aiden
/
suricata
mirror of https://github.com/OISF/suricata
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

Change the struct members uricontent and uricontent_len in DetectUricontentData to content and content_len. Make replacements everywhere else in the codebase to accomodate these changes

Browse Source
remotes/origin/master-1.1.x
Anoop Saldanha 15 years ago committed by Victor Julien
parent ede7be34b5
commit 4a038511ff
11 changed files with 73 additions and 73 deletions
Show Stats Download Patch File Download Diff File

4
src/detect-depth.c
Unescape Escape View File

@ -122,8 +122,8 @@ static int DetectDepthSetup (DetectEngineCtx *de_ctx, Signature *s, char *depths
}
ud->depth = (uint32_t)atoi(str);
if (ud->depth < ud->uricontent_len) {
ud->depth = ud->uricontent_len;
if (ud->depth < ud->content_len) {
ud->depth = ud->content_len;
SCLogDebug("depth increased to %"PRIu32" to match pattern len ",
ud->depth);
}

4
src/detect-distance.c
Unescape Escape View File

@ -204,8 +204,8 @@ static int DetectDistanceSetup (DetectEngineCtx *de_ctx, Signature *s,
ud->distance = strtol(str, NULL, 10);
if (ud->flags & DETECT_URICONTENT_WITHIN) {
if ((ud->distance + ud->uricontent_len) > ud->within) {
ud->within = ud->distance + ud->uricontent_len;
if ((ud->distance + ud->content_len) > ud->within) {
ud->within = ud->distance + ud->content_len;
}
}

