aiden
/
suricata
mirror of https://github.com/OISF/suricata
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

replace all Signature->pmatch instances in the engine with Signature->sm_lists[DETECT_SM_LIST_PMATCH]

Browse Source
remotes/origin/master-1.1.x
Anoop Saldanha 16 years ago committed by Victor Julien
parent 82fd581b64
commit e54358a9e1
26 changed files with 345 additions and 339 deletions
Show Stats Download Patch File Download Diff File

8
src/detect-bytejump.c
Unescape Escape View File

@ -553,9 +553,9 @@ int DetectBytejumpSetup(DetectEngineCtx *de_ctx, Signature *s, char *optstr)
SigMatch *dm = NULL;
pm = SigMatchGetLastSMFromLists(s, 6,
DETECT_CONTENT, s->pmatch_tail,
DETECT_PCRE, s->pmatch_tail,
DETECT_BYTEJUMP, s->pmatch_tail);
DETECT_CONTENT, s->sm_lists_tail[DETECT_SM_LIST_PMATCH],
DETECT_PCRE, s->sm_lists_tail[DETECT_SM_LIST_PMATCH],
DETECT_BYTEJUMP, s->sm_lists_tail[DETECT_SM_LIST_PMATCH]);
dm = SigMatchGetLastSMFromLists(s, 6,
DETECT_CONTENT, s->dmatch_tail,
DETECT_PCRE, s->dmatch_tail,
@ -853,7 +853,7 @@ int DetectBytejumpTestParse09(void) {
result &= (DetectBytejumpSetup(NULL, s, "4,0, string, oct, dce") == -1);
result &= (DetectBytejumpSetup(NULL, s, "4,0, string, hex, dce") == -1);
result &= (DetectBytejumpSetup(NULL, s, "4,0, from_beginning, dce") == -1);
result &= (s->dmatch == NULL && s->pmatch != NULL);
result &= (s->dmatch == NULL && s->sm_lists[DETECT_SM_LIST_PMATCH] != NULL);
SigFree(s);
return result;

6
src/detect-bytetest.c
Unescape Escape View File

@ -583,9 +583,9 @@ int DetectBytetestSetup(DetectEngineCtx *de_ctx, Signature *s, char *optstr)
SigMatch *dm = NULL;
pm = SigMatchGetLastSMFromLists(s, 6,
DETECT_CONTENT, s->pmatch_tail,
DETECT_PCRE, s->pmatch_tail,
DETECT_BYTEJUMP, s->pmatch_tail);
DETECT_CONTENT, s->sm_lists_tail[DETECT_SM_LIST_PMATCH],
DETECT_PCRE, s->sm_lists_tail[DETECT_SM_LIST_PMATCH],
DETECT_BYTEJUMP, s->sm_lists_tail[DETECT_SM_LIST_PMATCH]);
dm = SigMatchGetLastSMFromLists(s, 6,
DETECT_CONTENT, s->dmatch_tail,
DETECT_PCRE, s->dmatch_tail,

32
src/detect-content.c
Unescape Escape View File

@ -378,7 +378,7 @@ SigMatch *SigMatchGetLastPattern(Signature *s) {
BUG_ON(s == NULL);
SigMatch *co_sm = DetectContentGetLastPattern(s->pmatch_tail);
SigMatch *co_sm = DetectContentGetLastPattern(s->sm_lists_tail[DETECT_SM_LIST_PMATCH]);
SigMatch *ur_sm = SigMatchGetLastSM(s->umatch_tail, DETECT_URICONTENT);
SigMatch *sm = NULL;
@ -707,8 +707,8 @@ int DetectContentLongPatternMatchTest(uint8_t *raw_eth_pkt, uint16_t pktsize, ch
}
de_ctx->sig_list->next = NULL;
if (de_ctx->sig_list->pmatch_tail->type == DETECT_CONTENT) {
DetectContentData *co = (DetectContentData *)de_ctx->sig_list->pmatch_tail->ctx;
if (de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_PMATCH]->type == DETECT_CONTENT) {
DetectContentData *co = (DetectContentData *)de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_PMATCH]->ctx;
if (co->flags & DETECT_CONTENT_RELATIVE_NEXT) {
printf("relative next flag set on final match which is content: ");
goto end;
@ -1097,13 +1097,13 @@ int DetectContentParseTest18(void)
s->alproto = ALPROTO_DCERPC;
result &= (DetectContentSetup(de_ctx, s, "one") == 0);
result &= (s->dmatch == NULL && s->pmatch != NULL);
result &= (s->dmatch == NULL && s->sm_lists[DETECT_SM_LIST_PMATCH] != NULL);
SigFree(s);
s = SigAlloc();
result &= (DetectContentSetup(de_ctx, s, "one") == 0);
result &= (s->dmatch == NULL && s->pmatch != NULL);
result &= (s->dmatch == NULL && s->sm_lists[DETECT_SM_LIST_PMATCH] != NULL);
end:
SigFree(s);
@ -1142,7 +1142,7 @@ int DetectContentParseTest19(void)
goto end;
}
result &= (s->dmatch_tail->type == DETECT_CONTENT);
result &= (s->pmatch == NULL);
result &= (s->sm_lists[DETECT_SM_LIST_PMATCH] == NULL);
data = (DetectContentData *)s->dmatch_tail->ctx;
if (data->flags & DETECT_CONTENT_RAWBYTES ||
data->flags & DETECT_CONTENT_NOCASE ||
@ -1170,7 +1170,7 @@ int DetectContentParseTest19(void)
goto end;
}
result &= (s->dmatch_tail->type == DETECT_CONTENT);
result &= (s->pmatch == NULL);
result &= (s->sm_lists[DETECT_SM_LIST_PMATCH] == NULL);
data = (DetectContentData *)s->dmatch_tail->ctx;
if (data->flags & DETECT_CONTENT_RAWBYTES ||
data->flags & DETECT_CONTENT_NOCASE ||
@ -1200,7 +1200,7 @@ int DetectContentParseTest19(void)
goto end;
}
result &= (s->dmatch_tail->type == DETECT_CONTENT);
result &= (s->pmatch == NULL);
result &= (s->sm_lists[DETECT_SM_LIST_PMATCH] == NULL);
data = (DetectContentData *)s->dmatch_tail->ctx;
if (data->flags & DETECT_CONTENT_RAWBYTES ||
data->flags & DETECT_CONTENT_NOCASE ||
@ -1242,7 +1242,7 @@ int DetectContentParseTest19(void)
goto end;
}
result &= (s->dmatch_tail->type == DETECT_CONTENT);
result &= (s->pmatch == NULL);
result &= (s->sm_lists[DETECT_SM_LIST_PMATCH] == NULL);
data = (DetectContentData *)s->dmatch_tail->ctx;
if (data->flags & DETECT_CONTENT_RAWBYTES ||
data->flags & DETECT_CONTENT_NOCASE ||
@ -1272,7 +1272,7 @@ int DetectContentParseTest19(void)
goto end;
}
result &= (s->dmatch_tail->type == DETECT_CONTENT);
result &= (s->pmatch == NULL);
result &= (s->sm_lists[DETECT_SM_LIST_PMATCH] == NULL);
data = (DetectContentData *)s->dmatch_tail->ctx;
if (data->flags & DETECT_CONTENT_RAWBYTES ||
data->flags & DETECT_CONTENT_NOCASE ||
@ -1301,7 +1301,7 @@ int DetectContentParseTest19(void)
goto end;
}
result &= (s->dmatch_tail->type == DETECT_CONTENT);
result &= (s->pmatch == NULL);
result &= (s->sm_lists[DETECT_SM_LIST_PMATCH] == NULL);
data = (DetectContentData *)s->dmatch_tail->ctx;
if (data->flags & DETECT_CONTENT_RAWBYTES ||
data->flags & DETECT_CONTENT_NOCASE ||
@ -1330,7 +1330,7 @@ int DetectContentParseTest19(void)
goto end;
}
result &= (s->dmatch_tail->type == DETECT_CONTENT);
result &= (s->pmatch == NULL);
result &= (s->sm_lists[DETECT_SM_LIST_PMATCH] == NULL);
data = (DetectContentData *)s->dmatch_tail->ctx;
if (data->flags & DETECT_CONTENT_RAWBYTES ||
data->flags & DETECT_CONTENT_NOCASE ||
@ -1359,7 +1359,7 @@ int DetectContentParseTest19(void)
goto end;
}
result &= (s->dmatch_tail->type == DETECT_CONTENT);
result &= (s->pmatch == NULL);
result &= (s->sm_lists[DETECT_SM_LIST_PMATCH] == NULL);
data = (DetectContentData *)s->dmatch_tail->ctx;
if (data->flags & DETECT_CONTENT_RAWBYTES ||
data->flags & DETECT_CONTENT_NOCASE ||
@ -1385,7 +1385,7 @@ int DetectContentParseTest19(void)
result = 0;
goto end;
}
result &= (s->pmatch != NULL);
result &= (s->sm_lists[DETECT_SM_LIST_PMATCH] != NULL);
end:
SigGroupCleanup(de_ctx);
@ -1535,13 +1535,13 @@ int DetectContentParseTest24(void)
goto end;
}
if (s->pmatch_tail == NULL && s->pmatch_tail->ctx) {
if (s->sm_lists_tail[DETECT_SM_LIST_PMATCH] == NULL && s->sm_lists_tail[DETECT_SM_LIST_PMATCH]->ctx) {
printf("de_ctx->pmatch_tail == NULL && de_ctx->pmatch_tail->ctx\n");
result = 0;
goto end;
}
cd = (DetectContentData *)s->pmatch_tail->ctx;
cd = (DetectContentData *)s->sm_lists_tail[DETECT_SM_LIST_PMATCH]->ctx;
result = (strncmp("boo", (char *)cd->content, cd->content_len) == 0);
end:

4
src/detect-depth.c
Unescape Escape View File

@ -71,7 +71,7 @@ static int DetectDepthSetup (DetectEngineCtx *de_ctx, Signature *s, char *depths
/* add to the latest content keyword from either dmatch or pmatch */
pm = SigMatchGetLastSMFromLists(s, 4,
DETECT_CONTENT, s->dmatch_tail,
DETECT_CONTENT, s->pmatch_tail);
DETECT_CONTENT, s->sm_lists_tail[DETECT_SM_LIST_PMATCH]);
if (pm == NULL) {
SCLogError(SC_ERR_DEPTH_MISSING_CONTENT, "depth needs "
"preceeding content option for dcerpc sig");
@ -84,7 +84,7 @@ static int DetectDepthSetup (DetectEngineCtx *de_ctx, Signature *s, char *depths
default:
pm = SigMatchGetLastSMFromLists(s, 4,
DETECT_CONTENT, s->pmatch_tail,
DETECT_CONTENT, s->sm_lists_tail[DETECT_SM_LIST_PMATCH],
DETECT_URICONTENT, s->umatch_tail);
if (pm == NULL) {
SCLogError(SC_ERR_DEPTH_MISSING_CONTENT, "depth needs "

23
src/detect-distance.c
Unescape Escape View File

@ -73,7 +73,7 @@ static int DetectDistanceSetup (DetectEngineCtx *de_ctx, Signature *s,
}
/* if we still haven't found that the sig is related to DCERPC,
* it's a direct entry into Signature->pmatch */
* it's a direct entry into Signature->sm_lists[DETECT_SM_LIST_PMATCH] */
if (s->alproto == ALPROTO_DCERPC) {
SigMatch *dcem = NULL;
SigMatch *dm = NULL;
@ -94,9 +94,9 @@ static int DetectDistanceSetup (DetectEngineCtx *de_ctx, Signature *s,
DETECT_PCRE, s->dmatch_tail,
DETECT_BYTEJUMP, s->dmatch_tail);
pm1_ots = SigMatchGetLastSMFromLists(s, 6,
DETECT_CONTENT, s->pmatch_tail,
DETECT_PCRE, s->pmatch_tail,
DETECT_BYTEJUMP, s->pmatch_tail);
DETECT_CONTENT, s->sm_lists_tail[DETECT_SM_LIST_PMATCH],
DETECT_PCRE, s->sm_lists_tail[DETECT_SM_LIST_PMATCH],
DETECT_BYTEJUMP, s->sm_lists_tail[DETECT_SM_LIST_PMATCH]);
if (pm1_ots != NULL && pm1_ots->prev != NULL) {
pm2_ots = SigMatchGetLastSMFromLists(s, 6,
DETECT_CONTENT, pm1_ots->prev,
@ -105,7 +105,7 @@ static int DetectDistanceSetup (DetectEngineCtx *de_ctx, Signature *s,
}
dm = SigMatchGetLastSMFromLists(s, 2, DETECT_CONTENT, s->dmatch_tail);
pm1 = SigMatchGetLastSMFromLists(s, 2, DETECT_CONTENT, s->pmatch_tail);
pm1 = SigMatchGetLastSMFromLists(s, 2, DETECT_CONTENT, s->sm_lists_tail[DETECT_SM_LIST_PMATCH]);
if (pm1 != NULL && pm1->prev != NULL) {
pm2 = SigMatchGetLastSMFromLists(s, 2, DETECT_CONTENT, pm1->prev);
}
@ -121,7 +121,8 @@ static int DetectDistanceSetup (DetectEngineCtx *de_ctx, Signature *s,
if (pm1->idx > dcem->idx) {
/* transfer pm1 to dmatch list and within is against this */
SigMatchTransferSigMatchAcrossLists(pm1,
&s->pmatch, &s->pmatch_tail,
&s->sm_lists[DETECT_SM_LIST_PMATCH],
&s->sm_lists_tail[DETECT_SM_LIST_PMATCH],
&s->dmatch, &s->dmatch_tail);
pm = pm1;
} else {
@ -134,7 +135,8 @@ static int DetectDistanceSetup (DetectEngineCtx *de_ctx, Signature *s,
} else if (pm1->idx > dcem->idx) {
/* transfer pm1 to dmatch list and within is against this */
SigMatchTransferSigMatchAcrossLists(pm1,
&s->pmatch, &s->pmatch_tail,
&s->sm_lists[DETECT_SM_LIST_PMATCH],
&s->sm_lists_tail[DETECT_SM_LIST_PMATCH],
&s->dmatch, &s->dmatch_tail);
pm = pm1;
} else {
@ -151,7 +153,8 @@ static int DetectDistanceSetup (DetectEngineCtx *de_ctx, Signature *s,
} else if (pm2_ots == NULL || pm2_ots->idx < dcem->idx) {
/* trasnfer pm1 to dmatch list and pm = pm1 */
SigMatchTransferSigMatchAcrossLists(pm1,
&s->pmatch, &s->pmatch_tail,
&s->sm_lists[DETECT_SM_LIST_PMATCH],
&s->sm_lists_tail[DETECT_SM_LIST_PMATCH],
&s->dmatch, &s->dmatch_tail);
pm = pm1;
} else {
@ -161,7 +164,7 @@ static int DetectDistanceSetup (DetectEngineCtx *de_ctx, Signature *s,
}
} else {
pm = SigMatchGetLastSMFromLists(s, 4,
DETECT_CONTENT, s->pmatch_tail,
DETECT_CONTENT, s->sm_lists_tail[DETECT_SM_LIST_PMATCH],
DETECT_URICONTENT, s->umatch_tail);
if (pm == NULL) {
SCLogError(SC_ERR_WITHIN_MISSING_CONTENT, "within needs"
@ -394,7 +397,7 @@ static int DetectDistanceTest01(void)
goto end;
}
SigMatch *sm = de_ctx->sig_list->pmatch;
SigMatch *sm = de_ctx->sig_list->sm_lists[DETECT_SM_LIST_PMATCH];
if (sm == NULL) {
printf("sm NULL: ");
goto end;

