|
|
|
@ -55,112 +55,6 @@ void DetectNocaseRegister (void) {
|
|
|
|
|
sigmatch_table[DETECT_NOCASE].flags |= SIGMATCH_PAYLOAD;
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
/**
|
|
|
|
|
* \internal
|
|
|
|
|
* \brief get the last pattern sigmatch that supports nocase:
|
|
|
|
|
* content, uricontent, http_client_body, http_cookie
|
|
|
|
|
*
|
|
|
|
|
* \param s signature
|
|
|
|
|
*
|
|
|
|
|
* \retval sm sigmatch of either content or uricontent that is the last
|
|
|
|
|
* or NULL if none was found
|
|
|
|
|
*/
|
|
|
|
|
//static SigMatch *SigMatchGetLastNocasePattern(Signature *s) {
|
|
|
|
|
// SCEnter();
|
|
|
|
|
//
|
|
|
|
|
// BUG_ON(s == NULL);
|
|
|
|
|
//
|
|
|
|
|
// SigMatch *co_sm = DetectContentGetLastPattern(s->sm_lists_tail[DETECT_SM_LIST_PMATCH]);
|
|
|
|
|
// SigMatch *ur_sm = SigMatchGetLastSM(s->sm_lists_tail[DETECT_SM_LIST_UMATCH], DETECT_URICONTENT);
|
|
|
|
|
// /* http client body SigMatch */
|
|
|
|
|
// SigMatch *hcbd_sm = SigMatchGetLastSM(s->sm_lists_tail[DETECT_SM_LIST_AMATCH], DETECT_AL_HTTP_CLIENT_BODY);
|
|
|
|
|
// /* http cookie SigMatch */
|
|
|
|
|
// SigMatch *hcd_sm = SigMatchGetLastSM(s->sm_lists_tail[DETECT_SM_LIST_AMATCH], DETECT_AL_HTTP_COOKIE);
|
|
|
|
|
// /* http header SigMatch */
|
|
|
|
|
// SigMatch *hhd_sm = SigMatchGetLastSM(s->sm_lists_tail[DETECT_SM_LIST_AMATCH], DETECT_AL_HTTP_HEADER);
|
|
|
|
|
// /* http method SigMatch */
|
|
|
|
|
// SigMatch *hmd_sm = SigMatchGetLastSM(s->sm_lists_tail[DETECT_SM_LIST_AMATCH], DETECT_AL_HTTP_METHOD);
|
|
|
|
|
//
|
|
|
|
|
// SigMatch *temp_sm = NULL;
|
|
|
|
|
//
|
|
|
|
|
// SigMatch **sm_list = NULL;
|
|
|
|
|
// uint8_t sm_list_count = 0;
|
|
|
|
|
//
|
|
|
|
|
// if (co_sm != NULL) {
|
|
|
|
|
// sm_list_count++;
|
|
|
|
|
// if ( (sm_list = SCRealloc(sm_list, sizeof(SigMatch *) * sm_list_count)) == NULL) {
|
|
|
|
|
// SCLogError(SC_ERR_FATAL, "Fatal error encountered in SigMatchGetLastNocasePattern. Exiting...");
|
|
|
|
|
// exit(EXIT_FAILURE);
|
|
|
|
|
// }
|
|
|
|
|
// sm_list[sm_list_count - 1] = co_sm;
|
|
|
|
|
// }
|
|
|
|
|
// if (ur_sm != NULL) {
|
|
|
|
|
// sm_list_count++;
|
|
|
|
|
// if ( (sm_list = SCRealloc(sm_list, sizeof(SigMatch *) * sm_list_count)) == NULL) {
|
|
|
|
|
// SCLogError(SC_ERR_FATAL, "Fatal error encountered in SigMatchGetLastNocasePattern. Exiting...");
|
|
|
|
|
// exit(EXIT_FAILURE);
|
|
|
|
|
// }
|
|
|
|
|
// sm_list[sm_list_count - 1] = ur_sm;
|
|
|
|
|
// }
|
|
|
|
|
