diff --git a/src/detect-content.h b/src/detect-content.h index e5d21732a3..4ec9c65c36 100644 --- a/src/detect-content.h +++ b/src/detect-content.h @@ -62,7 +62,6 @@ SigMatch *DetectContentFindNextApplicableSM(SigMatch *); SigMatch *DetectContentHasPrevSMPattern(SigMatch *); SigMatch *SigMatchGetLastPattern(Signature *s); -void SigMatchAppendUricontent(Signature *, SigMatch *); void DetectContentFree(void *); diff --git a/src/detect-depth.c b/src/detect-depth.c index b74ddabd9f..bcf2b083a0 100644 --- a/src/detect-depth.c +++ b/src/detect-depth.c @@ -41,7 +41,8 @@ static int DetectDepthSetup (DetectEngineCtx *de_ctx, Signature *s, char *depths * SigMatch (it can be the same as this one) */ SigMatch *pm = SigMatchGetLastPattern(s); if (pm == NULL) { - SCLogError(SC_ERR_DEPTH_MISSING_CONTENT, "depth needs a preceeding content option"); + SCLogError(SC_ERR_DEPTH_MISSING_CONTENT, "depth needs a preceeding " + "content or uricontent option"); if (dubbed) SCFree(str); return -1; } @@ -52,13 +53,14 @@ static int DetectDepthSetup (DetectEngineCtx *de_ctx, Signature *s, char *depths case DETECT_URICONTENT: ud = (DetectUricontentData *)pm->ctx; if (ud == NULL) { - SCLogError(SC_ERR_INVALID_ARGUMENT, "invalid argpment"); + SCLogError(SC_ERR_INVALID_ARGUMENT, "invalid argument"); if (dubbed) SCFree(str); return -1; } ud->depth = (uint32_t)atoi(str); if (ud->uricontent_len + ud->offset > ud->depth) { - SCLogDebug("depth increased to %"PRIu32" to match pattern len and offset", ud->uricontent_len + ud->offset); + SCLogDebug("depth increased to %"PRIu32" to match pattern len " + "and offset", ud->uricontent_len + ud->offset); ud->depth = ud->uricontent_len + ud->offset; } break; @@ -72,13 +74,15 @@ static int DetectDepthSetup (DetectEngineCtx *de_ctx, Signature *s, char *depths } cd->depth = (uint32_t)atoi(str); if (cd->content_len + cd->offset > cd->depth) { - SCLogDebug("depth increased to %"PRIu32" to match pattern len and offset", cd->content_len + cd->offset); + SCLogDebug("depth increased to %"PRIu32" to match pattern len " + "and offset", cd->content_len + cd->offset); cd->depth = cd->content_len + cd->offset; } break; default: - SCLogError(SC_ERR_DEPTH_MISSING_CONTENT, "depth needs a preceeding content (or uricontent) option"); + SCLogError(SC_ERR_DEPTH_MISSING_CONTENT, "depth needs a preceeding " + "content (or uricontent) option"); if (dubbed) SCFree(str); return -1; break; @@ -87,4 +91,3 @@ static int DetectDepthSetup (DetectEngineCtx *de_ctx, Signature *s, char *depths if (dubbed) SCFree(str); return 0; } - diff --git a/src/detect-distance.c b/src/detect-distance.c index e9db8267c5..88db382df7 100644 --- a/src/detect-distance.c +++ b/src/detect-distance.c @@ -25,7 +25,8 @@ void DetectDistanceRegister (void) { sigmatch_table[DETECT_DISTANCE].flags |= SIGMATCH_PAYLOAD; } -static int DetectDistanceSetup (DetectEngineCtx *de_ctx, Signature *s, char *distancestr) +static int DetectDistanceSetup (DetectEngineCtx *de_ctx, Signature *s, + char *distancestr) { char *str = distancestr; char dubbed = 0; @@ -41,7 +42,8 @@ static int DetectDistanceSetup (DetectEngineCtx *de_ctx, Signature *s, char *dis * SigMatch (it can be the same as this one) */ SigMatch *pm = SigMatchGetLastPattern(s); if (pm == NULL) { - SCLogError(SC_ERR_DISTANCE_MISSING_CONTENT, "depth needs two preceeding content (or uricontent) options"); + SCLogError(SC_ERR_DISTANCE_MISSING_CONTENT, "distance needs two " + "preceeding content or uricontent options"); if (dubbed) SCFree(str); return -1; } @@ -53,7 +55,8 @@ static int DetectDistanceSetup (DetectEngineCtx *de_ctx, Signature *s, char *dis case DETECT_URICONTENT: ud = (DetectUricontentData *)pm->ctx; if (ud == NULL) { - SCLogError(SC_ERR_DISTANCE_MISSING_CONTENT, "Unknown previous keyword!