78
src/detect-engine-dcepayload.c
Unescape Escape View File

@ -7811,12 +7811,12 @@ int DcePayloadParseTest25(void)
result = 0;
goto end;
}
if (s->pmatch_tail == NULL) {
if (s->sm_lists_tail[DETECT_SM_LIST_PMATCH] == NULL) {
result = 0;
goto end;
}
sm = s->pmatch;
sm = s->sm_lists[DETECT_SM_LIST_PMATCH];
if (sm->type != DETECT_CONTENT) {
result = 0;
goto end;
@ -7933,12 +7933,12 @@ int DcePayloadParseTest26(void)
result = 0;
goto end;
}
if (s->pmatch_tail == NULL) {
if (s->sm_lists_tail[DETECT_SM_LIST_PMATCH] == NULL) {
result = 0;
goto end;
}
sm = s->pmatch;
sm = s->sm_lists[DETECT_SM_LIST_PMATCH];
if (sm->type != DETECT_CONTENT) {
result = 0;
goto end;
@ -8059,7 +8059,7 @@ int DcePayloadParseTest27(void)
result = 0;
goto end;
}
if (s->pmatch_tail != NULL) {
if (s->sm_lists_tail[DETECT_SM_LIST_PMATCH] != NULL) {
result = 0;
goto end;
}
@ -8185,7 +8185,7 @@ int DcePayloadParseTest28(void)
result = 0;
goto end;
}
if (s->pmatch_tail == NULL) {
if (s->sm_lists_tail[DETECT_SM_LIST_PMATCH] == NULL) {
result = 0;
goto end;
}
@ -8230,7 +8230,7 @@ int DcePayloadParseTest28(void)
if (result == 0)
goto end;
sm = s->pmatch;
sm = s->sm_lists[DETECT_SM_LIST_PMATCH];
if (sm->type != DETECT_CONTENT) {
result = 0;
goto end;
@ -8313,12 +8313,12 @@ int DcePayloadParseTest29(void)
result = 0;
goto end;
}
if (s->pmatch_tail == NULL) {
if (s->sm_lists_tail[DETECT_SM_LIST_PMATCH] == NULL) {
result = 0;
goto end;
}
sm = s->pmatch;
sm = s->sm_lists[DETECT_SM_LIST_PMATCH];
if (sm->type != DETECT_PCRE) {
result = 0;
goto end;
@ -8454,12 +8454,12 @@ int DcePayloadParseTest30(void)
result = 0;
goto end;
}
if (s->pmatch_tail == NULL) {
if (s->sm_lists_tail[DETECT_SM_LIST_PMATCH] == NULL) {
result = 0;
goto end;
}
sm = s->pmatch;
sm = s->sm_lists[DETECT_SM_LIST_PMATCH];
if (sm->type != DETECT_BYTEJUMP) {
result = 0;
goto end;
@ -8600,7 +8600,7 @@ int DcePayloadParseTest31(void)
result = 0;
goto end;
}
if (s->pmatch_tail == NULL) {
if (s->sm_lists_tail[DETECT_SM_LIST_PMATCH] == NULL) {
result = 0;
goto end;
}
@ -8663,7 +8663,7 @@ int DcePayloadParseTest31(void)
if (result == 0)
goto end;
sm = s->pmatch;
sm = s->sm_lists[DETECT_SM_LIST_PMATCH];
if (sm->type != DETECT_CONTENT) {
result = 0;
goto end;
@ -8746,7 +8746,7 @@ int DcePayloadParseTest32(void)
result = 0;
goto end;
}
if (s->pmatch_tail == NULL) {
if (s->sm_lists_tail[DETECT_SM_LIST_PMATCH] == NULL) {
result = 0;
goto end;
}
@ -8809,7 +8809,7 @@ int DcePayloadParseTest32(void)
if (result == 0)
goto end;
sm = s->pmatch;
sm = s->sm_lists[DETECT_SM_LIST_PMATCH];
if (sm->type != DETECT_CONTENT) {
result = 0;
goto end;
@ -8892,7 +8892,7 @@ int DcePayloadParseTest33(void)
result = 0;
goto end;
}
if (s->pmatch_tail == NULL) {
if (s->sm_lists_tail[DETECT_SM_LIST_PMATCH] == NULL) {
result = 0;
goto end;
}
@ -8950,7 +8950,7 @@ int DcePayloadParseTest33(void)
if (result == 0)
goto end;
sm = s->pmatch;
sm = s->sm_lists[DETECT_SM_LIST_PMATCH];
if (sm->type != DETECT_CONTENT) {
result = 0;
goto end;
@ -9034,7 +9034,7 @@ int DcePayloadParseTest34(void)
result = 0;
goto end;
}
if (s->pmatch_tail == NULL) {
if (s->sm_lists_tail[DETECT_SM_LIST_PMATCH] == NULL) {
result = 0;
goto end;
}
@ -9092,7 +9092,7 @@ int DcePayloadParseTest34(void)
result &= (sm->next == NULL);
sm = s->pmatch;
sm = s->sm_lists[DETECT_SM_LIST_PMATCH];
if (sm->type != DETECT_CONTENT) {
result = 0;
goto end;
@ -9155,7 +9155,7 @@ int DcePayloadParseTest35(void)
result = 0;
goto end;
}
if (s->pmatch_tail == NULL) {
if (s->sm_lists_tail[DETECT_SM_LIST_PMATCH] == NULL) {
result = 0;
goto end;
}
@ -9178,7 +9178,7 @@ int DcePayloadParseTest35(void)
result &= (sm->next == NULL);
sm = s->pmatch;
sm = s->sm_lists[DETECT_SM_LIST_PMATCH];
if (sm->type != DETECT_CONTENT) {
result = 0;
goto end;
@ -9242,7 +9242,7 @@ int DcePayloadParseTest36(void)
result = 0;
goto end;
}
if (s->pmatch_tail == NULL) {
if (s->sm_lists_tail[DETECT_SM_LIST_PMATCH] == NULL) {
result = 0;
goto end;
}
@ -9281,7 +9281,7 @@ int DcePayloadParseTest36(void)
result &= (sm->next == NULL);
sm = s->pmatch;
sm = s->sm_lists[DETECT_SM_LIST_PMATCH];
if (sm->type != DETECT_CONTENT) {
result = 0;
goto end;
@ -9346,7 +9346,7 @@ int DcePayloadParseTest37(void)
result = 0;
goto end;
}
if (s->pmatch_tail == NULL) {
if (s->sm_lists_tail[DETECT_SM_LIST_PMATCH] == NULL) {
result = 0;
goto end;
}
@ -9387,7 +9387,7 @@ int DcePayloadParseTest37(void)
result &= (sm->next == NULL);
sm = s->pmatch;
sm = s->sm_lists[DETECT_SM_LIST_PMATCH];
if (sm->type != DETECT_CONTENT) {
result = 0;
goto end;
@ -9454,7 +9454,7 @@ int DcePayloadParseTest38(void)
result = 0;
goto end;
}
if (s->pmatch_tail == NULL) {
if (s->sm_lists_tail[DETECT_SM_LIST_PMATCH] == NULL) {
result = 0;
goto end;
}
@ -9508,7 +9508,7 @@ int DcePayloadParseTest38(void)
result &= (sm->next == NULL);
sm = s->pmatch;
sm = s->sm_lists[DETECT_SM_LIST_PMATCH];
if (sm->type != DETECT_CONTENT) {
result = 0;
goto end;
@ -9570,12 +9570,12 @@ int DcePayloadParseTest39(void)
result = 0;
goto end;
}
if (s->pmatch_tail == NULL) {
if (s->sm_lists_tail[DETECT_SM_LIST_PMATCH] == NULL) {
result = 0;
goto end;
}
sm = s->pmatch;
sm = s->sm_lists[DETECT_SM_LIST_PMATCH];
if (sm->type != DETECT_CONTENT) {
result = 0;
goto end;
@ -9658,7 +9658,7 @@ int DcePayloadParseTest40(void)
result = 0;
goto end;
}
if (s->pmatch_tail == NULL) {
if (s->sm_lists_tail[DETECT_SM_LIST_PMATCH] == NULL) {
result = 0;
goto end;
}
@ -9722,7 +9722,7 @@ int DcePayloadParseTest40(void)
result &= (sm->next == NULL);
sm = s->pmatch;
sm = s->sm_lists[DETECT_SM_LIST_PMATCH];
if (sm->type != DETECT_CONTENT) {
result = 0;
goto end;
@ -9787,7 +9787,7 @@ int DcePayloadParseTest41(void)
result = 0;
goto end;
}
if (s->pmatch_tail == NULL) {
if (s->sm_lists_tail[DETECT_SM_LIST_PMATCH] == NULL) {
result = 0;
goto end;
}
@ -9814,7 +9814,7 @@ int DcePayloadParseTest41(void)
result &= (sm->next == NULL);
sm = s->pmatch;
sm = s->sm_lists[DETECT_SM_LIST_PMATCH];
if (sm->type != DETECT_CONTENT) {
result = 0;
goto end;
@ -10111,7 +10111,7 @@ int DcePayloadParseTest44(void)
result = 0;
goto end;
}
if (s->pmatch_tail == NULL) {
if (s->sm_lists_tail[DETECT_SM_LIST_PMATCH] == NULL) {
result = 0;
goto end;
}
@ -10151,7 +10151,7 @@ int DcePayloadParseTest44(void)
result &= (sm->next == NULL);
sm = s->pmatch;
sm = s->sm_lists[DETECT_SM_LIST_PMATCH];
if (sm->type != DETECT_CONTENT) {
result = 0;
goto end;
@ -10236,7 +10236,7 @@ int DcePayloadParseTest45(void)
result = 0;
goto end;
}
if (s->pmatch_tail == NULL) {
if (s->sm_lists_tail[DETECT_SM_LIST_PMATCH] == NULL) {
result = 0;
goto end;
}
@ -10261,7 +10261,7 @@ int DcePayloadParseTest45(void)
result &= (sm->next == NULL);
sm = s->pmatch;
sm = s->sm_lists[DETECT_SM_LIST_PMATCH];
if (sm->type != DETECT_CONTENT) {
result = 0;
goto end;
@ -10347,7 +10347,7 @@ int DcePayloadParseTest46(void)
result = 0;
goto end;
}
if (s->pmatch_tail == NULL) {
if (s->sm_lists_tail[DETECT_SM_LIST_PMATCH] == NULL) {
result = 0;
goto end;
}
@ -10370,7 +10370,7 @@ int DcePayloadParseTest46(void)
result &= (sm->next == NULL);
sm = s->pmatch;
sm = s->sm_lists[DETECT_SM_LIST_PMATCH];
if (sm->type != DETECT_CONTENT) {
result = 0;
goto end;