44
src/detect-engine-mpm.c
Unescape Escape View File

@ -435,8 +435,8 @@ uint32_t UricontentHashFunc(HashTable *ht, void *data, uint16_t datalen) {
DetectUricontentData *ud = ch->ptr;
uint32_t hash = 0;
int i;
for (i = 0; i < ud->uricontent_len; i++) {
hash += ud->uricontent[i];
for (i = 0; i < ud->content_len; i++) {
hash += ud->content[i];
}
hash = hash % ht->array_size;
SCLogDebug("hash %" PRIu32 "", hash);
@ -463,9 +463,9 @@ char UricontentHashCompareFunc(void *data1, uint16_t len1, void *data2, uint16_t
DetectUricontentData *ud1 = ch1->ptr;
DetectUricontentData *ud2 = ch2->ptr;
if (ud1->uricontent_len == ud2->uricontent_len &&
if (ud1->content_len == ud2->content_len &&
((ud1->flags & DETECT_URICONTENT_NOCASE) == (ud2->flags & DETECT_URICONTENT_NOCASE)) &&
SCMemcmp(ud1->uricontent, ud2->uricontent, ud1->uricontent_len) == 0)
SCMemcmp(ud1->content, ud2->content, ud1->content_len) == 0)
return 1;
return 0;
@ -1140,7 +1140,7 @@ static int PatternMatchPreprarePopulateMpmUri(DetectEngineCtx *de_ctx, SigGroupH
if (ud == NULL)
continue;
if (ud->uricontent_len < sgh->mpm_uricontent_maxlen) {
if (ud->content_len < sgh->mpm_uricontent_maxlen) {
continue;
}
@ -1198,7 +1198,7 @@ static int PatternMatchPreprarePopulateMpmUri(DetectEngineCtx *de_ctx, SigGroupH
} else
#endif
if (ud->uricontent_len < sgh->mpm_uricontent_maxlen) {
if (ud->content_len < sgh->mpm_uricontent_maxlen) {
continue;
}
@ -1217,15 +1217,15 @@ static int PatternMatchPreprarePopulateMpmUri(DetectEngineCtx *de_ctx, SigGroupH
SCLogDebug("mpm_ch == NULL, so selecting lookup_ch->ptr->id %"PRIu32"", lookup_ch->ptr->id);
mpm_ch = lookup_ch;
} else {
uint32_t ls = PatternStrength(lookup_ch->ptr->uricontent,lookup_ch->ptr->uricontent_len);
uint32_t ss = PatternStrength(mpm_ch->ptr->uricontent,mpm_ch->ptr->uricontent_len);
uint32_t ls = PatternStrength(lookup_ch->ptr->content,lookup_ch->ptr->content_len);
uint32_t ss = PatternStrength(mpm_ch->ptr->content,mpm_ch->ptr->content_len);
if (ls > ss) {
SCLogDebug("lookup_ch->ptr->id %"PRIu32" selected over %"PRIu32"", lookup_ch->ptr->id, mpm_ch->ptr->id);
mpm_ch = lookup_ch;
}
else if (ls == ss) {
/* if 2 patterns are of equal strength, we pick the longest */
if (lookup_ch->ptr->uricontent_len > mpm_ch->ptr->uricontent_len) {
if (lookup_ch->ptr->content_len > mpm_ch->ptr->content_len) {
SCLogDebug("lookup_ch->ptr->id %"PRIu32" selected over %"PRIu32" as the first is longer",
lookup_ch->ptr->id, mpm_ch->ptr->id);
mpm_ch = lookup_ch;
@ -1264,10 +1264,10 @@ static int PatternMatchPreprarePopulateMpmUri(DetectEngineCtx *de_ctx, SigGroupH
/* add the content to the "packet" mpm */
if (ud->flags & DETECT_URICONTENT_NOCASE) {
mpm_table[sgh->mpm_uri_ctx->mpm_type].AddPatternNocase(sgh->mpm_uri_ctx,
ud->uricontent, ud->uricontent_len, 0, 0, ud->id, s->num, flags);
ud->content, ud->content_len, 0, 0, ud->id, s->num, flags);
} else {
mpm_table[sgh->mpm_uri_ctx->mpm_type].AddPattern(sgh->mpm_uri_ctx,
ud->uricontent, ud->uricontent_len, 0, 0, ud->id,
ud->content, ud->content_len, 0, 0, ud->id,
s->num, flags);
}
@ -1500,13 +1500,13 @@ int PatternMatchPrepareGroup(DetectEngineCtx *de_ctx, SigGroupHead *sh)
if (ud == NULL)
continue;
if (ud->uricontent_len > uricontent_maxlen)
uricontent_maxlen = ud->uricontent_len;
if (ud->content_len > uricontent_maxlen)
uricontent_maxlen = ud->content_len;
if (uricontent_minlen == 0)
uricontent_minlen = ud->uricontent_len;
else if (ud->uricontent_len < uricontent_minlen)
uricontent_minlen = ud->uricontent_len;
uricontent_minlen = ud->content_len;
else if (ud->content_len < uricontent_minlen)
uricontent_minlen = ud->content_len;
if (!uricontent_added) {
uricontent_added = 1;
@ -1734,10 +1734,10 @@ uint32_t DetectUricontentGetId(MpmPatternIdStore *ht, DetectUricontentData *co)
e = malloc(sizeof(MpmPatternIdTableElmt));
BUG_ON(e == NULL);
e->pattern = SCMalloc(co->uricontent_len);
e->pattern = SCMalloc(co->content_len);
BUG_ON(e->pattern == NULL);
memcpy(e->pattern, co->uricontent, co->uricontent_len);
e->pattern_len = co->uricontent_len;
memcpy(e->pattern, co->content, co->content_len);
e->pattern_len = co->content_len;
e->sm_type = DETECT_URICONTENT;
e->dup_count = 1;
e->id = 0;
@ -1801,13 +1801,13 @@ uint32_t DetectPatternGetId(MpmPatternIdStore *ht, void *ctx, uint8_t sm_type)
* we wouldn't have needed this if/else here */
if (sm_type == DETECT_URICONTENT) {
DetectUricontentData *ud = ctx;
e->pattern = SCMalloc(ud->uricontent_len);
e->pattern = SCMalloc(ud->content_len);
if (e->pattern == NULL) {
SCLogError(SC_ERR_MEM_ALLOC, "Error allocating memory");
exit(EXIT_FAILURE);
}
memcpy(e->pattern, ud->uricontent, ud->uricontent_len);
e->pattern_len = ud->uricontent_len;
memcpy(e->pattern, ud->content, ud->content_len);
e->pattern_len = ud->content_len;
/* CONTENT, HTTP_(CLIENT_BODY|METHOD|URI|COOKIE|HEADER) */
} else {