\n"); + SCLogError(SC_ERR_DISTANCE_MISSING_CONTENT, "distance needs two " + "preceeding content or uricontent options"); goto error; } @@ -67,7 +70,8 @@ static int DetectDistanceSetup (DetectEngineCtx *de_ctx, Signature *s, char *dis pm = DetectUricontentGetLastPattern(s->umatch_tail->prev); if (pm == NULL) { - SCLogError(SC_ERR_DISTANCE_MISSING_CONTENT, "distance needs two preceeding content options"); + SCLogError(SC_ERR_DISTANCE_MISSING_CONTENT, "distance needs two" + " preceeding content or uricontent options"); goto error; } @@ -75,7 +79,8 @@ static int DetectDistanceSetup (DetectEngineCtx *de_ctx, Signature *s, char *dis ud = (DetectUricontentData *)pm->ctx; ud->flags |= DETECT_URICONTENT_RELATIVE_NEXT; } else { - SCLogError(SC_ERR_RULE_KEYWORD_UNKNOWN, "Unknown previous-previous keyword!"); + SCLogError(SC_ERR_RULE_KEYWORD_UNKNOWN, "Unknown previous" + " keyword!"); goto error; } break; @@ -83,7 +88,8 @@ static int DetectDistanceSetup (DetectEngineCtx *de_ctx, Signature *s, char *dis case DETECT_CONTENT: cd = (DetectContentData *)pm->ctx; if (cd == NULL) { - SCLogError(SC_ERR_DISTANCE_MISSING_CONTENT, "Unknown previous keyword!\n"); + SCLogError(SC_ERR_DISTANCE_MISSING_CONTENT, "distance needs two " + "preceeding content or uricontent options"); goto error; } @@ -97,7 +103,8 @@ static int DetectDistanceSetup (DetectEngineCtx *de_ctx, Signature *s, char *dis pm = DetectContentGetLastPattern(s->pmatch_tail->prev); if (pm == NULL) { - SCLogError(SC_ERR_DISTANCE_MISSING_CONTENT, "distance needs two preceeding content options"); + SCLogError(SC_ERR_DISTANCE_MISSING_CONTENT, "distance needs two" + " preceeding content or uricontent options"); goto error; } @@ -105,13 +112,15 @@ static int DetectDistanceSetup (DetectEngineCtx *de_ctx, Signature *s, char *dis cd = (DetectContentData *)pm->ctx; cd->flags |= DETECT_CONTENT_RELATIVE_NEXT; } else { - SCLogError(SC_ERR_RULE_KEYWORD_UNKNOWN, "Unknown previous-previous keyword!"); + SCLogError(SC_ERR_RULE_KEYWORD_UNKNOWN, "Unknown previous " + "keyword!"); goto error; } break; default: - SCLogError(SC_ERR_DISTANCE_MISSING_CONTENT, "distance needs two preceeding content (or uricontent) options"); + SCLogError(SC_ERR_DISTANCE_MISSING_CONTENT, "distance needs two " + "preceeding content or uricontent options"); if (dubbed) SCFree(str); return -1; break; diff --git a/src/detect-nocase.c b/src/detect-nocase.c index ff67905a9e..fbb9ab06c3 100644 --- a/src/detect-nocase.c +++ b/src/detect-nocase.c @@ -127,15 +127,15 @@ static int DetectNocaseSetup (DetectEngineCtx *de_ctx, Signature *s, char *nulls SCEnter(); if (nullstr != NULL) { - SCLogError(SC_ERR_INVALID_VALUE, "nocase has no value"); + SCLogError(SC_ERR_INVALID_VALUE, "nocase has value"); SCReturnInt(-1); } /* Search for the first previous SigMatch that supports nocase */ SigMatch *pm = SigMatchGetLastNocasePattern(s); if (pm == NULL) { - SCLogError(SC_ERR_NOCASE_MISSING_PATTERN, "nocase needs a preceeding " - "content, uricontent, http_client_body or http_cookie option"); + SCLogError(SC_ERR_NOCASE_MISSING_PATTERN, "\"nocase\" needs a preceeding" + " content, uricontent, http_client_body or