32
src/detect-engine-mpm.c
Unescape Escape View File

@ -107,7 +107,7 @@ int SignatureHasPacketContent(Signature *s) {
SCReturnInt(0);
}
SigMatch *sm = s->pmatch;
SigMatch *sm = s->sm_lists[DETECT_SM_LIST_PMATCH];
if (sm == NULL) {
SCReturnInt(0);
}
@ -148,7 +148,7 @@ int SignatureHasStreamContent(Signature *s) {
SCReturnInt(0);
}
SigMatch *sm = s->pmatch;
SigMatch *sm = s->sm_lists[DETECT_SM_LIST_PMATCH];
if (sm == NULL) {
SCReturnInt(0);
}
@ -571,7 +571,7 @@ static int PatternMatchPreprarePopulateMpm(DetectEngineCtx *de_ctx, SigGroupHead
/* get the total no of patterns in this Signature, as well as find out
* if we have a fast_pattern set in this Signature */
for (sm = s->pmatch; sm != NULL; sm = sm->next) {
for (sm = s->sm_lists[DETECT_SM_LIST_PMATCH]; sm != NULL; sm = sm->next) {
if (sm->type != DETECT_CONTENT)
continue;
@ -605,7 +605,7 @@ static int PatternMatchPreprarePopulateMpm(DetectEngineCtx *de_ctx, SigGroupHead
continue;
}
for (sm = s->pmatch; sm != NULL; sm = sm->next) {
for (sm = s->sm_lists[DETECT_SM_LIST_PMATCH]; sm != NULL; sm = sm->next) {
if (sm->type != DETECT_CONTENT)
continue;
@ -644,7 +644,7 @@ static int PatternMatchPreprarePopulateMpm(DetectEngineCtx *de_ctx, SigGroupHead
/* now determine which one to add to the mpm phase */
for (sig = 0; sig < sgh->sig_cnt; sig++) {
Signature *s = sgh->match_array[sig];
if (s == NULL || s->pmatch == NULL)
if (s == NULL || s->sm_lists[DETECT_SM_LIST_PMATCH] == NULL)
continue;
if (SignatureHasPacketContent(s) == 0) {
@ -654,7 +654,7 @@ static int PatternMatchPreprarePopulateMpm(DetectEngineCtx *de_ctx, SigGroupHead
ContentHash *mpm_ch = NULL;
SigMatch *sm = NULL;
for (sm = s->pmatch; sm != NULL; sm = sm->next) {
for (sm = s->sm_lists[DETECT_SM_LIST_PMATCH]; sm != NULL; sm = sm->next) {
if (sm->type != DETECT_CONTENT)
continue;
@ -723,7 +723,7 @@ static int PatternMatchPreprarePopulateMpm(DetectEngineCtx *de_ctx, SigGroupHead
char scan_negated = 0;
/* see if our content is actually negated */
SigMatch *tmpsm = s->pmatch;
SigMatch *tmpsm = s->sm_lists[DETECT_SM_LIST_PMATCH];
for ( ; tmpsm != NULL; tmpsm = tmpsm->next) {
if (tmpsm->type != DETECT_CONTENT)
continue;
@ -761,7 +761,7 @@ static int PatternMatchPreprarePopulateMpm(DetectEngineCtx *de_ctx, SigGroupHead
/* see if we can bypass the match validation for this pattern */
} else {
if (!(co->flags & DETECT_CONTENT_RELATIVE_NEXT)) {
SigMatch *tmp_sm = s->pmatch;
SigMatch *tmp_sm = s->sm_lists[DETECT_SM_LIST_PMATCH];
for ( ; tmp_sm != NULL; tmp_sm = tmp_sm->next) {
if (tmp_sm->type != DETECT_CONTENT)
continue;
@ -860,7 +860,7 @@ static int PatternMatchPreprarePopulateMpmStream(DetectEngineCtx *de_ctx, SigGro
/* get the total no of patterns in this Signature, as well as find out
* if we have a fast_pattern set in this Signature */
for (sm = s->pmatch; sm != NULL; sm = sm->next) {
for (sm = s->sm_lists[DETECT_SM_LIST_PMATCH]; sm != NULL; sm = sm->next) {
if (sm->type != DETECT_CONTENT)
continue;
@ -894,7 +894,7 @@ static int PatternMatchPreprarePopulateMpmStream(DetectEngineCtx *de_ctx, SigGro
continue;
}
for (sm = s->pmatch; sm != NULL; sm = sm->next) {
for (sm = s->sm_lists[DETECT_SM_LIST_PMATCH]; sm != NULL; sm = sm->next) {
if (sm->type != DETECT_CONTENT)
continue;
@ -933,7 +933,7 @@ static int PatternMatchPreprarePopulateMpmStream(DetectEngineCtx *de_ctx, SigGro
/* now determine which one to add to the mpm phase */
for (sig = 0; sig < sgh->sig_cnt; sig++) {
Signature *s = sgh->match_array[sig];
if (s == NULL || s->pmatch == NULL)
if (s == NULL || s->sm_lists[DETECT_SM_LIST_PMATCH] == NULL)
continue;
if (SignatureHasStreamContent(s) == 0) {
@ -943,7 +943,7 @@ static int PatternMatchPreprarePopulateMpmStream(DetectEngineCtx *de_ctx, SigGro
ContentHash *mpm_ch = NULL;
SigMatch *sm = NULL;
for (sm = s->pmatch; sm != NULL; sm = sm->next) {
for (sm = s->sm_lists[DETECT_SM_LIST_PMATCH]; sm != NULL; sm = sm->next) {
if (sm->type != DETECT_CONTENT)
continue;
@ -1011,7 +1011,7 @@ static int PatternMatchPreprarePopulateMpmStream(DetectEngineCtx *de_ctx, SigGro
char scan_negated = 0;
/* see if our content is actually negated */
SigMatch *tmpsm = s->pmatch;
SigMatch *tmpsm = s->sm_lists[DETECT_SM_LIST_PMATCH];
for ( ; tmpsm != NULL; tmpsm = tmpsm->next) {
if (tmpsm->type != DETECT_CONTENT)
continue;
@ -1244,7 +1244,7 @@ static int PatternMatchPreprarePopulateMpmUri(DetectEngineCtx *de_ctx, SigGroupH
uint8_t flags = 0;
#if 0
/* see if our content is actually negated */
SigMatch *tmpsm = s->pmatch;
SigMatch *tmpsm = s->sm_lists[DETECT_SM_LIST_PMATCH];
for ( ; tmpsm != NULL; tmpsm = tmpsm->next) {
if (tmpsm->type != DETECT_CONTENT)
continue;
@ -1416,7 +1416,7 @@ int PatternMatchPrepareGroup(DetectEngineCtx *de_ctx, SigGroupHead *sh)
!(sh->flags & SIG_GROUP_HEAD_MPM_COPY))
{
if (SignatureHasPacketContent(s) == 1) {
for (sm = s->pmatch; sm != NULL; sm = sm->next) {
for (sm = s->sm_lists[DETECT_SM_LIST_PMATCH]; sm != NULL; sm = sm->next) {
if (sm->type != DETECT_CONTENT)
continue;
@ -1454,7 +1454,7 @@ int PatternMatchPrepareGroup(DetectEngineCtx *de_ctx, SigGroupHead *sh)
!(sh->flags & SIG_GROUP_HEAD_MPM_STREAM_COPY))
{
if (SignatureHasStreamContent(s) == 1) {
for (sm = s->pmatch; sm != NULL; sm = sm->next) {
for (sm = s->sm_lists[DETECT_SM_LIST_PMATCH]; sm != NULL; sm = sm->next) {
if (sm->type != DETECT_CONTENT)
continue;

8
src/detect-engine-payload.c
Unescape Escape View File

@ -371,7 +371,7 @@ int DetectEngineInspectPacketPayload(DetectEngineCtx *de_ctx,
SCEnter();
int r = 0;
if (s->pmatch == NULL) {
if (s->sm_lists[DETECT_SM_LIST_PMATCH] == NULL) {
SCReturnInt(0);
}
@ -379,7 +379,7 @@ int DetectEngineInspectPacketPayload(DetectEngineCtx *de_ctx,
det_ctx->discontinue_matching = 0;
det_ctx->inspection_recursion_counter = 0;
r = DoInspectPacketPayload(de_ctx, det_ctx, s, s->pmatch, p, f, p->payload, p->payload_len);
r = DoInspectPacketPayload(de_ctx, det_ctx, s, s->sm_lists[DETECT_SM_LIST_PMATCH], p, f, p->payload, p->payload_len);
if (r == 1) {
SCReturnInt(1);
}
@ -411,13 +411,13 @@ int DetectEngineInspectStreamPayload(DetectEngineCtx *de_ctx,
SCEnter();
int r = 0;
if (s->pmatch == NULL) {
if (s->sm_lists[DETECT_SM_LIST_PMATCH] == NULL) {
SCReturnInt(0);
}
det_ctx->payload_offset = 0;
r = DoInspectPacketPayload(de_ctx, det_ctx, s, s->pmatch, NULL, f, payload, payload_len);
r = DoInspectPacketPayload(de_ctx, det_ctx, s, s->sm_lists[DETECT_SM_LIST_PMATCH], NULL, f, payload, payload_len);
if (r == 1) {
SCReturnInt(1);
}

4
src/detect-engine-siggroup.c
Unescape Escape View File

@ -1307,7 +1307,7 @@ int SigGroupHeadLoadContent(DetectEngineCtx *de_ctx, SigGroupHead *sgh)
if (s->alproto != ALPROTO_UNKNOWN)
continue;
sm = s->pmatch;
sm = s->sm_lists[DETECT_SM_LIST_PMATCH];
if (sm == NULL)
continue;
@ -1485,7 +1485,7 @@ int SigGroupHeadLoadStreamContent(DetectEngineCtx *de_ctx, SigGroupHead *sgh)
continue;
}
sm = s->pmatch;
sm = s->sm_lists[DETECT_SM_LIST_PMATCH];
if (sm == NULL)
continue;

48
src/detect-fast-pattern.c
Unescape Escape View File

@ -107,7 +107,7 @@ static int DetectFastPatternSetup(DetectEngineCtx *de_ctx, Signature *s, char *a
DetectContentData *cd = NULL;
DetectUricontentData *ud = NULL;
if (s->pmatch_tail == NULL && s->umatch_tail == NULL) {
if (s->sm_lists_tail[DETECT_SM_LIST_PMATCH] == NULL && s->umatch_tail == NULL) {
SCLogWarning(SC_WARN_COMPATIBILITY, "fast_pattern found inside the "
"rule, without a preceding content based keyword. "
"Currently we provide fast_pattern support for content "
@ -116,7 +116,7 @@ static int DetectFastPatternSetup(DetectEngineCtx *de_ctx, Signature *s, char *a
}
SigMatch *pm = SigMatchGetLastSMFromLists(s, 4,
DETECT_CONTENT, s->pmatch_tail,
DETECT_CONTENT, s->sm_lists_tail[DETECT_SM_LIST_PMATCH],
DETECT_URICONTENT, s->umatch_tail);
if (pm == NULL) {
SCLogError(SC_ERR_INVALID_SIGNATURE, "fast_pattern found inside "
@ -302,7 +302,7 @@ int DetectFastPatternTest01(void)
goto end;
result = 0;
sm = de_ctx->sig_list->pmatch;
sm = de_ctx->sig_list->sm_lists[DETECT_SM_LIST_PMATCH];
while (sm != NULL) {
if (sm->type == DETECT_CONTENT) {
if ( ((DetectContentData *)sm->ctx)->flags &
@ -344,7 +344,7 @@ int DetectFastPatternTest02(void)
goto end;
result = 0;
sm = de_ctx->sig_list->pmatch;
sm = de_ctx->sig_list->sm_lists[DETECT_SM_LIST_PMATCH];
while (sm != NULL) {
if (sm->type == DETECT_CONTENT) {
if (((DetectContentData *)sm->ctx)->flags &
@ -385,7 +385,7 @@ int DetectFastPatternTest03(void)
goto end;
result = 0;
sm = de_ctx->sig_list->pmatch;
sm = de_ctx->sig_list->sm_lists[DETECT_SM_LIST_PMATCH];
while (sm != NULL) {
if (sm->type == DETECT_CONTENT) {
if ( !(((DetectContentData *)sm->ctx)->flags &
@ -999,7 +999,7 @@ int DetectFastPatternTest15(void)
goto end;
result = 0;
sm = de_ctx->sig_list->pmatch;
sm = de_ctx->sig_list->sm_lists[DETECT_SM_LIST_PMATCH];
while (sm != NULL) {
if (sm->type == DETECT_CONTENT) {
if ( ((DetectContentData *)sm->ctx)->flags &
@ -1040,7 +1040,7 @@ int DetectFastPatternTest16(void)
goto end;
result = 0;
sm = de_ctx->sig_list->pmatch;
sm = de_ctx->sig_list->sm_lists[DETECT_SM_LIST_PMATCH];
while (sm != NULL) {
if (sm->type == DETECT_CONTENT) {
if ( ((DetectContentData *)sm->ctx)->flags &
@ -1077,7 +1077,7 @@ int DetectFastPatternTest17(void)
goto end;
result = 0;
sm = de_ctx->sig_list->pmatch;
sm = de_ctx->sig_list->sm_lists[DETECT_SM_LIST_PMATCH];
DetectContentData *cd = sm->ctx;
if (sm != NULL && sm->type == DETECT_CONTENT) {
if (cd->flags & DETECT_CONTENT_FAST_PATTERN &&
@ -1113,7 +1113,7 @@ int DetectFastPatternTest18(void)
goto end;
result = 0;
sm = de_ctx->sig_list->pmatch;
sm = de_ctx->sig_list->sm_lists[DETECT_SM_LIST_PMATCH];
DetectContentData *cd = sm->ctx;
if (sm != NULL && sm->type == DETECT_CONTENT) {
if (cd->flags & DETECT_CONTENT_FAST_PATTERN &&
@ -1345,7 +1345,7 @@ int DetectFastPatternTest28(void)
if (de_ctx->sig_list == NULL)
goto end;
DetectContentData *cd = de_ctx->sig_list->pmatch_tail->ctx;
DetectContentData *cd = de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_PMATCH]->ctx;
if (cd->flags & DETECT_CONTENT_FAST_PATTERN &&
cd->flags & DETECT_CONTENT_FAST_PATTERN_ONLY &&
!(cd->flags & cd->flags & DETECT_CONTENT_FAST_PATTERN_CHOP) &&
@ -1375,7 +1375,7 @@ int DetectFastPatternTest29(void)
"(content:one; content:two; within:30; content:two; fast_pattern:only; sid:1;)");
if (de_ctx->sig_list == NULL)
goto end;
DetectContentData *cd = de_ctx->sig_list->pmatch_tail->ctx;
DetectContentData *cd = de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_PMATCH]->ctx;
if (cd->flags & DETECT_CONTENT_FAST_PATTERN &&
cd->flags & DETECT_CONTENT_FAST_PATTERN_ONLY &&
!(cd->flags & cd->flags & DETECT_CONTENT_FAST_PATTERN_CHOP) &&
@ -1405,7 +1405,7 @@ int DetectFastPatternTest30(void)
"(content:one; content:two; offset:30; content:two; fast_pattern:only; sid:1;)");
if (de_ctx->sig_list == NULL)
goto end;
DetectContentData *cd = de_ctx->sig_list->pmatch_tail->ctx;
DetectContentData *cd = de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_PMATCH]->ctx;
if (cd->flags & DETECT_CONTENT_FAST_PATTERN &&
cd->flags & DETECT_CONTENT_FAST_PATTERN_ONLY &&
!(cd->flags & cd->flags & DETECT_CONTENT_FAST_PATTERN_CHOP) &&
@ -1435,7 +1435,7 @@ int DetectFastPatternTest31(void)
"(content:one; content:two; depth:30; content:two; fast_pattern:only; sid:1;)");
if (de_ctx->sig_list == NULL)
goto end;
DetectContentData *cd = de_ctx->sig_list->pmatch_tail->ctx;
DetectContentData *cd = de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_PMATCH]->ctx;
if (cd->flags & DETECT_CONTENT_FAST_PATTERN &&
cd->flags & DETECT_CONTENT_FAST_PATTERN_ONLY &&
!(cd->flags & cd->flags & DETECT_CONTENT_FAST_PATTERN_CHOP) &&
@ -1465,7 +1465,7 @@ int DetectFastPatternTest32(void)
"(content:!one; fast_pattern; content:two; sid:1;)");
if (de_ctx->sig_list == NULL)
goto end;
DetectContentData *cd = de_ctx->sig_list->pmatch_tail->prev->ctx;
DetectContentData *cd = de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_PMATCH]->prev->ctx;
if (cd->flags & DETECT_CONTENT_FAST_PATTERN &&
cd->flags & DETECT_CONTENT_NEGATED &&
!(cd->flags & DETECT_CONTENT_FAST_PATTERN_ONLY) &&
@ -1584,7 +1584,7 @@ int DetectFastPatternTest37(void)
"(content:one; content:two; fast_pattern:3,4; content:three; sid:1;)");
if (de_ctx->sig_list == NULL)
goto end;
DetectContentData *cd = de_ctx->sig_list->pmatch_tail->prev->ctx;
DetectContentData *cd = de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_PMATCH]->prev->ctx;
if (cd->flags & DETECT_CONTENT_FAST_PATTERN &&
!(cd->flags & DETECT_CONTENT_FAST_PATTERN_ONLY) &&
cd->flags & cd->flags & DETECT_CONTENT_FAST_PATTERN_CHOP &&
@ -1614,7 +1614,7 @@ int DetectFastPatternTest38(void)
"(content:one; content:two; fast_pattern:3,4; content:three; distance:30; sid:1;)");
if (de_ctx->sig_list == NULL)
goto end;
DetectContentData *cd = de_ctx->sig_list->pmatch_tail->prev->ctx;
DetectContentData *cd = de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_PMATCH]->prev->ctx;
if (cd->flags & DETECT_CONTENT_FAST_PATTERN &&
!(cd->flags & DETECT_CONTENT_FAST_PATTERN_ONLY) &&
cd->flags & cd->flags & DETECT_CONTENT_FAST_PATTERN_CHOP &&
@ -1644,7 +1644,7 @@ int DetectFastPatternTest39(void)
"(content:one; content:two; fast_pattern:3,4; content:three; within:30; sid:1;)");
if (de_ctx->sig_list == NULL)
goto end;
DetectContentData *cd = de_ctx->sig_list->pmatch_tail->prev->ctx;
DetectContentData *cd = de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_PMATCH]->prev->ctx;
if (cd->flags & DETECT_CONTENT_FAST_PATTERN &&
!(cd->flags & DETECT_CONTENT_FAST_PATTERN_ONLY) &&
cd->flags & cd->flags & DETECT_CONTENT_FAST_PATTERN_CHOP &&
@ -1674,7 +1674,7 @@ int DetectFastPatternTest40(void)
"(content:one; content:two; fast_pattern:3,4; content:three; offset:30; sid:1;)");
if (de_ctx->sig_list == NULL)
goto end;
DetectContentData *cd = de_ctx->sig_list->pmatch_tail->prev->ctx;
DetectContentData *cd = de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_PMATCH]->prev->ctx;
if (cd->flags & DETECT_CONTENT_FAST_PATTERN &&
!(cd->flags & DETECT_CONTENT_FAST_PATTERN_ONLY) &&
cd->flags & cd->flags & DETECT_CONTENT_FAST_PATTERN_CHOP &&
@ -1704,7 +1704,7 @@ int DetectFastPatternTest41(void)
"(content:one; content:two; fast_pattern:3,4; content:three; depth:30; sid:1;)");
if (de_ctx->sig_list == NULL)
goto end;
DetectContentData *cd = de_ctx->sig_list->pmatch_tail->prev->ctx;
DetectContentData *cd = de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_PMATCH]->prev->ctx;
if (cd->flags & DETECT_CONTENT_FAST_PATTERN &&
!(cd->flags & DETECT_CONTENT_FAST_PATTERN_ONLY) &&
cd->flags & cd->flags & DETECT_CONTENT_FAST_PATTERN_CHOP &&
@ -1734,7 +1734,7 @@ int DetectFastPatternTest42(void)
"(content:one; content:two; distance:10; content:three; fast_pattern:3,4; sid:1;)");
if (de_ctx->sig_list == NULL)
goto end;
DetectContentData *cd = de_ctx->sig_list->pmatch_tail->ctx;
DetectContentData *cd = de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_PMATCH]->ctx;
if (cd->flags & DETECT_CONTENT_FAST_PATTERN &&
!(cd->flags & DETECT_CONTENT_FAST_PATTERN_ONLY) &&
cd->flags & cd->flags & DETECT_CONTENT_FAST_PATTERN_CHOP &&
@ -1764,7 +1764,7 @@ int DetectFastPatternTest43(void)
"(content:one; content:two; within:10; content:three; fast_pattern:3,4; sid:1;)");
if (de_ctx->sig_list == NULL)
goto end;
DetectContentData *cd = de_ctx->sig_list->pmatch_tail->ctx;
DetectContentData *cd = de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_PMATCH]->ctx;
if (cd->flags & DETECT_CONTENT_FAST_PATTERN &&
!(cd->flags & DETECT_CONTENT_FAST_PATTERN_ONLY) &&
cd->flags & cd->flags & DETECT_CONTENT_FAST_PATTERN_CHOP &&
@ -1794,7 +1794,7 @@ int DetectFastPatternTest44(void)
"(content:one; content:two; offset:10; content:three; fast_pattern:3,4; sid:1;)");
if (de_ctx->sig_list == NULL)
goto end;
DetectContentData *cd = de_ctx->sig_list->pmatch_tail->ctx;
DetectContentData *cd = de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_PMATCH]->ctx;
if (cd->flags & DETECT_CONTENT_FAST_PATTERN &&
!(cd->flags & DETECT_CONTENT_FAST_PATTERN_ONLY) &&
cd->flags & cd->flags & DETECT_CONTENT_FAST_PATTERN_CHOP &&
@ -1824,7 +1824,7 @@ int DetectFastPatternTest45(void)
"(content:one; content:two; depth:10; content:three; fast_pattern:3,4; sid:1;)");
if (de_ctx->sig_list == NULL)
goto end;
DetectContentData *cd = de_ctx->sig_list->pmatch_tail->ctx;
DetectContentData *cd = de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_PMATCH]->ctx;
if (cd->flags & DETECT_CONTENT_FAST_PATTERN &&
!(cd->flags & DETECT_CONTENT_FAST_PATTERN_ONLY) &&
cd->flags & cd->flags & DETECT_CONTENT_FAST_PATTERN_CHOP &&
@ -1920,7 +1920,7 @@ int DetectFastPatternTest49(void)
"(content:one; content:!two; fast_pattern:3,4; content:three; sid:1;)");
if (de_ctx->sig_list == NULL)
goto end;
DetectContentData *cd = de_ctx->sig_list->pmatch_tail->prev->ctx;
DetectContentData *cd = de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_PMATCH]->prev->ctx;
if (cd->flags & DETECT_CONTENT_FAST_PATTERN &&
cd->flags & DETECT_CONTENT_NEGATED &&
!(cd->flags & DETECT_CONTENT_FAST_PATTERN_ONLY) &&

