diff --git a/src/detect-bytejump.c b/src/detect-bytejump.c index abb97c7e54..43ca341da5 100644 --- a/src/detect-bytejump.c +++ b/src/detect-bytejump.c @@ -553,9 +553,9 @@ int DetectBytejumpSetup(DetectEngineCtx *de_ctx, Signature *s, char *optstr) SigMatch *dm = NULL; pm = SigMatchGetLastSMFromLists(s, 6, - DETECT_CONTENT, s->pmatch_tail, - DETECT_PCRE, s->pmatch_tail, - DETECT_BYTEJUMP, s->pmatch_tail); + DETECT_CONTENT, s->sm_lists_tail[DETECT_SM_LIST_PMATCH], + DETECT_PCRE, s->sm_lists_tail[DETECT_SM_LIST_PMATCH], + DETECT_BYTEJUMP, s->sm_lists_tail[DETECT_SM_LIST_PMATCH]); dm = SigMatchGetLastSMFromLists(s, 6, DETECT_CONTENT, s->dmatch_tail, DETECT_PCRE, s->dmatch_tail, @@ -853,7 +853,7 @@ int DetectBytejumpTestParse09(void) { result &= (DetectBytejumpSetup(NULL, s, "4,0, string, oct, dce") == -1); result &= (DetectBytejumpSetup(NULL, s, "4,0, string, hex, dce") == -1); result &= (DetectBytejumpSetup(NULL, s, "4,0, from_beginning, dce") == -1); - result &= (s->dmatch == NULL && s->pmatch != NULL); + result &= (s->dmatch == NULL && s->sm_lists[DETECT_SM_LIST_PMATCH] != NULL); SigFree(s); return result; diff --git a/src/detect-bytetest.c b/src/detect-bytetest.c index 0ff76fa7b7..877f8bc44e 100644 --- a/src/detect-bytetest.c +++ b/src/detect-bytetest.c @@ -583,9 +583,9 @@ int DetectBytetestSetup(DetectEngineCtx *de_ctx, Signature *s, char *optstr) SigMatch *dm = NULL; pm = SigMatchGetLastSMFromLists(s, 6, - DETECT_CONTENT, s->pmatch_tail, - DETECT_PCRE, s->pmatch_tail, - DETECT_BYTEJUMP, s->pmatch_tail); + DETECT_CONTENT, s->sm_lists_tail[DETECT_SM_LIST_PMATCH], + DETECT_PCRE, s->sm_lists_tail[DETECT_SM_LIST_PMATCH], + DETECT_BYTEJUMP, s->sm_lists_tail[DETECT_SM_LIST_PMATCH]); dm = SigMatchGetLastSMFromLists(s, 6, DETECT_CONTENT, s->dmatch_tail, DETECT_PCRE, s->dmatch_tail, diff --git a/src/detect-content.c b/src/detect-content.c index 15a3b37abe..70edbff58f 100644 --- a/src/detect-content.c +++ b/src/detect-content.c @@ -378,7 +378,7 @@ SigMatch *SigMatchGetLastPattern(Signature *s) { BUG_ON(s == NULL); - SigMatch *co_sm = DetectContentGetLastPattern(s->pmatch_tail); + SigMatch *co_sm = DetectContentGetLastPattern(s->sm_lists_tail[DETECT_SM_LIST_PMATCH]); SigMatch *ur_sm = SigMatchGetLastSM(s->umatch_tail, DETECT_URICONTENT); SigMatch *sm = NULL; @@ -707,8 +707,8 @@ int DetectContentLongPatternMatchTest(uint8_t *raw_eth_pkt, uint16_t pktsize, ch } de_ctx->sig_list->next = NULL; - if (de_ctx->sig_list->pmatch_tail->type == DETECT_CONTENT) { - DetectContentData *co = (DetectContentData *)de_ctx->sig_list->pmatch_tail->ctx; + if (de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_PMATCH]->type == DETECT_CONTENT) { + DetectContentData *co = (DetectContentData *)de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_PMATCH]->ctx; if (co->flags & DETECT_CONTENT_RELATIVE_NEXT) { printf("relative next flag set on final match which is content: "); goto end; @@ -1097,13 +1097,13 @@ int DetectContentParseTest18(void) s->alproto = ALPROTO_DCERPC; result &= (DetectContentSetup(de_ctx, s, "one") == 0); - result &= (s->dmatch == NULL && s->pmatch != NULL); + result &= (s->dmatch == NULL && s->sm_lists[DETECT_SM_LIST_PMATCH] != NULL); SigFree(s); s = SigAlloc(); result &= (DetectContentSetup(de_ctx, s, "one") == 0); - result &= (s->dmatch == NULL && s->pmatch != NULL); + result &= (s->dmatch == NULL && s->sm_lists[DETECT_SM_LIST_PMATCH] != NULL); end: SigFree(s); @@ -1142,7 +1142,7 @@ int DetectContentParseTest19(void) goto end; } result &= (s->dmatch_tail->type == DETECT_CONTENT); - result &= (s->pmatch == NULL); + result &= (s->sm_lists[DETECT_SM_LIST_PMATCH] == NULL); data = (DetectContentData *)s->dmatch_tail->ctx; if (data->flags & DETECT_CONTENT_RAWBYTES || data->flags & DETECT_CONTENT_NOCASE || @@ -1170,7 +1170,7 @@ int DetectContentParseTest19(void) goto end; } result &= (s->dmatch_tail->type == DETECT_CONTENT); - result &= (s->pmatch == NULL); + result &= (s->sm_lists[DETECT_SM_LIST_PMATCH] == NULL); data = (DetectContentData *)s->dmatch_tail->ctx; if (data->flags & DETECT_CONTENT_RAWBYTES || data->flags & DETECT_CONTENT_NOCASE || @@ -1200,7 +1200,7 @@ int DetectContentParseTest19(void) goto end; } result &= (s->dmatch_tail->type == DETECT_CONTENT); - result &= (s->pmatch == NULL); + result &= (s->sm_lists[DETECT_SM_LIST_PMATCH] == NULL); data = (DetectContentData *)s->dmatch_tail->ctx; if (data->flags & DETECT_CONTENT_RAWBYTES || data->flags & DETECT_CONTENT_NOCASE || @@ -1242,7 +1242,7 @@ int DetectContentParseTest19(void) goto end; } result &= (s->dmatch_tail->type == DETECT_CONTENT); - result &= (s->pmatch == NULL); + result &= (s->sm_lists[DETECT_SM_LIST_PMATCH] == NULL); data = (DetectContentData *)s->dmatch_tail->ctx; if (data->flags & DETECT_CONTENT_RAWBYTES || data->flags & DETECT_CONTENT_NOCASE || @@ -1272,7 +1272,7 @@ int DetectContentParseTest19(void) goto end; } result &= (s->dmatch_tail->type == DETECT_CONTENT); - result &= (s->pmatch == NULL); + result &= (s->sm_lists[DETECT_SM_LIST_PMATCH] == NULL); data = (DetectContentData *)s->dmatch_tail->ctx; if (data->flags & DETECT_CONTENT_RAWBYTES || data->flags & DETECT_CONTENT_NOCASE || @@ -1301,7 +1301,7 @@ int DetectContentParseTest19(void) goto end; } result &= (s->dmatch_tail->type == DETECT_CONTENT); - result &= (s->pmatch == NULL); + result &= (s->sm_lists[DETECT_SM_LIST_PMATCH] == NULL); data = (DetectContentData *)s->dmatch_tail->ctx; if (data->flags & DETECT_CONTENT_RAWBYTES || data->flags & DETECT_CONTENT_NOCASE || @@ -1330,7 +1330,7 @@ int DetectContentParseTest19(void) goto end; } result &= (s->dmatch_tail->type == DETECT_CONTENT); - result &= (s->pmatch == NULL); + result &= (s->sm_lists[DETECT_SM_LIST_PMATCH] == NULL); data = (DetectContentData *)s->dmatch_tail->ctx; if (data->flags & DETECT_CONTENT_RAWBYTES || data->flags & DETECT_CONTENT_NOCASE || @@ -1359,7 +1359,7 @@ int DetectContentParseTest19(void) goto end; } result &= (s->dmatch_tail->type == DETECT_CONTENT); - result &= (s->pmatch == NULL); + result &= (s->sm_lists[DETECT_SM_LIST_PMATCH] == NULL); data = (DetectContentData *)s->dmatch_tail->ctx; if (data->flags & DETECT_CONTENT_RAWBYTES || data->flags & DETECT_CONTENT_NOCASE || @@ -1385,7 +1385,7 @@ int DetectContentParseTest19(void) result = 0; goto end; } - result &= (s->pmatch != NULL); + result &= (s->sm_lists[DETECT_SM_LIST_PMATCH] != NULL); end: SigGroupCleanup(de_ctx); @@ -1535,13 +1535,13 @@ int DetectContentParseTest24(void) goto end; } - if (s->pmatch_tail == NULL && s->pmatch_tail->ctx) { + if (s->sm_lists_tail[DETECT_SM_LIST_PMATCH] == NULL && s->sm_lists_tail[DETECT_SM_LIST_PMATCH]->ctx) { printf("de_ctx->pmatch_tail == NULL && de_ctx->pmatch_tail->ctx\n"); result = 0; goto end; } - cd = (DetectContentData *)s->pmatch_tail->ctx; + cd = (DetectContentData *)s->sm_lists_tail[DETECT_SM_LIST_PMATCH]->ctx; result = (strncmp("boo", (char *)cd->content, cd->content_len) == 0); end: diff --git a/src/detect-depth.c b/src/detect-depth.c index 2025426f4a..ca2276083c 100644 --- a/src/detect-depth.c +++ b/src/detect-depth.c @@ -71,7 +71,7 @@ static int DetectDepthSetup (DetectEngineCtx *de_ctx, Signature *s, char *depths /* add to the latest content keyword from either dmatch or pmatch */ pm = SigMatchGetLastSMFromLists(s, 4, DETECT_CONTENT, s->dmatch_tail, - DETECT_CONTENT, s->pmatch_tail); + DETECT_CONTENT, s->sm_lists_tail[DETECT_SM_LIST_PMATCH]); if (pm == NULL) { SCLogError(SC_ERR_DEPTH_MISSING_CONTENT, "depth needs " "preceeding content option for dcerpc sig"); @@ -84,7 +84,7 @@ static int DetectDepthSetup (DetectEngineCtx *de_ctx, Signature *s, char *depths default: pm = SigMatchGetLastSMFromLists(s, 4, - DETECT_CONTENT, s->pmatch_tail, + DETECT_CONTENT, s->sm_lists_tail[DETECT_SM_LIST_PMATCH], DETECT_URICONTENT, s->umatch_tail); if (pm == NULL) { SCLogError(SC_ERR_DEPTH_MISSING_CONTENT, "depth needs " diff --git a/src/detect-distance.c b/src/detect-distance.c index dc2bca83cd..a94716915a 100644 --- a/src/detect-distance.c +++ b/src/detect-distance.c @@ -73,7 +73,7 @@ static int DetectDistanceSetup (DetectEngineCtx *de_ctx, Signature *s, } /* if we still haven't found that the sig is related to DCERPC, - * it's a direct entry into Signature->pmatch */ + * it's a direct entry into Signature->sm_lists[DETECT_SM_LIST_PMATCH] */ if (s->alproto == ALPROTO_DCERPC) { SigMatch *dcem = NULL; SigMatch *dm = NULL; @@ -94,9 +94,9 @@ static int DetectDistanceSetup (DetectEngineCtx *de_ctx, Signature *s, DETECT_PCRE, s->dmatch_tail, DETECT_BYTEJUMP, s->dmatch_tail); pm1_ots = SigMatchGetLastSMFromLists(s, 6, - DETECT_CONTENT, s->pmatch_tail, - DETECT_PCRE, s->pmatch_tail, - DETECT_BYTEJUMP, s->pmatch_tail); + DETECT_CONTENT, s->sm_lists_tail[DETECT_SM_LIST_PMATCH], + DETECT_PCRE, s->sm_lists_tail[DETECT_SM_LIST_PMATCH], + DETECT_BYTEJUMP, s->sm_lists_tail[DETECT_SM_LIST_PMATCH]); if (pm1_ots != NULL && pm1_ots->prev != NULL) { pm2_ots = SigMatchGetLastSMFromLists(s, 6, DETECT_CONTENT, pm1_ots->prev, @@ -105,7 +105,7 @@ static int DetectDistanceSetup (DetectEngineCtx *de_ctx, Signature *s, } dm = SigMatchGetLastSMFromLists(s, 2, DETECT_CONTENT, s->dmatch_tail); - pm1 = SigMatchGetLastSMFromLists(s, 2, DETECT_CONTENT, s->pmatch_tail); + pm1 = SigMatchGetLastSMFromLists(s, 2, DETECT_CONTENT, s->sm_lists_tail[DETECT_SM_LIST_PMATCH]); if (pm1 != NULL && pm1->prev != NULL) { pm2 = SigMatchGetLastSMFromLists(s, 2, DETECT_CONTENT, pm1->prev); } @@ -121,7 +121,8 @@ static int DetectDistanceSetup (DetectEngineCtx *de_ctx, Signature *s, if (pm1->idx > dcem->idx) { /* transfer pm1 to dmatch list and within is against this */ SigMatchTransferSigMatchAcrossLists(pm1, - &s->pmatch, &s->pmatch_tail, + &s->sm_lists[DETECT_SM_LIST_PMATCH], + &s->sm_lists_tail[DETECT_SM_LIST_PMATCH], &s->dmatch, &s->dmatch_tail); pm = pm1; } else { @@ -134,7 +135,8 @@ static int DetectDistanceSetup (DetectEngineCtx *de_ctx, Signature *s, } else if (pm1->idx > dcem->idx) { /* transfer pm1 to dmatch list and within is against this */ SigMatchTransferSigMatchAcrossLists(pm1, - &s->pmatch, &s->pmatch_tail, + &s->sm_lists[DETECT_SM_LIST_PMATCH], + &s->sm_lists_tail[DETECT_SM_LIST_PMATCH], &s->dmatch, &s->dmatch_tail); pm = pm1; } else { @@ -151,7 +153,8 @@ static int DetectDistanceSetup (DetectEngineCtx *de_ctx, Signature *s, } else if (pm2_ots == NULL || pm2_ots->idx < dcem->idx) { /* trasnfer pm1 to dmatch list and pm = pm1 */ SigMatchTransferSigMatchAcrossLists(pm1, - &s->pmatch, &s->pmatch_tail, + &s->sm_lists[DETECT_SM_LIST_PMATCH], + &s->sm_lists_tail[DETECT_SM_LIST_PMATCH], &s->dmatch, &s->dmatch_tail); pm = pm1; } else { @@ -161,7 +164,7 @@ static int DetectDistanceSetup (DetectEngineCtx *de_ctx, Signature *s, } } else { pm = SigMatchGetLastSMFromLists(s, 4, - DETECT_CONTENT, s->pmatch_tail, + DETECT_CONTENT, s->sm_lists_tail[DETECT_SM_LIST_PMATCH], DETECT_URICONTENT, s->umatch_tail); if (pm == NULL) { SCLogError(SC_ERR_WITHIN_MISSING_CONTENT, "within needs" @@ -394,7 +397,7 @@ static int DetectDistanceTest01(void) goto end; } - SigMatch *sm = de_ctx->sig_list->pmatch; + SigMatch *sm = de_ctx->sig_list->sm_lists[DETECT_SM_LIST_PMATCH]; if (sm == NULL) { printf("sm NULL: "); goto end; diff --git a/src/detect-engine-dcepayload.c b/src/detect-engine-dcepayload.c index 4fefcf5996..cd73e24108 100644 --- a/src/detect-engine-dcepayload.c +++ b/src/detect-engine-dcepayload.c @@ -7811,12 +7811,12 @@ int DcePayloadParseTest25(void) result = 0; goto end; } - if (s->pmatch_tail == NULL) { + if (s->sm_lists_tail[DETECT_SM_LIST_PMATCH] == NULL) { result = 0; goto end; } - sm = s->pmatch; + sm = s->sm_lists[DETECT_SM_LIST_PMATCH]; if (sm->type != DETECT_CONTENT) { result = 0; goto end; @@ -7933,12 +7933,12 @@ int DcePayloadParseTest26(void) result = 0; goto end; } - if (s->pmatch_tail == NULL) { + if (s->sm_lists_tail[DETECT_SM_LIST_PMATCH] == NULL) { result = 0; goto end; } - sm = s->pmatch; + sm = s->sm_lists[DETECT_SM_LIST_PMATCH]; if (sm->type != DETECT_CONTENT) { result = 0; goto end; @@ -8059,7 +8059,7 @@ int DcePayloadParseTest27(void) result = 0; goto end; } - if (s->pmatch_tail != NULL) { + if (s->sm_lists_tail[DETECT_SM_LIST_PMATCH] != NULL) { result = 0; goto end; } @@ -8185,7 +8185,7 @@ int DcePayloadParseTest28(void) result = 0; goto end; } - if (s->pmatch_tail == NULL) { + if (s->sm_lists_tail[DETECT_SM_LIST_PMATCH] == NULL) { result = 0; goto end; } @@ -8230,7 +8230,7 @@ int DcePayloadParseTest28(void) if (result == 0) goto end; - sm = s->pmatch; + sm = s->sm_lists[DETECT_SM_LIST_PMATCH]; if (sm->type != DETECT_CONTENT) { result = 0; goto end; @@ -8313,12 +8313,12 @@ int DcePayloadParseTest29(void) result = 0; goto end; } - if (s->pmatch_tail == NULL) { + if (s->sm_lists_tail[DETECT_SM_LIST_PMATCH] == NULL) { result = 0; goto end; } - sm = s->pmatch; + sm = s->sm_lists[DETECT_SM_LIST_PMATCH]; if (sm->type != DETECT_PCRE) { result = 0; goto end; @@ -8454,12 +8454,12 @@ int DcePayloadParseTest30(void) result = 0; goto end; } - if (s->pmatch_tail == NULL) { + if (s->sm_lists_tail[DETECT_SM_LIST_PMATCH] == NULL) { result = 0; goto end; } - sm = s->pmatch; + sm = s->sm_lists[DETECT_SM_LIST_PMATCH]; if (sm->type != DETECT_BYTEJUMP) { result = 0; goto end; @@ -8600,7 +8600,7 @@ int DcePayloadParseTest31(void) result = 0; goto end; } - if (s->pmatch_tail == NULL) { + if (s->sm_lists_tail[DETECT_SM_LIST_PMATCH] == NULL) { result = 0; goto end; } @@ -8663,7 +8663,7 @@ int DcePayloadParseTest31(void) if (result == 0) goto end; - sm = s->pmatch; + sm = s->sm_lists[DETECT_SM_LIST_PMATCH]; if (sm->type != DETECT_CONTENT) { result = 0; goto end; @@ -8746,7 +8746,7 @@ int DcePayloadParseTest32(void) result = 0; goto end; } - if (s->pmatch_tail == NULL) { + if (s->sm_lists_tail[DETECT_SM_LIST_PMATCH] == NULL) { result = 0; goto end; } @@ -8809,7 +8809,7 @@ int DcePayloadParseTest32(void) if (result == 0) goto end; - sm = s->pmatch; + sm = s->sm_lists[DETECT_SM_LIST_PMATCH]; if (sm->type != DETECT_CONTENT) { result = 0; goto end; @@ -8892,7 +8892,7 @@ int DcePayloadParseTest33(void) result = 0; goto end; } - if (s->pmatch_tail == NULL) { + if (s->sm_lists_tail[DETECT_SM_LIST_PMATCH] == NULL) { result = 0; goto end; } @@ -8950,7 +8950,7 @@ int DcePayloadParseTest33(void) if (result == 0) goto end; - sm = s->pmatch; + sm = s->sm_lists[DETECT_SM_LIST_PMATCH]; if (sm->type != DETECT_CONTENT) { result = 0; goto end; @@ -9034,7 +9034,7 @@ int DcePayloadParseTest34(void) result = 0; goto end; } - if (s->pmatch_tail == NULL) { + if (s->sm_lists_tail[DETECT_SM_LIST_PMATCH] == NULL) { result = 0; goto end; } @@ -9092,7 +9092,7 @@ int DcePayloadParseTest34(void) result &= (sm->next == NULL); - sm = s->pmatch; + sm = s->sm_lists[DETECT_SM_LIST_PMATCH]; if (sm->type != DETECT_CONTENT) { result = 0; goto end; @@ -9155,7 +9155,7 @@ int DcePayloadParseTest35(void) result = 0; goto end; } - if (s->pmatch_tail == NULL) { + if (s->sm_lists_tail[DETECT_SM_LIST_PMATCH] == NULL) { result = 0; goto end; } @@ -9178,7 +9178,7 @@ int DcePayloadParseTest35(void) result &= (sm->next == NULL); - sm = s->pmatch; + sm = s->sm_lists[DETECT_SM_LIST_PMATCH]; if (sm->type != DETECT_CONTENT) { result = 0; goto end; @@ -9242,7 +9242,7 @@ int DcePayloadParseTest36(void) result = 0; goto end; } - if (s->pmatch_tail == NULL) { + if (s->sm_lists_tail[DETECT_SM_LIST_PMATCH] == NULL) { result = 0; goto end; } @@ -9281,7 +9281,7 @@ int DcePayloadParseTest36(void) result &= (sm->next == NULL); - sm = s->pmatch; + sm = s->sm_lists[DETECT_SM_LIST_PMATCH]; if (sm->type != DETECT_CONTENT) { result = 0; goto end; @@ -9346,7 +9346,7 @@ int DcePayloadParseTest37(void) result = 0; goto end; } - if (s->pmatch_tail == NULL) { + if (s->sm_lists_tail[DETECT_SM_LIST_PMATCH] == NULL) { result = 0; goto end; } @@ -9387,7 +9387,7 @@ int DcePayloadParseTest37(void) result &= (sm->next == NULL); - sm = s->pmatch; + sm = s->sm_lists[DETECT_SM_LIST_PMATCH]; if (sm->type != DETECT_CONTENT) { result = 0; goto end; @@ -9454,7 +9454,7 @@ int DcePayloadParseTest38(void) result = 0; goto end; } - if (s->pmatch_tail == NULL) { + if (s->sm_lists_tail[DETECT_SM_LIST_PMATCH] == NULL) { result = 0; goto end; } @@ -9508,7 +9508,7 @@ int DcePayloadParseTest38(void) result &= (sm->next == NULL); - sm = s->pmatch; + sm = s->sm_lists[DETECT_SM_LIST_PMATCH]; if (sm->type != DETECT_CONTENT) { result = 0; goto end; @@ -9570,12 +9570,12 @@ int DcePayloadParseTest39(void) result = 0; goto end; } - if (s->pmatch_tail == NULL) { + if (s->sm_lists_tail[DETECT_SM_LIST_PMATCH] == NULL) { result = 0; goto end; } - sm = s->pmatch; + sm = s->sm_lists[DETECT_SM_LIST_PMATCH]; if (sm->type != DETECT_CONTENT) { result = 0; goto end; @@ -9658,7 +9658,7 @@ int DcePayloadParseTest40(void) result = 0; goto end; } - if (s->pmatch_tail == NULL) { + if (s->sm_lists_tail[DETECT_SM_LIST_PMATCH] == NULL) { result = 0; goto end; } @@ -9722,7 +9722,7 @@ int DcePayloadParseTest40(void) result &= (sm->next == NULL); - sm = s->pmatch; + sm = s->sm_lists[DETECT_SM_LIST_PMATCH]; if (sm->type != DETECT_CONTENT) { result = 0; goto end; @@ -9787,7 +9787,7 @@ int DcePayloadParseTest41(void) result = 0; goto end; } - if (s->pmatch_tail == NULL) { + if (s->sm_lists_tail[DETECT_SM_LIST_PMATCH] == NULL) { result = 0; goto end; } @@ -9814,7 +9814,7 @@ int DcePayloadParseTest41(void) result &= (sm->next == NULL); - sm = s->pmatch; + sm = s->sm_lists[DETECT_SM_LIST_PMATCH]; if (sm->type != DETECT_CONTENT) { result = 0; goto end; @@ -10111,7 +10111,7 @@ int DcePayloadParseTest44(void) result = 0; goto end; } - if (s->pmatch_tail == NULL) { + if (s->sm_lists_tail[DETECT_SM_LIST_PMATCH] == NULL) { result = 0; goto end; } @@ -10151,7 +10151,7 @@ int DcePayloadParseTest44(void) result &= (sm->next == NULL); - sm = s->pmatch; + sm = s->sm_lists[DETECT_SM_LIST_PMATCH]; if (sm->type != DETECT_CONTENT) { result = 0; goto end; @@ -10236,7 +10236,7 @@ int DcePayloadParseTest45(void) result = 0; goto end; } - if (s->pmatch_tail == NULL) { + if (s->sm_lists_tail[DETECT_SM_LIST_PMATCH] == NULL) { result = 0; goto end; } @@ -10261,7 +10261,7 @@ int DcePayloadParseTest45(void) result &= (sm->next == NULL); - sm = s->pmatch; + sm = s->sm_lists[DETECT_SM_LIST_PMATCH]; if (sm->type != DETECT_CONTENT) { result = 0; goto end; @@ -10347,7 +10347,7 @@ int DcePayloadParseTest46(void) result = 0; goto end; } - if (s->pmatch_tail == NULL) { + if (s->sm_lists_tail[DETECT_SM_LIST_PMATCH] == NULL) { result = 0; goto end; } @@ -10370,7 +10370,7 @@ int DcePayloadParseTest46(void) result &= (sm->next == NULL); - sm = s->pmatch; + sm = s->sm_lists[DETECT_SM_LIST_PMATCH]; if (sm->type != DETECT_CONTENT) { result = 0; goto end; diff --git a/src/detect-engine-mpm.c b/src/detect-engine-mpm.c index 315253b0d0..b2547020d8 100644 --- a/src/detect-engine-mpm.c +++ b/src/detect-engine-mpm.c @@ -107,7 +107,7 @@ int SignatureHasPacketContent(Signature *s) { SCReturnInt(0); } - SigMatch *sm = s->pmatch; + SigMatch *sm = s->sm_lists[DETECT_SM_LIST_PMATCH]; if (sm == NULL) { SCReturnInt(0); } @@ -148,7 +148,7 @@ int SignatureHasStreamContent(Signature *s) { SCReturnInt(0); } - SigMatch *sm = s->pmatch; + SigMatch *sm = s->sm_lists[DETECT_SM_LIST_PMATCH]; if (sm == NULL) { SCReturnInt(0); } @@ -571,7 +571,7 @@ static int PatternMatchPreprarePopulateMpm(DetectEngineCtx *de_ctx, SigGroupHead /* get the total no of patterns in this Signature, as well as find out * if we have a fast_pattern set in this Signature */ - for (sm = s->pmatch; sm != NULL; sm = sm->next) { + for (sm = s->sm_lists[DETECT_SM_LIST_PMATCH]; sm != NULL; sm = sm->next) { if (sm->type != DETECT_CONTENT) continue; @@ -605,7 +605,7 @@ static int PatternMatchPreprarePopulateMpm(DetectEngineCtx *de_ctx, SigGroupHead continue; } - for (sm = s->pmatch; sm != NULL; sm = sm->next) { + for (sm = s->sm_lists[DETECT_SM_LIST_PMATCH]; sm != NULL; sm = sm->next) { if (sm->type != DETECT_CONTENT) continue; @@ -644,7 +644,7 @@ static int PatternMatchPreprarePopulateMpm(DetectEngineCtx *de_ctx, SigGroupHead /* now determine which one to add to the mpm phase */ for (sig = 0; sig < sgh->sig_cnt; sig++) { Signature *s = sgh->match_array[sig]; - if (s == NULL || s->pmatch == NULL) + if (s == NULL || s->sm_lists[DETECT_SM_LIST_PMATCH] == NULL) continue; if (SignatureHasPacketContent(s) == 0) { @@ -654,7 +654,7 @@ static int PatternMatchPreprarePopulateMpm(DetectEngineCtx *de_ctx, SigGroupHead ContentHash *mpm_ch = NULL; SigMatch *sm = NULL; - for (sm = s->pmatch; sm != NULL; sm = sm->next) { + for (sm = s->sm_lists[DETECT_SM_LIST_PMATCH]; sm != NULL; sm = sm->next) { if (sm->type != DETECT_CONTENT) continue; @@ -723,7 +723,7 @@ static int PatternMatchPreprarePopulateMpm(DetectEngineCtx *de_ctx, SigGroupHead char scan_negated = 0; /* see if our content is actually negated */ - SigMatch *tmpsm = s->pmatch; + SigMatch *tmpsm = s->sm_lists[DETECT_SM_LIST_PMATCH]; for ( ; tmpsm != NULL; tmpsm = tmpsm->next) { if (tmpsm->type != DETECT_CONTENT) continue; @@ -761,7 +761,7 @@ static int PatternMatchPreprarePopulateMpm(DetectEngineCtx *de_ctx, SigGroupHead /* see if we can bypass the match validation for this pattern */ } else { if (!