10
src/detect-engine-uri.c
Unescape Escape View File

@ -189,15 +189,15 @@ static int DoInspectPacketUri(DetectEngineCtx *de_ctx,
SCLogDebug("spayload_len %"PRIu32, spayload_len);
BUG_ON(spayload_len > payload_len);
//PrintawDataFp(stdout,ud->uricontent,ud->uricontent_len);
//PrintawDataFp(stdout,ud->content,ud->content_len);
/* If we got no matches from the mpm, avoid searching (just check if negated) */
if (det_ctx->de_have_httpuri == TRUE) {
/* do the actual search with boyer moore precooked ctx */
if (ud->flags & DETECT_URICONTENT_NOCASE)
found = BoyerMooreNocase(ud->uricontent, ud->uricontent_len, spayload, spayload_len, ud->bm_ctx->bmGs, ud->bm_ctx->bmBc);
found = BoyerMooreNocase(ud->content, ud->content_len, spayload, spayload_len, ud->bm_ctx->bmGs, ud->bm_ctx->bmBc);
else
found = BoyerMoore(ud->uricontent, ud->uricontent_len, spayload, spayload_len, ud->bm_ctx->bmGs, ud->bm_ctx->bmBc);
found = BoyerMoore(ud->content, ud->content_len, spayload, spayload_len, ud->bm_ctx->bmGs, ud->bm_ctx->bmBc);
} else {
found = NULL;
}
@ -215,7 +215,7 @@ static int DoInspectPacketUri(DetectEngineCtx *de_ctx,
det_ctx->discontinue_matching = 1;
SCReturnInt(0);
} else {
match_offset = (uint32_t)((found - payload) + ud->uricontent_len);
match_offset = (uint32_t)((found - payload) + ud->content_len);
SCLogDebug("uricontent %"PRIu32" matched at offset %"PRIu32"", ud->id, match_offset);
det_ctx->payload_offset = match_offset;
@ -239,7 +239,7 @@ static int DoInspectPacketUri(DetectEngineCtx *de_ctx,
SCReturnInt(0);
/* set the previous match offset to the start of this match + 1 */
prev_offset = (match_offset - (ud->uricontent_len - 1));
prev_offset = (match_offset - (ud->content_len - 1));
SCLogDebug("trying to see if there is another match after prev_offset %"PRIu32, prev_offset);
}

16
src/detect-http-uri.c
Unescape Escape View File

@ -134,17 +134,17 @@ static int DetectHttpUriSetup (DetectEngineCtx *de_ctx, Signature *s, char *str)
goto error;
memset(duc, 0, sizeof(DetectUricontentData));
duc->uricontent_len = ((DetectContentData *)pm->ctx)->content_len;
if ((duc->uricontent = SCMalloc(duc->uricontent_len)) == NULL)
duc->content_len = ((DetectContentData *)pm->ctx)->content_len;
if ((duc->content = SCMalloc(duc->content_len)) == NULL)
goto error;
memcpy(duc->uricontent, ((DetectContentData *)pm->ctx)->content, duc->uricontent_len);
memcpy(duc->content, ((DetectContentData *)pm->ctx)->content, duc->content_len);
duc->flags |= (((DetectContentData *)pm->ctx)->flags & DETECT_CONTENT_NOCASE) ?
DETECT_URICONTENT_NOCASE : 0;
duc->flags |= (((DetectContentData *)pm->ctx)->flags & DETECT_CONTENT_NEGATED) ?
DETECT_URICONTENT_NEGATED : 0;
duc->id = DetectPatternGetId(de_ctx->mpm_pattern_id_store, duc, DETECT_URICONTENT);
duc->bm_ctx = BoyerMooreCtxInit(duc->uricontent, duc->uricontent_len);
duc->bm_ctx = BoyerMooreCtxInit(duc->content, duc->content_len);
nm->type = DETECT_URICONTENT;
nm->ctx = (void *)duc;
@ -171,8 +171,8 @@ static int DetectHttpUriSetup (DetectEngineCtx *de_ctx, Signature *s, char *str)
return 0;
error:
if (duc != NULL) {
if (duc->uricontent != NULL)
SCFree(duc->uricontent);
if (duc->content != NULL)
SCFree(duc->content);
SCFree(duc);
}
if(sm !=NULL) SCFree(sm);
@ -335,8 +335,8 @@ int DetectHttpUriTest05(void)
}
char *str = "we are testing http_uri keyword";
int uricomp = memcmp((const char *)((DetectUricontentData*) s->sm_lists[DETECT_SM_LIST_UMATCH]->ctx)->uricontent, str, strlen(str)-1);
int urilen = ((DetectUricontentData*) s->sm_lists_tail[DETECT_SM_LIST_UMATCH]->ctx)->uricontent_len;
int uricomp = memcmp((const char *)((DetectUricontentData*) s->sm_lists[DETECT_SM_LIST_UMATCH]->ctx)->content, str, strlen(str)-1);
int urilen = ((DetectUricontentData*) s->sm_lists_tail[DETECT_SM_LIST_UMATCH]->ctx)->content_len;
if (uricomp != 0 ||
urilen != strlen("we are testing http_uri keyword")) {
printf("sig failed to parse, content not setup properly\n");

