_pattern set in this Signature */ - for (sm = s->umatch; sm != NULL; sm = sm->next) { + for (sm = s->sm_lists[DETECT_SM_LIST_UMATCH]; sm != NULL; sm = sm->next) { if (sm->type != DETECT_URICONTENT) continue; @@ -1132,7 +1132,7 @@ static int PatternMatchPreprarePopulateMpmUri(DetectEngineCtx *de_ctx, SigGroupH continue; } #endif - for (sm = s->umatch; sm != NULL; sm = sm->next) { + for (sm = s->sm_lists[DETECT_SM_LIST_UMATCH]; sm != NULL; sm = sm->next) { if (sm->type != DETECT_URICONTENT) continue; @@ -1171,13 +1171,13 @@ static int PatternMatchPreprarePopulateMpmUri(DetectEngineCtx *de_ctx, SigGroupH /* now determine which one to add to the mpm phase */ for (sig = 0; sig < sgh->sig_cnt; sig++) { Signature *s = sgh->match_array[sig]; - if (s == NULL || s->umatch == NULL) + if (s == NULL || s->sm_lists[DETECT_SM_LIST_UMATCH] == NULL) continue; UricontentHash *mpm_ch = NULL; SigMatch *sm = NULL; - for (sm = s->umatch; sm != NULL; sm = sm->next) { + for (sm = s->sm_lists[DETECT_SM_LIST_UMATCH]; sm != NULL; sm = sm->next) { if (sm->type != DETECT_URICONTENT) continue; @@ -1333,7 +1333,7 @@ int PatternMatchPrepareGroup(DetectEngineCtx *de_ctx, SigGroupHead *sh) has_co_stream = 1; } - for (sm = s->umatch; sm != NULL; sm = sm->next) { + for (sm = s->sm_lists[DETECT_SM_LIST_UMATCH]; sm != NULL; sm = sm->next) { if (sm->type == DETECT_URICONTENT) { has_co_uri = 1; } @@ -1492,7 +1492,7 @@ int PatternMatchPrepareGroup(DetectEngineCtx *de_ctx, SigGroupHead *sh) !(sh->flags & SIG_GROUP_HEAD_MPM_URI_COPY)) { /* determine the length of the longest pattern */ - for (sm = s->umatch; sm != NULL; sm = sm->next) { + for (sm = s->sm_lists[DETECT_SM_LIST_UMATCH]; sm != NULL; sm = sm->next) { if (sm->type != DETECT_URICONTENT) continue; diff --git a/src/detect-engine-siggroup.c b/src/detect-engine-siggroup.c index 76681cf24f..42a90c3b84 100644 --- a/src/detect-engine-siggroup.c +++ b/src/detect-engine-siggroup.c @@ -1388,7 +1388,7 @@ int SigGroupHeadLoadUricontent(DetectEngineCtx *de_ctx, SigGroupHead *sgh) if (!(s->flags & SIG_FLAG_MPM_URI)) continue; - sm = s->umatch; + sm = s->sm_lists[DETECT_SM_LIST_UMATCH]; if (sm == NULL) continue; diff --git a/src/detect-engine-state.c b/src/detect-engine-state.c index 825d2cfa31..0418299f5d 100644 --- a/src/detect-engine-state.c +++ b/src/detect-engine-state.c @@ -306,7 +306,7 @@ int DeStateDetectStartDetection(ThreadVars *tv, DetectEngineCtx *de_ctx, /* Check the uricontent keywords here. */ if (alproto == ALPROTO_HTTP && (flags & STREAM_TOSERVER)) { - if (s->umatch != NULL) { + if (s->sm_lists[DETECT_SM_LIST_UMATCH] != NULL) { uinspect = 1; SCLogDebug("inspecting uri"); @@ -477,7 +477,7 @@ int DeStateDetectContinueDetection(ThreadVars *tv, DetectEngineCtx *de_ctx, Dete /* first, check uricontent */ if (alproto == ALPROTO_HTTP && (flags & STREAM_TOSERVER)) { - if (s->umatch != NULL) { + if (s->sm_lists[DETECT_SM_LIST_UMATCH] != NULL) { if (!(item->flags & DE_STATE_FLAG_URI_MATCH)) { SCLogDebug("inspecting uri"); uinspect = 1; diff --git a/src/detect-engine-uri.c b/src/detect-engine-uri.c index bfc2433b40..91f1eb4487 100644 --- a/src/detect-engine-uri.c +++ b/src/detect-engine-uri.c @@ -410,7 +410,7 @@ int DetectEngineInspectPacketUris(DetectEngineCtx *de_ctx, } } - sm = s->umatch; + sm = s->sm_lists[DETECT_SM_LIST_UMATCH]; #ifdef DEBUG DetectUricontentData *co = (DetectUricontentData *)sm->ctx; @@ -432,7 +432,7 @@ int DetectEngineInspectPacketUris(DetectEngineCtx *de_ctx, /* Inspect all the uricontents fetched on each * transaction at the app layer */ - r = DoInspectPacketUri(de_ctx, det_ctx, s, s->umatch, + r = DoInspectPacketUri(de_ctx, det_ctx, s, s->sm_lists[DETECT_SM_LIST_UMATCH], (uint8_t *) bstr_ptr(tx->request_uri_normalized), bstr_len(tx->request_uri_normalized)); diff --git a/src/detect-fast-pattern.c b/src/detect-fast-pattern.c index f8458bd1d7..47e9ab743e 100644 --- a/src/detect-fast-pattern.c +++ b/src/detect-fast-pattern.c @@ -107,7 +107,7 @@ static int DetectFastPatternSetup(DetectEngineCtx *de_ctx, Signature *s, char *a DetectContentData *cd = NULL; DetectUricontentData *ud = NULL; - if (s->sm_lists_tail[DETECT_SM_LIST_PMATCH] == NULL && s->umatch_tail == NULL) { + if (s->sm_lists_tail[DETECT_SM_LIST_PMATCH] == NULL && s->sm_lists_tail[DETECT_SM_LIST_UMATCH] == NULL) { SCLogWarning(SC_WARN_COMPATIBILITY, "fast_pattern found inside the " "rule, without a preceding content based keyword. " "Currently we provide fast_pattern support for content " @@ -117,7 +117,7 @@ static int DetectFastPatternSetup(DetectEngineCtx *de_ctx, Signature *s, char *a SigMatch *pm = SigMatchGetLastSMFromLists(s, 4, DETECT_CONTENT, s->sm_lists_tail[DETECT_SM_LIST_PMATCH], - DETECT_URICONTENT, s->umatch_tail); + DETECT_URICONTENT, s->sm_lists_tail[DETECT_SM_LIST_UMATCH]); if (pm == NULL) { SCLogError(SC_ERR_INVALID_SIGNATURE, "fast_pattern found inside " "the rule, without a content context. Please use a " @@ -2046,7 +2046,7 @@ int DetectFastPatternTest54(void) goto end; result = 0; - sm = de_ctx->sig_list->umatch; + sm = de_ctx->sig_list->sm_lists[DETECT_SM_LIST_UMATCH]; while (sm != NULL) { if (sm->type == DETECT_URICONTENT) { if ( ((DetectUricontentData *)sm->ctx)->flags & @@ -2087,7 +2087,7 @@ int DetectFastPatternTest55(void) goto end; result = 0; - sm = de_ctx->sig_list->umatch; + sm = de_ctx->sig_list->sm_lists[DETECT_SM_LIST_UMATCH]; while (sm != NULL) { if (sm->type == DETECT_URICONTENT) { if ( ((DetectUricontentData *)sm->ctx)->flags & @@ -2124,7 +2124,7 @@ int DetectFastPatternTest56(void) goto end; result = 0; - sm = de_ctx->sig_list->umatch; + sm = de_ctx->sig_list->sm_lists[DETECT_SM_LIST_UMATCH]; DetectUricontentData *ud = sm->ctx; if (sm != NULL && sm->type == DETECT_URICONTENT) { if (ud->flags & DETECT_URICONTENT_FAST_PATTERN && @@ -2160,7 +2160,7 @@ int DetectFastPatternTest57(void) goto end; result = 0; - sm = de_ctx->sig_list->umatch; + sm = de_ctx->sig_list->sm_lists[DETECT_SM_LIST_UMATCH]; DetectUricontentData *ud = sm->ctx; if (sm != NULL && sm->type == DETECT_URICONTENT) { if (ud->flags & DETECT_URICONTENT_FAST_PATTERN && @@ -2392,7 +2392,7 @@ int DetectFastPatternTest67(void) if (de_ctx->sig_list == NULL) goto end; - DetectUricontentData *ud = de_ctx->sig_list->umatch_tail->ctx; + DetectUricontentData *ud = de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_UMATCH]->ctx; if (ud->flags & DETECT_URICONTENT_FAST_PATTERN && ud->flags & DETECT_URICONTENT_FAST_PATTERN_ONLY && !(ud->flags & ud->flags & DETECT_URICONTENT_FAST_PATTERN_CHOP) && @@ -2422,7 +2422,7 @@ int DetectFastPatternTest68(void) "(uricontent:one; uricontent:two; within:30; uricontent:two; fast_pattern:only; sid:1;)"); if (de_ctx->sig_list == NULL) goto end; - DetectUricontentData *ud = de_ctx->sig_list->umatch_tail->ctx; + DetectUricontentData *ud = de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_UMATCH]->ctx; if (ud->flags & DETECT_URICONTENT_FAST_PATTERN && ud->flags & DETECT_URICONTENT_FAST_PATTERN_ONLY && !(ud->flags & ud->flags & DETECT_URICONTENT_FAST_PATTERN_CHOP) && @@ -2452,7 +2452,7 @@ int DetectFastPatternTest69(void) "(uricontent:one; uricontent:two; offset:30; uricontent:two; fast_pattern:only; sid:1;)"); if (de_ctx->sig_list == NULL) goto end; - DetectUricontentData *ud = de_ctx->sig_list->umatch_tail->ctx; + DetectUricontentData *ud = de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_UMATCH]->ctx; if (ud->flags & DETECT_URICONTENT_FAST_PATTERN && ud->flags & DETECT_URICONTENT_FAST_PATTERN_ONLY && !(ud->flags & ud->flags & DETECT_URICONTENT_FAST_PATTERN_CHOP) && @@ -2482,7 +2482,7 @@ int DetectFastPatternTest70(void) "(uricontent:one; uricontent:two; depth:30; uricontent:two; fast_pattern:only; sid:1;)"); if (de_ctx->sig_list == NULL) goto end; - DetectUricontentData *ud = de_ctx->sig_list->umatch_tail->ctx; + DetectUricontentData *ud = de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_UMATCH]->ctx; if (ud->flags & DETECT_URICONTENT_FAST_PATTERN && ud->flags & DETECT_URICONTENT_FAST_PATTERN_ONLY && !(ud->flags & ud->flags & DETECT_URICONTENT_FAST_PATTERN_CHOP) && @@ -2512,7 +2512,7 @@ int DetectFastPatternTest71(void) "(uricontent:!one; fast_pattern; uricontent:two; sid:1;)"); if (de_ctx->sig_list == NULL) goto end; - DetectUricontentData *ud = de_ctx->sig_list->umatch_tail->prev->ctx; + DetectUricontentData *ud = de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_UMATCH]->prev->ctx; if (ud->flags & DETECT_URICONTENT_FAST_PATTERN && ud->flags & DETECT_URICONTENT_NEGATED && !(ud->flags & DETECT_URICONTENT_FAST_PATTERN_ONLY) && @@ -2631,7 +2631,7 @@ int DetectFastPatternTest76(void) "(uricontent:one; uricontent:two; fast_pattern:3,4; uricontent:three; sid:1;)"); if (de_ctx->sig_list == NULL) goto end; - DetectUricontentData *ud = de_ctx->sig_list->umatch_tail->prev->ctx; + DetectUricontentData *ud = de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_UMATCH]->prev->ctx; if (ud->flags & DETECT_URICONTENT_FAST_PATTERN && !(ud->flags & DETECT_URICONTENT_FAST_PATTERN_ONLY) && ud->flags & ud->flags & DETECT_URICONTENT_FAST_PATTERN_CHOP && @@ -2661,7 +2661,7 @@ int DetectFastPatternTest77(void) "(uricontent:one; uricontent:two; fast_pattern:3,4; uricontent:three; distance:30; sid:1;)"); if (de_ctx->sig_list == NULL) goto end; - DetectUricontentData *ud = de_ctx->sig_list->umatch_tail->prev->ctx; + DetectUricontentData *ud = de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_UMATCH]->prev->ctx; if (ud->flags & DETECT_URICONTENT_FAST_PATTERN && !(ud->flags & DETECT_URICONTENT_FAST_PATTERN_ONLY) && ud->flags & ud->flags & DETECT_URICONTENT_FAST_PATTERN_CHOP && @@ -2691,7 +2691,7 @@ int DetectFastPatternTest78(void) "(uricontent:one; uricontent:two; fast_pattern:3,4; uricontent:three; within:30; sid:1;)"); if (de_ctx->sig_list == NULL) goto end; - DetectUricontentData *ud = de_ctx->sig_list->umatch_tail->prev->ctx; + DetectUricontentData *ud = de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_UMATCH]->prev->ctx; if (ud->flags & DETECT_URICONTENT_FAST_PATTERN && !