(co->flags & DETECT_CONTENT_RELATIVE_NEXT)) { - SigMatch *tmp_sm = s->pmatch; + SigMatch *tmp_sm = s->sm_lists[DETECT_SM_LIST_PMATCH]; for ( ; tmp_sm != NULL; tmp_sm = tmp_sm->next) { if (tmp_sm->type != DETECT_CONTENT) continue; @@ -860,7 +860,7 @@ static int PatternMatchPreprarePopulateMpmStream(DetectEngineCtx *de_ctx, SigGro /* get the total no of patterns in this Signature, as well as find out * if we have a fast_pattern set in this Signature */ - for (sm = s->pmatch; sm != NULL; sm = sm->next) { + for (sm = s->sm_lists[DETECT_SM_LIST_PMATCH]; sm != NULL; sm = sm->next) { if (sm->type != DETECT_CONTENT) continue; @@ -894,7 +894,7 @@ static int PatternMatchPreprarePopulateMpmStream(DetectEngineCtx *de_ctx, SigGro continue; } - for (sm = s->pmatch; sm != NULL; sm = sm->next) { + for (sm = s->sm_lists[DETECT_SM_LIST_PMATCH]; sm != NULL; sm = sm->next) { if (sm->type != DETECT_CONTENT) continue; @@ -933,7 +933,7 @@ static int PatternMatchPreprarePopulateMpmStream(DetectEngineCtx *de_ctx, SigGro /* now determine which one to add to the mpm phase */ for (sig = 0; sig < sgh->sig_cnt; sig++) { Signature *s = sgh->match_array[sig]; - if (s == NULL || s->pmatch == NULL) + if (s == NULL || s->sm_lists[DETECT_SM_LIST_PMATCH] == NULL) continue; if (SignatureHasStreamContent(s) == 0) { @@ -943,7 +943,7 @@ static int PatternMatchPreprarePopulateMpmStream(DetectEngineCtx *de_ctx, SigGro ContentHash *mpm_ch = NULL; SigMatch *sm = NULL; - for (sm = s->pmatch; sm != NULL; sm = sm->next) { + for (sm = s->sm_lists[DETECT_SM_LIST_PMATCH]; sm != NULL; sm = sm->next) { if (sm->type != DETECT_CONTENT) continue; @@ -1011,7 +1011,7 @@ static int PatternMatchPreprarePopulateMpmStream(DetectEngineCtx *de_ctx, SigGro char scan_negated = 0; /* see if our content is actually negated */ - SigMatch *tmpsm = s->pmatch; + SigMatch *tmpsm = s->sm_lists[DETECT_SM_LIST_PMATCH]; for ( ; tmpsm != NULL; tmpsm = tmpsm->next) { if (tmpsm->type != DETECT_CONTENT) continue; @@ -1244,7 +1244,7 @@ static int PatternMatchPreprarePopulateMpmUri(DetectEngineCtx *de_ctx, SigGroupH uint8_t flags = 0; #if 0 /* see if our content is actually negated */ - SigMatch *tmpsm = s->pmatch; + SigMatch *tmpsm = s->sm_lists[DETECT_SM_LIST_PMATCH]; for ( ; tmpsm != NULL; tmpsm = tmpsm->next) { if (tmpsm->type != DETECT_CONTENT) continue; @@ -1416,7 +1416,7 @@ int PatternMatchPrepareGroup(DetectEngineCtx *de_ctx, SigGroupHead *sh) !(sh->flags & SIG_GROUP_HEAD_MPM_COPY)) { if (SignatureHasPacketContent(s) == 1) { - for (sm = s->pmatch; sm != NULL; sm = sm->next) { + for (sm = s->sm_lists[DETECT_SM_LIST_PMATCH]; sm != NULL; sm = sm->next) { if (sm->type != DETECT_CONTENT) continue; @@ -1454,7 +1454,7 @@ int PatternMatchPrepareGroup(DetectEngineCtx *de_ctx, SigGroupHead *sh) !(sh->flags & SIG_GROUP_HEAD_MPM_STREAM_COPY)) { if (SignatureHasStreamContent(s) == 1) { - for (sm = s->pmatch; sm != NULL; sm = sm->next) { + for (sm = s->sm_lists[DETECT_SM_LIST_PMATCH]; sm != NULL; sm = sm->next) { if (sm->type != DETECT_CONTENT) continue; diff --git a/src/detect-engine-payload.c b/src/detect-engine-payload.c index 98ffc3e78d..ec31722663 100644 --- a/src/detect-engine-payload.c +++ b/src/detect-engine-payload.c @@ -371,7 +371,7 @@ int DetectEngineInspectPacketPayload(DetectEngineCtx *de_ctx, SCEnter(); int r = 0; - if (s->pmatch == NULL) { + if (s->sm_lists[DETECT_SM_LIST_PMATCH] == NULL) { SCReturnInt(0); } @@ -379,7 +379,7 @@ int DetectEngineInspectPacketPayload(DetectEngineCtx *de_ctx, det_ctx->discontinue_matching = 0; det_ctx->inspection_recursion_counter = 0; - r = DoInspectPacketPayload(de_ctx, det_ctx, s, s->pmatch, p, f, p->payload, p->payload_len); + r = DoInspectPacketPayload(de_ctx, det_ctx, s, s->sm_lists[DETECT_SM_LIST_PMATCH], p, f, p->payload, p->payload_len); if (r == 1) { SCReturnInt(1); } @@ -411,13 +411,13 @@ int DetectEngineInspectStreamPayload(DetectEngineCtx *de_ctx, SCEnter(); int r = 0; - if (s->pmatch == NULL) { + if (s->sm_lists[DETECT_SM_LIST_PMATCH] == NULL) { SCReturnInt(0); } det_ctx->payload_offset = 0; - r = DoInspectPacketPayload(de_ctx, det_ctx, s, s->pmatch, NULL, f, payload, payload_len); + r = DoInspectPacketPayload(de_ctx, det_ctx, s, s->sm_lists[DETECT_SM_LIST_PMATCH], NULL, f, payload, payload_len); if (r == 1) { SCReturnInt(1); } diff --git a/src/detect-engine-siggroup.c b/src/detect-engine-siggroup.c index db6e61408b..76681cf24f 100644 --- a/src/detect-engine-siggroup.c +++ b/src/detect-engine-siggroup.c @@ -1307,7 +1307,7 @@ int SigGroupHeadLoadContent(DetectEngineCtx *de_ctx, SigGroupHead *sgh) if (s->alproto != ALPROTO_UNKNOWN) continue; - sm = s->pmatch; + sm = s->sm_lists[DETECT_SM_LIST_PMATCH]; if (sm == NULL) continue; @@ -1485,7 +1485,7 @@ int SigGroupHeadLoadStreamContent(DetectEngineCtx *de_ctx, SigGroupHead *sgh) continue; } - sm = s->pmatch; + sm = s->sm_lists[DETECT_SM_LIST_PMATCH]; if (sm == NULL) continue; diff --git a/src/detect-fast-pattern.c b/src/detect-fast-pattern.c index 4eac8b19c6..f8458bd1d7 100644 --- a/src/detect-fast-pattern.c +++ b/src/detect-fast-pattern.c @@ -107,7 +107,7 @@ static int DetectFastPatternSetup(DetectEngineCtx *de_ctx, Signature *s, char *a DetectContentData *cd = NULL; DetectUricontentData *ud = NULL; - if (s->pmatch_tail == NULL && s->umatch_tail == NULL) { + if (s->sm_lists_tail[DETECT_SM_LIST_PMATCH] == NULL && s->umatch_tail == NULL) { SCLogWarning(SC_WARN_COMPATIBILITY, "fast_pattern found inside the " "rule, without a preceding content based keyword. " "Currently we provide fast_pattern support for content " @@ -116,7 +116,7 @@ static int DetectFastPatternSetup(DetectEngineCtx *de_ctx, Signature *s, char *a } SigMatch *pm = SigMatchGetLastSMFromLists(s, 4, - DETECT_CONTENT, s->pmatch_tail, + DETECT_CONTENT, s->sm_lists_tail[DETECT_SM_LIST_PMATCH], DETECT_URICONTENT, s->umatch_tail); if (pm == NULL) { SCLogError(SC_ERR_INVALID_SIGNATURE, "fast_pattern found inside " @@ -302,7 +302,7 @@ int DetectFastPatternTest01(void) goto end; result = 0; - sm = de_ctx->sig_list->pmatch; + sm = de_ctx->sig_list->sm_lists[DETECT_SM_LIST_PMATCH]; while (sm != NULL) { if (sm->type == DETECT_CONTENT) { if ( ((DetectContentData *)sm->ctx)->flags & @@ -344,7 +344,7 @@ int DetectFastPatternTest02(void) goto end; result = 0; - sm = de_ctx->sig_list->pmatch; + sm = de_ctx->sig_list->sm_lists[DETECT_SM_LIST_PMATCH]; while (sm != NULL) { if (sm->type == DETECT_CONTENT) { if (((DetectContentData *)sm->ctx)->flags & @@ -385,7 +385,7 @@ int DetectFastPatternTest03(void) goto end; result = 0; - sm = de_ctx->sig_list->pmatch; + sm = de_ctx->sig_list->sm_lists[DETECT_SM_LIST_PMATCH]; while (sm != NULL) { if (sm->type == DETECT_CONTENT) { if ( !(((DetectContentData *)sm->ctx)->flags & @@ -999,7 +999,7 @@ int DetectFastPatternTest15(void) goto end; result = 0; - sm = de_ctx->sig_list->pmatch; + sm = de_ctx->sig_list->sm_lists[DETECT_SM_LIST_PMATCH]; while (sm != NULL) { if (sm->type == DETECT_CONTENT) { if ( ((DetectContentData *)sm->ctx)->flags & @@ -1040,7 +1040,7 @@ int DetectFastPatternTest16(void) goto end; result = 0; - sm = de_ctx->sig_list->pmatch; + sm = de_ctx->sig_list->sm_lists[DETECT_SM_LIST_PMATCH]; while (sm != NULL) { if (sm->type == DETECT_CONTENT) { if ( ((DetectContentData *)sm->ctx)->flags & @@ -1077,7 +1077,7 @@ int DetectFastPatternTest17(void) goto end; result = 0; - sm = de_ctx->sig_list->pmatch; + sm = de_ctx->sig_list->sm_lists[DETECT_SM_LIST_PMATCH]; DetectContentData *cd = sm->ctx; if (sm != NULL && sm->type == DETECT_CONTENT) { if (cd->flags & DETECT_CONTENT_FAST_PATTERN && @@ -1113,7 +1113,7 @@ int DetectFastPatternTest18(void) goto end; result = 0; - sm = de_ctx->sig_list->pmatch; + sm = de_ctx->sig_list->sm_lists[DETECT_SM_LIST_PMATCH]; DetectContentData *cd = sm->ctx; if (sm != NULL && sm->type == DETECT_CONTENT) { if (cd->flags & DETECT_CONTENT_FAST_PATTERN && @@ -1345,7 +1345,7 @@ int DetectFastPatternTest28(void) if (de_ctx->sig_list == NULL) goto end; - DetectContentData *cd = de_ctx->sig_list->pmatch_tail->ctx; + DetectContentData *cd = de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_PMATCH]->ctx; if (cd->flags & DETECT_CONTENT_FAST_PATTERN && cd->flags & DETECT_CONTENT_FAST_PATTERN_ONLY && !(cd->flags & cd->flags & DETECT_CONTENT_FAST_PATTERN_CHOP) && @@ -1375,7 +1375,7 @@ int DetectFastPatternTest29(void) "(content:one; content:two; within:30; content:two; fast_pattern:only; sid:1;)"); if (de_ctx->sig_list == NULL) goto end; - DetectContentData *cd = de_ctx->sig_list->pmatch_tail->ctx; + DetectContentData *cd = de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_PMATCH]->ctx; if (cd->flags & DETECT_CONTENT_FAST_PATTERN && cd->flags & DETECT_CONTENT_FAST_PATTERN_ONLY && !(cd->flags & cd->flags & DETECT_CONTENT_FAST_PATTERN_CHOP) && @@ -1405,7 +1405,7 @@ int DetectFastPatternTest30(void) "(content:one; content:two; offset:30; content:two; fast_pattern:only; sid:1;)"); if (de_ctx->sig_list == NULL) goto end; - DetectContentData *cd = de_ctx->sig_list->pmatch_tail->ctx; + DetectContentData *cd = de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_PMATCH]->ctx; if (cd->flags & DETECT_CONTENT_FAST_PATTERN && cd->flags & DETECT_CONTENT_FAST_PATTERN_ONLY && !(cd->flags & cd->flags & DETECT_CONTENT_FAST_PATTERN_CHOP) && @@ -1435,7 +1435,7 @@ int DetectFastPatternTest31(void) "(content:one; content:two; depth:30; content:two; fast_pattern:only; sid:1;)"); if (de_ctx->sig_list == NULL) goto end; - DetectContentData *cd = de_ctx->sig_list->pmatch_tail->ctx; + DetectContentData *cd = de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_PMATCH]->ctx; if (cd->flags & DETECT_CONTENT_FAST_PATTERN && cd->flags & DETECT_CONTENT_FAST_PATTERN_ONLY && !(cd->flags & cd->flags & DETECT_CONTENT_FAST_PATTERN_CHOP) && @@ -1465,7 +1465,7 @@ int DetectFastPatternTest32(void) "(content:!one; fast_pattern; content:two; sid:1;)"); if (de_ctx->sig_list == NULL) goto end; - DetectContentData *cd = de_ctx->sig_list->pmatch_tail->prev->ctx; + DetectContentData *cd = de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_PMATCH]->prev->ctx; if (cd->flags & DETECT_CONTENT_FAST_PATTERN && cd->flags & DETECT_CONTENT_NEGATED && !(cd->flags & DETECT_CONTENT_FAST_PATTERN_ONLY) && @@ -1584,7 +1584,7 @@ int DetectFastPatternTest37(void) "(content:one; content:two; fast_pattern:3,4; content:three; sid:1;)"); if (de_ctx->sig_list == NULL) goto end; - DetectContentData *cd = de_ctx->sig_list->pmatch_tail->prev->ctx; + DetectContentData *cd = de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_PMATCH]->prev->ctx; if (cd->flags & DETECT_CONTENT_FAST_PATTERN && !(cd->flags & DETECT_CONTENT_FAST_PATTERN_ONLY) && cd->flags & cd->flags & DETECT_CONTENT_FAST_PATTERN_CHOP && @@ -1614,7 +1614,7 @@ int DetectFastPatternTest38(void) "(content:one; content:two; fast_pattern:3,4; content:three; distance:30; sid:1;)"); if (de_ctx->sig_list == NULL) goto end; - DetectContentData *cd = de_ctx->sig_list->pmatch_tail->prev->ctx; + DetectContentData *cd = de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_PMATCH]->prev->ctx; if (cd->flags & DETECT_CONTENT_FAST_PATTERN && !(cd->flags & DETECT_CONTENT_FAST_PATTERN_ONLY) && cd->flags & cd->flags & DETECT_CONTENT_FAST_PATTERN_CHOP && @@ -1644,7 +1644,7 @@ int DetectFastPatternTest39(void) "(content:one; content:two; fast_pattern:3,4; content:three; within:30; sid:1;)"); if (de_ctx->sig_list == NULL) goto end; - DetectContentData *cd = de_ctx->sig_list->pmatch_tail->prev->ctx; + DetectContentData *cd = de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_PMATCH]->prev->ctx; if (cd->flags & DETECT_CONTENT_FAST_PATTERN && !(cd->flags & DETECT_CONTENT_FAST_PATTERN_ONLY) && cd->flags & cd->flags & DETECT_CONTENT_FAST_PATTERN_CHOP && @@ -1674,7 +1674,7 @@ int DetectFastPatternTest40(void) "(content:one; content:two; fast_pattern:3,4; content:three; offset:30; sid:1;)"); if (de_ctx->sig_list == NULL) goto end; - DetectContentData *cd = de_ctx->sig_list->pmatch_tail->prev->ctx; + DetectContentData *cd = de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_PMATCH]->prev->ctx; if (cd->flags & DETECT_CONTENT_FAST_PATTERN && !