2
src/detect-nocase.c
Unescape Escape View File

@ -203,7 +203,7 @@ static int DetectNocaseSetup (DetectEngineCtx *de_ctx, Signature *s, char *nulls
}
ud->flags |= DETECT_URICONTENT_NOCASE;
/* Recreate the context with nocase chars */
BoyerMooreCtxToNocase(ud->bm_ctx, ud->uricontent, ud->uricontent_len);
BoyerMooreCtxToNocase(ud->bm_ctx, ud->content, ud->content_len);
break;
case DETECT_CONTENT:

6
src/detect-offset.c
Unescape Escape View File

@ -122,10 +122,10 @@ int DetectOffsetSetup (DetectEngineCtx *de_ctx, Signature *s, char *offsetstr)
ud->offset = (uint32_t)atoi(str);
if (ud->depth != 0) {
if (ud->depth < ud->uricontent_len) {
if (ud->depth < ud->content_len) {
SCLogDebug("depth increased to %"PRIu32" to match pattern len",
ud->uricontent_len);
ud->depth = ud->uricontent_len;
ud->content_len);
ud->depth = ud->content_len;
}
/* Updating the depth as is relative to the offset */
ud->depth += ud->offset;

18
src/detect-parse.c
Unescape Escape View File

@ -1331,9 +1331,9 @@ Signature *SigInit(DetectEngineCtx *de_ctx, char *sigstr) {
continue;
if (sig->mpm_uricontent_maxlen == 0)
sig->mpm_uricontent_maxlen = ud->uricontent_len;
if (sig->mpm_uricontent_maxlen < ud->uricontent_len)
sig->mpm_uricontent_maxlen = ud->uricontent_len;
sig->mpm_uricontent_maxlen = ud->content_len;
if (sig->mpm_uricontent_maxlen < ud->content_len)
sig->mpm_uricontent_maxlen = ud->content_len;
}
}
}
@ -1472,9 +1472,9 @@ Signature *SigInitReal(DetectEngineCtx *de_ctx, char *sigstr) {
if (ud == NULL)
continue;
if (sig->mpm_uricontent_maxlen == 0)
sig->mpm_uricontent_maxlen = ud->uricontent_len;
if (sig->mpm_uricontent_maxlen < ud->uricontent_len)
sig->mpm_uricontent_maxlen = ud->uricontent_len;
sig->mpm_uricontent_maxlen = ud->content_len;
if (sig->mpm_uricontent_maxlen < ud->content_len)
sig->mpm_uricontent_maxlen = ud->content_len;
}
}
}
@ -1522,9 +1522,9 @@ Signature *SigInitReal(DetectEngineCtx *de_ctx, char *sigstr) {
continue;
if (sig->next->mpm_uricontent_maxlen == 0)
sig->next->mpm_uricontent_maxlen = ud->uricontent_len;
if (sig->next->mpm_uricontent_maxlen < ud->uricontent_len)
sig->next->mpm_uricontent_maxlen = ud->uricontent_len;
sig->next->mpm_uricontent_maxlen = ud->content_len;
if (sig->next->mpm_uricontent_maxlen < ud->content_len)
sig->next->mpm_uricontent_maxlen = ud->content_len;
}
}
}

