aiden
/
suricata
mirror of https://github.com/OISF/suricata
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

Change the struct members uricontent and uricontent_len in DetectUricontentData to content and content_len. Make replacements everywhere else in the codebase to accomodate these changes

Browse Source
remotes/origin/master-1.1.x
Anoop Saldanha 15 years ago committed by Victor Julien
parent ede7be34b5
commit 4a038511ff
11 changed files with 73 additions and 73 deletions
Show Stats Download Patch File Download Diff File

4
src/detect-depth.c
Unescape Escape View File

@ -122,8 +122,8 @@ static int DetectDepthSetup (DetectEngineCtx *de_ctx, Signature *s, char *depths
} }
ud->depth = (uint32_t)atoi(str); ud->depth = (uint32_t)atoi(str);
if (ud->depth < ud->uricontent_len) { if (ud->depth < ud->content_len) {
ud->depth = ud->uricontent_len; ud->depth = ud->content_len;
SCLogDebug("depth increased to %"PRIu32" to match pattern len ", SCLogDebug("depth increased to %"PRIu32" to match pattern len ",
ud->depth); ud->depth);
} }

4
src/detect-distance.c
Unescape Escape View File

@ -204,8 +204,8 @@ static int DetectDistanceSetup (DetectEngineCtx *de_ctx, Signature *s,
ud->distance = strtol(str, NULL, 10); ud->distance = strtol(str, NULL, 10);
if (ud->flags & DETECT_URICONTENT_WITHIN) { if (ud->flags & DETECT_URICONTENT_WITHIN) {
if ((ud->distance + ud->uricontent_len) > ud->within) { if ((ud->distance + ud->content_len) > ud->within) {
ud->within = ud->distance + ud->uricontent_len; ud->within = ud->distance + ud->content_len;
} }
} }