(ud->flags & DETECT_URICONTENT_FAST_PATTERN_ONLY) && ud->flags & ud->flags & DETECT_URICONTENT_FAST_PATTERN_CHOP && @@ -2721,7 +2721,7 @@ int DetectFastPatternTest79(void) "(uricontent:one; uricontent:two; fast_pattern:3,4; uricontent:three; offset:30; sid:1;)"); if (de_ctx->sig_list == NULL) goto end; - DetectUricontentData *ud = de_ctx->sig_list->umatch_tail->prev->ctx; + DetectUricontentData *ud = de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_UMATCH]->prev->ctx; if (ud->flags & DETECT_URICONTENT_FAST_PATTERN && !(ud->flags & DETECT_URICONTENT_FAST_PATTERN_ONLY) && ud->flags & ud->flags & DETECT_URICONTENT_FAST_PATTERN_CHOP && @@ -2751,7 +2751,7 @@ int DetectFastPatternTest80(void) "(uricontent:one; uricontent:two; fast_pattern:3,4; uricontent:three; depth:30; sid:1;)"); if (de_ctx->sig_list == NULL) goto end; - DetectUricontentData *ud = de_ctx->sig_list->umatch_tail->prev->ctx; + DetectUricontentData *ud = de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_UMATCH]->prev->ctx; if (ud->flags & DETECT_URICONTENT_FAST_PATTERN && !(ud->flags & DETECT_URICONTENT_FAST_PATTERN_ONLY) && ud->flags & ud->flags & DETECT_URICONTENT_FAST_PATTERN_CHOP && @@ -2781,7 +2781,7 @@ int DetectFastPatternTest81(void) "(uricontent:one; uricontent:two; distance:10; uricontent:three; fast_pattern:3,4; sid:1;)"); if (de_ctx->sig_list == NULL) goto end; - DetectUricontentData *ud = de_ctx->sig_list->umatch_tail->ctx; + DetectUricontentData *ud = de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_UMATCH]->ctx; if (ud->flags & DETECT_URICONTENT_FAST_PATTERN && !(ud->flags & DETECT_URICONTENT_FAST_PATTERN_ONLY) && ud->flags & ud->flags & DETECT_URICONTENT_FAST_PATTERN_CHOP && @@ -2811,7 +2811,7 @@ int DetectFastPatternTest82(void) "(uricontent:one; uricontent:two; within:10; uricontent:three; fast_pattern:3,4; sid:1;)"); if (de_ctx->sig_list == NULL) goto end; - DetectUricontentData *ud = de_ctx->sig_list->umatch_tail->ctx; + DetectUricontentData *ud = de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_UMATCH]->ctx; if (ud->flags & DETECT_URICONTENT_FAST_PATTERN && !(ud->flags & DETECT_URICONTENT_FAST_PATTERN_ONLY) && ud->flags & ud->flags & DETECT_URICONTENT_FAST_PATTERN_CHOP && @@ -2841,7 +2841,7 @@ int DetectFastPatternTest83(void) "(uricontent:one; uricontent:two; offset:10; uricontent:three; fast_pattern:3,4; sid:1;)"); if (de_ctx->sig_list == NULL) goto end; - DetectUricontentData *ud = de_ctx->sig_list->umatch_tail->ctx; + DetectUricontentData *ud = de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_UMATCH]->ctx; if (ud->flags & DETECT_URICONTENT_FAST_PATTERN && !(ud->flags & DETECT_URICONTENT_FAST_PATTERN_ONLY) && ud->flags & ud->flags & DETECT_URICONTENT_FAST_PATTERN_CHOP && @@ -2871,7 +2871,7 @@ int DetectFastPatternTest84(void) "(uricontent:one; uricontent:two; depth:10; uricontent:three; fast_pattern:3,4; sid:1;)"); if (de_ctx->sig_list == NULL) goto end; - DetectUricontentData *ud = de_ctx->sig_list->umatch_tail->ctx; + DetectUricontentData *ud = de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_UMATCH]->ctx; if (ud->flags & DETECT_URICONTENT_FAST_PATTERN && !(ud->flags & DETECT_URICONTENT_FAST_PATTERN_ONLY) && ud->flags & ud->flags & DETECT_URICONTENT_FAST_PATTERN_CHOP && @@ -2970,7 +2970,7 @@ int DetectFastPatternTest88(void) "(uricontent:one; uricontent:!two; fast_pattern:3,4; uricontent:three; sid:1;)"); if (de_ctx->sig_list == NULL) goto end; - DetectUricontentData *ud = de_ctx->sig_list->umatch_tail->prev->ctx; + DetectUricontentData *ud = de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_UMATCH]->prev->ctx; if (ud->flags & DETECT_URICONTENT_FAST_PATTERN && ud->flags & DETECT_URICONTENT_NEGATED && !(ud->flags & DETECT_URICONTENT_FAST_PATTERN_ONLY) && diff --git a/src/detect-http-cookie.c b/src/detect-http-cookie.c index 4bcf2dadbc..47fa4bd75c 100644 --- a/src/detect-http-cookie.c +++ b/src/detect-http-cookie.c @@ -462,12 +462,12 @@ int DetectHttpCookieTest06(void) if (s->amatch->type != DETECT_AL_HTTP_COOKIE) goto end; - if (s->umatch == NULL) { + if (s->sm_lists[DETECT_SM_LIST_UMATCH] == NULL) { printf("expected another SigMatch, got NULL: "); goto end; } - if (s->umatch->type != DETECT_URICONTENT) { + if (s->sm_lists[DETECT_SM_LIST_UMATCH]->type != DETECT_URICONTENT) { goto end; } diff --git a/src/detect-http-uri.c b/src/detect-http-uri.c index d77c938d1a..cd10fbdef5 100644 --- a/src/detect-http-uri.c +++ b/src/detect-http-uri.c @@ -259,7 +259,7 @@ int DetectHttpUriTest03(void) goto end; } - sm = de_ctx->sig_list->umatch; + sm = de_ctx->sig_list->sm_lists[DETECT_SM_LIST_UMATCH]; if (sm == NULL) { printf("no sigmatch(es): "); goto end; @@ -327,16 +327,16 @@ int DetectHttpUriTest05(void) printf("sig failed to parse\n"); goto end; } - if (s->umatch == NULL) + if (s->sm_lists[DETECT_SM_LIST_UMATCH] == NULL) goto end; - if (s->umatch->type != DETECT_URICONTENT) { + if (s->sm_lists[DETECT_SM_LIST_UMATCH]->type != DETECT_URICONTENT) { printf("wrong type\n"); goto end; } char *str = "we are testing http_uri keyword"; - int uricomp = memcmp((const