30
src/detect-uricontent.c
Unescape Escape View File

@ -101,8 +101,8 @@ void DetectUricontentFree(void *ptr) {
if (cd == NULL)
SCReturn;
if (cd->uricontent != NULL)
SCFree(cd->uricontent);
if (cd->content != NULL)
SCFree(cd->content);
BoyerMooreCtxDeInit(cd->bm_ctx);
@ -120,14 +120,14 @@ void DetectUricontentPrint(DetectUricontentData *cd)
SCLogDebug("Detect UricontentData \"cd\" is NULL");
return;
}
char *tmpstr = SCMalloc(sizeof(char) * cd->uricontent_len + 1);
char *tmpstr = SCMalloc(sizeof(char) * cd->content_len + 1);
if (tmpstr == NULL)
return;
if (tmpstr != NULL) {
for (i = 0; i < cd->uricontent_len; i++) {
if (isprint(cd->uricontent[i]))
tmpstr[i] = cd->uricontent[i];
for (i = 0; i < cd->content_len; i++) {
if (isprint(cd->content[i]))
tmpstr[i] = cd->content[i];
else
tmpstr[i] = '.';
}
@ -136,12 +136,12 @@ void DetectUricontentPrint(DetectUricontentData *cd)
SCFree(tmpstr);
} else {
SCLogDebug("Uricontent: ");
for (i = 0; i < cd->uricontent_len; i++)
SCLogDebug("%c", cd->uricontent[i]);
for (i = 0; i < cd->content_len; i++)
SCLogDebug("%c", cd->content[i]);
}
SCLogDebug("Uricontent_id: %"PRIu32, cd->id);
SCLogDebug("Uricontent_len: %"PRIu16, cd->uricontent_len);
SCLogDebug("Uricontent_len: %"PRIu16, cd->content_len);
SCLogDebug("Depth: %"PRIu16, cd->depth);
SCLogDebug("Offset: %"PRIu16, cd->offset);
SCLogDebug("Within: %"PRIi32, cd->within);
@ -324,22 +324,22 @@ DetectUricontentData *DoDetectUricontentSetup (char * contentstr)
SCLogDebug("len %" PRIu32 "", len);
cd->uricontent = SCMalloc(len);
if (cd->uricontent == NULL) {
cd->content = SCMalloc(len);
if (cd->content == NULL) {
SCFree(cd);
SCFree(str);
return NULL;;
}
memcpy(cd->uricontent, str, len);
cd->uricontent_len = len;
memcpy(cd->content, str, len);
cd->content_len = len;
cd->depth = 0;
cd->offset = 0;
cd->within = 0;
cd->distance = 0;
/* Prepare Boyer Moore context for searching faster */
cd->bm_ctx = BoyerMooreCtxInit(cd->uricontent, cd->uricontent_len);
cd->bm_ctx = BoyerMooreCtxInit(cd->content, cd->content_len);
SCFree(str);
return cd;
@ -1782,7 +1782,7 @@ int DetectUriSigTest12(void)
}
ud = (DetectUricontentData *)s->sm_lists_tail[DETECT_SM_LIST_UMATCH]->ctx;
result = (strncmp("boo", (char *)ud->uricontent, ud->uricontent_len) == 0);
result = (strncmp("boo", (char *)ud->content, ud->content_len) == 0);
end:
SigGroupCleanup(de_ctx);

4
src/detect-uricontent.h
Unescape Escape View File

@ -52,8 +52,8 @@
#include "app-layer-htp.h"
typedef struct DetectUricontentData_ {
uint8_t *uricontent;
uint8_t uricontent_len;
uint8_t *content;
uint8_t content_len;
PatIntId id;
uint32_t flags;
uint16_t depth;

8
src/detect-within.c
Unescape Escape View File

@ -208,19 +208,19 @@ static int DetectWithinSetup (DetectEngineCtx *de_ctx, Signature *s, char *withi
}
ud->within = strtol(str, NULL, 10);
if (ud->within < (int32_t)ud->uricontent_len) {
if (ud->within < (int32_t)ud->content_len) {
SCLogError(SC_ERR_WITHIN_INVALID, "within argument \"%"PRIi32"\" is "
"less than the content length \"%"PRIu32"\" which is invalid, since "
"this will never match. Invalidating signature", ud->within,
ud->uricontent_len);
ud->content_len);
goto error;
}
ud->flags |= DETECT_URICONTENT_WITHIN;
if (ud->flags & DETECT_URICONTENT_DISTANCE) {
if ((ud->distance + ud->uricontent_len) > ud->within) {
ud->within = ud->distance + ud->uricontent_len;
if ((ud->distance + ud->content_len) > ud->within) {
ud->within = ud->distance + ud->content_len;
}
}

Write Preview
Loading…
Cancel
Save