diff --git a/src/detect-depth.c b/src/detect-depth.c index baf8ab1c76..0fa6a1116c 100644 --- a/src/detect-depth.c +++ b/src/detect-depth.c @@ -122,8 +122,8 @@ static int DetectDepthSetup (DetectEngineCtx *de_ctx, Signature *s, char *depths } ud->depth = (uint32_t)atoi(str); - if (ud->depth < ud->uricontent_len) { - ud->depth = ud->uricontent_len; + if (ud->depth < ud->content_len) { + ud->depth = ud->content_len; SCLogDebug("depth increased to %"PRIu32" to match pattern len ", ud->depth); } diff --git a/src/detect-distance.c b/src/detect-distance.c index 795181dcca..470f8eb0b2 100644 --- a/src/detect-distance.c +++ b/src/detect-distance.c @@ -204,8 +204,8 @@ static int DetectDistanceSetup (DetectEngineCtx *de_ctx, Signature *s, ud->distance = strtol(str, NULL, 10); if (ud->flags & DETECT_URICONTENT_WITHIN) { - if ((ud->distance + ud->uricontent_len) > ud->within) { - ud->within = ud->distance + ud->uricontent_len; + if ((ud->distance + ud->content_len) > ud->within) { + ud->within = ud->distance + ud->content_len; } } diff --git a/src/detect-engine-mpm.c b/src/detect-engine-mpm.c index 3646606b44..bc6a17efcf 100644 --- a/src/detect-engine-mpm.c +++ b/src/detect-engine-mpm.c @@ -435,8 +435,8 @@ uint32_t UricontentHashFunc(HashTable *ht, void *data, uint16_t datalen) { DetectUricontentData *ud = ch->ptr; uint32_t hash = 0; int i; - for (i = 0; i < ud->uricontent_len; i++) { - hash += ud->uricontent[i]; + for (i = 0; i < ud->content_len; i++) { + hash += ud->content[i]; } hash = hash % ht->array_size; SCLogDebug("hash %" PRIu32 "", hash); @@ -463,9 +463,9 @@ char UricontentHashCompareFunc(void *data1, uint16_t len1, void *data2, uint16_t DetectUricontentData *ud1 = ch1->ptr; DetectUricontentData *ud2 = ch2->ptr; - if (ud1->uricontent_len == ud2->uricontent_len && + if (ud1->content_len == ud2->content_len && ((ud1->flags & DETECT_URICONTENT_NOCASE) == (ud2->flags & DETECT_URICONTENT_NOCASE)) && - SCMemcmp(ud1->uricontent, ud2->uricontent, ud1->uricontent_len) == 0) + SCMemcmp(ud1->content, ud2->content, ud1->content_len) == 0) return 1; return 0; @@ -1140,7 +1140,7 @@ static int PatternMatchPreprarePopulateMpmUri(DetectEngineCtx *de_ctx, SigGroupH if (ud == NULL) continue; - if (ud->uricontent_len < sgh->mpm_uricontent_maxlen) { + if (ud->content_len < sgh->mpm_uricontent_maxlen) { continue; } @@ -1198,7 +1198,7 @@ static int PatternMatchPreprarePopulateMpmUri(DetectEngineCtx *de_ctx, SigGroupH } else #endif - if (ud->uricontent_len < sgh->mpm_uricontent_maxlen) { + if (ud->content_len < sgh->mpm_uricontent_maxlen) { continue; } @@ -1217,15 +1217,15 @@ static int PatternMatchPreprarePopulateMpmUri(DetectEngineCtx *de_ctx, SigGroupH SCLogDebug("mpm_ch == NULL, so selecting lookup_ch->ptr->id %"PRIu32"", lookup_ch->ptr->id); mpm_ch = lookup_ch; } else { - uint32_t ls = PatternStrength(lookup_ch->ptr->uricontent,lookup_ch->ptr->uricontent_len); - uint32_t ss = PatternStrength(mpm_ch->ptr->uricontent,mpm_ch->ptr->uricontent_len); + uint32_t ls = PatternStrength(lookup_ch->ptr->content,lookup_ch->ptr->content_len); + uint32_t ss = PatternStrength(mpm_ch->ptr->content,mpm_ch->ptr->content_len); if (ls > ss) { SCLogDebug("lookup_ch->ptr->id %"PRIu32" selected over %"PRIu32"", lookup_ch->ptr->id, mpm_ch->ptr->id); mpm_ch = lookup_ch; } else if (ls == ss) { /* if 2 patterns are of equal strength, we