char *)((DetectUricontentData*) s->umatch->ctx)->uricontent, str, strlen(str)-1); - int urilen = ((DetectUricontentData*) s->umatch_tail->ctx)->uricontent_len; + int uricomp = memcmp((const char *)((DetectUricontentData*) s->sm_lists[DETECT_SM_LIST_UMATCH]->ctx)->uricontent, str, strlen(str)-1); + int urilen = ((DetectUricontentData*) s->sm_lists_tail[DETECT_SM_LIST_UMATCH]->ctx)->uricontent_len; if (uricomp != 0 || urilen != strlen("we are testing http_uri keyword")) { printf("sig failed to parse, content not setup properly\n"); @@ -371,13 +371,13 @@ int DetectHttpUriTest06(void) goto end; } - if (de_ctx->sig_list->umatch == NULL) { - printf("de_ctx->sig_list->umatch == NULL\n"); + if (de_ctx->sig_list->sm_lists[DETECT_SM_LIST_UMATCH] == NULL) { + printf("de_ctx->sig_list->sm_lists[DETECT_SM_LIST_UMATCH] == NULL\n"); goto end; } DetectContentData *cd = de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_PMATCH]->ctx; - DetectUricontentData *ud = de_ctx->sig_list->umatch_tail->ctx; + DetectUricontentData *ud = de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_UMATCH]->ctx; if (cd->id == ud->id) goto end; @@ -410,13 +410,13 @@ int DetectHttpUriTest07(void) goto end; } - if (de_ctx->sig_list->umatch == NULL) { - printf("de_ctx->sig_list->umatch == NULL\n"); + if (de_ctx->sig_list->sm_lists[DETECT_SM_LIST_UMATCH] == NULL) { + printf("de_ctx->sig_list->sm_lists[DETECT_SM_LIST_UMATCH] == NULL\n"); goto end; } DetectContentData *cd = de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_PMATCH]->ctx; - DetectUricontentData *ud = de_ctx->sig_list->umatch_tail->ctx; + DetectUricontentData *ud = de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_UMATCH]->ctx; if (cd->id == ud->id) goto end; @@ -449,13 +449,13 @@ int DetectHttpUriTest08(void) goto end; } - if (de_ctx->sig_list->umatch == NULL) { - printf("de_ctx->sig_list->umatch == NULL\n"); + if (de_ctx->sig_list->sm_lists[DETECT_SM_LIST_UMATCH] == NULL) { + printf("de_ctx->sig_list->sm_lists[DETECT_SM_LIST_UMATCH] == NULL\n"); goto end; } DetectContentData *cd = de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_PMATCH]->ctx; - DetectUricontentData *ud = de_ctx->sig_list->umatch_tail->ctx; + DetectUricontentData *ud = de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_UMATCH]->ctx; if (cd->id != 0 || ud->id != 1) goto end; @@ -488,13 +488,13 @@ int DetectHttpUriTest09(void) goto end; } - if (de_ctx->sig_list->umatch == NULL) { - printf("de_ctx->sig_list->umatch == NULL\n"); + if (de_ctx->sig_list->sm_lists[DETECT_SM_LIST_UMATCH] == NULL) { + printf("de_ctx->sig_list->sm_lists[DETECT_SM_LIST_UMATCH] == NULL\n"); goto end; } DetectContentData *cd = de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_PMATCH]->ctx; - DetectUricontentData *ud = de_ctx->sig_list->umatch_tail->ctx; + DetectUricontentData *ud = de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_UMATCH]->ctx; if (cd->id != 1 || ud->id != 0) goto end; @@ -528,14 +528,14 @@ int DetectHttpUriTest10(void) goto end; } - if (de_ctx->sig_list->umatch == NULL) { - printf("de_ctx->sig_list->umatch == NULL\n"); + if (de_ctx->sig_list->sm_lists[DETECT_SM_LIST_UMATCH] == NULL) { + printf("de_ctx->sig_list->sm_lists[DETECT_SM_LIST_UMATCH] == NULL\n"); goto end; } DetectContentData *cd = de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_PMATCH]->ctx; - DetectUricontentData *ud1 = de_ctx->sig_list->umatch_tail->ctx; - DetectUricontentData *ud2 = de_ctx->sig_list->umatch_tail->prev->ctx; + DetectUricontentData *ud1 = de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_UMATCH]->ctx; + DetectUricontentData *ud2 = de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_UMATCH]->prev->ctx; if (cd->id != 1 || ud1->id != 0 || ud2->id != 0) goto end; @@ -569,14 +569,14 @@ int DetectHttpUriTest11(void) goto end; } - if (de_ctx->sig_list->umatch == NULL) { - printf("de_ctx->sig_list->umatch == NULL\n"); + if (de_ctx->sig_list->sm_lists[DETECT_SM_LIST_UMATCH] == NULL) { + printf("de_ctx->sig_list->sm_lists[DETECT_SM_LIST_UMATCH] == NULL\n"); goto end; } DetectContentData *cd = de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_PMATCH]->ctx; - DetectUricontentData *ud1 = de_ctx->sig_list->umatch_tail->ctx; - DetectUricontentData *ud2 = de_ctx->sig_list->umatch_tail->prev->ctx; + DetectUricontentData *ud1 = de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_UMATCH]->ctx; + DetectUricontentData *ud2 = de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_UMATCH]->prev->ctx; if (cd->id != 2 || ud1->id != 0 || ud2->id != 0) goto end; diff --git a/src/detect-nocase.c b/src/detect-nocase.c index c33254162d..964a2e0b2a 100644 --- a/src/detect-nocase.c +++ b/src/detect-nocase.c @@ -71,7 +71,7 @@ static SigMatch *SigMatchGetLastNocasePattern(Signature *s) { BUG_ON(s == NULL); SigMatch *co_sm = DetectContentGetLastPattern(s->sm_lists_tail[DETECT_SM_LIST_PMATCH]); - SigMatch *ur_sm = SigMatchGetLastSM(s->umatch_tail, DETECT_URICONTENT); + SigMatch *ur_sm = SigMatchGetLastSM(s->sm_lists_tail[DETECT_SM_LIST_UMATCH], DETECT_URICONTENT); /* http