http_cookie option"); SCReturnInt(-1); } @@ -167,8 +167,8 @@ static int DetectNocaseSetup (DetectEngineCtx *de_ctx, Signature *s, char *nulls break; /* should never happen */ default: - SCLogError(SC_ERR_NOCASE_MISSING_PATTERN, "nocase needs a preceeding " - "content, uricontent, http_client_body or http_cookie option"); + SCLogError(SC_ERR_NOCASE_MISSING_PATTERN, "\"nocase\" needs a" + " preceeding content, uricontent, http_client_body or http_cookie option"); SCReturnInt(-1); break; } diff --git a/src/detect-offset.c b/src/detect-offset.c index ded7800c79..a3b468f9f2 100644 --- a/src/detect-offset.c +++ b/src/detect-offset.c @@ -41,7 +41,8 @@ int DetectOffsetSetup (DetectEngineCtx *de_ctx, Signature *s, char *offsetstr) * SigMatch (it can be the same as this one) */ SigMatch *pm = SigMatchGetLastPattern(s); if (pm == NULL) { - SCLogError(SC_ERR_OFFSET_MISSING_CONTENT, "offset needs a preceeding content option"); + SCLogError(SC_ERR_OFFSET_MISSING_CONTENT, "offset needs a preceeding " + "content or uricontent option"); if (dubbed) SCFree(str); return -1; } @@ -52,13 +53,14 @@ int DetectOffsetSetup (DetectEngineCtx *de_ctx, Signature *s, char *offsetstr) case DETECT_URICONTENT: ud = (DetectUricontentData *)pm->ctx; if (ud == NULL) { - SCLogError(SC_ERR_INVALID_ARGUMENT, "invalid argpment"); + SCLogError(SC_ERR_INVALID_ARGUMENT, "invalid argument"); if (dubbed) SCFree(str); return -1; } ud->offset = (uint32_t)atoi(str); if (ud->depth != 0) { - SCLogDebug("depth increased to %"PRIu32" to match pattern len and offset", ud->uricontent_len + ud->offset); + SCLogDebug("depth increased to %"PRIu32" to match pattern len" + " and offset", ud->uricontent_len + ud->offset); ud->depth = ud->uricontent_len + ud->offset; } break; @@ -72,13 +74,15 @@ int DetectOffsetSetup (DetectEngineCtx *de_ctx, Signature *s, char *offsetstr) } cd->offset = (uint32_t)atoi(str); if (cd->depth != 0) { - SCLogDebug("depth increased to %"PRIu32" to match pattern len and offset", cd->content_len + cd->offset); + SCLogDebug("depth increased to %"PRIu32" to match pattern len" + " and offset", cd->content_len + cd->offset); cd->depth = cd->content_len + cd->offset; } break; default: - SCLogError(SC_ERR_OFFSET_MISSING_CONTENT, "offset needs a preceeding content (or uricontent) option"); + SCLogError(SC_ERR_OFFSET_MISSING_CONTENT, "offset needs a preceeding" + " content or uricontent option"); if (dubbed) SCFree(str); return -1; break; diff --git a/src/detect-uricontent.c b/src/detect-uricontent.c index cd925e28ca..2993625a15 100644 --- a/src/detect-uricontent.c +++ b/src/detect-uricontent.c @@ -105,8 +105,10 @@ void DetectUricontentPrint(DetectUricontentData *cd) SCLogDebug("Within: %"PRIi32, cd->within); SCLogDebug("Distance: %"PRIi32, cd->distance); SCLogDebug("flags: %u ", cd->flags); - SCLogDebug("negated: %s ", cd->flags & DETECT_URICONTENT_NEGATED ? "true" : "false"); - SCLogDebug("relative match next: %s ", cd->flags & DETECT_URICONTENT_RELATIVE_NEXT ? "true" : "false"); + SCLogDebug("negated: %s ", + cd->flags & DETECT_URICONTENT_NEGATED ? "true" : "false"); + SCLogDebug("relative match next: %s ", + cd->flags & DETECT_URICONTENT_RELATIVE_NEXT ? "true" : "false"); SCLogDebug("-----------"); } @@ -316,7 +318,8 @@ int DetectUricontentSetup (DetectEngineCtx *de_ctx, Signature *s, char *contents s->flags |= SIG_FLAG_APPLAYER; if (s->alproto != ALPROTO_UNKNOWN && s->alproto != ALPROTO_HTTP) { - SCLogError(SC_ERR_CONFLICTING_RULE_KEYWORDS, "rule