pick the longest */ - if (lookup_ch->ptr->uricontent_len > mpm_ch->ptr->uricontent_len) { + if (lookup_ch->ptr->content_len > mpm_ch->ptr->content_len) { SCLogDebug("lookup_ch->ptr->id %"PRIu32" selected over %"PRIu32" as the first is longer", lookup_ch->ptr->id, mpm_ch->ptr->id); mpm_ch = lookup_ch; @@ -1264,10 +1264,10 @@ static int PatternMatchPreprarePopulateMpmUri(DetectEngineCtx *de_ctx, SigGroupH /* add the content to the "packet" mpm */ if (ud->flags & DETECT_URICONTENT_NOCASE) { mpm_table[sgh->mpm_uri_ctx->mpm_type].AddPatternNocase(sgh->mpm_uri_ctx, - ud->uricontent, ud->uricontent_len, 0, 0, ud->id, s->num, flags); + ud->content, ud->content_len, 0, 0, ud->id, s->num, flags); } else { mpm_table[sgh->mpm_uri_ctx->mpm_type].AddPattern(sgh->mpm_uri_ctx, - ud->uricontent, ud->uricontent_len, 0, 0, ud->id, + ud->content, ud->content_len, 0, 0, ud->id, s->num, flags); } @@ -1500,13 +1500,13 @@ int PatternMatchPrepareGroup(DetectEngineCtx *de_ctx, SigGroupHead *sh) if (ud == NULL) continue; - if (ud->uricontent_len > uricontent_maxlen) - uricontent_maxlen = ud->uricontent_len; + if (ud->content_len > uricontent_maxlen) + uricontent_maxlen = ud->content_len; if (uricontent_minlen == 0) - uricontent_minlen = ud->uricontent_len; - else if (ud->uricontent_len < uricontent_minlen) - uricontent_minlen = ud->uricontent_len; + uricontent_minlen = ud->content_len; + else if (ud->content_len < uricontent_minlen) + uricontent_minlen = ud->content_len; if (!uricontent_added) { uricontent_added = 1; @@ -1734,10 +1734,10 @@ uint32_t DetectUricontentGetId(MpmPatternIdStore *ht, DetectUricontentData *co) e = malloc(sizeof(MpmPatternIdTableElmt)); BUG_ON(e == NULL); - e->pattern = SCMalloc(co->uricontent_len); + e->pattern = SCMalloc(co->content_len); BUG_ON(e->pattern == NULL); - memcpy(e->pattern, co->uricontent, co->uricontent_len); - e->pattern_len = co->uricontent_len; + memcpy(e->pattern, co->content, co->content_len); + e->pattern_len = co->content_len; e->sm_type = DETECT_URICONTENT; e->dup_count = 1; e->id = 0; @@ -1801,13 +1801,13 @@ uint32_t DetectPatternGetId(MpmPatternIdStore *ht, void *ctx, uint8_t sm_type) * we wouldn't have needed this if/else here */ if (sm_type == DETECT_URICONTENT) { DetectUricontentData *ud = ctx; - e->pattern = SCMalloc(ud->uricontent_len); + e->pattern = SCMalloc(ud->content_len); if (e->pattern == NULL) { SCLogError(SC_ERR_MEM_ALLOC, "Error allocating memory"); exit(EXIT_FAILURE); } - memcpy(e->pattern, ud->uricontent, ud->uricontent_len); - e->pattern_len = ud->uricontent_len; + memcpy(e->pattern, ud->content, ud->content_len); + e->pattern_len = ud->content_len; /* CONTENT, HTTP_(CLIENT_BODY|METHOD|URI|COOKIE|HEADER) */ } else { diff --git a/src/detect-engine-uri.c b/src/detect-engine-uri.c index 91f1eb4487..124065b7f0 100644 --- a/src/detect-engine-uri.c +++ b/src/detect-engine-uri.c @@ -189,15 +189,15 @@ static int DoInspectPacketUri(DetectEngineCtx *de_ctx, SCLogDebug("spayload_len %"PRIu32, spayload_len); BUG_ON(spayload_len > payload_len); - //PrintawDataFp(stdout,ud->uricontent,ud->uricontent_len); + //PrintawDataFp(stdout,ud->content,ud->content_len); /* If we got no matches from the mpm, avoid searching (just check if negated) */ if (det_ctx->de_have_httpuri == TRUE) { /* do the actual search with boyer moore precooked ctx */ if (ud->flags & DETECT_URICONTENT_NOCASE) - found = BoyerMooreNocase(ud->uricontent, ud->uricontent_len, spayload, spayload_len, ud->bm_ctx->bmGs, ud->bm_ctx->bmBc); + found = BoyerMooreNocase(ud->content, ud->content_len, spayload, spayload_len, ud->bm_ctx->bmGs, ud->bm_ctx->bmBc); else - found = BoyerMoore(ud->uricontent, ud->uricontent_len, spayload, spayload_len, ud->bm_ctx->bmGs, ud->bm_ctx->bmBc); + found = BoyerMoore(ud->content, ud->content_len, spayload, spayload_len, ud->bm_ctx->bmGs, ud->bm_ctx->bmBc); } else { found = NULL; } @@ -215,7 +215,7 @@ static int DoInspectPacketUri(DetectEngineCtx *de_ctx, det_ctx->discontinue_matching = 1; SCReturnInt(0); } else { - match_offset = (uint32_t)((found - payload) + ud->uricontent_len); + match_offset = (uint32_t)((found - payload) + ud->content_len); SCLogDebug("uricontent %"PRIu32" matched at offset %"PRIu32"", ud->id, match_offset); det_ctx->payload_offset = match_offset; @@ -239,7 +239,7 @@ static int DoInspectPacketUri(DetectEngineCtx *de_ctx, SCReturnInt(0); /* set the previous match offset to the start of this match + 1 */ - prev_offset = (match_offset - (ud->uricontent_len - 1)); + prev_offset = (match_offset - (ud->content_len - 1)); SCLogDebug("trying to see if there is another match after prev_offset %"PRIu32, prev_offset); } diff --git a/src/detect-http-uri.c b/src/detect-http-uri.c index cd10fbdef5..e0d5354f6b 100644 --- a/src/detect-http-uri.c +++ b/src/detect-http-uri.c @@ -134,17 +134,17 @@ static int DetectHttpUriSetup (DetectEngineCtx *de_ctx, Signature *s, char *str) goto error; memset(duc, 0, sizeof(DetectUricontentData)); - duc->uricontent_len = ((DetectContentData *)pm->ctx)->content_len; - if ((duc->uricontent = SCMalloc(duc->uricontent_len)) == NULL) + duc->content_len = ((DetectContentData *)pm->ctx)->content_len; + if ((duc->content = SCMalloc(duc->content_len)) == NULL) goto error; - memcpy(duc->uricontent, ((DetectContentData *)pm->ctx)->content, duc->uricontent_len); + memcpy(duc->content, ((DetectContentData *)pm->ctx)->content, duc->content_len); duc->flags |= (((DetectContentData *)pm->ctx)->flags & DETECT_CONTENT_NOCASE) ? DETECT_URICONTENT_NOCASE : 0; duc->flags |= (((DetectContentData *)pm->ctx)->flags & DETECT_CONTENT_NEGATED) ? DETECT_URICONTENT_NEGATED : 0; duc->id = DetectPatternGetId(de_ctx->mpm_pattern_id_store, duc, DETECT_URICONTENT); - duc->bm_ctx = BoyerMooreCtxInit(duc->uricontent, duc->uricontent_len); + duc->bm_ctx = BoyerMooreCtxInit(duc->content, duc->content_len); nm->type = DETECT_URICONTENT; nm->ctx = (void *)duc; @@ -171,8 +171,8 @@ static int DetectHttpUriSetup (DetectEngineCtx *de_ctx, Signature *s, char *str) return 0; error: if (duc != NULL) { - if (duc->uricontent != NULL) - SCFree(duc->uricontent); + if (duc->content != NULL) + SCFree(duc->content); SCFree(duc); } if(sm !=NULL) SCFree(sm); @@ -335,8 +335,8 @@ int DetectHttpUriTest05(void) } char *str = "we are testing http_uri keyword"; - int uricomp = memcmp((const char *)((DetectUricontentData*) s->sm_lists[DETECT_SM_LIST_UMATCH]->ctx)->uricontent, str, strlen(str)-1); - int urilen = ((DetectUricontentData*) s->sm_lists_tail[DETECT_SM_LIST_UMATCH]->ctx)->uricontent_len; + int uricomp = memcmp((const char *)((DetectUricontentData*) s->sm_lists[DETECT_SM_LIST_UMATCH]->ctx)->content, str, strlen(str)-1); + int urilen = ((DetectUricontentData*) s->sm_lists_tail[DETECT_SM_LIST_UMATCH]->ctx)->content_len; if (uricomp != 0 || urilen != strlen("we are testing http_uri keyword")) { printf("sig failed to parse, content not setup properly\n"); diff --git a/src/detect-nocase.c b/src/detect-nocase.c index 3e5bdd533f..11fd47bd32 100644 --- a/src/detect-nocase.c +++ b/src/detect-nocase.c @@ -203,7 +203,7 @@ static int DetectNocaseSetup (DetectEngineCtx *de_ctx, Signature *s, char *nulls } ud->flags |= DETECT_URICONTENT_NOCASE; /* Recreate the context with nocase chars */ - BoyerMooreCtxToNocase(ud->bm_ctx, ud->uricontent, ud->uricontent_len); + BoyerMooreCtxToNocase(ud->bm_ctx, ud->content, ud->content_len); break; case DETECT_CONTENT: diff --git a/src/detect-offset.c b/src/detect-offset.c index 82a45410aa..2345d64111 100644 --- a/src/detect-offset.c +++ b/src/detect-offset.c @@ -122,10 +122,10 @@ int DetectOffsetSetup (DetectEngineCtx *de_ctx, Signature *s, char *offsetstr) ud->offset = (uint32_t)atoi(str); if (ud->depth != 0) { - if (ud->depth < ud->uricontent_len) { + if (ud->depth < ud->content_len) { SCLogDebug("depth increased to %"PRIu32" to match pattern len", - ud->uricontent_len); - ud->depth = ud->uricontent_len; + ud->content_len); + ud->depth = ud->content_len; } /* Updating the depth as is relative to the offset */ ud->depth += ud->offset; diff --git a/src/detect-parse.c b/src/detect-parse.c index af7658949c..c336f317d2 100644 --- a/src/detect-parse.c +++ b/src/detect-parse.c @@ -1331,9 +1331,9 @@ Signature *SigInit(DetectEngineCtx *de_ctx, char *sigstr) { continue; if (sig->mpm_uricontent_maxlen == 0) - sig->mpm_uricontent_maxlen = ud->uricontent_len; - if (sig->mpm_uricontent_maxlen < ud->uricontent_len) - sig->mpm_uricontent_maxlen = ud->uricontent_len; + sig->mpm_uricontent_maxlen = ud->content_len; + if (sig->mpm_uricontent_maxlen < ud->content_len) + sig->mpm_uricontent_maxlen = ud->content_len; } } } @@ -1472,9 +1472,9 @@ Signature *SigInitReal(DetectEngineCtx *de_ctx, char *sigstr) { if (ud == NULL) continue; if (sig->mpm_uricontent_maxlen == 0) - sig->mpm_uricontent_maxlen = ud->uricontent_len; - if (sig->mpm_uricontent_maxlen < ud->uricontent_len) - sig->mpm_uricontent_maxlen = ud->uricontent_len; + sig->mpm_uricontent_maxlen = ud->content_len; + if (sig->mpm_uricontent_maxlen < ud->content_len) + sig->mpm_uricontent_maxlen = ud->content_len; } } } @@ -1522,9 +1522,9 @@ Signature *SigInitReal(DetectEngineCtx *de_ctx, char *sigstr) { continue; if (sig->next->mpm_uricontent_maxlen == 0) - sig->next->mpm_uricontent_maxlen = ud->uricontent_len; - if (sig->next->mpm_uricontent_maxlen < ud->uricontent_len) - sig->next->mpm_uricontent_maxlen = ud->uricontent_len; + sig->next->mpm_uricontent_maxlen = ud->content_len; + if (sig->next->mpm_uricontent_maxlen < ud->content_len) + sig->next->mpm_uricontent_maxlen = ud->content_len; } } } diff --git a/src/detect-uricontent.c b/src/detect-uricontent.c index 33ee385ff5..ce384567da 100644 --- a/src/detect-uricontent.c +++ b/src/detect-uricontent.c @@ -101,8 +101,8 @@ void DetectUricontentFree(void *ptr) { if (cd == NULL) SCReturn; - if (cd->uricontent != NULL) - SCFree(cd->uricontent); + if (cd->content != NULL) + SCFree(cd->content); BoyerMooreCtxDeInit(cd->bm_ctx); @@ -120,14 +120,14 @@ void DetectUricontentPrint(DetectUricontentData *cd) SCLogDebug("Detect UricontentData \"cd\" is NULL"); return; } - char *tmpstr = SCMalloc(sizeof(char) * cd->uricontent_len + 1); + char *tmpstr = SCMalloc(sizeof(char) * cd->content_len + 1); if (tmpstr == NULL) return; if (tmpstr != NULL) { - for (i = 0; i < cd->uricontent_len; i++) { - if (isprint(cd->uricontent[i])) - tmpstr[i] = cd->uricontent[i]; + for (i = 0; i < cd->content_len; i++) { + if (isprint(cd->content[i])) + tmpstr[i] = cd->content[i]; else tmpstr[i] = '.'; } @@ -136,12 +136,12 @@ void DetectUricontentPrint(DetectUricontentData *cd) SCFree(tmpstr); } else { SCLogDebug("Uricontent: "); - for (i = 0; i < cd->uricontent_len; i++) - SCLogDebug("%c", cd->uricontent[i]); + for (i = 0; i < cd->content_len; i++) + SCLogDebug("%c", cd->content[i]); } SCLogDebug("Uricontent_id: %"PRIu32, cd->id); - SCLogDebug("Uricontent_len: %"PRIu16, cd->uricontent_len); + SCLogDebug("Uricontent_len: %"PRIu16, cd->content_len); SCLogDebug("Depth: %"PRIu16, cd->depth); SCLogDebug("Offset: %"PRIu16, cd->offset); SCLogDebug("Within: %"PRIi32, cd->within); @@ -324,22 +324,22 @@ DetectUricontentData *DoDetectUricontentSetup (char * contentstr) SCLogDebug("len %" PRIu32 "", len); - cd->uricontent = SCMalloc(len); - if (cd->uricontent == NULL) { + cd->content = SCMalloc(len); + if (cd->content == NULL) { SCFree(cd); SCFree(str); return NULL;; } - memcpy(cd->uricontent, str, len); - cd->uricontent_len = len; + memcpy(cd->content, str, len); + cd->content_len = len; cd->depth = 0; cd->offset = 0; cd->within = 0; cd->distance = 0; /* Prepare Boyer Moore context for searching faster */ - cd->bm_ctx = BoyerMooreCtxInit(cd->uricontent, cd->uricontent_len); + cd->bm_ctx = BoyerMooreCtxInit(cd->content, cd->content_len); SCFree(str); return cd; @@ -1782,7 +1782,7 @@ int DetectUriSigTest12(void) } ud = (DetectUricontentData *)s->sm_lists_tail[DETECT_SM_LIST_UMATCH]->ctx; - result = (strncmp("boo", (char *)ud->uricontent, ud->uricontent_len) == 0); + result = (strncmp("boo", (char *)ud->content, ud->content_len) == 0); end: SigGroupCleanup(de_ctx); diff --git a/src/detect-uricontent.h b/src/detect-uricontent.h index ece0559958..5eef280d2c 100644 --- a/src/detect-uricontent.h +++ b/src/detect-uricontent.h @@ -52,8 +52,8 @@ #include "app-layer-htp.h" typedef struct DetectUricontentData_ { - uint8_t *uricontent; - uint8_t uricontent_len; + uint8_t *content; + uint8_t content_len; PatIntId id; uint32_t flags; uint16_t depth; diff --git a/src/detect-within.c b/src/detect-within.c index 22a488fedb..a82e121037 100644 --- a/src/detect-within.c +++ b/src/detect-within.c @@ -208,19 +208,19 @@ static int DetectWithinSetup (DetectEngineCtx *de_ctx, Signature *s, char *withi } ud->within = strtol(str, NULL, 10); - if (ud->within < (int32_t)ud->uricontent_len) { + if (ud->within < (int32_t)ud->content_len) { SCLogError(SC_ERR_WITHIN_INVALID, "within argument \"%"PRIi32"\" is " "less than the content length \"%"PRIu32"\" which is invalid, since " "this will never match. Invalidating signature", ud->within, - ud->uricontent_len); + ud->content_len); goto error; } ud->flags |= DETECT_URICONTENT_WITHIN; if (ud->flags & DETECT_URICONTENT_DISTANCE) { - if ((ud->distance + ud->uricontent_len) > ud->within) { - ud->within = ud->distance + ud->uricontent_len; + if ((ud->distance + ud->content_len) > ud->within) { + ud->within = ud->distance + ud->content_len; } }