client body SigMatch */ SigMatch *hcbd_sm = SigMatchGetLastSM(s->amatch_tail, DETECT_AL_HTTP_CLIENT_BODY); /* http cookie SigMatch */ diff --git a/src/detect-offset.c b/src/detect-offset.c index 323bcdc07a..47c4c959dc 100644 --- a/src/detect-offset.c +++ b/src/detect-offset.c @@ -82,7 +82,7 @@ int DetectOffsetSetup (DetectEngineCtx *de_ctx, Signature *s, char *offsetstr) default: pm = SigMatchGetLastSMFromLists(s, 4, DETECT_CONTENT, s->sm_lists_tail[DETECT_SM_LIST_PMATCH], - DETECT_URICONTENT, s->umatch_tail); + DETECT_URICONTENT, s->sm_lists_tail[DETECT_SM_LIST_UMATCH]); if (pm == NULL) { SCLogError(SC_ERR_WITHIN_MISSING_CONTENT, "distance needs" "preceeding content or uricontent option"); diff --git a/src/detect-parse.c b/src/detect-parse.c index 0595f76d6d..080bd74dfc 100644 --- a/src/detect-parse.c +++ b/src/detect-parse.c @@ -175,17 +175,17 @@ void SigMatchAppendAppLayer(Signature *s, SigMatch *new) { * \param new pointer to the SigMatch of type uricontent to be appended */ void SigMatchAppendUricontent(Signature *s, SigMatch *new) { - if (s->umatch == NULL) { - s->umatch = new; - s->umatch_tail = new; + if (s->sm_lists[DETECT_SM_LIST_UMATCH] == NULL) { + s->sm_lists[DETECT_SM_LIST_UMATCH] = new; + s->sm_lists_tail[DETECT_SM_LIST_UMATCH] = new; new->next = NULL; new->prev = NULL; } else { - SigMatch *cur = s->umatch_tail; + SigMatch *cur = s->sm_lists_tail[DETECT_SM_LIST_UMATCH]; cur->next = new; new->prev = cur; new->next = NULL; - s->umatch_tail = new; + s->sm_lists_tail[DETECT_SM_LIST_UMATCH] = new; } new->idx = s->sm_cnt; @@ -388,20 +388,20 @@ void SigMatchReplaceContentToUricontent(Signature *s, SigMatch *old, SigMatch *n /* finally append the "new" sig match to the app layer list */ /** \todo if the app layer gets it's own list, adapt this code */ - if (s->umatch == NULL) { - s->umatch = new; - s->umatch_tail = new; + if (s->sm_lists[DETECT_SM_LIST_UMATCH] == NULL) { + s->sm_lists[DETECT_SM_LIST_UMATCH] = new; + s->sm_lists_tail[DETECT_SM_LIST_UMATCH] = new; new->next = NULL; new->prev = NULL; } else { - SigMatch *cur = s->umatch; + SigMatch *cur = s->sm_lists[DETECT_SM_LIST_UMATCH]; for ( ; cur->next != NULL; cur = cur->next); cur->next = new; new->next = NULL; new->prev = cur; - s->umatch_tail = new; + s->sm_lists_tail[DETECT_SM_LIST_UMATCH] = new; } /* move over the idx */ @@ -1058,7 +1058,7 @@ void SigFree(Signature *s) { sm = nsm; } - sm = s->umatch; + sm = s->sm_lists[DETECT_SM_LIST_UMATCH]; while (sm != NULL) { nsm = sm->next; SigMatchFree(sm); @@ -1288,7 +1288,7 @@ Signature *SigInit(DetectEngineCtx *de_ctx, char *sigstr) { sig->flags |= SIG_FLAG_MPM; } } - for (sm = sig->umatch; sm != NULL; sm = sm->next) { + for (sm = sig->sm_lists[DETECT_SM_LIST_UMATCH]; sm != NULL; sm = sm->next) { if (sm->type == DETECT_URICONTENT) { DetectUricontentData *ud = (DetectUricontentData *)sm->ctx; if (ud == NULL) @@ -1324,7 +1324,7 @@ Signature *SigInit(DetectEngineCtx *de_ctx, char *sigstr) { if (sig->flags & SIG_FLAG_MPM_URI) { sig->mpm_uricontent_maxlen = 0; - for (sm = sig->umatch; sm != NULL; sm = sm->next) { + for (sm = sig->sm_lists[DETECT_SM_LIST_UMATCH]; sm != NULL; sm = sm->next) { if (sm->type == DETECT_URICONTENT) { DetectUricontentData *ud = (DetectUricontentData *)sm->ctx; if (ud == NULL) @@ -1355,7 +1355,7 @@ Signature *SigInit(DetectEngineCtx *de_ctx, char *sigstr) { } } - if (sig->umatch) + if (sig->sm_lists[DETECT_SM_LIST_UMATCH]) sig->flags |= SIG_FLAG_UMATCH; if (sig->dmatch) sig->flags |= SIG_FLAG_AMATCH; @@ -1430,7 +1430,7 @@ Signature *SigInitReal(DetectEngineCtx *de_ctx, char *sigstr) { sig->flags |= SIG_FLAG_MPM; } } - for (sm = sig->umatch; sm != NULL; sm = sm->next) { + for (sm = sig->sm_lists[DETECT_SM_LIST_UMATCH]; sm != NULL; sm = sm->next) { if (sm->type == DETECT_URICONTENT) { DetectUricontentData *ud = (DetectUricontentData *)sm->ctx; if (ud == NULL) @@ -1466,7 +1466,7 @@ Signature *SigInitReal(DetectEngineCtx *de_ctx, char *sigstr) { if (sig->flags & SIG_FLAG_MPM_URI) { sig->mpm_uricontent_maxlen = 0; - for (sm = sig->umatch; sm != NULL; sm = sm->next) { + for (sm = sig->sm_lists[DETECT_SM_LIST_UMATCH]; sm != NULL; sm = sm->next) { if (sm->type == DETECT_URICONTENT) { DetectUricontentData *ud = (DetectUricontentData *)sm->ctx; if (ud == NULL) @@ -1515,7 +1515,7 @@ Signature *SigInitReal(DetectEngineCtx *de_ctx, char *sigstr) { if (sig->next->flags & SIG_FLAG_MPM_URI) { sig->next->mpm_uricontent_maxlen = 0; - for (sm = sig->next->umatch; sm != NULL; sm = sm->next) { + for (sm = sig->next->sm_lists[DETECT_SM_LIST_UMATCH]; sm != NULL; sm = sm->next) { if (sm->type == DETECT_URICONTENT) { DetectUricontentData *ud = (DetectUricontentData *)sm->ctx; if (ud == NULL) @@ -1547,7 +1547,7 @@ Signature *SigInitReal(DetectEngineCtx *de_ctx, char *sigstr) { } } - if (sig->umatch) + if (sig->sm_lists[DETECT_SM_LIST_UMATCH]) sig->flags |= SIG_FLAG_UMATCH; if (sig->dmatch) sig->flags |= SIG_FLAG_AMATCH; diff --git a/src/detect-uricontent.c b/src/detect-uricontent.c