44
src/detect-engine-mpm.c
Unescape Escape View File

@ -435,8 +435,8 @@ uint32_t UricontentHashFunc(HashTable *ht, void *data, uint16_t datalen) {
DetectUricontentData *ud = ch->ptr; DetectUricontentData *ud = ch->ptr;
uint32_t hash = 0; uint32_t hash = 0;
int i; int i;
for (i = 0; i < ud->uricontent_len; i++) { for (i = 0; i < ud->content_len; i++) {
hash += ud->uricontent[i]; hash += ud->content[i];
} }
hash = hash % ht->array_size; hash = hash % ht->array_size;
SCLogDebug("hash %" PRIu32 "", hash); SCLogDebug("hash %" PRIu32 "", hash);
@ -463,9 +463,9 @@ char UricontentHashCompareFunc(void *data1, uint16_t len1, void *data2, uint16_t
DetectUricontentData *ud1 = ch1->ptr; DetectUricontentData *ud1 = ch1->ptr;
DetectUricontentData *ud2 = ch2->ptr; DetectUricontentData *ud2 = ch2->ptr;
if (ud1->uricontent_len == ud2->uricontent_len && if (ud1->content_len == ud2->content_len &&
((ud1->flags & DETECT_URICONTENT_NOCASE) == (ud2->flags & DETECT_URICONTENT_NOCASE)) && ((ud1->flags & DETECT_URICONTENT_NOCASE) == (ud2->flags & DETECT_URICONTENT_NOCASE)) &&
SCMemcmp(ud1->uricontent, ud2->uricontent, ud1->uricontent_len) == 0) SCMemcmp(ud1->content, ud2->content, ud1->content_len) == 0)
return 1; return 1;
return 0; return 0;
@ -1140,7 +1140,7 @@ static int PatternMatchPreprarePopulateMpmUri(DetectEngineCtx *de_ctx, SigGroupH
if (ud == NULL) if (ud == NULL)
continue; continue;
if (ud->uricontent_len < sgh->mpm_uricontent_maxlen) { if (ud->content_len < sgh->mpm_uricontent_maxlen) {
continue; continue;
} }
@ -1198,7 +1198,7 @@ static int PatternMatchPreprarePopulateMpmUri(DetectEngineCtx *de_ctx, SigGroupH
} else } else
#endif #endif
if (ud->uricontent_len < sgh->mpm_uricontent_maxlen) { if (ud->content_len < sgh->mpm_uricontent_maxlen) {
continue; continue;
} }
@ -1217,15 +1217,15 @@ static int PatternMatchPreprarePopulateMpmUri(DetectEngineCtx *de_ctx, SigGroupH
SCLogDebug("mpm_ch == NULL, so selecting lookup_ch->ptr->id %"PRIu32"", lookup_ch->ptr->id); SCLogDebug("mpm_ch == NULL, so selecting lookup_ch->ptr->id %"PRIu32"", lookup_ch->ptr->id);
mpm_ch = lookup_ch; mpm_ch = lookup_ch;
} else { } else {
uint32_t ls = PatternStrength(lookup_ch->ptr->uricontent,lookup_ch->ptr->uricontent_len); uint32_t ls = PatternStrength(lookup_ch->ptr->content,lookup_ch->ptr->content_len);
uint32_t ss = PatternStrength(mpm_ch->ptr->uricontent,mpm_ch->ptr->uricontent_len); uint32_t ss = PatternStrength(mpm_ch->ptr->content,mpm_ch->ptr->content_len);
if (ls > ss) { if (ls > ss) {
SCLogDebug("lookup_ch->ptr->id %"PRIu32" selected over %"PRIu32"", lookup_ch->ptr->id, mpm_ch->ptr->id); SCLogDebug("lookup_ch->ptr->id %"PRIu32" selected over %"PRIu32"", lookup_ch->ptr->id, mpm_ch->ptr->id);
mpm_ch = lookup_ch; mpm_ch = lookup_ch;
} }
else if (ls == ss) { else if (ls == ss) {
/* if 2 patterns are of equal strength, we pick the longest */ /* if 2 patterns are of equal strength, we pick the longest */
if (lookup_ch->ptr->uricontent_len > mpm_ch->ptr->uricontent_len) { if (lookup_ch->ptr->content_len > mpm_ch->ptr->content_len) {
SCLogDebug("lookup_ch->ptr->id %"PRIu32" selected over %"PRIu32" as the first is longer", SCLogDebug("lookup_ch->ptr->id %"PRIu32" selected over %"PRIu32" as the first is longer",