2
src/detect-ftpbounce.c
Unescape Escape View File

@ -208,7 +208,7 @@ int DetectFtpbounceMatch(ThreadVars *t, DetectEngineThreadCtx *det_ctx,
if (!(PKT_IS_TCP(p)))
return 0;
SigMatch *sm = SigMatchGetLastSM(s->pmatch_tail, DETECT_CONTENT);
SigMatch *sm = SigMatchGetLastSM(s->sm_lists_tail[DETECT_SM_LIST_PMATCH], DETECT_CONTENT);
if (sm == NULL)
return 0;

40
src/detect-http-client-body.c
Unescape Escape View File

@ -198,13 +198,13 @@ int DetectHttpClientBodySetup(DetectEngineCtx *de_ctx, Signature *s, char *arg)
return -1;
}
if (s->pmatch_tail == NULL) {
if (s->sm_lists_tail[DETECT_SM_LIST_PMATCH] == NULL) {
SCLogError(SC_ERR_INVALID_SIGNATURE, "http_client_body found inside the "
"rule, without any preceding content keywords");
return -1;
}
sm = DetectContentGetLastPattern(s->pmatch_tail);
sm = DetectContentGetLastPattern(s->sm_lists_tail[DETECT_SM_LIST_PMATCH]);
/* if still we are unable to find any content previous keywords, it is an
* invalid rule */
if (sm == NULL) {
@ -1788,8 +1788,8 @@ int DetectHttpClientBodyTest16(void)
goto end;
}
if (de_ctx->sig_list->pmatch == NULL) {
printf("de_ctx->sig_list->pmatch == NULL\n");
if (de_ctx->sig_list->sm_lists[DETECT_SM_LIST_PMATCH] == NULL) {
printf("de_ctx->sig_list->sm_lists[DETECT_SM_LIST_PMATCH] == NULL\n");
goto end;
}
@ -1798,7 +1798,7 @@ int DetectHttpClientBodyTest16(void)
goto end;
}
DetectContentData *cd = de_ctx->sig_list->pmatch_tail->ctx;
DetectContentData *cd = de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_PMATCH]->ctx;
DetectHttpClientBodyData *hcbd = de_ctx->sig_list->amatch_tail->ctx;
if (cd->id == hcbd->id)
goto end;
@ -1827,8 +1827,8 @@ int DetectHttpClientBodyTest17(void)
goto end;
}
if (de_ctx->sig_list->pmatch == NULL) {
printf("de_ctx->sig_list->pmatch == NULL\n");
if (de_ctx->sig_list->sm_lists[DETECT_SM_LIST_PMATCH] == NULL) {
printf("de_ctx->sig_list->sm_lists[DETECT_SM_LIST_PMATCH] == NULL\n");
goto end;
}
@ -1837,7 +1837,7 @@ int DetectHttpClientBodyTest17(void)
goto end;
}
DetectContentData *cd = de_ctx->sig_list->pmatch_tail->ctx;
DetectContentData *cd = de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_PMATCH]->ctx;
DetectHttpClientBodyData *hcbd = de_ctx->sig_list->amatch_tail->ctx;
if (cd->id == hcbd->id)
goto end;
@ -1866,8 +1866,8 @@ int DetectHttpClientBodyTest18(void)
goto end;
}
if (de_ctx->sig_list->pmatch == NULL) {
printf("de_ctx->sig_list->pmatch == NULL\n");
if (de_ctx->sig_list->sm_lists[DETECT_SM_LIST_PMATCH] == NULL) {
printf("de_ctx->sig_list->sm_lists[DETECT_SM_LIST_PMATCH] == NULL\n");
goto end;
}
@ -1876,7 +1876,7 @@ int DetectHttpClientBodyTest18(void)
goto end;
}
DetectContentData *cd = de_ctx->sig_list->pmatch_tail->ctx;
DetectContentData *cd = de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_PMATCH]->ctx;
DetectHttpClientBodyData *hcbd = de_ctx->sig_list->amatch_tail->ctx;
if (cd->id != 0 || hcbd->id != 1)
goto end;
@ -1905,8 +1905,8 @@ int DetectHttpClientBodyTest19(void)
goto end;
}
if (de_ctx->sig_list->pmatch == NULL) {
printf("de_ctx->sig_list->pmatch == NULL\n");
if (de_ctx->sig_list->sm_lists[DETECT_SM_LIST_PMATCH] == NULL) {
printf("de_ctx->sig_list->sm_lists[DETECT_SM_LIST_PMATCH] == NULL\n");
goto end;
}
@ -1915,7 +1915,7 @@ int DetectHttpClientBodyTest19(void)
goto end;
}
DetectContentData *cd = de_ctx->sig_list->pmatch_tail->ctx;
DetectContentData *cd = de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_PMATCH]->ctx;
DetectHttpClientBodyData *hcbd = de_ctx->sig_list->amatch_tail->ctx;
if (cd->id != 1 || hcbd->id != 0)
goto end;
@ -1945,8 +1945,8 @@ int DetectHttpClientBodyTest20(void)
goto end;
}
if (de_ctx->sig_list->pmatch == NULL) {
printf("de_ctx->sig_list->pmatch == NULL\n");
if (de_ctx->sig_list->sm_lists[DETECT_SM_LIST_PMATCH] == NULL) {
printf("de_ctx->sig_list->sm_lists[DETECT_SM_LIST_PMATCH] == NULL\n");
goto end;
}
@ -1955,7 +1955,7 @@ int DetectHttpClientBodyTest20(void)
goto end;
}
DetectContentData *cd = de_ctx->sig_list->pmatch_tail->ctx;
DetectContentData *cd = de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_PMATCH]->ctx;
DetectHttpClientBodyData *hcbd1 = de_ctx->sig_list->amatch_tail->ctx;
DetectHttpClientBodyData *hcbd2 = de_ctx->sig_list->amatch_tail->prev->ctx;
if (cd->id != 1 || hcbd1->id != 0 || hcbd2->id != 0)
@ -1986,8 +1986,8 @@ int DetectHttpClientBodyTest21(void)
goto end;
}
if (de_ctx->sig_list->pmatch == NULL) {
printf("de_ctx->sig_list->pmatch == NULL\n");
if (de_ctx->sig_list->sm_lists[DETECT_SM_LIST_PMATCH] == NULL) {
printf("de_ctx->sig_list->sm_lists[DETECT_SM_LIST_PMATCH] == NULL\n");
goto end;
}
@ -1996,7 +1996,7 @@ int DetectHttpClientBodyTest21(void)
goto end;
}
DetectContentData *cd = de_ctx->sig_list->pmatch_tail->ctx;
DetectContentData *cd = de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_PMATCH]->ctx;
DetectHttpClientBodyData *hcbd1 = de_ctx->sig_list->amatch_tail->ctx;
DetectHttpClientBodyData *hcbd2 = de_ctx->sig_list->amatch_tail->prev->ctx;
if (cd->id != 2 || hcbd1->id != 0 || hcbd2->id != 0)

40
src/detect-http-cookie.c
Unescape Escape View File

@ -208,13 +208,13 @@ static int DetectHttpCookieSetup (DetectEngineCtx *de_ctx, Signature *s, char *s
return -1;
}
if (s->pmatch_tail == NULL) {
if (s->sm_lists_tail[DETECT_SM_LIST_PMATCH] == NULL) {
SCLogError(SC_ERR_INVALID_SIGNATURE, "http_cookie found inside the "
"rule, without any preceding content keywords");
return -1;
}
SigMatch *pm = DetectContentGetLastPattern(s->pmatch_tail);
SigMatch *pm = DetectContentGetLastPattern(s->sm_lists_tail[DETECT_SM_LIST_PMATCH]);
if (pm == NULL) {
SCLogWarning(SC_ERR_INVALID_SIGNATURE, "http_cookie found inside "
"the rule, without a content context. Please use a "
@ -495,8 +495,8 @@ int DetectHttpCookieTest07(void)
goto end;
}
if (de_ctx->sig_list->pmatch == NULL) {
printf("de_ctx->sig_list->pmatch == NULL\n");
if (de_ctx->sig_list->sm_lists[DETECT_SM_LIST_PMATCH] == NULL) {
printf("de_ctx->sig_list->sm_lists[DETECT_SM_LIST_PMATCH] == NULL\n");
goto end;
}
@ -505,7 +505,7 @@ int DetectHttpCookieTest07(void)
goto end;
}
DetectContentData *cd = de_ctx->sig_list->pmatch_tail->ctx;
DetectContentData *cd = de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_PMATCH]->ctx;
DetectHttpCookieData *hcd = de_ctx->sig_list->amatch_tail->ctx;
if (cd->id == hcd->id)
goto end;
@ -534,8 +534,8 @@ int DetectHttpCookieTest08(void)
goto end;
}
if (de_ctx->sig_list->pmatch == NULL) {
printf("de_ctx->sig_list->pmatch == NULL\n");
if (de_ctx->sig_list->sm_lists[DETECT_SM_LIST_PMATCH] == NULL) {
printf("de_ctx->sig_list->sm_lists[DETECT_SM_LIST_PMATCH] == NULL\n");
goto end;
}
@ -544,7 +544,7 @@ int DetectHttpCookieTest08(void)
goto end;
}
DetectContentData *cd = de_ctx->sig_list->pmatch_tail->ctx;
DetectContentData *cd = de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_PMATCH]->ctx;
DetectHttpCookieData *hcd = de_ctx->sig_list->amatch_tail->ctx;
if (cd->id == hcd->id)
goto end;
@ -573,8 +573,8 @@ int DetectHttpCookieTest09(void)
goto end;
}
if (de_ctx->sig_list->pmatch == NULL) {
printf("de_ctx->sig_list->pmatch == NULL\n");
if (de_ctx->sig_list->sm_lists[DETECT_SM_LIST_PMATCH] == NULL) {
printf("de_ctx->sig_list->sm_lists[DETECT_SM_LIST_PMATCH] == NULL\n");
goto end;
}
@ -583,7 +583,7 @@ int DetectHttpCookieTest09(void)
goto end;
}
DetectContentData *cd = de_ctx->sig_list->pmatch_tail->ctx;
DetectContentData *cd = de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_PMATCH]->ctx;
DetectHttpCookieData *hcd = de_ctx->sig_list->amatch_tail->ctx;
if (cd->id != 0 || hcd->id != 1)
goto end;
@ -612,8 +612,8 @@ int DetectHttpCookieTest10(void)
goto end;
}
if (de_ctx->sig_list->pmatch == NULL) {
printf("de_ctx->sig_list->pmatch == NULL\n");
if (de_ctx->sig_list->sm_lists[DETECT_SM_LIST_PMATCH] == NULL) {
printf("de_ctx->sig_list->sm_lists[DETECT_SM_LIST_PMATCH] == NULL\n");
goto end;
}
@ -622,7 +622,7 @@ int DetectHttpCookieTest10(void)
goto end;
}
DetectContentData *cd = de_ctx->sig_list->pmatch_tail->ctx;
DetectContentData *cd = de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_PMATCH]->ctx;
DetectHttpCookieData *hcd = de_ctx->sig_list->amatch_tail->ctx;
if (cd->id != 1 || hcd->id != 0)
goto end;
@ -652,8 +652,8 @@ int DetectHttpCookieTest11(void)
goto end;
}
if (de_ctx->sig_list->pmatch == NULL) {
printf("de_ctx->sig_list->pmatch == NULL\n");
if (de_ctx->sig_list->sm_lists[DETECT_SM_LIST_PMATCH] == NULL) {
printf("de_ctx->sig_list->sm_lists[DETECT_SM_LIST_PMATCH] == NULL\n");
goto end;
}
@ -662,7 +662,7 @@ int DetectHttpCookieTest11(void)
goto end;
}
DetectContentData *cd = de_ctx->sig_list->pmatch_tail->ctx;
DetectContentData *cd = de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_PMATCH]->ctx;
DetectHttpCookieData *hcd1 = de_ctx->sig_list->amatch_tail->ctx;
DetectHttpCookieData *hcd2 = de_ctx->sig_list->amatch_tail->prev->ctx;
if (cd->id != 1 || hcd1->id != 0 || hcd2->id != 0)
@ -693,8 +693,8 @@ int DetectHttpCookieTest12(void)
goto end;
}
if (de_ctx->sig_list->pmatch == NULL) {
printf("de_ctx->sig_list->pmatch == NULL\n");
if (de_ctx->sig_list->sm_lists[DETECT_SM_LIST_PMATCH] == NULL) {
printf("de_ctx->sig_list->sm_lists[DETECT_SM_LIST_PMATCH] == NULL\n");
goto end;
}
@ -703,7 +703,7 @@ int DetectHttpCookieTest12(void)
goto end;
}
DetectContentData *cd = de_ctx->sig_list->pmatch_tail->ctx;
DetectContentData *cd = de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_PMATCH]->ctx;
DetectHttpCookieData *hcd1 = de_ctx->sig_list->amatch_tail->ctx;
DetectHttpCookieData *hcd2 = de_ctx->sig_list->amatch_tail->prev->ctx;
if (cd->id != 2 || hcd1->id != 0 || hcd2->id != 0)