index 1237cf82d0..33ee385ff5 100644 --- a/src/detect-uricontent.c +++ b/src/detect-uricontent.c @@ -804,9 +804,9 @@ int DetectUriSigTest01(void) SigGroupBuild(de_ctx); DetectEngineThreadCtxInit(&th_v, (void *)de_ctx, (void *)&det_ctx); - BUG_ON(de_ctx->sig_list == NULL); + BUG_ON(de_ctx->sig_list->sm_lists[DETECT_SM_LIST_UMATCH] == NULL); - sm = de_ctx->sig_list->umatch; + sm = de_ctx->sig_list->sm_lists[DETECT_SM_LIST_UMATCH]; if (sm->type == DETECT_URICONTENT) { result = 1; } else { @@ -1073,7 +1073,7 @@ static int DetectUriSigTest04(void) { "\" Test uricontent\"; " "uricontent:\"foo\"; sid:1;)"); if (s == NULL || - s->umatch == NULL || + s->sm_lists[DETECT_SM_LIST_UMATCH] == NULL || s->sm_lists[DETECT_SM_LIST_PMATCH] != NULL || s->sm_lists[DETECT_SM_LIST_MATCH] != NULL) { @@ -1085,7 +1085,7 @@ static int DetectUriSigTest04(void) { "\" Test uricontent and content\"; " "uricontent:\"foo\"; content:\"bar\";sid:1;)"); if (s == NULL || - s->umatch == NULL || + s->sm_lists[DETECT_SM_LIST_UMATCH] == NULL || s->sm_lists[DETECT_SM_LIST_PMATCH] == NULL || s->sm_lists[DETECT_SM_LIST_MATCH] != NULL) { @@ -1098,7 +1098,7 @@ static int DetectUriSigTest04(void) { "uricontent:\"foo\"; content:\"bar\";" " depth:10; offset: 5; sid:1;)"); if (s == NULL || - s->umatch == NULL || + s->sm_lists[DETECT_SM_LIST_UMATCH] == NULL || s->sm_lists[DETECT_SM_LIST_PMATCH] == NULL || ((DetectContentData *)s->sm_lists[DETECT_SM_LIST_PMATCH]->ctx)->depth != 15 || ((DetectContentData *)s->sm_lists[DETECT_SM_LIST_PMATCH]->ctx)->offset != 5 || @@ -1113,10 +1113,10 @@ static int DetectUriSigTest04(void) { "content:\"foo\"; uricontent:\"bar\";" " depth:10; offset: 5; sid:1;)"); if (s == NULL || - s->umatch == NULL || + s->sm_lists[DETECT_SM_LIST_UMATCH] == NULL || s->sm_lists[DETECT_SM_LIST_PMATCH] == NULL || - ((DetectUricontentData *)s->umatch->ctx)->depth != 15 || - ((DetectUricontentData *)s->umatch->ctx)->offset != 5 || + ((DetectUricontentData *)s->sm_lists[DETECT_SM_LIST_UMATCH]->ctx)->depth != 15 || + ((DetectUricontentData *)s->sm_lists[DETECT_SM_LIST_UMATCH]->ctx)->offset != 5 || s->sm_lists[DETECT_SM_LIST_MATCH] != NULL) { printf("sig 4 failed to parse: "); @@ -1148,7 +1148,7 @@ static int DetectUriSigTest04(void) { "\"two_contents\"; within:30; sid:1;)"); if (s == NULL) { goto end; - } else if (s->umatch == NULL || + } else if (s->sm_lists[DETECT_SM_LIST_UMATCH] == NULL || s->sm_lists[DETECT_SM_LIST_PMATCH] == NULL || ((DetectContentData*) s->sm_lists[DETECT_SM_LIST_PMATCH]->ctx)->depth != 15 || ((DetectContentData*) s->sm_lists[DETECT_SM_LIST_PMATCH]->ctx)->offset != 5 || @@ -1167,15 +1167,15 @@ static int DetectUriSigTest04(void) { "\"two_uricontents\"; within:30; sid:1;)"); if (s == NULL) { goto end; - } else if (s->umatch == NULL || + } else if (s->sm_lists[DETECT_SM_LIST_UMATCH] == NULL || s->sm_lists[DETECT_SM_LIST_PMATCH] == NULL || ((DetectContentData*) s->sm_lists[DETECT_SM_LIST_PMATCH]->ctx)->depth != 15 || ((DetectContentData*) s->sm_lists[DETECT_SM_LIST_PMATCH]->ctx)->offset != 5 || - ((DetectUricontentData*) s->umatch_tail->ctx)->within != 30 || + ((DetectUricontentData*) s->sm_lists_tail[DETECT_SM_LIST_UMATCH]->ctx)->within != 30 || s->sm_lists[DETECT_SM_LIST_MATCH] != NULL) { printf("sig 8 failed to parse: "); - DetectUricontentPrint((DetectUricontentData*) s->umatch_tail->ctx); + DetectUricontentPrint((DetectUricontentData*) s->sm_lists_tail[DETECT_SM_LIST_UMATCH]->ctx); goto end; } @@ -1187,7 +1187,7 @@ static int DetectUriSigTest04(void) { if (s == NULL) { goto end; } else if ( - s->umatch == NULL || + s->sm_lists[DETECT_SM_LIST_UMATCH] == NULL || s->sm_lists[DETECT_SM_LIST_PMATCH] == NULL || ((DetectContentData*) s->sm_lists[DETECT_SM_LIST_PMATCH]->ctx)->depth != 15 || ((DetectContentData*) s->sm_lists[DETECT_SM_LIST_PMATCH]->ctx)->offset != 5 || @@ -1207,15 +1207,15 @@ static int DetectUriSigTest04(void) { if (s == NULL) { goto end; } else if ( - s->umatch == NULL || + s->sm_lists[DETECT_SM_LIST_UMATCH] == NULL || s->sm_lists[DETECT_SM_LIST_PMATCH] == NULL || ((DetectContentData*) s->sm_lists[DETECT_SM_LIST_PMATCH]->ctx)->depth != 15 || ((DetectContentData*) s->sm_lists[DETECT_SM_LIST_PMATCH]->ctx)->offset != 5 || - ((DetectUricontentData*) s->umatch_tail->ctx)->distance != 30 || + ((DetectUricontentData*) s->sm_lists_tail[DETECT_SM_LIST_UMATCH]->ctx)->distance != 30 || s->sm_lists[DETECT_SM_LIST_MATCH] != NULL) { printf("sig 10 failed to parse: "); - DetectUricontentPrint((DetectUricontentData*) s->umatch_tail->ctx); + DetectUricontentPrint((DetectUricontentData*) s->sm_lists_tail[DETECT_SM_LIST_UMATCH]->ctx); goto end; } @@ -1231,21 +1231,21 @@ static int DetectUriSigTest04(void) { goto end; } - if (s->umatch == NULL || s->sm_lists[DETECT_SM_LIST_PMATCH] == NULL) { - printf("umatch %p or pmatch %p: ", s->umatch, s->sm_lists[DETECT_SM_LIST_PMATCH]); + if (s->sm_lists[DETECT_SM_LIST_UMATCH] == NULL || s->sm_lists[DETECT_SM_LIST_PMATCH] == NULL) { + printf("umatch %p or pmatch %p: ", s->sm_lists[DETECT_SM_LIST_UMATCH], s->sm_lists[DETECT_SM_LIST_PMATCH]); goto