lookup_ch->ptr->id, mpm_ch->ptr->id); lookup_ch->ptr->id, mpm_ch->ptr->id);
mpm_ch = lookup_ch; mpm_ch = lookup_ch;
@ -1264,10 +1264,10 @@ static int PatternMatchPreprarePopulateMpmUri(DetectEngineCtx *de_ctx, SigGroupH
/* add the content to the "packet" mpm */ /* add the content to the "packet" mpm */
if (ud->flags & DETECT_URICONTENT_NOCASE) { if (ud->flags & DETECT_URICONTENT_NOCASE) {
mpm_table[sgh->mpm_uri_ctx->mpm_type].AddPatternNocase(sgh->mpm_uri_ctx, mpm_table[sgh->mpm_uri_ctx->mpm_type].AddPatternNocase(sgh->mpm_uri_ctx,
ud->uricontent, ud->uricontent_len, 0, 0, ud->id, s->num, flags); ud->content, ud->content_len, 0, 0, ud->id, s->num, flags);
} else { } else {
mpm_table[sgh->mpm_uri_ctx->mpm_type].AddPattern(sgh->mpm_uri_ctx, mpm_table[sgh->mpm_uri_ctx->mpm_type].AddPattern(sgh->mpm_uri_ctx,
ud->uricontent, ud->uricontent_len, 0, 0, ud->id, ud->content, ud->content_len, 0, 0, ud->id,
s->num, flags); s->num, flags);
} }
@ -1500,13 +1500,13 @@ int PatternMatchPrepareGroup(DetectEngineCtx *de_ctx, SigGroupHead *sh)
if (ud == NULL) if (ud == NULL)
continue; continue;
if (ud->uricontent_len > uricontent_maxlen) if (ud->content_len > uricontent_maxlen)
uricontent_maxlen = ud->uricontent_len; uricontent_maxlen = ud->content_len;
if (uricontent_minlen == 0) if (uricontent_minlen == 0)
uricontent_minlen = ud->uricontent_len; uricontent_minlen = ud->content_len;
else if (ud->uricontent_len < uricontent_minlen) else if (ud->content_len < uricontent_minlen)
uricontent_minlen = ud->uricontent_len; uricontent_minlen = ud->content_len;
if (!uricontent_added) { if (!uricontent_added) {
uricontent_added = 1; uricontent_added = 1;
@ -1734,10 +1734,10 @@ uint32_t DetectUricontentGetId(MpmPatternIdStore *ht, DetectUricontentData *co)
e = malloc(sizeof(MpmPatternIdTableElmt)); e = malloc(sizeof(MpmPatternIdTableElmt));
BUG_ON(e == NULL); BUG_ON(e == NULL);
e->pattern = SCMalloc(co->uricontent_len); e->pattern = SCMalloc(co->content_len);
BUG_ON(e->pattern == NULL); BUG_ON(e->pattern == NULL);
memcpy(e->pattern, co->uricontent, co->uricontent_len); memcpy(e->pattern, co->content, co->content_len);
e->pattern_len = co->uricontent_len; e->pattern_len = co->content_len;
e->sm_type = DETECT_URICONTENT; e->sm_type = DETECT_URICONTENT;
e->dup_count = 1; e->dup_count = 1;
e->id = 0; e->id = 0;
@ -1801,13 +1801,13 @@ uint32_t DetectPatternGetId(MpmPatternIdStore *ht, void *ctx, uint8_t sm_type)
* we wouldn't have needed this if/else here */ * we wouldn't have needed this if/else here */
if (sm_type == DETECT_URICONTENT) { if (sm_type == DETECT_URICONTENT) {
DetectUricontentData *ud = ctx; DetectUricontentData *ud = ctx;
e->pattern = SCMalloc(ud->uricontent_len); e->pattern = SCMalloc(ud->content_len);
if (e->pattern == NULL) { if (e->pattern == NULL) {
SCLogError(SC_ERR_MEM_ALLOC, "Error allocating memory"); SCLogError(SC_ERR_MEM_ALLOC, "Error allocating memory");
exit(EXIT_FAILURE); exit(EXIT_FAILURE);
} }
memcpy(e->pattern, ud->uricontent, ud->uricontent_len); memcpy(e->pattern, ud->content, ud->content_len);
e->pattern_len = ud->uricontent_len; e->pattern_len = ud->content_len;
/* CONTENT, HTTP_(CLIENT_BODY|METHOD|URI|COOKIE|HEADER) */ /* CONTENT, HTTP_(CLIENT_BODY|METHOD|URI|COOKIE|HEADER) */
} else { } else {