(cd->flags & DETECT_CONTENT_FAST_PATTERN_ONLY) && cd->flags & cd->flags & DETECT_CONTENT_FAST_PATTERN_CHOP && @@ -1704,7 +1704,7 @@ int DetectFastPatternTest41(void) "(content:one; content:two; fast_pattern:3,4; content:three; depth:30; sid:1;)"); if (de_ctx->sig_list == NULL) goto end; - DetectContentData *cd = de_ctx->sig_list->pmatch_tail->prev->ctx; + DetectContentData *cd = de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_PMATCH]->prev->ctx; if (cd->flags & DETECT_CONTENT_FAST_PATTERN && !(cd->flags & DETECT_CONTENT_FAST_PATTERN_ONLY) && cd->flags & cd->flags & DETECT_CONTENT_FAST_PATTERN_CHOP && @@ -1734,7 +1734,7 @@ int DetectFastPatternTest42(void) "(content:one; content:two; distance:10; content:three; fast_pattern:3,4; sid:1;)"); if (de_ctx->sig_list == NULL) goto end; - DetectContentData *cd = de_ctx->sig_list->pmatch_tail->ctx; + DetectContentData *cd = de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_PMATCH]->ctx; if (cd->flags & DETECT_CONTENT_FAST_PATTERN && !(cd->flags & DETECT_CONTENT_FAST_PATTERN_ONLY) && cd->flags & cd->flags & DETECT_CONTENT_FAST_PATTERN_CHOP && @@ -1764,7 +1764,7 @@ int DetectFastPatternTest43(void) "(content:one; content:two; within:10; content:three; fast_pattern:3,4; sid:1;)"); if (de_ctx->sig_list == NULL) goto end; - DetectContentData *cd = de_ctx->sig_list->pmatch_tail->ctx; + DetectContentData *cd = de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_PMATCH]->ctx; if (cd->flags & DETECT_CONTENT_FAST_PATTERN && !(cd->flags & DETECT_CONTENT_FAST_PATTERN_ONLY) && cd->flags & cd->flags & DETECT_CONTENT_FAST_PATTERN_CHOP && @@ -1794,7 +1794,7 @@ int DetectFastPatternTest44(void) "(content:one; content:two; offset:10; content:three; fast_pattern:3,4; sid:1;)"); if (de_ctx->sig_list == NULL) goto end; - DetectContentData *cd = de_ctx->sig_list->pmatch_tail->ctx; + DetectContentData *cd = de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_PMATCH]->ctx; if (cd->flags & DETECT_CONTENT_FAST_PATTERN && !(cd->flags & DETECT_CONTENT_FAST_PATTERN_ONLY) && cd->flags & cd->flags & DETECT_CONTENT_FAST_PATTERN_CHOP && @@ -1824,7 +1824,7 @@ int DetectFastPatternTest45(void) "(content:one; content:two; depth:10; content:three; fast_pattern:3,4; sid:1;)"); if (de_ctx->sig_list == NULL) goto end; - DetectContentData *cd = de_ctx->sig_list->pmatch_tail->ctx; + DetectContentData *cd = de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_PMATCH]->ctx; if (cd->flags & DETECT_CONTENT_FAST_PATTERN && !(cd->flags & DETECT_CONTENT_FAST_PATTERN_ONLY) && cd->flags & cd->flags & DETECT_CONTENT_FAST_PATTERN_CHOP && @@ -1920,7 +1920,7 @@ int DetectFastPatternTest49(void) "(content:one; content:!two; fast_pattern:3,4; content:three; sid:1;)"); if (de_ctx->sig_list == NULL) goto end; - DetectContentData *cd = de_ctx->sig_list->pmatch_tail->prev->ctx; + DetectContentData *cd = de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_PMATCH]->prev->ctx; if (cd->flags & DETECT_CONTENT_FAST_PATTERN && cd->flags & DETECT_CONTENT_NEGATED && !(cd->flags & DETECT_CONTENT_FAST_PATTERN_ONLY) && diff --git a/src/detect-ftpbounce.c b/src/detect-ftpbounce.c index c1729bcc35..d0456f8da9 100644 --- a/src/detect-ftpbounce.c +++ b/src/detect-ftpbounce.c @@ -208,7 +208,7 @@ int DetectFtpbounceMatch(ThreadVars *t, DetectEngineThreadCtx *det_ctx, if (!(PKT_IS_TCP(p))) return 0; - SigMatch *sm = SigMatchGetLastSM(s->pmatch_tail, DETECT_CONTENT); + SigMatch *sm = SigMatchGetLastSM(s->sm_lists_tail[DETECT_SM_LIST_PMATCH], DETECT_CONTENT); if (sm == NULL) return 0; diff --git a/src/detect-http-client-body.c b/src/detect-http-client-body.c index c969191930..7a296b9738 100644 --- a/src/detect-http-client-body.c +++ b/src/detect-http-client-body.c @@ -198,13 +198,13 @@ int DetectHttpClientBodySetup(DetectEngineCtx *de_ctx, Signature *s, char *arg) return -1; } - if (s->pmatch_tail == NULL) { + if (s->sm_lists_tail[DETECT_SM_LIST_PMATCH] == NULL) { SCLogError(SC_ERR_INVALID_SIGNATURE, "http_client_body found inside the " "rule, without any preceding content keywords"); return -1; } - sm = DetectContentGetLastPattern(s->pmatch_tail); + sm = DetectContentGetLastPattern(s->sm_lists_tail[DETECT_SM_LIST_PMATCH]); /* if still we are unable to find any content previous keywords, it is an * invalid rule */ if (sm == NULL) { @@ -1788,8 +1788,8 @@ int DetectHttpClientBodyTest16(void) goto end; } - if (de_ctx->sig_list->pmatch == NULL) { - printf("de_ctx->sig_list->pmatch == NULL\n"); + if (de_ctx->sig_list->sm_lists[DETECT_SM_LIST_PMATCH] == NULL) { + printf("de_ctx->sig_list->sm_lists[DETECT_SM_LIST_PMATCH] == NULL\n"); goto end; } @@ -1798,7 +1798,7 @@ int DetectHttpClientBodyTest16(void) goto end; } - DetectContentData *cd = de_ctx->sig_list->pmatch_tail->ctx; + DetectContentData *cd = de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_PMATCH]->ctx; DetectHttpClientBodyData *hcbd = de_ctx->sig_list->amatch_tail->ctx; if (cd->id == hcbd->id) goto end; @@ -1827,8 +1827,8 @@ int DetectHttpClientBodyTest17(void) goto end; } - if (de_ctx->sig_list->pmatch == NULL) { - printf("de_ctx->sig_list->pmatch == NULL\n"); + if (de_ctx->sig_list->sm_lists[DETECT_SM_LIST_PMATCH] == NULL) { + printf("de_ctx->sig_list->sm_lists[DETECT_SM_LIST_PMATCH] == NULL\n"); goto end; } @@ -1837,7 +1837,7 @@ int DetectHttpClientBodyTest17(void) goto end; } - DetectContentData *cd = de_ctx->sig_list->pmatch_tail->ctx; + DetectContentData *cd = de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_PMATCH]->ctx; DetectHttpClientBodyData *hcbd = de_ctx->sig_list->amatch_tail->ctx; if (cd->id == hcbd->id) goto end; @@ -1866,8 +1866,8 @@ int DetectHttpClientBodyTest18(void) goto end; } - if (de_ctx->sig_list->pmatch == NULL) { - printf("de_ctx->sig_list->pmatch == NULL\n"); + if (de_ctx->sig_list->sm_lists[DETECT_SM_LIST_PMATCH] == NULL) { + printf("de_ctx->sig_list->sm_lists[DETECT_SM_LIST_PMATCH] == NULL\n"); goto end; } @@ -1876,7 +1876,7 @@ int DetectHttpClientBodyTest18(void) goto end; } - DetectContentData *cd = de_ctx->sig_list->pmatch_tail->ctx; + DetectContentData *cd = de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_PMATCH]->ctx; DetectHttpClientBodyData *hcbd = de_ctx->sig_list->amatch_tail->ctx; if (cd->id != 0 || hcbd->id != 1) goto end; @@ -1905,8 +1905,8 @@ int DetectHttpClientBodyTest19(void) goto end; } - if (de_ctx->sig_list->pmatch == NULL) { - printf("de_ctx->sig_list->pmatch == NULL\n"); + if (de_ctx->sig_list->sm_lists[DETECT_SM_LIST_PMATCH] == NULL) { + printf("de_ctx->sig_list->sm_lists[DETECT_SM_LIST_PMATCH] == NULL\n"); goto end; } @@ -1915,7 +1915,7 @@ int DetectHttpClientBodyTest19(void) goto end; } - DetectContentData *cd = de_ctx->sig_list->pmatch_tail->ctx; + DetectContentData *cd = de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_PMATCH]->ctx; DetectHttpClientBodyData *hcbd = de_ctx->sig_list->amatch_tail->ctx; if (cd->id != 1 || hcbd->id != 0) goto end; @@ -1945,8 +1945,8 @@ int DetectHttpClientBodyTest20(void) goto end; } - if (de_ctx->sig_list->pmatch == NULL) { - printf("de_ctx->sig_list->pmatch == NULL\n"); + if (de_ctx->sig_list->sm_lists[DETECT_SM_LIST_PMATCH] == NULL) { + printf("de_ctx->sig_list->sm_lists[DETECT_SM_LIST_PMATCH] == NULL\n"); goto end; } @@ -1955,7 +1955,7 @@ int DetectHttpClientBodyTest20(void) goto end; } - DetectContentData *cd = de_ctx->sig_list->pmatch_tail->ctx; + DetectContentData *cd = de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_PMATCH]->ctx; DetectHttpClientBodyData *hcbd1 = de_ctx->sig_list->amatch_tail->ctx; DetectHttpClientBodyData *hcbd2 = de_ctx->sig_list->amatch_tail->prev->ctx; if (cd->id != 1 || hcbd1->id != 0 || hcbd2->id != 0) @@ -1986,8 +1986,8 @@ int DetectHttpClientBodyTest21(void) goto end; } - if (de_ctx->sig_list->pmatch == NULL) { - printf("de_ctx->sig_list->pmatch == NULL\n"); + if (de_ctx->sig_list->sm_lists[DETECT_SM_LIST_PMATCH] == NULL) { + printf("de_ctx->sig_list->sm_lists[DETECT_SM_LIST_PMATCH] == NULL\n"); goto end; } @@ -1996,7 +1996,7 @@ int DetectHttpClientBodyTest21(void) goto end; } - DetectContentData *cd = de_ctx->sig_list->pmatch_tail->ctx; + DetectContentData *cd = de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_PMATCH]->ctx; DetectHttpClientBodyData *hcbd1 = de_ctx->sig_list->amatch_tail->ctx; DetectHttpClientBodyData *hcbd2 = de_ctx->sig_list->amatch_tail->prev->ctx; if (cd->id != 2 || hcbd1->id != 0 || hcbd2->id != 0) diff --git a/src/detect-http-cookie.c b/src/detect-http-cookie.c index 3a280f587d..4bcf2dadbc 100644 --- a/src/detect-http-cookie.c +++ b/src/detect-http-cookie.c @@ -208,13 +208,13 @@ static int DetectHttpCookieSetup (DetectEngineCtx *de_ctx, Signature *s, char *s return -1; } - if (s->pmatch_tail == NULL) { + if (s->sm_lists_tail[DETECT_SM_LIST_PMATCH] == NULL) { SCLogError(SC_ERR_INVALID_SIGNATURE, "http_cookie found inside the " "rule, without any preceding content keywords"); return -1; } - SigMatch *pm = DetectContentGetLastPattern(s->pmatch_tail); + SigMatch *pm = DetectContentGetLastPattern(s->sm_lists_tail[DETECT_SM_LIST_PMATCH]); if (pm == NULL) { SCLogWarning(SC_ERR_INVALID_SIGNATURE, "http_cookie found inside " "the rule, without a content context. Please use a " @@ -495,8 +495,8 @@ int DetectHttpCookieTest07(void) goto end; } - if (de_ctx->sig_list->pmatch == NULL) { - printf("de_ctx->sig_list->pmatch == NULL\n"); + if (de_ctx->sig_list->sm_lists[DETECT_SM_LIST_PMATCH] == NULL) { + printf("de_ctx->sig_list->sm_lists[DETECT_SM_LIST_PMATCH] == NULL\n"); goto end; } @@ -505,7 +505,7 @@ int DetectHttpCookieTest07(void) goto end; } - DetectContentData *cd = de_ctx->sig_list->pmatch_tail->ctx; + DetectContentData *cd = de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_PMATCH]->ctx; DetectHttpCookieData *hcd = de_ctx->sig_list->amatch_tail->ctx; if (cd->id == hcd->id) goto end; @@ -534,8 +534,8 @@ int DetectHttpCookieTest08(void) goto end; } - if (de_ctx->sig_list->pmatch == NULL) { - printf("de_ctx->sig_list->pmatch == NULL\n"); + if (de_ctx->sig_list->sm_lists[DETECT_SM_LIST_PMATCH] == NULL) { + printf("de_ctx->sig_list->sm_lists[DETECT_SM_LIST_PMATCH] == NULL\n"); goto end; } @@ -544,7 +544,7 @@ int DetectHttpCookieTest08(void) goto end; } - DetectContentData *cd = de_ctx->sig_list->pmatch_tail->ctx; + DetectContentData *cd = de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_PMATCH]->ctx; DetectHttpCookieData *hcd = de_ctx->sig_list->amatch_tail->ctx; if (cd->id == hcd->id) goto end; @@ -573,8 +573,8 @@ int DetectHttpCookieTest09(void) goto end; } - if (de_ctx->sig_list->pmatch == NULL) { - printf("de_ctx->sig_list->pmatch == NULL\n"); + if (de_ctx->sig_list->sm_lists[DETECT_SM_LIST_PMATCH] == NULL) { + printf("de_ctx->sig_list->sm_lists[DETECT_SM_LIST_PMATCH] == NULL\n"); goto end; } @@ -583,7 +583,7 @@ int DetectHttpCookieTest09(void) goto end; } - DetectContentData *cd = de_ctx->sig_list->pmatch_tail->ctx; + DetectContentData *cd = de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_PMATCH]->ctx; DetectHttpCookieData *hcd = de_ctx->sig_list->amatch_tail->ctx; if (cd->id != 0 || hcd->id != 1) goto end; @@ -612,8 +612,8 @@ int DetectHttpCookieTest10(void) goto end; } - if (de_ctx->sig_list->pmatch == NULL) { - printf("de_ctx->sig_list->pmatch == NULL\n"); + if (de_ctx->sig_list->sm_lists[DETECT_SM_LIST_PMATCH] == NULL) { + printf("de_ctx->sig_list->sm_lists[DETECT_SM_LIST_PMATCH] == NULL\n"); goto end; } @@ -622,7 +622,7 @@ int DetectHttpCookieTest10(void) goto end; } - DetectContentData *cd = de_ctx->sig_list->pmatch_tail->ctx; + DetectContentData *cd = de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_PMATCH]->ctx; DetectHttpCookieData *hcd = de_ctx->sig_list->amatch_tail->ctx; if (cd->id != 1 || hcd->id != 0) goto end; @@ -652,8 +652,8 @@ int DetectHttpCookieTest11(void) goto end; } - if (de_ctx->sig_list->pmatch == NULL) { - printf("de_ctx->sig_list->pmatch == NULL\n"); + if (de_ctx->sig_list->sm_lists[DETECT_SM_LIST_PMATCH] == NULL) { + printf("de_ctx->sig_list->sm_lists[DETECT_SM_LIST_PMATCH] == NULL\n"); goto end; } @@ -662,7 +662,7 @@ int DetectHttpCookieTest11(void) goto end; } - DetectContentData *cd = de_ctx->sig_list->pmatch_tail->ctx; + DetectContentData *cd = de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_PMATCH]->ctx; DetectHttpCookieData *hcd1 = de_ctx->sig_list->amatch_tail->ctx; DetectHttpCookieData *hcd2 = de_ctx->sig_list->amatch_tail->prev->ctx; if (cd->id != 1 || hcd1->id != 0 || hcd2->id != 0) @@ -693,8 +693,8 @@ int DetectHttpCookieTest12(void) goto end; } - if (de_ctx->sig_list->pmatch == NULL) { - printf("de_ctx->sig_list->pmatch == NULL\n"); + if (de_ctx->sig_list->sm_lists[DETECT_SM_LIST_PMATCH] == NULL) { + printf("de_ctx->sig_list->sm_lists[DETECT_SM_LIST_PMATCH] == NULL\n"); goto end; } @@ -703,7 +703,7 @@ int DetectHttpCookieTest12(void) goto end; } - DetectContentData *cd = de_ctx->sig_list->pmatch_tail->ctx; + DetectContentData *cd = de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_PMATCH]->ctx; DetectHttpCookieData *hcd1 = de_ctx->sig_list->amatch_tail->ctx; DetectHttpCookieData *hcd2 = de_ctx->sig_list->amatch_tail->prev->ctx; if (cd->id != 2 || hcd1->id != 0 || hcd2->id != 0) diff --git a/src/detect-http-header.c b/src/detect-http-header.c index 25eb9fc7fd..d7999f1d5f 100644 --- a/src/detect-http-header.c +++ b/src/detect-http-header.c @@ -205,13 +205,13 @@ int DetectHttpHeaderSetup(DetectEngineCtx *de_ctx, Signature *s, char *arg) return -1; } - if (s->pmatch_tail == NULL) { + if (s->sm_lists_tail[DETECT_SM_LIST_PMATCH] == NULL) { SCLogError(SC_ERR_INVALID_SIGNATURE, "http_header found inside the " "rule, without any preceding content keywords"); return -1; } - sm = DetectContentGetLastPattern(s->pmatch_tail); + sm = DetectContentGetLastPattern(s->sm_lists_tail[DETECT_SM_LIST_PMATCH]); /* if still we are unable to find any content previous keywords, it is an * invalid rule */ if (sm == NULL) { @@ -1350,8 +1350,8 @@ int DetectHttpHeaderTest14(void) goto end; } - if (de_ctx->sig_list->pmatch == NULL) { - printf("de_ctx->sig_list->pmatch == NULL\n"); + if (de_ctx->sig_list->sm_lists[DETECT_SM_LIST_PMATCH] == NULL) { + printf("de_ctx->sig_list->sm_lists[DETECT_SM_LIST_PMATCH] == NULL\n"); goto end; } @@ -1360,7 +1360,7 @@ int DetectHttpHeaderTest14(void) goto end; } - DetectContentData *cd = de_ctx->sig_list->pmatch_tail->ctx; + DetectContentData *cd = de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_PMATCH]->ctx; DetectHttpHeaderData *hhd = de_ctx->sig_list->amatch_tail->ctx; if (cd->id == hhd->id) goto end; @@ -1389,8 +1389,8 @@ int DetectHttpHeaderTest15(void) goto end; } - if (de_ctx->sig_list->pmatch == NULL) { - printf("de_ctx->sig_list->pmatch == NULL\n"); + if (de_ctx->sig_list->sm_lists[DETECT_SM_LIST_PMATCH] == NULL) { + printf("de_ctx->sig_list->sm_lists[DETECT_SM_LIST_PMATCH] == NULL\n"); goto end; } @@ -1399,7 +1399,7 @@ int DetectHttpHeaderTest15(void) goto end; } - DetectContentData *cd = de_ctx->sig_list->pmatch_tail->ctx; + DetectContentData *cd = de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_PMATCH]->ctx; DetectHttpHeaderData *hhd = de_ctx->sig_list->amatch_tail->ctx; if (cd->id == hhd->id) goto end; @@ -1428,8 +1428,8 @@ int DetectHttpHeaderTest16(void) goto end; } - if (de_ctx->sig_list->pmatch == NULL) { - printf("de_ctx->sig_list->pmatch == NULL\n"); + if (de_ctx->sig_list->sm_lists[DETECT_SM_LIST_PMATCH] == NULL) { + printf("de_ctx->sig_list->sm_lists[DETECT_SM_LIST_PMATCH] == NULL\n"); goto end; } @@ -1438,7 +1438,7 @@ int DetectHttpHeaderTest16(void) goto end; } - DetectContentData *cd = de_ctx->sig_list->pmatch_tail->ctx; + DetectContentData *cd = de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_PMATCH]->ctx; DetectHttpHeaderData *hhd = de_ctx->sig_list->amatch_tail->ctx; if (cd->id != 0 || hhd->id != 1) goto end; @@ -1467,8 +1467,8 @@ int DetectHttpHeaderTest17(void) goto end; } - if (de_ctx->sig_list->pmatch == NULL) { - printf("de_ctx->sig_list->pmatch == NULL\n"); + if (de_ctx->sig_list->sm_lists[DETECT_SM_LIST_PMATCH] == NULL) { + printf("de_ctx->sig_list->sm_lists[DETECT_SM_LIST_PMATCH] == NULL\n"); goto end; } @@ -1477,7 +1477,7 @@ int DetectHttpHeaderTest17(void) goto end; } - DetectContentData *cd = de_ctx->sig_list->pmatch_tail->ctx; + DetectContentData *cd = de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_PMATCH]->ctx; DetectHttpHeaderData *hhd = de_ctx->sig_list->amatch_tail->ctx; if (cd->id != 1 || hhd->id != 0) goto end; @@ -1507,8 +1507,8 @@ int DetectHttpHeaderTest18(void) goto end; } - if (de_ctx->sig_list->pmatch == NULL) { - printf("de_ctx->sig_list->pmatch == NULL\n"); + if (de_ctx->sig_list->sm_lists[DETECT_SM_LIST_PMATCH] == NULL) { + printf("de_ctx->sig_list->sm_lists[DETECT_SM_LIST_PMATCH] == NULL\n"); goto end; } @@ -1517,7 +1517,7 @@ int DetectHttpHeaderTest18(void) goto end; } - DetectContentData *cd = de_ctx->sig_list->pmatch_tail->ctx; + DetectContentData *cd = de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_PMATCH]->ctx; DetectHttpHeaderData *hhd1 = de_ctx->sig_list->amatch_tail->ctx; DetectHttpHeaderData *hhd2 = de_ctx->sig_list->amatch_tail->prev->ctx; if (cd->id != 1 || hhd1->id != 0 || hhd2->id != 0) @@ -1548,8 +1548,8 @@ int DetectHttpHeaderTest19(void) goto end; } - if (de_ctx->sig_list->pmatch == NULL) { - printf("de_ctx->sig_list->pmatch == NULL\n"); + if (de_ctx->sig_list->sm_lists[DETECT_SM_LIST_PMATCH] == NULL) { + printf("de_ctx->sig_list->sm_lists[DETECT_SM_LIST_PMATCH] == NULL\n"); goto end; } @@ -1558,7 +1558,7 @@ int DetectHttpHeaderTest19(void) goto end; } - DetectContentData *cd = de_ctx->sig_list->pmatch_tail->ctx; + DetectContentData *cd = de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_PMATCH]->ctx; DetectHttpHeaderData *hhd1 = de_ctx->sig_list->amatch_tail->ctx; DetectHttpHeaderData *hhd2 = de_ctx->sig_list->amatch_tail->prev->ctx; if (cd->id != 2 || hhd1->id != 0 || hhd2->id != 0) diff --git a/src/detect-http-method.c b/src/detect-http-method.c index 973b0a7fdf..f6657fe299 100644 --- a/src/detect-http-method.c +++ b/src/detect-http-method.c @@ -163,13 +163,13 @@ static int DetectHttpMethodSetup(DetectEngineCtx *de_ctx, Signature *s, char *st SCReturnInt(-1); } - if (s->pmatch_tail == NULL) { + if (s->sm_lists_tail[DETECT_SM_LIST_PMATCH] == NULL) { SCLogError(SC_ERR_INVALID_SIGNATURE, "http_method modifier used before any signature match"); SCReturnInt(-1); } - SigMatch *pm = DetectContentGetLastPattern(s->pmatch_tail); + SigMatch *pm = DetectContentGetLastPattern(s->sm_lists_tail[DETECT_SM_LIST_PMATCH]); if (pm == NULL) { SCLogError(SC_ERR_INVALID_SIGNATURE, "http_method modifies \"content\", but none was found"); @@ -415,8 +415,8 @@ int DetectHttpMethodTest06(void) goto end; } - if (de_ctx->sig_list->pmatch == NULL) { - printf("de_ctx->sig_list->pmatch == NULL\n"); + if (de_ctx->sig_list->sm_lists[DETECT_SM_LIST_PMATCH] == NULL) { + printf("de_ctx->sig_list->sm_lists[DETECT_SM_LIST_PMATCH] == NULL\n"); goto end; } @@ -425,7 +425,7 @@ int DetectHttpMethodTest06(void) goto end; } - DetectContentData *cd = de_ctx->sig_list->pmatch_tail->ctx; + DetectContentData *cd = de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_PMATCH]->ctx; DetectHttpMethodData *hmd = de_ctx->sig_list->amatch_tail->ctx; if (cd->id == hmd->id) goto end; @@ -454,8 +454,8 @@ int DetectHttpMethodTest07(void) goto end; } - if (de_ctx->sig_list->pmatch == NULL) { - printf("de_ctx->sig_list->pmatch == NULL\n"); + if (de_ctx->sig_list->sm_lists[DETECT_SM_LIST_PMATCH] == NULL) { + printf("de_ctx->sig_list->sm_lists[DETECT_SM_LIST_PMATCH] == NULL\n"); goto end; } @@ -464,7 +464,7 @@ int DetectHttpMethodTest07(void) goto end; } - DetectContentData *cd = de_ctx->sig_list->pmatch_tail->ctx; + DetectContentData *cd = de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_PMATCH]->ctx; DetectHttpMethodData *hmd = de_ctx->sig_list->amatch_tail->ctx; if (cd->id == hmd->id) goto end; @@ -493,8 +493,8 @@ int DetectHttpMethodTest08(void) goto end; } - if (de_ctx->sig_list->pmatch == NULL) { - printf("de_ctx->sig_list->pmatch == NULL\n"); + if (de_ctx->sig_list->sm_lists[DETECT_SM_LIST_PMATCH] == NULL) { + printf("de_ctx->sig_list->sm_lists[DETECT_SM_LIST_PMATCH] == NULL\n"); goto end; } @@ -503,7 +503,7 @@ int DetectHttpMethodTest08(void) goto end; } - DetectContentData *cd = de_ctx->sig_list->pmatch_tail->ctx; + DetectContentData *cd = de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_PMATCH]->ctx; DetectHttpMethodData *hmd = de_ctx->sig_list->amatch_tail->ctx; if (cd->id != 0 || hmd->id != 1) goto end; @@ -532,8 +532,8 @@ int DetectHttpMethodTest09(void) goto end; } - if (de_ctx->sig_list->pmatch == NULL) { - printf("de_ctx->sig_list->pmatch == NULL\n"); + if (de_ctx->sig_list->sm_lists[DETECT_SM_LIST_PMATCH] == NULL) { + printf("de_ctx->sig_list->sm_lists[DETECT_SM_LIST_PMATCH] == NULL\n"); goto end; } @@ -542,7 +542,7 @@ int DetectHttpMethodTest09(void) goto end; } - DetectContentData *cd = de_ctx->sig_list->pmatch_tail->ctx; + DetectContentData *cd = de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_PMATCH]->ctx; DetectHttpMethodData *hmd = de_ctx->sig_list->amatch_tail->ctx; if (cd->id != 1 || hmd->id != 0) goto end; @@ -572,8 +572,8 @@ int DetectHttpMethodTest10(void) goto end; } - if (de_ctx->sig_list->pmatch == NULL) { - printf("de_ctx->sig_list->pmatch == NULL\n"); + if (de_ctx->sig_list->sm_lists[DETECT_SM_LIST_PMATCH] == NULL) { + printf("de_ctx->sig_list->sm_lists[DETECT_SM_LIST_PMATCH] == NULL\n"); goto end; } @@ -582,7 +582,7 @@ int DetectHttpMethodTest10(void) goto end; } - DetectContentData *cd = de_ctx->sig_list->pmatch_tail->ctx; + DetectContentData *cd = de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_PMATCH]->ctx; DetectHttpMethodData *hmd1 = de_ctx->sig_list->amatch_tail->ctx; DetectHttpMethodData *hmd2 = de_ctx->sig_list->amatch_tail->prev->ctx; if (cd->id != 1 || hmd1->id != 0 || hmd2->id != 0) @@ -613,8 +613,8 @@ int DetectHttpMethodTest11(void) goto end; } - if (de_ctx->sig_list->pmatch == NULL) { - printf("de_ctx->sig_list->pmatch == NULL\n"); + if (de_ctx->sig_list->sm_lists[DETECT_SM_LIST_PMATCH] == NULL) { + printf("de_ctx->sig_list->sm_lists[DETECT_SM_LIST_PMATCH] == NULL\n"); goto end; } @@ -623,7 +623,7 @@ int DetectHttpMethodTest11(void) goto end; } - DetectContentData *cd = de_ctx->sig_list->pmatch_tail->ctx; + DetectContentData *cd = de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_PMATCH]->ctx; DetectHttpMethodData *hmd1 = de_ctx->sig_list->amatch_tail->ctx; DetectHttpMethodData *hmd2 = de_ctx->sig_list->amatch_tail->prev->ctx; if (cd->id != 2 || hmd1->id != 0 || hmd2->id != 0) diff --git a/src/detect-http-uri.c b/src/detect-http-uri.c index 5830660ee7..d77c938d1a 100644 --- a/src/detect-http-uri.c +++ b/src/detect-http-uri.c @@ -95,13 +95,13 @@ static int DetectHttpUriSetup (DetectEngineCtx *de_ctx, Signature *s, char *str) return -1; } - if (s->pmatch_tail == NULL) { + if (s->sm_lists_tail[DETECT_SM_LIST_PMATCH] == NULL) { SCLogError(SC_ERR_INVALID_SIGNATURE, "http_uri found inside the " "rule, without any preceding content keywords"); return -1; } - SigMatch *pm = DetectContentGetLastPattern(s->pmatch_tail); + SigMatch *pm = DetectContentGetLastPattern(s->sm_lists_tail[DETECT_SM_LIST_PMATCH]); if (pm == NULL) { SCLogWarning(SC_ERR_INVALID_SIGNATURE, "http_uri modifies \"content\"" "but none was found"); @@ -366,8 +366,8 @@ int DetectHttpUriTest06(void) goto end; } - if (de_ctx->sig_list->pmatch == NULL) { - printf("de_ctx->sig_list->pmatch == NULL\n"); + if (de_ctx->sig_list->sm_lists[DETECT_SM_LIST_PMATCH] == NULL) { + printf("de_ctx->sig_list->sm_lists[DETECT_SM_LIST_PMATCH] == NULL\n"); goto end; } @@ -376,7 +376,7 @@ int DetectHttpUriTest06(void) goto end; } - DetectContentData *cd = de_ctx->sig_list->pmatch_tail->ctx; + DetectContentData *cd = de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_PMATCH]->ctx; DetectUricontentData *ud = de_ctx->sig_list->umatch_tail->ctx; if (cd->id == ud->id) goto end; @@ -405,8 +405,8 @@ int DetectHttpUriTest07(void) goto end; } - if (de_ctx->sig_list->pmatch == NULL) { - printf("de_ctx->sig_list->pmatch == NULL\n"); + if (de_ctx->sig_list->sm_lists[DETECT_SM_LIST_PMATCH] == NULL) { + printf("de_ctx->sig_list->sm_lists[DETECT_SM_LIST_PMATCH] == NULL\n"); goto end; } @@ -415,7 +415,7 @@ int DetectHttpUriTest07(void) goto end; } - DetectContentData *cd = de_ctx->sig_list->pmatch_tail->ctx; + DetectContentData *cd = de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_PMATCH]->ctx; DetectUricontentData *ud = de_ctx->sig_list->umatch_tail->ctx; if (cd->id == ud->id) goto end; @@ -444,8 +444,8 @@ int DetectHttpUriTest08(void) goto end; } - if (de_ctx->sig_list->pmatch == NULL) { - printf("de_ctx->sig_list->pmatch == NULL\n"); + if (de_ctx->sig_list->sm_lists[DETECT_SM_LIST_PMATCH] == NULL) { + printf("de_ctx->sig_list->sm_lists[DETECT_SM_LIST_PMATCH] == NULL\n"); goto end; } @@ -454,7 +454,7 @@ int DetectHttpUriTest08(void) goto end; } - DetectContentData *cd = de_ctx->sig_list->pmatch_tail->ctx; + DetectContentData *cd = de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_PMATCH]->ctx; DetectUricontentData *ud = de_ctx->sig_list->umatch_tail->ctx; if (cd->id != 0 || ud->id != 1) goto end; @@ -483,8 +483,8 @@ int DetectHttpUriTest09(void) goto end; } - if (de_ctx->sig_list->pmatch == NULL) { - printf("de_ctx->sig_list->pmatch == NULL\n"); + if (de_ctx->sig_list->sm_lists[DETECT_SM_LIST_PMATCH] == NULL) { + printf("de_ctx->sig_list->sm_lists[DETECT_SM_LIST_PMATCH] == NULL\n"); goto end; } @@ -493,7 +493,7 @@ int DetectHttpUriTest09(void) goto end; } - DetectContentData *cd = de_ctx->sig_list->pmatch_tail->ctx; + DetectContentData *cd = de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_PMATCH]->ctx; DetectUricontentData *ud = de_ctx->sig_list->umatch_tail->ctx; if (cd->id != 1 || ud->id != 0) goto end; @@ -523,8 +523,8 @@ int DetectHttpUriTest10(void) goto end; } - if (de_ctx->sig_list->pmatch == NULL) { - printf("de_ctx->sig_list->pmatch == NULL\n"); + if (de_ctx->sig_list->sm_lists[DETECT_SM_LIST_PMATCH] == NULL) { + printf("de_ctx->sig_list->sm_lists[DETECT_SM_LIST_PMATCH] == NULL\n"); goto end; } @@ -533,7 +533,7 @@ int DetectHttpUriTest10(void) goto end; } - DetectContentData *cd = de_ctx->sig_list->pmatch_tail->ctx; + DetectContentData *cd = de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_PMATCH]->ctx; DetectUricontentData *ud1 = de_ctx->sig_list->umatch_tail->ctx; DetectUricontentData *ud2 = de_ctx->sig_list->umatch_tail->prev->ctx; if (cd->id != 1 || ud1->id != 0 || ud2->id != 0) @@ -564,8 +564,8 @@ int DetectHttpUriTest11(void) goto end; } - if (de_ctx->sig_list->pmatch == NULL) { - printf("de_ctx->sig_list->pmatch == NULL\n"); + if (de_ctx->sig_list->sm_lists[DETECT_SM_LIST_PMATCH] == NULL) { + printf("de_ctx->sig_list->sm_lists[DETECT_SM_LIST_PMATCH] == NULL\n"); goto end; } @@ -574,7 +574,7 @@ int DetectHttpUriTest11(void) goto end; } - DetectContentData *cd = de_ctx->sig_list->pmatch_tail->ctx; + DetectContentData *cd = de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_PMATCH]->ctx; DetectUricontentData *ud1 = de_ctx->sig_list->umatch_tail->ctx; DetectUricontentData *ud2 = de_ctx->sig_list->umatch_tail->prev->ctx; if (cd->id != 2 || ud1->id != 0 || ud2->id != 0) diff --git a/src/detect-isdataat.c b/src/detect-isdataat.c index 6d93ed3f1f..f4983cf2e6 100644 --- a/src/detect-isdataat.c +++ b/src/detect-isdataat.c @@ -251,9 +251,9 @@ int DetectIsdataatSetup (DetectEngineCtx *de_ctx, Signature *s, char *isdataatst SigMatch *dm = NULL; pm = SigMatchGetLastSMFromLists(s, 6, - DETECT_CONTENT, s->pmatch_tail, - DETECT_PCRE, s->pmatch_tail, - DETECT_BYTEJUMP, s->pmatch_tail); + DETECT_CONTENT, s->sm_lists_tail[DETECT_SM_LIST_PMATCH], + DETECT_PCRE, s->sm_lists_tail[DETECT_SM_LIST_PMATCH], + DETECT_BYTEJUMP, s->sm_lists_tail[DETECT_SM_LIST_PMATCH]); dm = SigMatchGetLastSMFromLists(s, 6, DETECT_CONTENT, s->dmatch_tail, DETECT_PCRE, s->dmatch_tail, @@ -429,14 +429,14 @@ int DetectIsdataatTestParse04(void) s->alproto = ALPROTO_DCERPC; result &= (DetectIsdataatSetup(NULL, s, "30") == 0); - result &= (s->dmatch == NULL && s->pmatch != NULL); + result &= (s->dmatch == NULL && s->sm_lists[DETECT_SM_LIST_PMATCH] != NULL); SigFree(s); s = SigAlloc(); s->alproto = ALPROTO_DCERPC; /* failure since we have no preceding content/pcre/bytejump */ result &= (DetectIsdataatSetup(NULL, s, "30,relative") == 0); - result &= (s->dmatch != NULL && s->pmatch == NULL); + result &= (s->dmatch != NULL && s->sm_lists[DETECT_SM_LIST_PMATCH] == NULL); SigFree(s); diff --git a/src/detect-nocase.c b/src/detect-nocase.c index 77d188a5f0..c33254162d 100644 --- a/src/detect-nocase.c +++ b/src/detect-nocase.c @@ -70,7 +70,7 @@ static SigMatch *SigMatchGetLastNocasePattern(Signature *s) { BUG_ON(s == NULL); - SigMatch *co_sm = DetectContentGetLastPattern(s->pmatch_tail); + SigMatch *co_sm = DetectContentGetLastPattern(s->sm_lists_tail[DETECT_SM_LIST_PMATCH]); SigMatch *ur_sm = SigMatchGetLastSM(s->umatch_tail, DETECT_URICONTENT); /* http client body SigMatch */ SigMatch *hcbd_sm = SigMatchGetLastSM(s->amatch_tail, DETECT_AL_HTTP_CLIENT_BODY); diff --git a/src/detect-offset.c b/src/detect-offset.c index 8cceb47302..323bcdc07a 100644 --- a/src/detect-offset.c +++ b/src/detect-offset.c @@ -68,7 +68,7 @@ int DetectOffsetSetup (DetectEngineCtx *de_ctx, Signature *s, char *offsetstr) /* add to the latest "content" keyword from either dmatch or pmatch */ pm = SigMatchGetLastSMFromLists(s, 4, DETECT_CONTENT, s->dmatch_tail, - DETECT_CONTENT, s->pmatch_tail); + DETECT_CONTENT, s->sm_lists_tail[DETECT_SM_LIST_PMATCH]); if (pm == NULL) { SCLogError(SC_ERR_WITHIN_MISSING_CONTENT, "offset needs" "preceeding content option for dcerpc sig"); @@ -81,7 +81,7 @@ int DetectOffsetSetup (DetectEngineCtx *de_ctx, Signature *s, char *offsetstr) default: pm = SigMatchGetLastSMFromLists(s, 4, - DETECT_CONTENT, s->pmatch_tail, + DETECT_CONTENT, s->sm_lists_tail[DETECT_SM_LIST_PMATCH], DETECT_URICONTENT, s->umatch_tail); if (pm == NULL) { SCLogError(SC_ERR_WITHIN_MISSING_CONTENT, "distance needs" diff --git a/src/detect-parse.c b/src/detect-parse.c index 7a7a1f33ac..0595f76d6d 100644 --- a/src/detect-parse.c +++ b/src/detect-parse.c @@ -193,17 +193,17 @@ void SigMatchAppendUricontent(Signature *s, SigMatch *new) { } void SigMatchAppendPayload(Signature *s, SigMatch *new) { - if (s->pmatch == NULL) { - s->pmatch = new; - s->pmatch_tail = new; + if (s->sm_lists[DETECT_SM_LIST_PMATCH] == NULL) { + s->sm_lists[DETECT_SM_LIST_PMATCH] = new; + s->sm_lists_tail[DETECT_SM_LIST_PMATCH] = new; new->next = NULL; new->prev = NULL; } else { - SigMatch *cur = s->pmatch_tail; + SigMatch *cur = s->sm_lists_tail[DETECT_SM_LIST_PMATCH]; cur->next = new; new->prev = cur; new->next = NULL; - s->pmatch_tail = new; + s->sm_lists_tail[DETECT_SM_LIST_PMATCH] = new; } new->idx = s->sm_cnt; @@ -290,13 +290,13 @@ void SigMatchAppendPacket(Signature *s, SigMatch *new) { void SigMatchReplaceContent(Signature *s, SigMatch *old, SigMatch *new) { BUG_ON(old == NULL); - SigMatch *m = s->pmatch; + SigMatch *m = s->sm_lists[DETECT_SM_LIST_PMATCH]; SigMatch *pm = m; for ( ; m != NULL; m = m->next) { if (m == old) { - if (m == s->pmatch) { - s->pmatch = m->next; + if (m == s->sm_lists[DETECT_SM_LIST_PMATCH]) { + s->sm_lists[DETECT_SM_LIST_PMATCH] = m->next; if (m->next != NULL) { m->next->prev = NULL; } @@ -307,15 +307,15 @@ void SigMatchReplaceContent(Signature *s, SigMatch *old, SigMatch *new) { } } - if (m == s->pmatch_tail) { + if (m == s->sm_lists_tail[DETECT_SM_LIST_PMATCH]) { if (pm == m) { - s->pmatch_tail = NULL; + s->sm_lists_tail[DETECT_SM_LIST_PMATCH] = NULL; } else { - s->pmatch_tail = pm; + s->sm_lists_tail[DETECT_SM_LIST_PMATCH] = pm; } } - //printf("m %p s->pmatch %p s->pmatch_tail %p\n", m, s->pmatch, s->pmatch_tail); + //printf("m %p s->sm_lists[DETECT_SM_LIST_PMATCH] %p s->sm_lists_tail[DETECT_SM_LIST_PMATCH] %p\n", m, s->sm_lists[DETECT_SM_LIST_PMATCH], s->sm_lists_tail[DETECT_SM_LIST_PMATCH]); break; } @@ -354,13 +354,13 @@ void SigMatchReplaceContent(Signature *s, SigMatch *old, SigMatch *new) { void SigMatchReplaceContentToUricontent(Signature *s, SigMatch *old, SigMatch *new) { BUG_ON(old == NULL); - SigMatch *m = s->pmatch; + SigMatch *m = s->sm_lists[DETECT_SM_LIST_PMATCH]; SigMatch *pm = m; for ( ; m != NULL; m = m->next) { if (m == old) { - if (m == s->pmatch) { - s->pmatch = m->next; + if (m == s->sm_lists[DETECT_SM_LIST_PMATCH]) { + s->sm_lists[DETECT_SM_LIST_PMATCH] = m->next; if (m->next != NULL) { m->next->prev = NULL; } @@ -371,15 +371,15 @@ void SigMatchReplaceContentToUricontent(Signature *s, SigMatch *old, SigMatch *n } } - if (m == s->pmatch_tail) { + if (m == s->sm_lists_tail[DETECT_SM_LIST_PMATCH]) { if (pm == m) { - s->pmatch_tail = NULL; + s->sm_lists_tail[DETECT_SM_LIST_PMATCH] = NULL; } else { - s->pmatch_tail = pm; + s->sm_lists_tail[DETECT_SM_LIST_PMATCH] = pm; } } - //printf("m %p s->pmatch %p s->pmatch_tail %p\n", m, s->pmatch, s->pmatch_tail); + //printf("m %p s->sm_lists[DETECT_SM_LIST_PMATCH] %p s->sm_lists_tail[DETECT_SM_LIST_PMATCH] %p\n", m, s->sm_lists[DETECT_SM_LIST_PMATCH], s->sm_lists_tail[DETECT_SM_LIST_PMATCH]); break; } @@ -1051,7 +1051,7 @@ void SigFree(Signature *s) { sm = nsm; } - sm = s->pmatch; + sm = s->sm_lists[DETECT_SM_LIST_PMATCH]; while (sm != NULL) { nsm = sm->next; SigMatchFree(sm); @@ -1279,7 +1279,7 @@ Signature *SigInit(DetectEngineCtx *de_ctx, char *sigstr) { /* see if need to set the SIG_FLAG_MPM flag */ SigMatch *sm; - for (sm = sig->pmatch; sm != NULL; sm = sm->next) { + for (sm = sig->sm_lists[DETECT_SM_LIST_PMATCH]; sm != NULL; sm = sm->next) { if (sm->type == DETECT_CONTENT) { DetectContentData *cd = (DetectContentData *)sm->ctx; if (cd == NULL) @@ -1308,7 +1308,7 @@ Signature *SigInit(DetectEngineCtx *de_ctx, char *sigstr) { if (sig->flags & SIG_FLAG_MPM) { sig->mpm_content_maxlen = 0; - for (sm = sig->pmatch; sm != NULL; sm = sm->next) { + for (sm = sig->sm_lists[DETECT_SM_LIST_PMATCH]; sm != NULL; sm = sm->next) { if (sm->type == DETECT_CONTENT) { DetectContentData *cd = (DetectContentData *)sm->ctx; if (cd == NULL) @@ -1421,7 +1421,7 @@ Signature *SigInitReal(DetectEngineCtx *de_ctx, char *sigstr) { /* see if need to set the SIG_FLAG_MPM flag */ SigMatch *sm; - for (sm = sig->pmatch; sm != NULL; sm = sm->next) { + for (sm = sig->sm_lists[DETECT_SM_LIST_PMATCH]; sm != NULL; sm = sm->next) { if (sm->type == DETECT_CONTENT) { DetectContentData *cd = (DetectContentData *)sm->ctx; if (cd == NULL) @@ -1450,7 +1450,7 @@ Signature *SigInitReal(DetectEngineCtx *de_ctx, char *sigstr) { if (sig->flags & SIG_FLAG_MPM) { sig->mpm_content_maxlen = 0; - for (sm = sig->pmatch; sm != NULL; sm = sm->next) { + for (sm = sig->sm_lists[DETECT_SM_LIST_PMATCH]; sm != NULL; sm = sm->next) { if (sm->type == DETECT_CONTENT) { DetectContentData *cd = (DetectContentData *)sm->ctx; if (cd == NULL) @@ -1499,7 +1499,7 @@ Signature *SigInitReal(DetectEngineCtx *de_ctx, char *sigstr) { sig->next->mpm_content_maxlen = 0; SigMatch *sm; - for (sm = sig->next->pmatch; sm != NULL; sm = sm->next) { + for (sm = sig->next->sm_lists[DETECT_SM_LIST_PMATCH]; sm != NULL; sm = sm->next) { if (sm->type == DETECT_CONTENT) { DetectContentData *cd = (DetectContentData *)sm->ctx; if (cd == NULL) diff --git a/src/detect-pcre.c b/src/detect-pcre.c index 4b896d8de3..dc4355030c 100644 --- a/src/detect-pcre.c +++ b/src/detect-pcre.c @@ -1347,13 +1347,13 @@ static int DetectPcreSetup (DetectEngineCtx *de_ctx, Signature *s, char *regexst SigMatch *dm = NULL; pm = SigMatchGetLastSMFromLists(s, 6, - DETECT_CONTENT, s->pmatch_tail, - DETECT_PCRE, s->pmatch_tail, - DETECT_BYTEJUMP, s->pmatch_tail); + DETECT_CONTENT, s->sm_lists_tail[DETECT_SM_LIST_PMATCH], + DETECT_PCRE, s->sm_lists_tail[DETECT_SM_LIST_PMATCH], + DETECT_BYTEJUMP, s->sm_lists_tail[DETECT_SM_LIST_PMATCH]); dm = SigMatchGetLastSMFromLists(s, 6, - DETECT_CONTENT, s->pmatch_tail, - DETECT_PCRE, s->pmatch_tail, - DETECT_BYTEJUMP, s->pmatch_tail); + DETECT_CONTENT, s->sm_lists_tail[DETECT_SM_LIST_PMATCH], + DETECT_PCRE, s->sm_lists_tail[DETECT_SM_LIST_PMATCH], + DETECT_BYTEJUMP, s->sm_lists_tail[DETECT_SM_LIST_PMATCH]); if (pm == NULL) { SigMatchAppendDcePayload(s, sm); @@ -1644,14 +1644,14 @@ int DetectPcreParseTest10(void) s->alproto = ALPROTO_DCERPC; result &= (DetectPcreSetup(de_ctx, s, "/bamboo/") == 0); - result &= (s->dmatch == NULL && s->pmatch != NULL); + result &= (s->dmatch == NULL && s->sm_lists[DETECT_SM_LIST_PMATCH] != NULL); SigFree(s); s = SigAlloc(); /* failure since we have no preceding content/pcre/bytejump */ result &= (DetectPcreSetup(de_ctx, s, "/bamboo/") == 0); - result &= (s->dmatch == NULL && s->pmatch != NULL); + result &= (s->dmatch == NULL && s->sm_lists[DETECT_SM_LIST_PMATCH] != NULL); end: SigFree(s); diff --git a/src/detect-rawbytes.c b/src/detect-rawbytes.c index 5415a4e3e1..e79c769931 100644 --- a/src/detect-rawbytes.c +++ b/src/detect-rawbytes.c @@ -58,7 +58,7 @@ static int DetectRawbytesSetup (DetectEngineCtx *de_ctx, Signature *s, char *nul return -1; } - SigMatch *pm = DetectContentGetLastPattern(s->pmatch_tail); + SigMatch *pm = DetectContentGetLastPattern(s->sm_lists_tail[DETECT_SM_LIST_PMATCH]); if (pm == NULL) { SCLogError(SC_ERR_RAWBYTES_MISSING_CONTENT, "\"rawbytes\" needs a preceeding content option"); SCReturnInt(-1); diff --git a/src/detect-uricontent.c b/src/detect-uricontent.c index 5493ab986c..1237cf82d0 100644 --- a/src/detect-uricontent.c +++ b/src/detect-uricontent.c @@ -1074,7 +1074,7 @@ static int DetectUriSigTest04(void) { "uricontent:\"foo\"; sid:1;)"); if (s == NULL || s->umatch == NULL || - s->pmatch != NULL || + s->sm_lists[DETECT_SM_LIST_PMATCH] != NULL || s->sm_lists[DETECT_SM_LIST_MATCH] != NULL) { printf("sig 1 failed to parse: "); @@ -1086,7 +1086,7 @@ static int DetectUriSigTest04(void) { "uricontent:\"foo\"; content:\"bar\";sid:1;)"); if (s == NULL || s->umatch == NULL || - s->pmatch == NULL || + s->sm_lists[DETECT_SM_LIST_PMATCH] == NULL || s->sm_lists[DETECT_SM_LIST_MATCH] != NULL) { printf("sig 2 failed to parse: "); @@ -1099,9 +1099,9 @@ static int DetectUriSigTest04(void) { " depth:10; offset: 5; sid:1;)"); if (s == NULL || s->umatch == NULL || - s->pmatch == NULL || - ((DetectContentData *)s->pmatch->ctx)->depth != 15 || - ((DetectContentData *)s->pmatch->ctx)->offset != 5 || + s->sm_lists[DETECT_SM_LIST_PMATCH] == NULL || + ((DetectContentData *)s->sm_lists[DETECT_SM_LIST_PMATCH]->ctx)->depth != 15 || + ((DetectContentData *)s->sm_lists[DETECT_SM_LIST_PMATCH]->ctx)->offset != 5 || s->sm_lists[DETECT_SM_LIST_MATCH] != NULL) { printf("sig 3 failed to parse: "); @@ -1114,7 +1114,7 @@ static int DetectUriSigTest04(void) { " depth:10; offset: 5; sid:1;)"); if (s == NULL || s->umatch == NULL || - s->pmatch == NULL || + s->sm_lists[DETECT_SM_LIST_PMATCH] == NULL || ((DetectUricontentData *)s->umatch->ctx)->depth != 15 || ((DetectUricontentData *)s->umatch->ctx)->offset != 5 || s->sm_lists[DETECT_SM_LIST_MATCH] != NULL) @@ -1149,14 +1149,14 @@ static int DetectUriSigTest04(void) { if (s == NULL) { goto end; } else if (s->umatch == NULL || - s->pmatch == NULL || - ((DetectContentData*) s->pmatch->ctx)->depth != 15 || - ((DetectContentData*) s->pmatch->ctx)->offset != 5 || - ((DetectContentData*) s->pmatch_tail->ctx)->within != 30 || + s->sm_lists[DETECT_SM_LIST_PMATCH] == NULL || + ((DetectContentData*) s->sm_lists[DETECT_SM_LIST_PMATCH]->ctx)->depth != 15 || + ((DetectContentData*) s->sm_lists[DETECT_SM_LIST_PMATCH]->ctx)->offset != 5 || + ((DetectContentData*) s->sm_lists_tail[DETECT_SM_LIST_PMATCH]->ctx)->within != 30 || s->sm_lists[DETECT_SM_LIST_MATCH] != NULL) { printf("sig 7 failed to parse: "); - DetectContentPrint((DetectContentData*) s->pmatch_tail->ctx); + DetectContentPrint((DetectContentData*) s->sm_lists_tail[DETECT_SM_LIST_PMATCH]->ctx); goto end; } @@ -1168,9 +1168,9 @@ static int DetectUriSigTest04(void) { if (s == NULL) { goto end; } else if (s->umatch == NULL || - s->pmatch == NULL || - ((DetectContentData*) s->pmatch->ctx)->depth != 15 || - ((DetectContentData*) s->pmatch->ctx)->offset != 5 || + s->sm_lists[DETECT_SM_LIST_PMATCH] == NULL || + ((DetectContentData*) s->sm_lists[DETECT_SM_LIST_PMATCH]->ctx)->depth != 15 || + ((DetectContentData*) s->sm_lists[DETECT_SM_LIST_PMATCH]->ctx)->offset != 5 || ((DetectUricontentData*) s->umatch_tail->ctx)->within != 30 || s->sm_lists[DETECT_SM_LIST_MATCH] != NULL) { @@ -1188,14 +1188,14 @@ static int DetectUriSigTest04(void) { goto end; } else if ( s->umatch == NULL || - s->pmatch == NULL || - ((DetectContentData*) s->pmatch->ctx)->depth != 15 || - ((DetectContentData*) s->pmatch->ctx)->offset != 5 || - ((DetectContentData*) s->pmatch_tail->ctx)->distance != 30 || + s->sm_lists[DETECT_SM_LIST_PMATCH] == NULL || + ((DetectContentData*) s->sm_lists[DETECT_SM_LIST_PMATCH]->ctx)->depth != 15 || + ((DetectContentData*) s->sm_lists[DETECT_SM_LIST_PMATCH]->ctx)->offset != 5 || + ((DetectContentData*) s->sm_lists_tail[DETECT_SM_LIST_PMATCH]->ctx)->distance != 30 || s->sm_lists[DETECT_SM_LIST_MATCH] != NULL) { printf("sig 9 failed to parse: "); - DetectContentPrint((DetectContentData*) s->pmatch_tail->ctx); + DetectContentPrint((DetectContentData*) s->sm_lists_tail[DETECT_SM_LIST_PMATCH]->ctx); goto end; } @@ -1208,9 +1208,9 @@ static int DetectUriSigTest04(void) { goto end; } else if ( s->umatch == NULL || - s->pmatch == NULL || - ((DetectContentData*) s->pmatch->ctx)->depth != 15 || - ((DetectContentData*) s->pmatch->ctx)->offset != 5 || + s->sm_lists[DETECT_SM_LIST_PMATCH] == NULL || + ((DetectContentData*) s->sm_lists[DETECT_SM_LIST_PMATCH]->ctx)->depth != 15 || + ((DetectContentData*) s->sm_lists[DETECT_SM_LIST_PMATCH]->ctx)->offset != 5 || ((DetectUricontentData*) s->umatch_tail->ctx)->distance != 30 || s->sm_lists[DETECT_SM_LIST_MATCH] != NULL) { @@ -1231,22 +1231,22 @@ static int DetectUriSigTest04(void) { goto end; } - if (s->umatch == NULL || s->pmatch == NULL) { - printf("umatch %p or pmatch %p: ", s->umatch, s->pmatch); + if (s->umatch == NULL || s->sm_lists[DETECT_SM_LIST_PMATCH] == NULL) { + printf("umatch %p or pmatch %p: ", s->umatch, s->sm_lists[DETECT_SM_LIST_PMATCH]); goto end; } - if ( ((DetectContentData*) s->pmatch->ctx)->depth != 15 || - ((DetectContentData*) s->pmatch->ctx)->offset != 5 || + if ( ((DetectContentData*) s->sm_lists[DETECT_SM_LIST_PMATCH]->ctx)->depth != 15 || + ((DetectContentData*) s->sm_lists[DETECT_SM_LIST_PMATCH]->ctx)->offset != 5 || ((DetectUricontentData*) s->umatch_tail->ctx)->distance != 30 || ((DetectUricontentData*) s->umatch_tail->ctx)->within != 60 || - ((DetectContentData*) s->pmatch_tail->ctx)->distance != 45 || - ((DetectContentData*) s->pmatch_tail->ctx)->within != 70 || + ((DetectContentData*) s->sm_lists_tail[DETECT_SM_LIST_PMATCH]->ctx)->distance != 45 || + ((DetectContentData*) s->sm_lists_tail[DETECT_SM_LIST_PMATCH]->ctx)->within != 70 || s->sm_lists[DETECT_SM_LIST_MATCH] != NULL) { printf("sig 10 failed to parse, content not setup properly: "); - DetectContentPrint((DetectContentData*) s->pmatch->ctx); + DetectContentPrint((DetectContentData*) s->sm_lists[DETECT_SM_LIST_PMATCH]->ctx); DetectUricontentPrint((DetectUricontentData*) s->umatch_tail->ctx); - DetectContentPrint((DetectContentData*) s->pmatch_tail->ctx); + DetectContentPrint((DetectContentData*) s->sm_lists_tail[DETECT_SM_LIST_PMATCH]->ctx); goto end; } @@ -2128,8 +2128,8 @@ int DetectUricontentSigTest08(void) goto end; } - if (de_ctx->sig_list->pmatch == NULL) { - printf("de_ctx->sig_list->pmatch == NULL\n"); + if (de_ctx->sig_list->sm_lists[DETECT_SM_LIST_PMATCH] == NULL) { + printf("de_ctx->sig_list->sm_lists[DETECT_SM_LIST_PMATCH] == NULL\n"); goto end; } @@ -2138,7 +2138,7 @@ int DetectUricontentSigTest08(void) goto end; } - DetectContentData *cd = de_ctx->sig_list->pmatch_tail->ctx; + DetectContentData *cd = de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_PMATCH]->ctx; DetectUricontentData *ud = de_ctx->sig_list->umatch_tail->ctx; if (cd->id == ud->id) goto end; @@ -2167,8 +2167,8 @@ int DetectUricontentSigTest09(void) goto end; } - if (de_ctx->sig_list->pmatch == NULL) { - printf("de_ctx->sig_list->pmatch == NULL\n"); + if (de_ctx->sig_list->sm_lists[DETECT_SM_LIST_PMATCH] == NULL) { + printf("de_ctx->sig_list->sm_lists[DETECT_SM_LIST_PMATCH] == NULL\n"); goto end; } @@ -2177,7 +2177,7 @@ int DetectUricontentSigTest09(void) goto end; } - DetectContentData *cd = de_ctx->sig_list->pmatch_tail->ctx; + DetectContentData *cd = de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_PMATCH]->ctx; DetectUricontentData *ud = de_ctx->sig_list->umatch_tail->ctx; if (cd->id == ud->id) goto end; @@ -2207,8 +2207,8 @@ int DetectUricontentSigTest10(void) goto end; } - if (de_ctx->sig_list->pmatch == NULL) { - printf("de_ctx->sig_list->pmatch == NULL\n"); + if (de_ctx->sig_list->sm_lists[DETECT_SM_LIST_PMATCH] == NULL) { + printf("de_ctx->sig_list->sm_lists[DETECT_SM_LIST_PMATCH] == NULL\n"); goto end; } @@ -2217,9 +2217,9 @@ int DetectUricontentSigTest10(void) goto end; } - DetectContentData *cd1 = de_ctx->sig_list->pmatch_tail->prev->prev->ctx; - DetectContentData *cd2 = de_ctx->sig_list->pmatch_tail->prev->ctx; - DetectContentData *cd3 = de_ctx->sig_list->pmatch_tail->ctx; + DetectContentData *cd1 = de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_PMATCH]->prev->prev->ctx; + DetectContentData *cd2 = de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_PMATCH]->prev->ctx; + DetectContentData *cd3 = de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_PMATCH]->ctx; DetectUricontentData *ud1 = de_ctx->sig_list->umatch_tail->prev->ctx; DetectUricontentData *ud2 = de_ctx->sig_list->umatch_tail->ctx; if (cd1->id != 1 || cd2->id != 2 || cd3->id != 1 || ud1->id != 0 || ud2->id != 0) @@ -2250,8 +2250,8 @@ int DetectUricontentSigTest11(void) goto end; } - if (de_ctx->sig_list->pmatch == NULL) { - printf("de_ctx->sig_list->pmatch == NULL\n"); + if (de_ctx->sig_list->sm_lists[DETECT_SM_LIST_PMATCH] == NULL) { + printf("de_ctx->sig_list->sm_lists[DETECT_SM_LIST_PMATCH] == NULL\n"); goto end; } @@ -2260,9 +2260,9 @@ int DetectUricontentSigTest11(void) goto end; } - DetectContentData *cd1 = de_ctx->sig_list->pmatch_tail->prev->prev->ctx; - DetectContentData *cd2 = de_ctx->sig_list->pmatch_tail->prev->ctx; - DetectContentData *cd3 = de_ctx->sig_list->pmatch_tail->ctx; + DetectContentData *cd1 = de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_PMATCH]->prev->prev->ctx; + DetectContentData *cd2 = de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_PMATCH]->prev->ctx; + DetectContentData *cd3 = de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_PMATCH]->ctx; DetectUricontentData *ud1 = de_ctx->sig_list->umatch_tail->prev->ctx; DetectUricontentData *ud2 = de_ctx->sig_list->umatch_tail->ctx; if (cd1->id != 1 || cd2->id != 2 || cd3->id != 1 || ud1->id != 0 || ud2->id != 0) @@ -2295,8 +2295,8 @@ int DetectUricontentSigTest12(void) goto end; } - if (de_ctx->sig_list->pmatch == NULL) { - printf("de_ctx->sig_list->pmatch == NULL\n"); + if (de_ctx->sig_list->sm_lists[DETECT_SM_LIST_PMATCH] == NULL) { + printf("de_ctx->sig_list->sm_lists[DETECT_SM_LIST_PMATCH] == NULL\n"); goto end; } @@ -2305,11 +2305,11 @@ int DetectUricontentSigTest12(void) goto end; } - DetectContentData *cd1 = de_ctx->sig_list->pmatch_tail->prev->prev->prev->prev->ctx; - DetectContentData *cd2 = de_ctx->sig_list->pmatch_tail->prev->prev->prev->ctx; - DetectContentData *cd3 = de_ctx->sig_list->pmatch_tail->prev->prev->ctx; - DetectContentData *cd4 = de_ctx->sig_list->pmatch_tail->prev->ctx; - DetectContentData *cd5 = de_ctx->sig_list->pmatch_tail->ctx; + DetectContentData *cd1 = de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_PMATCH]->prev->prev->prev->prev->ctx; + DetectContentData *cd2 = de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_PMATCH]->prev->prev->prev->ctx; + DetectContentData *cd3 = de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_PMATCH]->prev->prev->ctx; + DetectContentData *cd4 = de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_PMATCH]->prev->ctx; + DetectContentData *cd5 = de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_PMATCH]->ctx; DetectUricontentData *ud1 = de_ctx->sig_list->umatch_tail->prev->prev->prev->prev->ctx; DetectUricontentData *ud2 = de_ctx->sig_list->umatch_tail->prev->prev->prev->ctx; DetectUricontentData *ud3 = de_ctx->sig_list->umatch_tail->prev->prev->ctx; diff --git a/src/detect-within.c b/src/detect-within.c index 2eeda6a4ca..7359e0fdc4 100644 --- a/src/detect-within.c +++ b/src/detect-within.c @@ -76,7 +76,7 @@ static int DetectWithinSetup (DetectEngineCtx *de_ctx, Signature *s, char *withi } /* if we still haven't found that the sig is related to DCERPC, - * it's a direct entry into Signature->pmatch */ + * it's a direct entry into Signature->[DETECT_SM_LIST_PMATCH] */ if (s->alproto == ALPROTO_DCERPC) { SigMatch *dcem = NULL; SigMatch *dm = NULL; @@ -97,9 +97,9 @@ static int DetectWithinSetup (DetectEngineCtx *de_ctx, Signature *s, char *withi DETECT_PCRE, s->dmatch_tail, DETECT_BYTEJUMP, s->dmatch_tail); pm1_ots = SigMatchGetLastSMFromLists(s, 6, - DETECT_CONTENT, s->pmatch_tail, - DETECT_PCRE, s->pmatch_tail, - DETECT_BYTEJUMP, s->pmatch_tail); + DETECT_CONTENT, s->sm_lists_tail[DETECT_SM_LIST_PMATCH], + DETECT_PCRE, s->sm_lists_tail[DETECT_SM_LIST_PMATCH], + DETECT_BYTEJUMP, s->sm_lists_tail[DETECT_SM_LIST_PMATCH]); if (pm1_ots != NULL && pm1_ots->prev != NULL) { pm2_ots = SigMatchGetLastSMFromLists(s, 6, DETECT_CONTENT, pm1_ots->prev, @@ -108,7 +108,7 @@ static int DetectWithinSetup (DetectEngineCtx *de_ctx, Signature *s, char *withi } dm = SigMatchGetLastSMFromLists(s, 2, DETECT_CONTENT, s->dmatch_tail); - pm1 = SigMatchGetLastSMFromLists(s, 2, DETECT_CONTENT, s->pmatch_tail); + pm1 = SigMatchGetLastSMFromLists(s, 2, DETECT_CONTENT, s->sm_lists_tail[DETECT_SM_LIST_PMATCH]); if (pm1 != NULL && pm1->prev != NULL) { pm2 = SigMatchGetLastSMFromLists(s, 2, DETECT_CONTENT, pm1->prev); } @@ -124,7 +124,8 @@ static int DetectWithinSetup (DetectEngineCtx *de_ctx, Signature *s, char *withi if (pm1->idx > dcem->idx) { /* transfer pm1 to dmatch list and within is against this */ SigMatchTransferSigMatchAcrossLists(pm1, - &s->pmatch, &s->pmatch_tail, + &s->sm_lists[DETECT_SM_LIST_PMATCH], + &s->sm_lists_tail[DETECT_SM_LIST_PMATCH], &s->dmatch, &s->dmatch_tail); pm = pm1; } else { @@ -137,7 +138,8 @@ static int DetectWithinSetup (DetectEngineCtx *de_ctx, Signature *s, char *withi } else if (pm1->idx > dcem->idx) { /* transfer pm1 to dmatch list and within is against this */ SigMatchTransferSigMatchAcrossLists(pm1, - &s->pmatch, &s->pmatch_tail, + &s->sm_lists[DETECT_SM_LIST_PMATCH], + &s->sm_lists_tail[DETECT_SM_LIST_PMATCH], &s->dmatch, &s->dmatch_tail); pm = pm1; } else { @@ -154,7 +156,8 @@ static int DetectWithinSetup (DetectEngineCtx *de_ctx, Signature *s, char *withi } else if (pm2_ots == NULL || pm2_ots->idx < dcem->idx) { /* trasnfer pm1 to dmatch list and pm = pm1 */ SigMatchTransferSigMatchAcrossLists(pm1, - &s->pmatch, &s->pmatch_tail, + &s->sm_lists[DETECT_SM_LIST_PMATCH], + &s->sm_lists_tail[DETECT_SM_LIST_PMATCH], &s->dmatch, &s->dmatch_tail); pm = pm1; } else { @@ -164,7 +167,7 @@ static int DetectWithinSetup (DetectEngineCtx *de_ctx, Signature *s, char *withi } } else { pm = SigMatchGetLastSMFromLists(s, 4, - DETECT_CONTENT, s->pmatch_tail, + DETECT_CONTENT, s->sm_lists_tail[DETECT_SM_LIST_PMATCH], DETECT_URICONTENT, s->umatch_tail); if (pm == NULL) { SCLogError(SC_ERR_WITHIN_MISSING_CONTENT, "within needs" diff --git a/src/detect.c b/src/detect.c index ba1f60b638..d8329304a6 100644 --- a/src/detect.c +++ b/src/detect.c @@ -267,7 +267,7 @@ void EngineAnalysisFastPattern(Signature *s) DetectContentData *fp_cd = NULL; SigMatch *sm = NULL; - for (sm = s->pmatch; sm != NULL; sm = sm->next) { + for (sm = s->sm_lists[DETECT_SM_LIST_PMATCH]; sm != NULL; sm = sm->next) { if (sm->type != DETECT_CONTENT) continue; @@ -1094,7 +1094,7 @@ int SigMatchSignatures(ThreadVars *th_v, DetectEngineCtx *de_ctx, DetectEngineTh /* Check the payload keywords. If we are a MPM sig and we've made * to here, we've had at least one of the patterns match */ - if (s->pmatch != NULL) { + if (s->sm_lists[DETECT_SM_LIST_PMATCH] != NULL) { /* if we have stream msgs, inspect against those first, * but not for a "dsize" signature */ if (!(s->flags & SIG_FLAG_DSIZE) && smsg != NULL) { @@ -1445,7 +1445,7 @@ int SignatureIsIPOnly(DetectEngineCtx *de_ctx, Signature *s) { } } - if (s->pmatch != NULL) + if (s->sm_lists[DETECT_SM_LIST_PMATCH] != NULL) return 0; if (s->umatch != NULL) @@ -1482,11 +1482,11 @@ iponly: */ static int SignatureIsInspectingPayload(DetectEngineCtx *de_ctx, Signature *s) { - if (s->pmatch != NULL) { + if (s->sm_lists[DETECT_SM_LIST_PMATCH] != NULL) { return 1; } #if 0 - SigMatch *sm = s->pmatch; + SigMatch *sm = s->sm_lists[DETECT_SM_LIST_PMATCH]; if (sm == NULL) return 0; @@ -1513,7 +1513,7 @@ static int SignatureIsDEOnly(DetectEngineCtx *de_ctx, Signature *s) { if (s->alproto != ALPROTO_UNKNOWN) return 0; - if (s->pmatch != NULL) + if (s->sm_lists[DETECT_SM_LIST_PMATCH] != NULL) return 0; if (s->umatch != NULL) @@ -1594,7 +1594,7 @@ PacketCreateMask(Packet *p, SignatureMask *mask, uint16_t alproto, void *alstate static int SignatureCreateMask(Signature *s) { SCEnter(); - if (s->pmatch != NULL) { + if (s->sm_lists[DETECT_SM_LIST_PMATCH] != NULL) { s->mask |= SIG_MASK_REQUIRE_PAYLOAD; SCLogDebug("sig requires payload"); } @@ -7449,16 +7449,16 @@ int SigTest37ContentAndIsdataatKeywords02Real (int mpm_type) { goto end; } - if (s->pmatch->type != DETECT_CONTENT) { + if (s->sm_lists[DETECT_SM_LIST_PMATCH]->type != DETECT_CONTENT) { printf("type not content: "); goto end; } /* - if (s->pmatch->next == NULL) { - printf("s->pmatch->next == NULL: "); + if (s->sm_lists[DETECT_SM_LIST_PMATCH]->next == NULL) { + printf("s->sm_lists[DETECT_SM_LIST_PMATCH]->next == NULL: "); goto end; } - if (s->pmatch->next->type != DETECT_ISDATAAT) { + if (s->sm_lists[DETECT_SM_LIST_PMATCH]->next->type != DETECT_ISDATAAT) { printf("type not isdataat: "); goto end; } @@ -7630,7 +7630,7 @@ int SigTest40NoPayloadInspection02(void) { } // sigmatch_table[DETECT_CONTENT].flags |= SIGMATCH_PAYLOAD; -// de_ctx->sig_list->pmatch->type = DETECT_CONTENT; +// de_ctx->sig_list->sm_lists[DETECT_SM_LIST_PMATCH]->type = DETECT_CONTENT; SigGroupBuild(de_ctx); //PatternMatchPrepare(mpm_ctx,MPM_B2G); diff --git a/src/detect.h b/src/detect.h index f4e26ffefd..aee50f3fc7 100644 --- a/src/detect.h +++ b/src/detect.h @@ -358,7 +358,7 @@ typedef struct Signature_ { struct SigMatch_ *sm_lists[DETECT_SM_LIST_MAX]; /** ptr to the SigMatch lists */ - struct SigMatch_ *pmatch; /* payload matches */ + //struct SigMatch_ *pmatch; /* payload matches */ struct SigMatch_ *umatch; /* uricontent payload matches */ struct SigMatch_ *amatch; /* general app layer matches */ struct SigMatch_ *dmatch; /* dce app layer matches */ @@ -412,7 +412,7 @@ typedef struct Signature_ { struct SigMatch_ *sm_lists_tail[DETECT_SM_LIST_MAX]; //struct SigMatch_ *match_tail; /* non-payload matches, tail of the list */ - struct SigMatch_ *pmatch_tail; /* payload matches, tail of the list */ + //struct SigMatch_ *pmatch_tail; /* payload matches, tail of the list */ struct SigMatch_ *umatch_tail; /* uricontent payload matches, tail of the list */ struct SigMatch_ *amatch_tail; /* general app layer matches, tail of the list */ struct SigMatch_ *dmatch_tail; /* dce app layer matches, tail of the list */