end; } if ( ((DetectContentData*) s->sm_lists[DETECT_SM_LIST_PMATCH]->ctx)->depth != 15 || ((DetectContentData*) s->sm_lists[DETECT_SM_LIST_PMATCH]->ctx)->offset != 5 || - ((DetectUricontentData*) s->umatch_tail->ctx)->distance != 30 || - ((DetectUricontentData*) s->umatch_tail->ctx)->within != 60 || + ((DetectUricontentData*) s->sm_lists_tail[DETECT_SM_LIST_UMATCH]->ctx)->distance != 30 || + ((DetectUricontentData*) s->sm_lists_tail[DETECT_SM_LIST_UMATCH]->ctx)->within != 60 || ((DetectContentData*) s->sm_lists_tail[DETECT_SM_LIST_PMATCH]->ctx)->distance != 45 || ((DetectContentData*) s->sm_lists_tail[DETECT_SM_LIST_PMATCH]->ctx)->within != 70 || s->sm_lists[DETECT_SM_LIST_MATCH] != NULL) { printf("sig 10 failed to parse, content not setup properly: "); DetectContentPrint((DetectContentData*) s->sm_lists[DETECT_SM_LIST_PMATCH]->ctx); - DetectUricontentPrint((DetectUricontentData*) s->umatch_tail->ctx); + DetectUricontentPrint((DetectUricontentData*) s->sm_lists_tail[DETECT_SM_LIST_UMATCH]->ctx); DetectContentPrint((DetectContentData*) s->sm_lists_tail[DETECT_SM_LIST_PMATCH]->ctx); goto end; } @@ -1775,13 +1775,13 @@ int DetectUriSigTest12(void) goto end; } - if (s->umatch_tail == NULL && s->umatch_tail->ctx) { + if (s->sm_lists_tail[DETECT_SM_LIST_UMATCH] == NULL && s->sm_lists_tail[DETECT_SM_LIST_UMATCH]->ctx) { printf("de_ctx->pmatch_tail == NULL && de_ctx->pmatch_tail->ctx\n"); result = 0; goto end; } - ud = (DetectUricontentData *)s->umatch_tail->ctx; + ud = (DetectUricontentData *)s->sm_lists_tail[DETECT_SM_LIST_UMATCH]->ctx; result = (strncmp("boo", (char *)ud->uricontent, ud->uricontent_len) == 0); end: @@ -2133,13 +2133,13 @@ int DetectUricontentSigTest08(void) goto end; } - if (de_ctx->sig_list->umatch == NULL) { - printf("de_ctx->sig_list->umatch == NULL\n"); + if (de_ctx->sig_list->sm_lists[DETECT_SM_LIST_UMATCH] == NULL) { + printf("de_ctx->sig_list->sm_lists[DETECT_SM_LIST_UMATCH] == NULL\n"); goto end; } DetectContentData *cd = de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_PMATCH]->ctx; - DetectUricontentData *ud = de_ctx->sig_list->umatch_tail->ctx; + DetectUricontentData *ud = de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_UMATCH]->ctx; if (cd->id == ud->id) goto end; @@ -2172,13 +2172,13 @@ int DetectUricontentSigTest09(void) goto end; } - if (de_ctx->sig_list->umatch == NULL) { - printf("de_ctx->sig_list->umatch == NULL\n"); + if (de_ctx->sig_list->sm_lists[DETECT_SM_LIST_UMATCH] == NULL) { + printf("de_ctx->sig_list->sm_lists[DETECT_SM_LIST_UMATCH] == NULL\n"); goto end; } DetectContentData *cd = de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_PMATCH]->ctx; - DetectUricontentData *ud = de_ctx->sig_list->umatch_tail->ctx; + DetectUricontentData *ud = de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_UMATCH]->ctx; if (cd->id == ud->id) goto end; @@ -2212,16 +2212,16 @@ int DetectUricontentSigTest10(void) goto end; } - if (de_ctx->sig_list->umatch == NULL) { - printf("de_ctx->sig_list->umatch == NULL\n"); + if (de_ctx->sig_list->sm_lists[DETECT_SM_LIST_UMATCH] == NULL) { + printf("de_ctx->sig_list->sm_lists[DETECT_SM_LIST_UMATCH] == NULL\n"); goto end; } DetectContentData *cd1 = de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_PMATCH]->prev->prev->ctx; DetectContentData *cd2 = de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_PMATCH]->prev->ctx; DetectContentData *cd3 = de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_PMATCH]->ctx; - DetectUricontentData *ud1 = de_ctx->sig_list->umatch_tail->prev->ctx; - DetectUricontentData *ud2 = de_ctx->sig_list->umatch_tail->ctx; + DetectUricontentData *ud1 = de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_UMATCH]->prev->ctx; + DetectUricontentData *ud2 = de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_UMATCH]->ctx; if (cd1->id != 1 || cd2->id != 2 || cd3->id != 1 || ud1->id != 0 || ud2->id != 0) goto end; @@ -2255,16 +2255,16 @@ int DetectUricontentSigTest11(void) goto end; } - if (de_ctx->sig_list->umatch == NULL) { - printf("de_ctx->sig_list->umatch == NULL\n"); + if (de_ctx->sig_list->sm_lists[DETECT_SM_LIST_UMATCH] == NULL) { + printf("de_ctx->sig_list->sm_lists[DETECT_SM_LIST_UMATCH] == NULL\n"); goto end; } DetectContentData *cd1 = de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_PMATCH]->prev->prev->ctx; DetectContentData *cd2 = de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_PMATCH]->prev->ctx; DetectContentData *cd3 = de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_PMATCH]->ctx; - DetectUricontentData *ud1 = de_ctx->sig_list->umatch_tail->prev->ctx; - DetectUricontentData *ud2 = de_ctx->sig_list->umatch_tail->ctx; + DetectUricontentData *ud1 = de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_UMATCH]->prev->ctx; + DetectUricontentData *ud2 = de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_UMATCH]->ctx; if (cd1->id != 1 || cd2->id != 2 || cd3->id != 1 || ud1->id != 0 || ud2->id != 0) goto end; @@ -2300,8 +2300,8 @@ int