10
src/detect-engine-uri.c
Unescape Escape View File

@ -189,15 +189,15 @@ static int DoInspectPacketUri(DetectEngineCtx *de_ctx,
SCLogDebug("spayload_len %"PRIu32, spayload_len); SCLogDebug("spayload_len %"PRIu32, spayload_len);
BUG_ON(spayload_len > payload_len); BUG_ON(spayload_len > payload_len);
//PrintawDataFp(stdout,ud->uricontent,ud->uricontent_len); //PrintawDataFp(stdout,ud->content,ud->content_len);
/* If we got no matches from the mpm, avoid searching (just check if negated) */ /* If we got no matches from the mpm, avoid searching (just check if negated) */
if (det_ctx->de_have_httpuri == TRUE) { if (det_ctx->de_have_httpuri == TRUE) {
/* do the actual search with boyer moore precooked ctx */ /* do the actual search with boyer moore precooked ctx */
if (ud->flags & DETECT_URICONTENT_NOCASE) if (ud->flags & DETECT_URICONTENT_NOCASE)
found = BoyerMooreNocase(ud->uricontent, ud->uricontent_len, spayload, spayload_len, ud->bm_ctx->bmGs, ud->bm_ctx->bmBc); found = BoyerMooreNocase(ud->content, ud->content_len, spayload, spayload_len, ud->bm_ctx->bmGs, ud->bm_ctx->bmBc);
else else
found = BoyerMoore(ud->uricontent, ud->uricontent_len, spayload, spayload_len, ud->bm_ctx->bmGs, ud->bm_ctx->bmBc); found = BoyerMoore(ud->content, ud->content_len, spayload, spayload_len, ud->bm_ctx->bmGs, ud->bm_ctx->bmBc);
} else { } else {
found = NULL; found = NULL;
} }
@ -215,7 +215,7 @@ static int DoInspectPacketUri(DetectEngineCtx *de_ctx,
det_ctx->discontinue_matching = 1; det_ctx->discontinue_matching = 1;
SCReturnInt(0); SCReturnInt(0);
} else { } else {
match_offset = (uint32_t)((found - payload) + ud->uricontent_len); match_offset = (uint32_t)((found - payload) + ud->content_len);
SCLogDebug("uricontent %"PRIu32" matched at offset %"PRIu32"", ud->id, match_offset); SCLogDebug("uricontent %"PRIu32" matched at offset %"PRIu32"", ud->id, match_offset);
det_ctx->payload_offset = match_offset; det_ctx->payload_offset = match_offset;
@ -239,7 +239,7 @@ static int DoInspectPacketUri(DetectEngineCtx *de_ctx,
SCReturnInt(0); SCReturnInt(0);
/* set the previous match offset to the start of this match + 1 */ /* set the previous match offset to the start of this match + 1 */
prev_offset = (match_offset - (ud->uricontent_len - 1)); prev_offset = (match_offset - (ud->content_len - 1));
SCLogDebug("trying to see if there is another match after prev_offset %"PRIu32, prev_offset); SCLogDebug("trying to see if there is another match after prev_offset %"PRIu32, prev_offset);
} }

16
src/detect-http-uri.c
Unescape Escape View File

@ -134,17 +134,17 @@ static int DetectHttpUriSetup (DetectEngineCtx *de_ctx, Signature *s, char *str)
goto error; goto error;
memset(duc, 0, sizeof(DetectUricontentData)); memset(duc, 0, sizeof(DetectUricontentData));
duc->uricontent_len = ((DetectContentData *)pm->ctx)->content_len; duc->content_len = ((DetectContentData *)pm->ctx)->content_len;
if ((duc->uricontent = SCMalloc(duc->uricontent_len)) == NULL) if ((duc->content = SCMalloc(duc->content_len)) == NULL)
goto error; goto error;
memcpy(duc->uricontent, ((DetectContentData *)pm->ctx)->content, duc->uricontent_len); memcpy(duc->content, ((DetectContentData *)pm->ctx)->content, duc->content_len);
duc->flags |= (((DetectContentData *)pm->ctx)->flags & DETECT_CONTENT_NOCASE) ? duc->flags |= (((DetectContentData *)pm->ctx)->flags & DETECT_CONTENT_NOCASE) ?
DETECT_URICONTENT_NOCASE : 0; DETECT_URICONTENT_NOCASE : 0;
duc->flags |= (((DetectContentData *)pm->ctx)->flags & DETECT_CONTENT_NEGATED) ? duc->flags |= (((DetectContentData *)pm->ctx)->flags & DETECT_CONTENT_NEGATED) ?
DETECT_URICONTENT_NEGATED : 0; DETECT_URICONTENT_NEGATED : 0;
duc->id = DetectPatternGetId(de_ctx->mpm_pattern_id_store, duc, DETECT_URICONTENT); duc->id = DetectPatternGetId(de_ctx->mpm_pattern_id_store, duc, DETECT_URICONTENT);
duc->bm_ctx = BoyerMooreCtxInit(duc->uricontent, duc->uricontent_len); duc->bm_ctx = BoyerMooreCtxInit(duc->content, duc->content_len);
nm->type = DETECT_URICONTENT; nm->type = DETECT_URICONTENT;
nm->ctx = (void *)duc; nm->ctx = (void *)duc;
@ -171,8 +171,8 @@ static int DetectHttpUriSetup (DetectEngineCtx *de_ctx, Signature *s, char *str)
return 0; return 0;
error: error:
if (duc != NULL) { if (duc != NULL) {
if (duc->uricontent != NULL) if (duc->content != NULL)
SCFree(duc->uricontent); SCFree(duc->content);
SCFree(duc); SCFree(duc);
} }
if(sm !=NULL) SCFree(sm); if(sm !=NULL) SCFree(sm);
@ -335,8 +335,8 @@ int DetectHttpUriTest05(void)
} }
char *str = "we are testing http_uri keyword"; char *str = "we are testing http_uri keyword";
int uricomp = memcmp((const char *)((DetectUricontentData*) s->sm_lists[DETECT_SM_LIST_UMATCH]->ctx)->uricontent, str, strlen(str)-1); int uricomp = memcmp((const char *)((DetectUricontentData*) s->sm_lists[DETECT_SM_LIST_UMATCH]->ctx)->content, str, strlen(str)-1);
int urilen = ((DetectUricontentData*) s->sm_lists_tail[DETECT_SM_LIST_UMATCH]->ctx)->uricontent_len; int urilen = ((DetectUricontentData*) s->sm_lists_tail[DETECT_SM_LIST_UMATCH]->ctx)->content_len;
if (uricomp != 0 || if (uricomp != 0 ||
urilen != strlen("we are testing http_uri keyword")) { urilen != strlen("we are testing http_uri keyword")) {
printf("sig failed to parse, content not setup properly\n"); printf("sig failed to parse, content not setup properly\n");