contains conflicting keywords."); + SCLogError(SC_ERR_CONFLICTING_RULE_KEYWORDS, "rule contains conflicting" + " keywords."); goto error; } @@ -1224,13 +1227,13 @@ static int DetectUriSigTest05(void) { } if ((PacketAlertCheck(&p, 1))) { - printf("sig: 1 alerted, but it should not\n"); + printf("sig: 1 alerted, but it should not:"); goto end; } else if (! PacketAlertCheck(&p, 2)) { - printf("sig: 2 did not alerted, but it should\n"); + printf("sig: 2 did not alerted, but it should:"); goto end; } else if (! (PacketAlertCheck(&p, 3))) { - printf("sig: 3 did not alerted, but it should\n"); + printf("sig: 3 did not alerted, but it should:"); goto end; } @@ -1341,13 +1344,13 @@ static int DetectUriSigTest06(void) { } if ((PacketAlertCheck(&p, 1))) { - printf("sig: 1 alerted, but it should not\n"); + printf("sig: 1 alerted, but it should not:"); goto end; } else if (! PacketAlertCheck(&p, 2)) { - printf("sig: 2 did not alerted, but it should\n"); + printf("sig: 2 did not alerted, but it should:"); goto end; } else if (! (PacketAlertCheck(&p, 3))) { - printf("sig: 3 did not alerted, but it should\n"); + printf("sig: 3 did not alerted, but it should:"); goto end; } @@ -1458,13 +1461,13 @@ static int DetectUriSigTest07(void) { } if (PacketAlertCheck(&p, 1)) { - printf("sig: 1 alerted, but it should not\n"); + printf("sig: 1 alerted, but it should not:"); goto end; } else if (PacketAlertCheck(&p, 2)) { - printf("sig: 2 did not alerted, but it should\n"); + printf("sig: 2 alerted, but it should not:"); goto end; } else if (PacketAlertCheck(&p, 3)) { - printf("sig: 3 did not alerted, but it should\n"); + printf("sig: 3 alerted, but it should not:"); goto end; } diff --git a/src/detect-within.c b/src/detect-within.c index 12848ae33e..9c08326a88 100644 --- a/src/detect-within.c +++ b/src/detect-within.c @@ -52,7 +52,8 @@ static int DetectWithinSetup (DetectEngineCtx *de_ctx, Signature *s, char *withi * SigMatch (it can be the same as this one) */ SigMatch *pm = SigMatchGetLastPattern(s); if (pm == NULL) { - SCLogError(SC_ERR_WITHIN_MISSING_CONTENT, "depth needs two preceeding content (or uricontent) options"); + SCLogError(SC_ERR_WITHIN_MISSING_CONTENT, "depth needs" + "two preceeding content or uricontent options"); if (dubbed) SCFree(str); return -1; } @@ -87,7 +88,8 @@ static int DetectWithinSetup (DetectEngineCtx *de_ctx, Signature *s, char *withi pm = DetectUricontentGetLastPattern(s->umatch_tail->prev); if (pm == NULL) { - SCLogError(SC_ERR_WITHIN_MISSING_CONTENT, "within needs two preceeding content options"); + SCLogError(SC_ERR_WITHIN_MISSING_CONTENT, "within needs two" + " preceeding content or uricontent options"); goto error; } @@ -129,7 +131,8 @@ static int DetectWithinSetup (DetectEngineCtx *de_ctx, Signature *s, char *withi pm = DetectContentGetLastPattern(s->pmatch_tail->prev); if (pm == NULL) { - SCLogError(SC_ERR_WITHIN_MISSING_CONTENT, "within needs two preceeding content options"); + SCLogError(SC_ERR_WITHIN_MISSING_CONTENT, "within needs two" + " preceeding content or uricontent options"); goto error; } @@ -144,7 +147,7 @@ static int DetectWithinSetup (DetectEngineCtx *de_ctx, Signature *s, char *withi break; default: - SCLogError(SC_ERR_WITHIN_MISSING_CONTENT, "within needs two preceeding content (or uricontent) options"); + SCLogError(SC_ERR_WITHIN_MISSING_CONTENT, "within needs two preceeding content or uricontent options"); if (dubbed) SCFree(str); return -1; break;