40
src/detect-http-header.c
Unescape Escape View File

@ -205,13 +205,13 @@ int DetectHttpHeaderSetup(DetectEngineCtx *de_ctx, Signature *s, char *arg)
return -1;
}
if (s->pmatch_tail == NULL) {
if (s->sm_lists_tail[DETECT_SM_LIST_PMATCH] == NULL) {
SCLogError(SC_ERR_INVALID_SIGNATURE, "http_header found inside the "
"rule, without any preceding content keywords");
return -1;
}
sm = DetectContentGetLastPattern(s->pmatch_tail);
sm = DetectContentGetLastPattern(s->sm_lists_tail[DETECT_SM_LIST_PMATCH]);
/* if still we are unable to find any content previous keywords, it is an
* invalid rule */
if (sm == NULL) {
@ -1350,8 +1350,8 @@ int DetectHttpHeaderTest14(void)
goto end;
}
if (de_ctx->sig_list->pmatch == NULL) {
printf("de_ctx->sig_list->pmatch == NULL\n");
if (de_ctx->sig_list->sm_lists[DETECT_SM_LIST_PMATCH] == NULL) {
printf("de_ctx->sig_list->sm_lists[DETECT_SM_LIST_PMATCH] == NULL\n");
goto end;
}
@ -1360,7 +1360,7 @@ int DetectHttpHeaderTest14(void)
goto end;
}
DetectContentData *cd = de_ctx->sig_list->pmatch_tail->ctx;
DetectContentData *cd = de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_PMATCH]->ctx;
DetectHttpHeaderData *hhd = de_ctx->sig_list->amatch_tail->ctx;
if (cd->id == hhd->id)
goto end;
@ -1389,8 +1389,8 @@ int DetectHttpHeaderTest15(void)
goto end;
}
if (de_ctx->sig_list->pmatch == NULL) {
printf("de_ctx->sig_list->pmatch == NULL\n");
if (de_ctx->sig_list->sm_lists[DETECT_SM_LIST_PMATCH] == NULL) {
printf("de_ctx->sig_list->sm_lists[DETECT_SM_LIST_PMATCH] == NULL\n");
goto end;
}
@ -1399,7 +1399,7 @@ int DetectHttpHeaderTest15(void)
goto end;
}
DetectContentData *cd = de_ctx->sig_list->pmatch_tail->ctx;
DetectContentData *cd = de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_PMATCH]->ctx;
DetectHttpHeaderData *hhd = de_ctx->sig_list->amatch_tail->ctx;
if (cd->id == hhd->id)
goto end;
@ -1428,8 +1428,8 @@ int DetectHttpHeaderTest16(void)
goto end;
}
if (de_ctx->sig_list->pmatch == NULL) {
printf("de_ctx->sig_list->pmatch == NULL\n");
if (de_ctx->sig_list->sm_lists[DETECT_SM_LIST_PMATCH] == NULL) {
printf("de_ctx->sig_list->sm_lists[DETECT_SM_LIST_PMATCH] == NULL\n");
goto end;
}
@ -1438,7 +1438,7 @@ int DetectHttpHeaderTest16(void)
goto end;
}
DetectContentData *cd = de_ctx->sig_list->pmatch_tail->ctx;
DetectContentData *cd = de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_PMATCH]->ctx;
DetectHttpHeaderData *hhd = de_ctx->sig_list->amatch_tail->ctx;
if (cd->id != 0 || hhd->id != 1)
goto end;
@ -1467,8 +1467,8 @@ int DetectHttpHeaderTest17(void)
goto end;
}
if (de_ctx->sig_list->pmatch == NULL) {
printf("de_ctx->sig_list->pmatch == NULL\n");
if (de_ctx->sig_list->sm_lists[DETECT_SM_LIST_PMATCH] == NULL) {
printf("de_ctx->sig_list->sm_lists[DETECT_SM_LIST_PMATCH] == NULL\n");
goto end;
}
@ -1477,7 +1477,7 @@ int DetectHttpHeaderTest17(void)
goto end;
}
DetectContentData *cd = de_ctx->sig_list->pmatch_tail->ctx;
DetectContentData *cd = de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_PMATCH]->ctx;
DetectHttpHeaderData *hhd = de_ctx->sig_list->amatch_tail->ctx;
if (cd->id != 1 || hhd->id != 0)
goto end;
@ -1507,8 +1507,8 @@ int DetectHttpHeaderTest18(void)
goto end;
}
if (de_ctx->sig_list->pmatch == NULL) {
printf("de_ctx->sig_list->pmatch == NULL\n");
if (de_ctx->sig_list->sm_lists[DETECT_SM_LIST_PMATCH] == NULL) {
printf("de_ctx->sig_list->sm_lists[DETECT_SM_LIST_PMATCH] == NULL\n");
goto end;
}
@ -1517,7 +1517,7 @@ int DetectHttpHeaderTest18(void)
goto end;
}
DetectContentData *cd = de_ctx->sig_list->pmatch_tail->ctx;
DetectContentData *cd = de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_PMATCH]->ctx;
DetectHttpHeaderData *hhd1 = de_ctx->sig_list->amatch_tail->ctx;
DetectHttpHeaderData *hhd2 = de_ctx->sig_list->amatch_tail->prev->ctx;
if (cd->id != 1 || hhd1->id != 0 || hhd2->id != 0)
@ -1548,8 +1548,8 @@ int DetectHttpHeaderTest19(void)
goto end;
}
if (de_ctx->sig_list->pmatch == NULL) {
printf("de_ctx->sig_list->pmatch == NULL\n");
if (de_ctx->sig_list->sm_lists[DETECT_SM_LIST_PMATCH] == NULL) {
printf("de_ctx->sig_list->sm_lists[DETECT_SM_LIST_PMATCH] == NULL\n");
goto end;
}
@ -1558,7 +1558,7 @@ int DetectHttpHeaderTest19(void)
goto end;
}
DetectContentData *cd = de_ctx->sig_list->pmatch_tail->ctx;
DetectContentData *cd = de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_PMATCH]->ctx;
DetectHttpHeaderData *hhd1 = de_ctx->sig_list->amatch_tail->ctx;
DetectHttpHeaderData *hhd2 = de_ctx->sig_list->amatch_tail->prev->ctx;
if (cd->id != 2 || hhd1->id != 0 || hhd2->id != 0)

40
src/detect-http-method.c
Unescape Escape View File

@ -163,13 +163,13 @@ static int DetectHttpMethodSetup(DetectEngineCtx *de_ctx, Signature *s, char *st
SCReturnInt(-1);
}
if (s->pmatch_tail == NULL) {
if (s->sm_lists_tail[DETECT_SM_LIST_PMATCH] == NULL) {
SCLogError(SC_ERR_INVALID_SIGNATURE,
"http_method modifier used before any signature match");
SCReturnInt(-1);
}
SigMatch *pm = DetectContentGetLastPattern(s->pmatch_tail);
SigMatch *pm = DetectContentGetLastPattern(s->sm_lists_tail[DETECT_SM_LIST_PMATCH]);
if (pm == NULL) {
SCLogError(SC_ERR_INVALID_SIGNATURE,
"http_method modifies \"content\", but none was found");
@ -415,8 +415,8 @@ int DetectHttpMethodTest06(void)
goto end;
}
if (de_ctx->sig_list->pmatch == NULL) {
printf("de_ctx->sig_list->pmatch == NULL\n");
if (de_ctx->sig_list->sm_lists[DETECT_SM_LIST_PMATCH] == NULL) {
printf("de_ctx->sig_list->sm_lists[DETECT_SM_LIST_PMATCH] == NULL\n");
goto end;
}
@ -425,7 +425,7 @@ int DetectHttpMethodTest06(void)
goto end;
}
DetectContentData *cd = de_ctx->sig_list->pmatch_tail->ctx;
DetectContentData *cd = de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_PMATCH]->ctx;
DetectHttpMethodData *hmd = de_ctx->sig_list->amatch_tail->ctx;
if (cd->id == hmd->id)
goto end;
@ -454,8 +454,8 @@ int DetectHttpMethodTest07(void)
goto end;
}
if (de_ctx->sig_list->pmatch == NULL) {
printf("de_ctx->sig_list->pmatch == NULL\n");
if (de_ctx->sig_list->sm_lists[DETECT_SM_LIST_PMATCH] == NULL) {
printf("de_ctx->sig_list->sm_lists[DETECT_SM_LIST_PMATCH] == NULL\n");
goto end;
}
@ -464,7 +464,7 @@ int DetectHttpMethodTest07(void)
goto end;
}
DetectContentData *cd = de_ctx->sig_list->pmatch_tail->ctx;
DetectContentData *cd = de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_PMATCH]->ctx;
DetectHttpMethodData *hmd = de_ctx->sig_list->amatch_tail->ctx;
if (cd->id == hmd->id)
goto end;
@ -493,8 +493,8 @@ int DetectHttpMethodTest08(void)
goto end;
}
if (de_ctx->sig_list->pmatch == NULL) {
printf("de_ctx->sig_list->pmatch == NULL\n");
if (de_ctx->sig_list->sm_lists[DETECT_SM_LIST_PMATCH] == NULL) {
printf("de_ctx->sig_list->sm_lists[DETECT_SM_LIST_PMATCH] == NULL\n");
goto end;
}
@ -503,7 +503,7 @@ int DetectHttpMethodTest08(void)
goto end;
}
DetectContentData *cd = de_ctx->sig_list->pmatch_tail->ctx;
DetectContentData *cd = de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_PMATCH]->ctx;
DetectHttpMethodData *hmd = de_ctx->sig_list->amatch_tail->ctx;
if (cd->id != 0 || hmd->id != 1)
goto end;
@ -532,8 +532,8 @@ int DetectHttpMethodTest09(void)
goto end;
}
if (de_ctx->sig_list->pmatch == NULL) {
printf("de_ctx->sig_list->pmatch == NULL\n");
if (de_ctx->sig_list->sm_lists[DETECT_SM_LIST_PMATCH] == NULL) {
printf("de_ctx->sig_list->sm_lists[DETECT_SM_LIST_PMATCH] == NULL\n");
goto end;
}
@ -542,7 +542,7 @@ int DetectHttpMethodTest09(void)
goto end;
}
DetectContentData *cd = de_ctx->sig_list->pmatch_tail->ctx;
DetectContentData *cd = de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_PMATCH]->ctx;
DetectHttpMethodData *hmd = de_ctx->sig_list->amatch_tail->ctx;
if (cd->id != 1 || hmd->id != 0)
goto end;
@ -572,8 +572,8 @@ int DetectHttpMethodTest10(void)
goto end;
}
if (de_ctx->sig_list->pmatch == NULL) {
printf("de_ctx->sig_list->pmatch == NULL\n");
if (de_ctx->sig_list->sm_lists[DETECT_SM_LIST_PMATCH] == NULL) {
printf("de_ctx->sig_list->sm_lists[DETECT_SM_LIST_PMATCH] == NULL\n");
goto end;
}
@ -582,7 +582,7 @@ int DetectHttpMethodTest10(void)
goto end;
}
DetectContentData *cd = de_ctx->sig_list->pmatch_tail->ctx;
DetectContentData *cd = de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_PMATCH]->ctx;
DetectHttpMethodData *hmd1 = de_ctx->sig_list->amatch_tail->ctx;
DetectHttpMethodData *hmd2 = de_ctx->sig_list->amatch_tail->prev->ctx;
if (cd->id != 1 || hmd1->id != 0 || hmd2->id != 0)
@ -613,8 +613,8 @@ int DetectHttpMethodTest11(void)
goto end;
}
if (de_ctx->sig_list->pmatch == NULL) {
printf("de_ctx->sig_list->pmatch == NULL\n");
if (de_ctx->sig_list->sm_lists[DETECT_SM_LIST_PMATCH] == NULL) {
printf("de_ctx->sig_list->sm_lists[DETECT_SM_LIST_PMATCH] == NULL\n");
goto end;
}
@ -623,7 +623,7 @@ int DetectHttpMethodTest11(void)
goto end;
}
DetectContentData *cd = de_ctx->sig_list->pmatch_tail->ctx;
DetectContentData *cd = de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_PMATCH]->ctx;
DetectHttpMethodData *hmd1 = de_ctx->sig_list->amatch_tail->ctx;
DetectHttpMethodData *hmd2 = de_ctx->sig_list->amatch_tail->prev->ctx;
if (cd->id != 2 || hmd1->id != 0 || hmd2->id != 0)