2
src/detect-nocase.c
Unescape Escape View File

@ -203,7 +203,7 @@ static int DetectNocaseSetup (DetectEngineCtx *de_ctx, Signature *s, char *nulls
} }
ud->flags |= DETECT_URICONTENT_NOCASE; ud->flags |= DETECT_URICONTENT_NOCASE;
/* Recreate the context with nocase chars */ /* Recreate the context with nocase chars */
BoyerMooreCtxToNocase(ud->bm_ctx, ud->uricontent, ud->uricontent_len); BoyerMooreCtxToNocase(ud->bm_ctx, ud->content, ud->content_len);
break; break;
case DETECT_CONTENT: case DETECT_CONTENT:

6
src/detect-offset.c
Unescape Escape View File

@ -122,10 +122,10 @@ int DetectOffsetSetup (DetectEngineCtx *de_ctx, Signature *s, char *offsetstr)
ud->offset = (uint32_t)atoi(str); ud->offset = (uint32_t)atoi(str);
if (ud->depth != 0) { if (ud->depth != 0) {
if (ud->depth < ud->uricontent_len) { if (ud->depth < ud->content_len) {
SCLogDebug("depth increased to %"PRIu32" to match pattern len", SCLogDebug("depth increased to %"PRIu32" to match pattern len",
ud->uricontent_len); ud->content_len);
ud->depth = ud->uricontent_len; ud->depth = ud->content_len;
} }
/* Updating the depth as is relative to the offset */ /* Updating the depth as is relative to the offset */
ud->depth += ud->offset; ud->depth += ud->offset;