// if (hcbd_sm != NULL) {
|
|
|
|
|
// sm_list_count++;
|
|
|
|
|
// if ( (sm_list = SCRealloc(sm_list, sizeof(SigMatch *) * sm_list_count)) == NULL) {
|
|
|
|
|
// SCLogError(SC_ERR_FATAL, "Fatal error encountered in SigMatchGetLastNocasePattern. Exiting...");
|
|
|
|
|
// exit(EXIT_FAILURE);
|
|
|
|
|
// }
|
|
|
|
|
// sm_list[sm_list_count - 1] = hcbd_sm;
|
|
|
|
|
// }
|
|
|
|
|
// if (hcd_sm != NULL) {
|
|
|
|
|
// sm_list_count++;
|
|
|
|
|
// if ( (sm_list = SCRealloc(sm_list, sizeof(SigMatch *) * sm_list_count)) == NULL) {
|
|
|
|
|
// SCLogError(SC_ERR_FATAL, "Fatal error encountered in SigMatchGetLastNocasePattern. Exiting...");
|
|
|
|
|
// exit(EXIT_FAILURE);
|
|
|
|
|
// }
|
|
|
|
|
// sm_list[sm_list_count - 1] = hcd_sm;
|
|
|
|
|
// }
|
|
|
|
|
// if (hhd_sm != NULL) {
|
|
|
|
|
// sm_list_count++;
|
|
|
|
|
// if ( (sm_list = SCRealloc(sm_list, sizeof(SigMatch *) * sm_list_count)) == NULL) {
|
|
|
|
|
// SCLogError(SC_ERR_FATAL, "Fatal error encountered in SigMatchGetLastNocasePattern. Exiting...");
|
|
|
|
|
// exit(EXIT_FAILURE);
|
|
|
|
|
// }
|
|
|
|
|
// sm_list[sm_list_count - 1] = hhd_sm;
|
|
|
|
|
// }
|
|
|
|
|
//
|
|
|
|
|
// if (hmd_sm != NULL) {
|
|
|
|
|
// sm_list_count++;
|
|
|
|
|
// if ( (sm_list = SCRealloc(sm_list, sizeof(SigMatch *) * sm_list_count)) == NULL) {
|
|
|
|
|
// SCLogError(SC_ERR_FATAL, "Fatal error encountered in SigMatchGetLastNocasePattern. Exiting...");
|
|
|
|
|
// exit(EXIT_FAILURE);
|
|
|
|
|
// }
|
|
|
|
|
// sm_list[sm_list_count - 1] = hmd_sm;
|
|
|
|
|
// }
|
|
|
|
|
//
|
|
|
|
|
// if (sm_list_count == 0)
|
|
|
|
|
// SCReturnPtr(NULL, "SigMatch");
|
|
|
|
|
//
|
|
|
|
|
// /* find the highest idx sm, so we apply to the last sm that we support */
|
|
|
|
|
// int i = 0, j = 0;
|
|
|
|
|
// int swapped = 1;
|
|
|
|
|
// while (swapped) {
|
|
|
|
|
// swapped = 0;
|
|
|
|
|
// for (j = i; j < sm_list_count - 1; j++) {
|
|
|
|
|
// if (sm_list[j]->idx < sm_list[j + 1]->idx) {
|
|
|
|
|
// temp_sm = sm_list[j];
|
|
|
|
|
// sm_list[j] = sm_list[j + 1];
|
|
|
|
|
// sm_list[j + 1] = temp_sm;
|
|
|
|
|
// swapped = 1;
|
|
|
|
|
// i++;
|
|
|
|
|
// }
|
|
|
|
|
// }
|
|
|
|
|
// }
|
|
|
|
|
//
|
|
|
|
|
// temp_sm = sm_list[0];
|
|
|
|
|
// SCFree(sm_list);
|
|
|
|
|
//
|
|
|
|
|
// SCReturnPtr(temp_sm, "SigMatch");
|
|
|
|
|
//}
|
|
|
|
|
|
|
|
|
|
/**
|
|
|
|
|
* \internal
|
|
|
|
|
* \brief Apply the nocase keyword to the last pattern match, either content or uricontent
|
|
|
|
|