40
src/detect-http-uri.c
Unescape Escape View File

@ -95,13 +95,13 @@ static int DetectHttpUriSetup (DetectEngineCtx *de_ctx, Signature *s, char *str)
return -1;
}
if (s->pmatch_tail == NULL) {
if (s->sm_lists_tail[DETECT_SM_LIST_PMATCH] == NULL) {
SCLogError(SC_ERR_INVALID_SIGNATURE, "http_uri found inside the "
"rule, without any preceding content keywords");
return -1;
}
SigMatch *pm = DetectContentGetLastPattern(s->pmatch_tail);
SigMatch *pm = DetectContentGetLastPattern(s->sm_lists_tail[DETECT_SM_LIST_PMATCH]);
if (pm == NULL) {
SCLogWarning(SC_ERR_INVALID_SIGNATURE, "http_uri modifies \"content\""
"but none was found");
@ -366,8 +366,8 @@ int DetectHttpUriTest06(void)
goto end;
}
if (de_ctx->sig_list->pmatch == NULL) {
printf("de_ctx->sig_list->pmatch == NULL\n");
if (de_ctx->sig_list->sm_lists[DETECT_SM_LIST_PMATCH] == NULL) {
printf("de_ctx->sig_list->sm_lists[DETECT_SM_LIST_PMATCH] == NULL\n");
goto end;
}
@ -376,7 +376,7 @@ int DetectHttpUriTest06(void)
goto end;
}
DetectContentData *cd = de_ctx->sig_list->pmatch_tail->ctx;
DetectContentData *cd = de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_PMATCH]->ctx;
DetectUricontentData *ud = de_ctx->sig_list->umatch_tail->ctx;
if (cd->id == ud->id)
goto end;
@ -405,8 +405,8 @@ int DetectHttpUriTest07(void)
goto end;
}
if (de_ctx->sig_list->pmatch == NULL) {
printf("de_ctx->sig_list->pmatch == NULL\n");
if (de_ctx->sig_list->sm_lists[DETECT_SM_LIST_PMATCH] == NULL) {
printf("de_ctx->sig_list->sm_lists[DETECT_SM_LIST_PMATCH] == NULL\n");
goto end;
}
@ -415,7 +415,7 @@ int DetectHttpUriTest07(void)
goto end;
}
DetectContentData *cd = de_ctx->sig_list->pmatch_tail->ctx;
DetectContentData *cd = de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_PMATCH]->ctx;
DetectUricontentData *ud = de_ctx->sig_list->umatch_tail->ctx;
if (cd->id == ud->id)
goto end;
@ -444,8 +444,8 @@ int DetectHttpUriTest08(void)
goto end;
}
if (de_ctx->sig_list->pmatch == NULL) {
printf("de_ctx->sig_list->pmatch == NULL\n");
if (de_ctx->sig_list->sm_lists[DETECT_SM_LIST_PMATCH] == NULL) {
printf("de_ctx->sig_list->sm_lists[DETECT_SM_LIST_PMATCH] == NULL\n");
goto end;
}
@ -454,7 +454,7 @@ int DetectHttpUriTest08(void)
goto end;
}
DetectContentData *cd = de_ctx->sig_list->pmatch_tail->ctx;
DetectContentData *cd = de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_PMATCH]->ctx;
DetectUricontentData *ud = de_ctx->sig_list->umatch_tail->ctx;
if (cd->id != 0 || ud->id != 1)
goto end;
@ -483,8 +483,8 @@ int DetectHttpUriTest09(void)
goto end;
}
if (de_ctx->sig_list->pmatch == NULL) {
printf("de_ctx->sig_list->pmatch == NULL\n");
if (de_ctx->sig_list->sm_lists[DETECT_SM_LIST_PMATCH] == NULL) {
printf("de_ctx->sig_list->sm_lists[DETECT_SM_LIST_PMATCH] == NULL\n");
goto end;
}
@ -493,7 +493,7 @@ int DetectHttpUriTest09(void)
goto end;
}
DetectContentData *cd = de_ctx->sig_list->pmatch_tail->ctx;
DetectContentData *cd = de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_PMATCH]->ctx;
DetectUricontentData *ud = de_ctx->sig_list->umatch_tail->ctx;
if (cd->id != 1 || ud->id != 0)
goto end;
@ -523,8 +523,8 @@ int DetectHttpUriTest10(void)
goto end;
}
if (de_ctx->sig_list->pmatch == NULL) {
printf("de_ctx->sig_list->pmatch == NULL\n");
if (de_ctx->sig_list->sm_lists[DETECT_SM_LIST_PMATCH] == NULL) {
printf("de_ctx->sig_list->sm_lists[DETECT_SM_LIST_PMATCH] == NULL\n");
goto end;
}
@ -533,7 +533,7 @@ int DetectHttpUriTest10(void)
goto end;
}
DetectContentData *cd = de_ctx->sig_list->pmatch_tail->ctx;
DetectContentData *cd = de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_PMATCH]->ctx;
DetectUricontentData *ud1 = de_ctx->sig_list->umatch_tail->ctx;
DetectUricontentData *ud2 = de_ctx->sig_list->umatch_tail->prev->ctx;
if (cd->id != 1 || ud1->id != 0 || ud2->id != 0)
@ -564,8 +564,8 @@ int DetectHttpUriTest11(void)
goto end;
}
if (de_ctx->sig_list->pmatch == NULL) {
printf("de_ctx->sig_list->pmatch == NULL\n");
if (de_ctx->sig_list->sm_lists[DETECT_SM_LIST_PMATCH] == NULL) {
printf("de_ctx->sig_list->sm_lists[DETECT_SM_LIST_PMATCH] == NULL\n");
goto end;
}
@ -574,7 +574,7 @@ int DetectHttpUriTest11(void)
goto end;
}
DetectContentData *cd = de_ctx->sig_list->pmatch_tail->ctx;
DetectContentData *cd = de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_PMATCH]->ctx;
DetectUricontentData *ud1 = de_ctx->sig_list->umatch_tail->ctx;
DetectUricontentData *ud2 = de_ctx->sig_list->umatch_tail->prev->ctx;
if (cd->id != 2 || ud1->id != 0 || ud2->id != 0)

10
src/detect-isdataat.c
Unescape Escape View File

@ -251,9 +251,9 @@ int DetectIsdataatSetup (DetectEngineCtx *de_ctx, Signature *s, char *isdataatst
SigMatch *dm = NULL;
pm = SigMatchGetLastSMFromLists(s, 6,
DETECT_CONTENT, s->pmatch_tail,
DETECT_PCRE, s->pmatch_tail,
DETECT_BYTEJUMP, s->pmatch_tail);
DETECT_CONTENT, s->sm_lists_tail[DETECT_SM_LIST_PMATCH],
DETECT_PCRE, s->sm_lists_tail[DETECT_SM_LIST_PMATCH],
DETECT_BYTEJUMP, s->sm_lists_tail[DETECT_SM_LIST_PMATCH]);
dm = SigMatchGetLastSMFromLists(s, 6,
DETECT_CONTENT, s->dmatch_tail,
DETECT_PCRE, s->dmatch_tail,
@ -429,14 +429,14 @@ int DetectIsdataatTestParse04(void)
s->alproto = ALPROTO_DCERPC;
result &= (DetectIsdataatSetup(NULL, s, "30") == 0);
result &= (s->dmatch == NULL && s->pmatch != NULL);
result &= (s->dmatch == NULL && s->sm_lists[DETECT_SM_LIST_PMATCH] != NULL);
SigFree(s);
s = SigAlloc();
s->alproto = ALPROTO_DCERPC;
/* failure since we have no preceding content/pcre/bytejump */
result &= (DetectIsdataatSetup(NULL, s, "30,relative") == 0);
result &= (s->dmatch != NULL && s->pmatch == NULL);
result &= (s->dmatch != NULL && s->sm_lists[DETECT_SM_LIST_PMATCH] == NULL);
SigFree(s);

2
src/detect-nocase.c
Unescape Escape View File

@ -70,7 +70,7 @@ static SigMatch *SigMatchGetLastNocasePattern(Signature *s) {
BUG_ON(s == NULL);
SigMatch *co_sm = DetectContentGetLastPattern(s->pmatch_tail);
SigMatch *co_sm = DetectContentGetLastPattern(s->sm_lists_tail[DETECT_SM_LIST_PMATCH]);
SigMatch *ur_sm = SigMatchGetLastSM(s->umatch_tail, DETECT_URICONTENT);
/* http client body SigMatch */
SigMatch *hcbd_sm = SigMatchGetLastSM(s->amatch_tail, DETECT_AL_HTTP_CLIENT_BODY);

4
src/detect-offset.c
Unescape Escape View File

@ -68,7 +68,7 @@ int DetectOffsetSetup (DetectEngineCtx *de_ctx, Signature *s, char *offsetstr)
/* add to the latest "content" keyword from either dmatch or pmatch */
pm = SigMatchGetLastSMFromLists(s, 4,
DETECT_CONTENT, s->dmatch_tail,
DETECT_CONTENT, s->pmatch_tail);
DETECT_CONTENT, s->sm_lists_tail[DETECT_SM_LIST_PMATCH]);
if (pm == NULL) {
SCLogError(SC_ERR_WITHIN_MISSING_CONTENT, "offset needs"
"preceeding content option for dcerpc sig");
@ -81,7 +81,7 @@ int DetectOffsetSetup (DetectEngineCtx *de_ctx, Signature *s, char *offsetstr)
default:
pm = SigMatchGetLastSMFromLists(s, 4,
DETECT_CONTENT, s->pmatch_tail,
DETECT_CONTENT, s->sm_lists_tail[DETECT_SM_LIST_PMATCH],
DETECT_URICONTENT, s->umatch_tail);
if (pm == NULL) {
SCLogError(SC_ERR_WITHIN_MISSING_CONTENT, "distance needs"

50
src/detect-parse.c
Unescape Escape View File

@ -193,17 +193,17 @@ void SigMatchAppendUricontent(Signature *s, SigMatch *new) {
}
void SigMatchAppendPayload(Signature *s, SigMatch *new) {
if (s->pmatch == NULL) {
s->pmatch = new;
s->pmatch_tail = new;
if (s->sm_lists[DETECT_SM_LIST_PMATCH] == NULL) {
s->sm_lists[DETECT_SM_LIST_PMATCH] = new;
s->sm_lists_tail[DETECT_SM_LIST_PMATCH] = new;
new->next = NULL;
new->prev = NULL;
} else {
SigMatch *cur = s->pmatch_tail;
SigMatch *cur = s->sm_lists_tail[DETECT_SM_LIST_PMATCH];
cur->next = new;
new->prev = cur;
new->next = NULL;
s->pmatch_tail = new;
s->sm_lists_tail[DETECT_SM_LIST_PMATCH] = new;
}
new->idx = s->sm_cnt;
@ -290,13 +290,13 @@ void SigMatchAppendPacket(Signature *s, SigMatch *new) {
void SigMatchReplaceContent(Signature *s, SigMatch *old, SigMatch *new) {
BUG_ON(old == NULL);
SigMatch *m = s->pmatch;
SigMatch *m = s->sm_lists[DETECT_SM_LIST_PMATCH];
SigMatch *pm = m;
for ( ; m != NULL; m = m->next) {
if (m == old) {
if (m == s->pmatch) {
s->pmatch = m->next;
if (m == s->sm_lists[DETECT_SM_LIST_PMATCH]) {
s->sm_lists[DETECT_SM_LIST_PMATCH] = m->next;
if (m->next != NULL) {
m->next->prev = NULL;
}
@ -307,15 +307,15 @@ void SigMatchReplaceContent(Signature *s, SigMatch *old, SigMatch *new) {
}
}
if (m == s->pmatch_tail) {
if (m == s->sm_lists_tail[DETECT_SM_LIST_PMATCH]) {
if (pm == m) {
s->pmatch_tail = NULL;
s->sm_lists_tail[DETECT_SM_LIST_PMATCH] = NULL;
} else {
s->pmatch_tail = pm;
s->sm_lists_tail[DETECT_SM_LIST_PMATCH] = pm;
}
}
//printf("m %p s->pmatch %p s->pmatch_tail %p\n", m, s->pmatch, s->pmatch_tail);
//printf("m %p s->sm_lists[DETECT_SM_LIST_PMATCH] %p s->sm_lists_tail[DETECT_SM_LIST_PMATCH] %p\n", m, s->sm_lists[DETECT_SM_LIST_PMATCH], s->sm_lists_tail[DETECT_SM_LIST_PMATCH]);
break;
}
@ -354,13 +354,13 @@ void SigMatchReplaceContent(Signature *s, SigMatch *old, SigMatch *new) {
void SigMatchReplaceContentToUricontent(Signature *s, SigMatch *old, SigMatch *new) {
BUG_ON(old == NULL);
SigMatch *m = s->pmatch;
SigMatch *m = s->sm_lists[DETECT_SM_LIST_PMATCH];
SigMatch *pm = m;
for ( ; m != NULL; m = m->next) {
if (m == old) {
if (m == s->pmatch) {
s->pmatch = m->next;
if (m == s->sm_lists[DETECT_SM_LIST_PMATCH]) {
s->sm_lists[DETECT_SM_LIST_PMATCH] = m->next;
if (m->next != NULL) {
m->next->prev = NULL;
}
@ -371,15 +371,15 @@ void SigMatchReplaceContentToUricontent(Signature *s, SigMatch *old, SigMatch *n
}
}
if (m == s->pmatch_tail) {
if (m == s->sm_lists_tail[DETECT_SM_LIST_PMATCH]) {
if (pm == m) {
s->pmatch_tail = NULL;
s->sm_lists_tail[DETECT_SM_LIST_PMATCH] = NULL;
} else {
s->pmatch_tail = pm;
s->sm_lists_tail[DETECT_SM_LIST_PMATCH] = pm;
}
}
//printf("m %p s->pmatch %p s->pmatch_tail %p\n", m, s->pmatch, s->pmatch_tail);
//printf("m %p s->sm_lists[DETECT_SM_LIST_PMATCH] %p s->sm_lists_tail[DETECT_SM_LIST_PMATCH] %p\n", m, s->sm_lists[DETECT_SM_LIST_PMATCH], s->sm_lists_tail[DETECT_SM_LIST_PMATCH]);
break;
}
@ -1051,7 +1051,7 @@ void SigFree(Signature *s) {
sm = nsm;
}
sm = s->pmatch;
sm = s->sm_lists[DETECT_SM_LIST_PMATCH];
while (sm != NULL) {
nsm = sm->next;
SigMatchFree(sm);
@ -1279,7 +1279,7 @@ Signature *SigInit(DetectEngineCtx *de_ctx, char *sigstr) {
/* see if need to set the SIG_FLAG_MPM flag */
SigMatch *sm;
for (sm = sig->pmatch; sm != NULL; sm = sm->next) {
for (sm = sig->sm_lists[DETECT_SM_LIST_PMATCH]; sm != NULL; sm = sm->next) {
if (sm->type == DETECT_CONTENT) {
DetectContentData *cd = (DetectContentData *)sm->ctx;
if (cd == NULL)
@ -1308,7 +1308,7 @@ Signature *SigInit(DetectEngineCtx *de_ctx, char *sigstr) {
if (sig->flags & SIG_FLAG_MPM) {
sig->mpm_content_maxlen = 0;
for (sm = sig->pmatch; sm != NULL; sm = sm->next) {
for (sm = sig->sm_lists[DETECT_SM_LIST_PMATCH]; sm != NULL; sm = sm->next) {
if (sm->type == DETECT_CONTENT) {
DetectContentData *cd = (DetectContentData *)sm->ctx;
if (cd == NULL)
@ -1421,7 +1421,7 @@ Signature *SigInitReal(DetectEngineCtx *de_ctx, char *sigstr) {
/* see if need to set the SIG_FLAG_MPM flag */
SigMatch *sm;
for (sm = sig->pmatch; sm != NULL; sm = sm->next) {
for (sm = sig->sm_lists[DETECT_SM_LIST_PMATCH]; sm != NULL; sm = sm->next) {
if (sm->type == DETECT_CONTENT) {
DetectContentData *cd = (DetectContentData *)sm->ctx;
if (cd == NULL)
@ -1450,7 +1450,7 @@ Signature *SigInitReal(DetectEngineCtx *de_ctx, char *sigstr) {
if (sig->flags & SIG_FLAG_MPM) {
sig->mpm_content_maxlen = 0;
for (sm = sig->pmatch; sm != NULL; sm = sm->next) {
for (sm = sig->sm_lists[DETECT_SM_LIST_PMATCH]; sm != NULL; sm = sm->next) {
if (sm->type == DETECT_CONTENT) {
DetectContentData *cd = (DetectContentData *)sm->ctx;
if (cd == NULL)
@ -1499,7 +1499,7 @@ Signature *SigInitReal(DetectEngineCtx *de_ctx, char *sigstr) {
sig->next->mpm_content_maxlen = 0;
SigMatch *sm;
for (sm = sig->next->pmatch; sm != NULL; sm = sm->next) {
for (sm = sig->next->sm_lists[DETECT_SM_LIST_PMATCH]; sm != NULL; sm = sm->next) {
if (sm->type == DETECT_CONTENT) {
DetectContentData *cd = (DetectContentData *)sm->ctx;
if (cd == NULL)