18
src/detect-parse.c
Unescape Escape View File

@ -1331,9 +1331,9 @@ Signature *SigInit(DetectEngineCtx *de_ctx, char *sigstr) {
continue; continue;
if (sig->mpm_uricontent_maxlen == 0) if (sig->mpm_uricontent_maxlen == 0)
sig->mpm_uricontent_maxlen = ud->uricontent_len; sig->mpm_uricontent_maxlen = ud->content_len;
if (sig->mpm_uricontent_maxlen < ud->uricontent_len) if (sig->mpm_uricontent_maxlen < ud->content_len)
sig->mpm_uricontent_maxlen = ud->uricontent_len; sig->mpm_uricontent_maxlen = ud->content_len;
} }
} }
} }
@ -1472,9 +1472,9 @@ Signature *SigInitReal(DetectEngineCtx *de_ctx, char *sigstr) {
if (ud == NULL) if (ud == NULL)
continue; continue;
if (sig->mpm_uricontent_maxlen == 0) if (sig->mpm_uricontent_maxlen == 0)
sig->mpm_uricontent_maxlen = ud->uricontent_len; sig->mpm_uricontent_maxlen = ud->content_len;
if (sig->mpm_uricontent_maxlen < ud->uricontent_len) if (sig->mpm_uricontent_maxlen < ud->content_len)
sig->mpm_uricontent_maxlen = ud->uricontent_len; sig->mpm_uricontent_maxlen = ud->content_len;
} }
} }
} }
@ -1522,9 +1522,9 @@ Signature *SigInitReal(DetectEngineCtx *de_ctx, char *sigstr) {
continue; continue;
if (sig->next->mpm_uricontent_maxlen == 0) if (sig->next->mpm_uricontent_maxlen == 0)
sig->next->mpm_uricontent_maxlen = ud->uricontent_len; sig->next->mpm_uricontent_maxlen = ud->content_len;
if (sig->next->mpm_uricontent_maxlen < ud->uricontent_len) if (sig->next->mpm_uricontent_maxlen < ud->content_len)
sig->next->mpm_uricontent_maxlen = ud->uricontent_len; sig->next->mpm_uricontent_maxlen = ud->content_len;
} }
} }
} }

30
src/detect-uricontent.c
Unescape Escape View File

@ -101,8 +101,8 @@ void DetectUricontentFree(void *ptr) {
if (cd == NULL) if (cd == NULL)
SCReturn; SCReturn;
if (cd->uricontent != NULL) if (cd->content != NULL)
SCFree(cd->uricontent); SCFree(cd->content);
BoyerMooreCtxDeInit(cd->bm_ctx); BoyerMooreCtxDeInit(cd->bm_ctx);
@ -120,14 +120,14 @@ void DetectUricontentPrint(DetectUricontentData *cd)
SCLogDebug("Detect UricontentData \"cd\" is NULL"); SCLogDebug("Detect UricontentData \"cd\" is NULL");
return; return;
} }
char *tmpstr = SCMalloc(sizeof(char) * cd->uricontent_len + 1); char *tmpstr = SCMalloc(sizeof(char) * cd->content_len + 1);
if (tmpstr == NULL) if (tmpstr == NULL)
return; return;
if (tmpstr != NULL) { if (tmpstr != NULL) {
for (i = 0; i < cd->uricontent_len; i++) { for (i = 0; i < cd->content_len; i++) {
if (isprint(cd->uricontent[i])) if (isprint(cd->content[i]))
tmpstr[i] = cd->uricontent[i]; tmpstr[i] = cd->content[i];
else else
tmpstr[i] = '.'; tmpstr[i] = '.';
} }
@ -136,12 +136,12 @@ void DetectUricontentPrint(DetectUricontentData *cd)
SCFree(tmpstr); SCFree(tmpstr);
} else { } else {
SCLogDebug("Uricontent: "); SCLogDebug("Uricontent: ");
for (i = 0; i < cd->uricontent_len; i++) for (i = 0; i < cd->content_len; i++)
SCLogDebug("%c", cd->uricontent[i]); SCLogDebug("%c", cd->content[i]);
} }
SCLogDebug("Uricontent_id: %"PRIu32, cd->id); SCLogDebug("Uricontent_id: %"PRIu32, cd->id);
SCLogDebug("Uricontent_len: %"PRIu16, cd->uricontent_len); SCLogDebug("Uricontent_len: %"PRIu16, cd->content_len);
SCLogDebug("Depth: %"PRIu16, cd->depth); SCLogDebug("Depth: %"PRIu16, cd->depth);
SCLogDebug("Offset: %"PRIu16, cd->offset); SCLogDebug("Offset: %"PRIu16, cd->offset);
SCLogDebug("Within: %"PRIi32, cd->within); SCLogDebug("Within: %"PRIi32, cd->within);
@ -324,22 +324,22 @@ DetectUricontentData *DoDetectUricontentSetup (char * contentstr)
SCLogDebug("len %" PRIu32 "", len); SCLogDebug("len %" PRIu32 "", len);
cd->uricontent = SCMalloc(len); cd->content = SCMalloc(len);
if (cd->uricontent == NULL) { if (cd->content == NULL) {
SCFree(cd); SCFree(cd);
SCFree(str); SCFree(str);
return NULL;; return NULL;;
} }
memcpy(cd->uricontent, str, len); memcpy(cd->content, str, len);
cd->uricontent_len = len; cd->content_len = len;
cd->depth = 0; cd->depth = 0;
cd->offset = 0; cd->offset = 0;
cd->within = 0; cd->within = 0;
cd->distance = 0; cd->distance = 0;
/* Prepare Boyer Moore context for searching faster */ /* Prepare Boyer Moore context for searching faster */
cd->bm_ctx = BoyerMooreCtxInit(cd->uricontent, cd->uricontent_len); cd->bm_ctx = BoyerMooreCtxInit(cd->content, cd->content_len);
SCFree(str); SCFree(str);
return cd; return cd;
@ -1782,7 +1782,7 @@ int DetectUriSigTest12(void)
} }
ud = (DetectUricontentData *)s->sm_lists_tail[DETECT_SM_LIST_UMATCH]->ctx; ud = (DetectUricontentData *)s->sm_lists_tail[DETECT_SM_LIST_UMATCH]->ctx;
result = (strncmp("boo", (char *)ud->uricontent, ud->uricontent_len) == 0); result = (strncmp("boo", (char *)ud->content, ud->content_len) == 0);
end: end:
SigGroupCleanup(de_ctx); SigGroupCleanup(de_ctx);

