detect/bytejump: Change DoMatch signature to return bool

Issue: 4624

Change the function signature of byte-jump's domatch from an int to a
bool to avoid ambiguity handling return values.
pull/9535/head
Jeff Lucovsky 2 years ago committed by Victor Julien
parent 22ffdbb1b3
commit 27a665546b

@ -132,10 +132,10 @@ static bool DetectBytejumpValidateNbytes(const DetectBytejumpData *data, int32_t
* \param m byte jump sigmatch * \param m byte jump sigmatch
* \param payload ptr to the payload * \param payload ptr to the payload
* \param payload_len length of the payload * \param payload_len length of the payload
* \retval 1 match * \retval true match
* \retval 0 no match * \retval false no match
*/ */
int DetectBytejumpDoMatch(DetectEngineThreadCtx *det_ctx, const Signature *s, bool DetectBytejumpDoMatch(DetectEngineThreadCtx *det_ctx, const Signature *s,
const SigMatchCtx *ctx, const uint8_t *payload, uint32_t payload_len, uint16_t flags, const SigMatchCtx *ctx, const uint8_t *payload, uint32_t payload_len, uint16_t flags,
int32_t nbytes, int32_t offset) int32_t nbytes, int32_t offset)
{ {
@ -148,7 +148,7 @@ int DetectBytejumpDoMatch(DetectEngineThreadCtx *det_ctx, const Signature *s,
int extbytes; int extbytes;
if (payload_len == 0) { if (payload_len == 0) {
SCReturnInt(0); SCReturnBool(false);
} }
/* Validate the number of bytes we are testing /* Validate the number of bytes we are testing
@ -161,7 +161,7 @@ int DetectBytejumpDoMatch(DetectEngineThreadCtx *det_ctx, const Signature *s,
SCLogDebug("Invalid byte_jump nbytes " SCLogDebug("Invalid byte_jump nbytes "
"seen in byte_jump - %d", "seen in byte_jump - %d",
nbytes); nbytes);
SCReturnInt(0); SCReturnBool(false);
} }
} }
@ -177,7 +177,7 @@ int DetectBytejumpDoMatch(DetectEngineThreadCtx *det_ctx, const Signature *s,
/* No match if there is no relative base */ /* No match if there is no relative base */
if (ptr == NULL || len <= 0) { if (ptr == NULL || len <= 0) {
SCReturnInt(0); SCReturnBool(false);
} }
} }
else { else {
@ -190,7 +190,7 @@ int DetectBytejumpDoMatch(DetectEngineThreadCtx *det_ctx, const Signature *s,
SCLogDebug("Data not within payload " SCLogDebug("Data not within payload "
"pkt=%p, ptr=%p, len=%d, nbytes=%d", "pkt=%p, ptr=%p, len=%d, nbytes=%d",
payload, ptr, len, nbytes); payload, ptr, len, nbytes);
SCReturnInt(0); SCReturnBool(false);
} }
/* Extract the byte data */ /* Extract the byte data */
@ -198,7 +198,7 @@ int DetectBytejumpDoMatch(DetectEngineThreadCtx *det_ctx, const Signature *s,
extbytes = ByteExtractStringUint64(&val, data->base, nbytes, (const char *)ptr); extbytes = ByteExtractStringUint64(&val, data->base, nbytes, (const char *)ptr);
if(extbytes <= 0) { if(extbytes <= 0) {
SCLogDebug("error extracting %d bytes of string data: %d", nbytes, extbytes); SCLogDebug("error extracting %d bytes of string data: %d", nbytes, extbytes);
SCReturnInt(0); SCReturnBool(false);
} }
} }
else { else {
@ -206,7 +206,7 @@ int DetectBytejumpDoMatch(DetectEngineThreadCtx *det_ctx, const Signature *s,
extbytes = ByteExtractUint64(&val, endianness, (uint16_t)nbytes, ptr); extbytes = ByteExtractUint64(&val, endianness, (uint16_t)nbytes, ptr);
if (extbytes != nbytes) { if (extbytes != nbytes) {
SCLogDebug("error extracting %d bytes of numeric data: %d", nbytes, extbytes); SCLogDebug("error extracting %d bytes of numeric data: %d", nbytes, extbytes);
SCReturnInt(0); SCReturnBool(false);
} }
} }
@ -239,7 +239,7 @@ int DetectBytejumpDoMatch(DetectEngineThreadCtx *det_ctx, const Signature *s,
SCLogDebug("Jump location (%" PRIu64 ") is not within " SCLogDebug("Jump location (%" PRIu64 ") is not within "
"payload (%" PRIu32 ")", "payload (%" PRIu32 ")",
val, payload_len); val, payload_len);
SCReturnInt(0); SCReturnBool(false);
} }
#ifdef DEBUG #ifdef DEBUG
@ -252,7 +252,7 @@ int DetectBytejumpDoMatch(DetectEngineThreadCtx *det_ctx, const Signature *s,
/* Adjust the detection context to the jump location. */ /* Adjust the detection context to the jump location. */
det_ctx->buffer_offset = val; det_ctx->buffer_offset = val;
SCReturnInt(1); SCReturnBool(true);
} }
static int DetectBytejumpMatch(DetectEngineThreadCtx *det_ctx, static int DetectBytejumpMatch(DetectEngineThreadCtx *det_ctx,

@ -68,16 +68,10 @@ void DetectBytejumpRegister (void);
* \param p pointer to the current packet * \param p pointer to the current packet
* \param m pointer to the sigmatch that we will cast into DetectBytejumpData * \param m pointer to the sigmatch that we will cast into DetectBytejumpData
* *
* \retval -1 error * \retval false no match
* \retval 0 no match * \retval true
* \retval 1 match
*
* \todo The return seems backwards. We should return a non-zero error code.
* One of the error codes is "no match". As-is if someone accidentally
* does: if (DetectBytejumpMatch(...)) { match }, then they catch an
* error as a match.
*/ */
int DetectBytejumpDoMatch(DetectEngineThreadCtx *, const Signature *, const SigMatchCtx *, bool DetectBytejumpDoMatch(DetectEngineThreadCtx *, const Signature *, const SigMatchCtx *,
const uint8_t *, uint32_t, uint16_t, int32_t, int32_t); const uint8_t *, uint32_t, uint16_t, int32_t, int32_t);
#endif /* __DETECT_BYTEJUMP_H__ */ #endif /* __DETECT_BYTEJUMP_H__ */

@ -534,8 +534,8 @@ uint8_t DetectEngineContentInspection(DetectEngineCtx *de_ctx, DetectEngineThrea
DETECT_BYTEJUMP_LITTLE: 0); DETECT_BYTEJUMP_LITTLE: 0);
} }
if (DetectBytejumpDoMatch( if (!DetectBytejumpDoMatch(
det_ctx, s, smd->ctx, buffer, buffer_len, bjflags, nbytes, offset) != 1) { det_ctx, s, smd->ctx, buffer, buffer_len, bjflags, nbytes, offset)) {
goto no_match; goto no_match;
} }

Loading…
Cancel
Save