DetectUricontentSigTest12(void) goto end; } - if (de_ctx->sig_list->umatch == NULL) { - printf("de_ctx->sig_list->umatch == NULL\n"); + if (de_ctx->sig_list->sm_lists[DETECT_SM_LIST_UMATCH] == NULL) { + printf("de_ctx->sig_list->sm_lists[DETECT_SM_LIST_UMATCH] == NULL\n"); goto end; } @@ -2310,11 +2310,11 @@ int DetectUricontentSigTest12(void) DetectContentData *cd3 = de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_PMATCH]->prev->prev->ctx; DetectContentData *cd4 = de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_PMATCH]->prev->ctx; DetectContentData *cd5 = de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_PMATCH]->ctx; - DetectUricontentData *ud1 = de_ctx->sig_list->umatch_tail->prev->prev->prev->prev->ctx; - DetectUricontentData *ud2 = de_ctx->sig_list->umatch_tail->prev->prev->prev->ctx; - DetectUricontentData *ud3 = de_ctx->sig_list->umatch_tail->prev->prev->ctx; - DetectUricontentData *ud4 = de_ctx->sig_list->umatch_tail->prev->ctx; - DetectUricontentData *ud5 = de_ctx->sig_list->umatch_tail->ctx; + DetectUricontentData *ud1 = de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_UMATCH]->prev->prev->prev->prev->ctx; + DetectUricontentData *ud2 = de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_UMATCH]->prev->prev->prev->ctx; + DetectUricontentData *ud3 = de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_UMATCH]->prev->prev->ctx; + DetectUricontentData *ud4 = de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_UMATCH]->prev->ctx; + DetectUricontentData *ud5 = de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_UMATCH]->ctx; if (cd1->id != 1 || cd2->id != 2 || cd3->id != 1 || cd4->id != 1 || cd5->id != 4 || ud1->id != 0 || ud2->id != 0 || ud3->id != 0 || ud4->id != 0 || ud5->id != 3) { goto end; diff --git a/src/detect-within.c b/src/detect-within.c index 7359e0fdc4..5f98ff39d5 100644 --- a/src/detect-within.c +++ b/src/detect-within.c @@ -167,8 +167,8 @@ static int DetectWithinSetup (DetectEngineCtx *de_ctx, Signature *s, char *withi } } else { pm = SigMatchGetLastSMFromLists(s, 4, - DETECT_CONTENT, s->sm_lists_tail[DETECT_SM_LIST_PMATCH], - DETECT_URICONTENT, s->umatch_tail); + DETECT_CONTENT, s->sm_lists_tail[DETECT_SM_LIST_PMATCH], + DETECT_URICONTENT, s->sm_lists_tail[DETECT_SM_LIST_UMATCH]); if (pm == NULL) { SCLogError(SC_ERR_WITHIN_MISSING_CONTENT, "within needs" "preceeding content or uricontent option"); diff --git a/src/detect.c b/src/detect.c index d8329304a6..da0761fc5b 100644 --- a/src/detect.c +++ b/src/detect.c @@ -1141,10 +1141,10 @@ int SigMatchSignatures(ThreadVars *th_v, DetectEngineCtx *de_ctx, DetectEngineTh } } - SCLogDebug("s->amatch %p, s->umatch %p, s->dmatch %p", - s->amatch, s->umatch, s->dmatch); + SCLogDebug("s->amatch %p, s->sm_lists[DETECT_SM_LIST_UMATCH] %p, s->dmatch %p", + s->amatch, s->sm_lists[DETECT_SM_LIST_UMATCH], s->dmatch); - if (s->amatch != NULL || s->umatch != NULL || s->dmatch != NULL) { + if (s->amatch != NULL || s->sm_lists[DETECT_SM_LIST_UMATCH] != NULL || s->dmatch != NULL) { if (alstate == NULL) { SCLogDebug("state matches but no state, we can't match"); goto next; @@ -1448,7 +1448,7 @@ int SignatureIsIPOnly(DetectEngineCtx *de_ctx, Signature *s) { if (s->sm_lists[DETECT_SM_LIST_PMATCH] != NULL) return 0; - if (s->umatch != NULL) + if (s->sm_lists[DETECT_SM_LIST_UMATCH] != NULL) return 0; if (s->amatch != NULL) @@ -1516,7 +1516,7 @@ static int SignatureIsDEOnly(DetectEngineCtx *de_ctx, Signature *s) { if (s->sm_lists[DETECT_SM_LIST_PMATCH] != NULL) return 0; - if (s->umatch != NULL) + if (s->sm_lists[DETECT_SM_LIST_UMATCH] != NULL) return 0; if (s->amatch != NULL) @@ -1604,7 +1604,7 @@ static int SignatureCreateMask(Signature *s) { SCLogDebug("sig requires dce state"); } - if (s->umatch != NULL) { + if (s->sm_lists[DETECT_SM_LIST_UMATCH] != NULL) { s->mask |= SIG_MASK_REQUIRE_HTTP_STATE; SCLogDebug("sig requires dce http state"); } diff --git a/src/detect.h b/src/detect.h index aee50f3fc7..d68d16ba45 100644 --- a/src/detect.h +++ b/src/detect.h @@ -359,7 +359,7 @@ typedef struct Signature_ { /** ptr to the SigMatch lists */ //struct SigMatch_ *pmatch; /* payload matches */ - struct SigMatch_ *umatch; /* uricontent payload matches */ + //struct SigMatch_ *umatch; /* uricontent payload matches */ struct SigMatch_ *amatch; /* general app layer matches */ struct SigMatch_ *dmatch; /* dce app layer matches */ //struct SigMatch_ *match; /* non-payload matches */ @@ -413,7 +413,7 @@ typedef struct Signature_ { //struct SigMatch_ *match_tail; /* non-payload matches, tail of the list */ //struct SigMatch_ *pmatch_tail; /* payload matches, tail of the list */ - struct SigMatch_ *umatch_tail; /* uricontent payload matches, tail of the list */ + //struct SigMatch_ *umatch_tail; /* uricontent payload matches, tail of the list */ struct SigMatch_ *amatch_tail; /* general app layer matches, tail of the list */ struct SigMatch_ *dmatch_tail; /* dce app layer matches, tail of the list */ struct SigMatch_ *tmatch_tail; /* tag matches, tail of the list */