4
src/detect-uricontent.h
Unescape Escape View File

@ -52,8 +52,8 @@
#include "app-layer-htp.h" #include "app-layer-htp.h"
typedef struct DetectUricontentData_ { typedef struct DetectUricontentData_ {
uint8_t *uricontent; uint8_t *content;
uint8_t uricontent_len; uint8_t content_len;
PatIntId id; PatIntId id;
uint32_t flags; uint32_t flags;
uint16_t depth; uint16_t depth;

8
src/detect-within.c
Unescape Escape View File

@ -208,19 +208,19 @@ static int DetectWithinSetup (DetectEngineCtx *de_ctx, Signature *s, char *withi
} }
ud->within = strtol(str, NULL, 10); ud->within = strtol(str, NULL, 10);
if (ud->within < (int32_t)ud->uricontent_len) { if (ud->within < (int32_t)ud->content_len) {
SCLogError(SC_ERR_WITHIN_INVALID, "within argument \"%"PRIi32"\" is " SCLogError(SC_ERR_WITHIN_INVALID, "within argument \"%"PRIi32"\" is "
"less than the content length \"%"PRIu32"\" which is invalid, since " "less than the content length \"%"PRIu32"\" which is invalid, since "
"this will never match. Invalidating signature", ud->within, "this will never match. Invalidating signature", ud->within,
ud->uricontent_len); ud->content_len);
goto error; goto error;
} }
ud->flags |= DETECT_URICONTENT_WITHIN; ud->flags |= DETECT_URICONTENT_WITHIN;
if (ud->flags & DETECT_URICONTENT_DISTANCE) { if (ud->flags & DETECT_URICONTENT_DISTANCE) {
if ((ud->distance + ud->uricontent_len) > ud->within) { if ((ud->distance + ud->content_len) > ud->within) {
ud->within = ud->distance + ud->uricontent_len; ud->within = ud->distance + ud->content_len;
} }
} }

Write Preview
Loading…
Cancel
Save