changed to DetectHttpCookieData

remotes/origin/master-1.0.x
Gurvinder Singh 16 years ago committed by Victor Julien
parent a0f184866c
commit 85f054cac2

@ -68,7 +68,7 @@ int DetectHttpCookieMatch (ThreadVars *t, DetectEngineThreadCtx *det_ctx,
Flow *f, uint8_t flags, void *state, Signature *s,
SigMatch *m)
{
DetectContentData *co = (DetectContentData *)m->ctx;
DetectHttpCookieData *co = (DetectHttpCookieData *)m->ctx;
HtpState *htp_state = (HtpState *)state;
if (htp_state == NULL) {
SCLogDebug("No HTTP layer state has been received, so no match!!");
@ -87,8 +87,8 @@ int DetectHttpCookieMatch (ThreadVars *t, DetectEngineThreadCtx *det_ctx,
}
if (BinSearch(bstr_ptr(h->value), bstr_size(h->value), co->content,
co->content_len) != NULL)
if (BinSearch(bstr_ptr(h->value), bstr_size(h->value), co->data,
co->data_len) != NULL)
{
SCLogDebug("Match has been found in received request and given http_"
"cookie rule\n");
@ -169,8 +169,6 @@ int DetectHttpCookieSetup (DetectEngineCtx *de_ctx, Signature *s, SigMatch *m,
}
memcpy(hd->data, ((DetectContentData *)m->ctx)->content, hd->data_len);
hd->flags |= DETECT_CONTENT_HTTP_COOKIE;
sm = SigMatchAlloc();
if (sm == NULL)
goto error;
@ -275,13 +273,10 @@ int DetectHttpCookieTest03(void)
sm = de_ctx->sig_list->match;
while (sm != NULL) {
if (sm->type == DETECT_AL_HTTP_COOKIE) {
if (((DetectHttpCookieData *)sm->ctx)->flags &
DETECT_CONTENT_HTTP_COOKIE) {
result = 1;
} else {
result = 0;
break;
}
} else {
result = 0;
break;
}
sm = sm->next;
}

@ -10,28 +10,6 @@
typedef struct DetectHttpCookieData_ {
uint8_t *data;
uint8_t data_len;
uint32_t id;
uint8_t negated;
uint16_t depth;
uint16_t offset;
uint32_t isdataat;
int32_t distance;
int32_t within;
uint16_t flags;
/** The group this chunk belongs to, relative to the signature
* It start from 1, and the last SigMatch of the list should be
* also the total number of DetectContent "Real" Patterns loaded
* from the Signature */
uint8_t chunk_group_id;
/** The id number for this chunk in the current group of chunks
* Starts from 0, and a chunk with chunk_id == 0 should be the
* of the current chunk group where real modifiers are set before
* propagation */
uint8_t chunk_id;
/** For modifier propagations (the new flags) */
uint8_t chunk_flags;
} DetectHttpCookieData;
/* prototypes */

Loading…
Cancel
Save