16
src/detect-pcre.c
Unescape Escape View File

@ -1347,13 +1347,13 @@ static int DetectPcreSetup (DetectEngineCtx *de_ctx, Signature *s, char *regexst
SigMatch *dm = NULL;
pm = SigMatchGetLastSMFromLists(s, 6,
DETECT_CONTENT, s->pmatch_tail,
DETECT_PCRE, s->pmatch_tail,
DETECT_BYTEJUMP, s->pmatch_tail);
DETECT_CONTENT, s->sm_lists_tail[DETECT_SM_LIST_PMATCH],
DETECT_PCRE, s->sm_lists_tail[DETECT_SM_LIST_PMATCH],
DETECT_BYTEJUMP, s->sm_lists_tail[DETECT_SM_LIST_PMATCH]);
dm = SigMatchGetLastSMFromLists(s, 6,
DETECT_CONTENT, s->pmatch_tail,
DETECT_PCRE, s->pmatch_tail,
DETECT_BYTEJUMP, s->pmatch_tail);
DETECT_CONTENT, s->sm_lists_tail[DETECT_SM_LIST_PMATCH],
DETECT_PCRE, s->sm_lists_tail[DETECT_SM_LIST_PMATCH],
DETECT_BYTEJUMP, s->sm_lists_tail[DETECT_SM_LIST_PMATCH]);
if (pm == NULL) {
SigMatchAppendDcePayload(s, sm);
@ -1644,14 +1644,14 @@ int DetectPcreParseTest10(void)
s->alproto = ALPROTO_DCERPC;
result &= (DetectPcreSetup(de_ctx, s, "/bamboo/") == 0);
result &= (s->dmatch == NULL && s->pmatch != NULL);
result &= (s->dmatch == NULL && s->sm_lists[DETECT_SM_LIST_PMATCH] != NULL);
SigFree(s);
s = SigAlloc();
/* failure since we have no preceding content/pcre/bytejump */
result &= (DetectPcreSetup(de_ctx, s, "/bamboo/") == 0);
result &= (s->dmatch == NULL && s->pmatch != NULL);
result &= (s->dmatch == NULL && s->sm_lists[DETECT_SM_LIST_PMATCH] != NULL);
end:
SigFree(s);

2
src/detect-rawbytes.c
Unescape Escape View File

@ -58,7 +58,7 @@ static int DetectRawbytesSetup (DetectEngineCtx *de_ctx, Signature *s, char *nul
return -1;
}
SigMatch *pm = DetectContentGetLastPattern(s->pmatch_tail);
SigMatch *pm = DetectContentGetLastPattern(s->sm_lists_tail[DETECT_SM_LIST_PMATCH]);
if (pm == NULL) {
SCLogError(SC_ERR_RAWBYTES_MISSING_CONTENT, "\"rawbytes\" needs a preceeding content option");
SCReturnInt(-1);

106
src/detect-uricontent.c
Unescape Escape View File

@ -1074,7 +1074,7 @@ static int DetectUriSigTest04(void) {
"uricontent:\"foo\"; sid:1;)");
if (s == NULL ||
s->umatch == NULL ||
s->pmatch != NULL ||
s->sm_lists[DETECT_SM_LIST_PMATCH] != NULL ||
s->sm_lists[DETECT_SM_LIST_MATCH] != NULL)
{
printf("sig 1 failed to parse: ");
@ -1086,7 +1086,7 @@ static int DetectUriSigTest04(void) {
"uricontent:\"foo\"; content:\"bar\";sid:1;)");
if (s == NULL ||
s->umatch == NULL ||
s->pmatch == NULL ||
s->sm_lists[DETECT_SM_LIST_PMATCH] == NULL ||
s->sm_lists[DETECT_SM_LIST_MATCH] != NULL)
{
printf("sig 2 failed to parse: ");
@ -1099,9 +1099,9 @@ static int DetectUriSigTest04(void) {
" depth:10; offset: 5; sid:1;)");
if (s == NULL ||
s->umatch == NULL ||
s->pmatch == NULL ||
((DetectContentData *)s->pmatch->ctx)->depth != 15 ||
((DetectContentData *)s->pmatch->ctx)->offset != 5 ||
s->sm_lists[DETECT_SM_LIST_PMATCH] == NULL ||
((DetectContentData *)s->sm_lists[DETECT_SM_LIST_PMATCH]->ctx)->depth != 15 ||
((DetectContentData *)s->sm_lists[DETECT_SM_LIST_PMATCH]->ctx)->offset != 5 ||
s->sm_lists[DETECT_SM_LIST_MATCH] != NULL)
{
printf("sig 3 failed to parse: ");
@ -1114,7 +1114,7 @@ static int DetectUriSigTest04(void) {
" depth:10; offset: 5; sid:1;)");
if (s == NULL ||
s->umatch == NULL ||
s->pmatch == NULL ||
s->sm_lists[DETECT_SM_LIST_PMATCH] == NULL ||
((DetectUricontentData *)s->umatch->ctx)->depth != 15 ||
((DetectUricontentData *)s->umatch->ctx)->offset != 5 ||
s->sm_lists[DETECT_SM_LIST_MATCH] != NULL)
@ -1149,14 +1149,14 @@ static int DetectUriSigTest04(void) {
if (s == NULL) {
goto end;
} else if (s->umatch == NULL ||
s->pmatch == NULL ||
((DetectContentData*) s->pmatch->ctx)->depth != 15 ||
((DetectContentData*) s->pmatch->ctx)->offset != 5 ||
((DetectContentData*) s->pmatch_tail->ctx)->within != 30 ||
s->sm_lists[DETECT_SM_LIST_PMATCH] == NULL ||
((DetectContentData*) s->sm_lists[DETECT_SM_LIST_PMATCH]->ctx)->depth != 15 ||
((DetectContentData*) s->sm_lists[DETECT_SM_LIST_PMATCH]->ctx)->offset != 5 ||
((DetectContentData*) s->sm_lists_tail[DETECT_SM_LIST_PMATCH]->ctx)->within != 30 ||
s->sm_lists[DETECT_SM_LIST_MATCH] != NULL)
{
printf("sig 7 failed to parse: ");
DetectContentPrint((DetectContentData*) s->pmatch_tail->ctx);
DetectContentPrint((DetectContentData*) s->sm_lists_tail[DETECT_SM_LIST_PMATCH]->ctx);
goto end;
}
@ -1168,9 +1168,9 @@ static int DetectUriSigTest04(void) {
if (s == NULL) {
goto end;
} else if (s->umatch == NULL ||
s->pmatch == NULL ||
((DetectContentData*) s->pmatch->ctx)->depth != 15 ||
((DetectContentData*) s->pmatch->ctx)->offset != 5 ||
s->sm_lists[DETECT_SM_LIST_PMATCH] == NULL ||
((DetectContentData*) s->sm_lists[DETECT_SM_LIST_PMATCH]->ctx)->depth != 15 ||
((DetectContentData*) s->sm_lists[DETECT_SM_LIST_PMATCH]->ctx)->offset != 5 ||
((DetectUricontentData*) s->umatch_tail->ctx)->within != 30 ||
s->sm_lists[DETECT_SM_LIST_MATCH] != NULL)
{
@ -1188,14 +1188,14 @@ static int DetectUriSigTest04(void) {
goto end;
} else if (
s->umatch == NULL ||
s->pmatch == NULL ||
((DetectContentData*) s->pmatch->ctx)->depth != 15 ||
((DetectContentData*) s->pmatch->ctx)->offset != 5 ||
((DetectContentData*) s->pmatch_tail->ctx)->distance != 30 ||
s->sm_lists[DETECT_SM_LIST_PMATCH] == NULL ||
((DetectContentData*) s->sm_lists[DETECT_SM_LIST_PMATCH]->ctx)->depth != 15 ||
((DetectContentData*) s->sm_lists[DETECT_SM_LIST_PMATCH]->ctx)->offset != 5 ||
((DetectContentData*) s->sm_lists_tail[DETECT_SM_LIST_PMATCH]->ctx)->distance != 30 ||
s->sm_lists[DETECT_SM_LIST_MATCH] != NULL)
{
printf("sig 9 failed to parse: ");
DetectContentPrint((DetectContentData*) s->pmatch_tail->ctx);
DetectContentPrint((DetectContentData*) s->sm_lists_tail[DETECT_SM_LIST_PMATCH]->ctx);
goto end;
}
@ -1208,9 +1208,9 @@ static int DetectUriSigTest04(void) {
goto end;
} else if (
s->umatch == NULL ||
s->pmatch == NULL ||
((DetectContentData*) s->pmatch->ctx)->depth != 15 ||
((DetectContentData*) s->pmatch->ctx)->offset != 5 ||
s->sm_lists[DETECT_SM_LIST_PMATCH] == NULL ||
((DetectContentData*) s->sm_lists[DETECT_SM_LIST_PMATCH]->ctx)->depth != 15 ||
((DetectContentData*) s->sm_lists[DETECT_SM_LIST_PMATCH]->ctx)->offset != 5 ||
((DetectUricontentData*) s->umatch_tail->ctx)->distance != 30 ||
s->sm_lists[DETECT_SM_LIST_MATCH] != NULL)
{
@ -1231,22 +1231,22 @@ static int DetectUriSigTest04(void) {
goto end;
}
if (s->umatch == NULL || s->pmatch == NULL) {
printf("umatch %p or pmatch %p: ", s->umatch, s->pmatch);
if (s->umatch == NULL || s->sm_lists[DETECT_SM_LIST_PMATCH] == NULL) {
printf("umatch %p or pmatch %p: ", s->umatch, s->sm_lists[DETECT_SM_LIST_PMATCH]);
goto end;
}
if ( ((DetectContentData*) s->pmatch->ctx)->depth != 15 ||
((DetectContentData*) s->pmatch->ctx)->offset != 5 ||
if ( ((DetectContentData*) s->sm_lists[DETECT_SM_LIST_PMATCH]->ctx)->depth != 15 ||
((DetectContentData*) s->sm_lists[DETECT_SM_LIST_PMATCH]->ctx)->offset != 5 ||
((DetectUricontentData*) s->umatch_tail->ctx)->distance != 30 ||
((DetectUricontentData*) s->umatch_tail->ctx)->within != 60 ||
((DetectContentData*) s->pmatch_tail->ctx)->distance != 45 ||
((DetectContentData*) s->pmatch_tail->ctx)->within != 70 ||
((DetectContentData*) s->sm_lists_tail[DETECT_SM_LIST_PMATCH]->ctx)->distance != 45 ||
((DetectContentData*) s->sm_lists_tail[DETECT_SM_LIST_PMATCH]->ctx)->within != 70 ||
s->sm_lists[DETECT_SM_LIST_MATCH] != NULL) {
printf("sig 10 failed to parse, content not setup properly: ");
DetectContentPrint((DetectContentData*) s->pmatch->ctx);
DetectContentPrint((DetectContentData*) s->sm_lists[DETECT_SM_LIST_PMATCH]->ctx);
DetectUricontentPrint((DetectUricontentData*) s->umatch_tail->ctx);
DetectContentPrint((DetectContentData*) s->pmatch_tail->ctx);
DetectContentPrint((DetectContentData*) s->sm_lists_tail[DETECT_SM_LIST_PMATCH]->ctx);
goto end;
}
@ -2128,8 +2128,8 @@ int DetectUricontentSigTest08(void)
goto end;
}
if (de_ctx->sig_list->pmatch == NULL) {
printf("de_ctx->sig_list->pmatch == NULL\n");
if (de_ctx->sig_list->sm_lists[DETECT_SM_LIST_PMATCH] == NULL) {
printf("de_ctx->sig_list->sm_lists[DETECT_SM_LIST_PMATCH] == NULL\n");
goto end;
}
@ -2138,7 +2138,7 @@ int DetectUricontentSigTest08(void)
goto end;
}
DetectContentData *cd = de_ctx->sig_list->pmatch_tail->ctx;
DetectContentData *cd = de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_PMATCH]->ctx;
DetectUricontentData *ud = de_ctx->sig_list->umatch_tail->ctx;
if (cd->id == ud->id)
goto end;
@ -2167,8 +2167,8 @@ int DetectUricontentSigTest09(void)
goto end;
}
if (de_ctx->sig_list->pmatch == NULL) {
printf("de_ctx->sig_list->pmatch == NULL\n");
if (de_ctx->sig_list->sm_lists[DETECT_SM_LIST_PMATCH] == NULL) {
printf("de_ctx->sig_list->sm_lists[DETECT_SM_LIST_PMATCH] == NULL\n");
goto end;
}
@ -2177,7 +2177,7 @@ int DetectUricontentSigTest09(void)
goto end;
}
DetectContentData *cd = de_ctx->sig_list->pmatch_tail->ctx;
DetectContentData *cd = de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_PMATCH]->ctx;
DetectUricontentData *ud = de_ctx->sig_list->umatch_tail->ctx;
if (cd->id == ud->id)
goto end;
@ -2207,8 +2207,8 @@ int DetectUricontentSigTest10(void)
goto end;
}
if (de_ctx->sig_list->pmatch == NULL) {
printf("de_ctx->sig_list->pmatch == NULL\n");
if (de_ctx->sig_list->sm_lists[DETECT_SM_LIST_PMATCH] == NULL) {
printf("de_ctx->sig_list->sm_lists[DETECT_SM_LIST_PMATCH] == NULL\n");
goto end;
}
@ -2217,9 +2217,9 @@ int DetectUricontentSigTest10(void)
goto end;
}
DetectContentData *cd1 = de_ctx->sig_list->pmatch_tail->prev->prev->ctx;
DetectContentData *cd2 = de_ctx->sig_list->pmatch_tail->prev->ctx;
DetectContentData *cd3 = de_ctx->sig_list->pmatch_tail->ctx;
DetectContentData *cd1 = de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_PMATCH]->prev->prev->ctx;
DetectContentData *cd2 = de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_PMATCH]->prev->ctx;
DetectContentData *cd3 = de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_PMATCH]->ctx;
DetectUricontentData *ud1 = de_ctx->sig_list->umatch_tail->prev->ctx;
DetectUricontentData *ud2 = de_ctx->sig_list->umatch_tail->ctx;
if (cd1->id != 1 || cd2->id != 2 || cd3->id != 1 || ud1->id != 0 || ud2->id != 0)
@ -2250,8 +2250,8 @@ int DetectUricontentSigTest11(void)
goto end;
}
if (de_ctx->sig_list->pmatch == NULL) {
printf("de_ctx->sig_list->pmatch == NULL\n");
if (de_ctx->sig_list->sm_lists[DETECT_SM_LIST_PMATCH] == NULL) {
printf("de_ctx->sig_list->sm_lists[DETECT_SM_LIST_PMATCH] == NULL\n");
goto end;
}
@ -2260,9 +2260,9 @@ int DetectUricontentSigTest11(void)
goto end;
}
DetectContentData *cd1 = de_ctx->sig_list->pmatch_tail->prev->prev->ctx;
DetectContentData *cd2 = de_ctx->sig_list->pmatch_tail->prev->ctx;
DetectContentData *cd3 = de_ctx->sig_list->pmatch_tail->ctx;
DetectContentData *cd1 = de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_PMATCH]->prev->prev->ctx;
DetectContentData *cd2 = de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_PMATCH]->prev->ctx;
DetectContentData *cd3 = de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_PMATCH]->ctx;
DetectUricontentData *ud1 = de_ctx->sig_list->umatch_tail->prev->ctx;
DetectUricontentData *ud2 = de_ctx->sig_list->umatch_tail->ctx;
if (cd1->id != 1 || cd2->id != 2 || cd3->id != 1 || ud1->id != 0 || ud2->id != 0)
@ -2295,8 +2295,8 @@ int DetectUricontentSigTest12(void)
goto end;
}
if (de_ctx->sig_list->pmatch == NULL) {
printf("de_ctx->sig_list->pmatch == NULL\n");
if (de_ctx->sig_list->sm_lists[DETECT_SM_LIST_PMATCH] == NULL) {
printf("de_ctx->sig_list->sm_lists[DETECT_SM_LIST_PMATCH] == NULL\n");
goto end;
}
@ -2305,11 +2305,11 @@ int DetectUricontentSigTest12(void)
goto end;
}
DetectContentData *cd1 = de_ctx->sig_list->pmatch_tail->prev->prev->prev->prev->ctx;
DetectContentData *cd2 = de_ctx->sig_list->pmatch_tail->prev->prev->prev->ctx;
DetectContentData *cd3 = de_ctx->sig_list->pmatch_tail->prev->prev->ctx;
DetectContentData *cd4 = de_ctx->sig_list->pmatch_tail->prev->ctx;
DetectContentData *cd5 = de_ctx->sig_list->pmatch_tail->ctx;
DetectContentData *cd1 = de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_PMATCH]->prev->prev->prev->prev->ctx;
DetectContentData *cd2 = de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_PMATCH]->prev->prev->prev->ctx;
DetectContentData *cd3 = de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_PMATCH]->prev->prev->ctx;
DetectContentData *cd4 = de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_PMATCH]->prev->ctx;
DetectContentData *cd5 = de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_PMATCH]->ctx;
DetectUricontentData *ud1 = de_ctx->sig_list->umatch_tail->prev->prev->prev->prev->ctx;
DetectUricontentData *ud2 = de_ctx->sig_list->umatch_tail->prev->prev->prev->ctx;
DetectUricontentData *ud3 = de_ctx->sig_list->umatch_tail->prev->prev->ctx;

21
src/detect-within.c
Unescape Escape View File

@ -76,7 +76,7 @@ static int DetectWithinSetup (DetectEngineCtx *de_ctx, Signature *s, char *withi
}
/* if we still haven't found that the sig is related to DCERPC,
* it's a direct entry into Signature->pmatch */
* it's a direct entry into Signature->[DETECT_SM_LIST_PMATCH] */
if (s->alproto == ALPROTO_DCERPC) {
SigMatch *dcem = NULL;
SigMatch *dm = NULL;
@ -97,9 +97,9 @@ static int DetectWithinSetup (DetectEngineCtx *de_ctx, Signature *s, char *withi
DETECT_PCRE, s->dmatch_tail,
DETECT_BYTEJUMP, s->dmatch_tail);
pm1_ots = SigMatchGetLastSMFromLists(s, 6,
DETECT_CONTENT, s->pmatch_tail,
DETECT_PCRE, s->pmatch_tail,
DETECT_BYTEJUMP, s->pmatch_tail);
DETECT_CONTENT, s->sm_lists_tail[DETECT_SM_LIST_PMATCH],
DETECT_PCRE, s->sm_lists_tail[DETECT_SM_LIST_PMATCH],
DETECT_BYTEJUMP, s->sm_lists_tail[DETECT_SM_LIST_PMATCH]);
if (pm1_ots != NULL && pm1_ots->prev != NULL) {
pm2_ots = SigMatchGetLastSMFromLists(s, 6,
DETECT_CONTENT, pm1_ots->prev,
@ -108,7 +108,7 @@ static int DetectWithinSetup (DetectEngineCtx *de_ctx, Signature *s, char *withi
}
dm = SigMatchGetLastSMFromLists(s, 2, DETECT_CONTENT, s->dmatch_tail);
pm1 = SigMatchGetLastSMFromLists(s, 2, DETECT_CONTENT, s->pmatch_tail);
pm1 = SigMatchGetLastSMFromLists(s, 2, DETECT_CONTENT, s->sm_lists_tail[DETECT_SM_LIST_PMATCH]);
if (pm1 != NULL && pm1->prev != NULL) {
pm2 = SigMatchGetLastSMFromLists(s, 2, DETECT_CONTENT, pm1->prev);
}
@ -124,7 +124,8 @@ static int DetectWithinSetup (DetectEngineCtx *de_ctx, Signature *s, char *withi
if (pm1->idx > dcem->idx) {
/* transfer pm1 to dmatch list and within is against this */
SigMatchTransferSigMatchAcrossLists(pm1,
&s->pmatch, &s->pmatch_tail,
&s->sm_lists[DETECT_SM_LIST_PMATCH],
&s->sm_lists_tail[DETECT_SM_LIST_PMATCH],
&s->dmatch, &s->dmatch_tail);
pm = pm1;
} else {
@ -137,7 +138,8 @@ static int DetectWithinSetup (DetectEngineCtx *de_ctx, Signature *s, char *withi
} else if (pm1->idx > dcem->idx) {
/* transfer pm1 to dmatch list and within is against this */
SigMatchTransferSigMatchAcrossLists(pm1,
&s->pmatch, &s->pmatch_tail,
&s->sm_lists[DETECT_SM_LIST_PMATCH],
&s->sm_lists_tail[DETECT_SM_LIST_PMATCH],
&s->dmatch, &s->dmatch_tail);
pm = pm1;
} else {
@ -154,7 +156,8 @@ static int DetectWithinSetup (DetectEngineCtx *de_ctx, Signature *s, char *withi
} else if (pm2_ots == NULL || pm2_ots->idx < dcem->idx) {
/* trasnfer pm1 to dmatch list and pm = pm1 */
SigMatchTransferSigMatchAcrossLists(pm1,
&s->pmatch, &s->pmatch_tail,
&s->sm_lists[DETECT_SM_LIST_PMATCH],
&s->sm_lists_tail[DETECT_SM_LIST_PMATCH],
&s->dmatch, &s->dmatch_tail);
pm = pm1;
} else {
@ -164,7 +167,7 @@ static int DetectWithinSetup (DetectEngineCtx *de_ctx, Signature *s, char *withi
}
} else {
pm = SigMatchGetLastSMFromLists(s, 4,
DETECT_CONTENT, s->pmatch_tail,
DETECT_CONTENT, s->sm_lists_tail[DETECT_SM_LIST_PMATCH],
DETECT_URICONTENT, s->umatch_tail);
if (pm == NULL) {
SCLogError(SC_ERR_WITHIN_MISSING_CONTENT, "within needs"

24
src/detect.c
Unescape Escape View File

@ -267,7 +267,7 @@ void EngineAnalysisFastPattern(Signature *s)
DetectContentData *fp_cd = NULL;
SigMatch *sm = NULL;
for (sm = s->pmatch; sm != NULL; sm = sm->next) {
for (sm = s->sm_lists[DETECT_SM_LIST_PMATCH]; sm != NULL; sm = sm->next) {
if (sm->type != DETECT_CONTENT)
continue;
@ -1094,7 +1094,7 @@ int SigMatchSignatures(ThreadVars *th_v, DetectEngineCtx *de_ctx, DetectEngineTh
/* Check the payload keywords. If we are a MPM sig and we've made
* to here, we've had at least one of the patterns match */
if (s->pmatch != NULL) {
if (s->sm_lists[DETECT_SM_LIST_PMATCH] != NULL) {
/* if we have stream msgs, inspect against those first,
* but not for a "dsize" signature */
if (!(s->flags & SIG_FLAG_DSIZE) && smsg != NULL) {
@ -1445,7 +1445,7 @@ int SignatureIsIPOnly(DetectEngineCtx *de_ctx, Signature *s) {
}
}
if (s->pmatch != NULL)
if (s->sm_lists[DETECT_SM_LIST_PMATCH] != NULL)
return 0;
if (s->umatch != NULL)
@ -1482,11 +1482,11 @@ iponly:
*/
static int SignatureIsInspectingPayload(DetectEngineCtx *de_ctx, Signature *s) {
if (s->pmatch != NULL) {
if (s->sm_lists[DETECT_SM_LIST_PMATCH] != NULL) {
return 1;
}
#if 0
SigMatch *sm = s->pmatch;
SigMatch *sm = s->sm_lists[DETECT_SM_LIST_PMATCH];
if (sm == NULL)
return 0;
@ -1513,7 +1513,7 @@ static int SignatureIsDEOnly(DetectEngineCtx *de_ctx, Signature *s) {
if (s->alproto != ALPROTO_UNKNOWN)
return 0;
if (s->pmatch != NULL)
if (s->sm_lists[DETECT_SM_LIST_PMATCH] != NULL)
return 0;
if (s->umatch != NULL)
@ -1594,7 +1594,7 @@ PacketCreateMask(Packet *p, SignatureMask *mask, uint16_t alproto, void *alstate
static int SignatureCreateMask(Signature *s) {
SCEnter();
if (s->pmatch != NULL) {
if (s->sm_lists[DETECT_SM_LIST_PMATCH] != NULL) {
s->mask |= SIG_MASK_REQUIRE_PAYLOAD;
SCLogDebug("sig requires payload");
}
@ -7449,16 +7449,16 @@ int SigTest37ContentAndIsdataatKeywords02Real (int mpm_type) {
goto end;
}
if (s->pmatch->type != DETECT_CONTENT) {
if (s->sm_lists[DETECT_SM_LIST_PMATCH]->type != DETECT_CONTENT) {
printf("type not content: ");
goto end;
}
/*
if (s->pmatch->next == NULL) {
printf("s->pmatch->next == NULL: ");
if (s->sm_lists[DETECT_SM_LIST_PMATCH]->next == NULL) {
printf("s->sm_lists[DETECT_SM_LIST_PMATCH]->next == NULL: ");
goto end;
}
if (s->pmatch->next->type != DETECT_ISDATAAT) {
if (s->sm_lists[DETECT_SM_LIST_PMATCH]->next->type != DETECT_ISDATAAT) {
printf("type not isdataat: ");
goto end;
}
@ -7630,7 +7630,7 @@ int SigTest40NoPayloadInspection02(void) {
}
// sigmatch_table[DETECT_CONTENT].flags |= SIGMATCH_PAYLOAD;
// de_ctx->sig_list->pmatch->type = DETECT_CONTENT;
// de_ctx->sig_list->sm_lists[DETECT_SM_LIST_PMATCH]->type = DETECT_CONTENT;
SigGroupBuild(de_ctx);
//PatternMatchPrepare(mpm_ctx,MPM_B2G);

4
src/detect.h
Unescape Escape View File

@ -358,7 +358,7 @@ typedef struct Signature_ {
struct SigMatch_ *sm_lists[DETECT_SM_LIST_MAX];
/** ptr to the SigMatch lists */
struct SigMatch_ *pmatch; /* payload matches */
//struct SigMatch_ *pmatch; /* payload matches */
struct SigMatch_ *umatch; /* uricontent payload matches */
struct SigMatch_ *amatch; /* general app layer matches */
struct SigMatch_ *dmatch; /* dce app layer matches */
@ -412,7 +412,7 @@ typedef struct Signature_ {
struct SigMatch_ *sm_lists_tail[DETECT_SM_LIST_MAX];
//struct SigMatch_ *match_tail; /* non-payload matches, tail of the list */
struct SigMatch_ *pmatch_tail; /* payload matches, tail of the list */
//struct SigMatch_ *pmatch_tail; /* payload matches, tail of the list */
struct SigMatch_ *umatch_tail; /* uricontent payload matches, tail of the list */
struct SigMatch_ *amatch_tail; /* general app layer matches, tail of the list */
struct SigMatch_ *dmatch_tail; /* dce app layer matches, tail of the list */

Write Preview
Loading…
Cancel
Save