aiden
/
suricata
mirror of https://github.com/OISF/suricata
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

code cleanup - remove DetectContentGetLastPattern. Replace it with SigMatchGetLastSMFromLists

Browse Source
remotes/origin/master
Anoop Saldanha 14 years ago committed by Victor Julien
parent d85ab5ab1f
commit ab35b98f76
13 changed files with 21 additions and 146 deletions
Show Stats Download Patch File Download Diff File

25
src/detect-content.c
Unescape Escape View File

@ -351,31 +351,6 @@ void DetectContentPrint(DetectContentData *cd)
SCLogDebug("-----------");
}
/**
* \brief Search the first DETECT_CONTENT
* \retval pointer to the SigMatch holding the DetectContent
* \param sm pointer to the current SigMatch of a parsing process
* \retval null if no applicable DetectContent was found
* \retval pointer to the SigMatch that has the previous SigMatch
* of type DetectContent
*/
SigMatch *DetectContentGetLastPattern(SigMatch *sm)
{
if (sm == NULL)
return NULL;
while (sm != NULL && sm->type != DETECT_CONTENT)
sm = sm->prev;
if (sm == NULL)
return NULL;
DetectContentData *cd = (DetectContentData*) sm->ctx;
if (cd == NULL)
return NULL;
return sm;
}
/**
* \brief Print list of DETECT_CONTENT SigMatch's allocated in a
* SigMatch list, from the current sm to the end

5
src/detect-content.h
Unescape Escape View File

@ -104,11 +104,6 @@ DetectContentData *DetectContentParseEncloseQuotes(char *);
void DetectContentPrint(DetectContentData *);
/** This function search backwards the first applicable SigMatch holding
* a DETECT_CONTENT context (If it belongs to a chunk group, the first chunk
* of the group will be returned). Modifiers must call this */
SigMatch *DetectContentGetLastPattern(SigMatch *);
void DetectContentFree(void *);
#endif /* __DETECT_CONTENT_H__ */

3
src/detect-http-client-body.c
Unescape Escape View File

@ -101,7 +101,8 @@ int DetectHttpClientBodySetup(DetectEngineCtx *de_ctx, Signature *s, char *arg)
return -1;
}
sm = DetectContentGetLastPattern(s->sm_lists_tail[DETECT_SM_LIST_PMATCH]);
sm = SigMatchGetLastSMFromLists(s, 2,
DETECT_CONTENT, s->sm_lists_tail[DETECT_SM_LIST_PMATCH]);
/* if still we are unable to find any content previous keywords, it is an
* invalid rule */
if (sm == NULL) {

3
src/detect-http-cookie.c
Unescape Escape View File

@ -122,7 +122,8 @@ static int DetectHttpCookieSetup (DetectEngineCtx *de_ctx, Signature *s, char *s
return -1;
}
sm = DetectContentGetLastPattern(s->sm_lists_tail[DETECT_SM_LIST_PMATCH]);
sm = SigMatchGetLastSMFromLists(s, 2,
DETECT_CONTENT, s->sm_lists_tail[DETECT_SM_LIST_PMATCH]);
if (sm == NULL) {
SCLogWarning(SC_ERR_HTTP_COOKIE_NEEDS_PRECEEDING_CONTENT, "http_cookie "
"found inside the rule, without a content context. Please use a "

3
src/detect-http-method.c
Unescape Escape View File

@ -107,7 +107,8 @@ static int DetectHttpMethodSetup(DetectEngineCtx *de_ctx, Signature *s, char *st
SCReturnInt(-1);
}
SigMatch *sm = DetectContentGetLastPattern(s->sm_lists_tail[DETECT_SM_LIST_PMATCH]);
SigMatch *sm = SigMatchGetLastSMFromLists(s, 2,
DETECT_CONTENT, s->sm_lists_tail[DETECT_SM_LIST_PMATCH]);
if (sm == NULL) {
SCLogError(SC_ERR_HTTP_METHOD_NEEDS_PRECEEDING_CONTENT, "http_method "
"modifies preceeding \"content\", but none was found");

3
src/detect-http-raw-header.c
Unescape Escape View File

@ -123,7 +123,8 @@ int DetectHttpRawHeaderSetup(DetectEngineCtx *de_ctx, Signature *s, char *arg)
return -1;
}
sm = DetectContentGetLastPattern(s->sm_lists_tail[DETECT_SM_LIST_PMATCH]);
sm = SigMatchGetLastSMFromLists(s, 2,
DETECT_CONTENT, s->sm_lists_tail[DETECT_SM_LIST_PMATCH]);
/* if still we are unable to find any previous content keywords, it is an
* invalid rule */
if (sm == NULL) {

3
src/detect-http-raw-uri.c
Unescape Escape View File

@ -96,7 +96,8 @@ static int DetectHttpRawUriSetup(DetectEngineCtx *de_ctx, Signature *s, char *ar
goto error;
}
sm = DetectContentGetLastPattern(s->sm_lists_tail[DETECT_SM_LIST_PMATCH]);
sm = SigMatchGetLastSMFromLists(s, 2,
DETECT_CONTENT, s->sm_lists_tail[DETECT_SM_LIST_PMATCH]);
if (sm == NULL) {
SCLogError(SC_ERR_INVALID_SIGNATURE, "\"http_raw_uri\" keyword "
"found inside the rule without a content context. "

3
src/detect-http-server-body.c
Unescape Escape View File

@ -102,7 +102,8 @@ int DetectHttpServerBodySetup(DetectEngineCtx *de_ctx, Signature *s, char *arg)
return -1;
}
sm = DetectContentGetLastPattern(s->sm_lists_tail[DETECT_SM_LIST_PMATCH]);
sm = SigMatchGetLastSMFromLists(s, 2,
DETECT_CONTENT, s->sm_lists_tail[DETECT_SM_LIST_PMATCH]);
/* if still we are unable to find any content previous keywords, it is an
* invalid rule */
if (sm == NULL) {

3
src/detect-http-stat-code.c
Unescape Escape View File

@ -223,7 +223,8 @@ static int DetectHttpStatCodeSetup (DetectEngineCtx *de_ctx, Signature *s, char
return -1;
}
sm = DetectContentGetLastPattern(s->sm_lists_tail[DETECT_SM_LIST_PMATCH]);
sm = SigMatchGetLastSMFromLists(s, 2,
DETECT_CONTENT, s->sm_lists_tail[DETECT_SM_LIST_PMATCH]);
/* if still we are unable to find any content previous keywords, it is an
* invalid rule */
if (sm == NULL) {

3
src/detect-http-stat-msg.c
Unescape Escape View File

@ -217,7 +217,8 @@ static int DetectHttpStatMsgSetup (DetectEngineCtx *de_ctx, Signature *s, char *
return -1;
}
sm = DetectContentGetLastPattern(s->sm_lists_tail[DETECT_SM_LIST_PMATCH]);
sm = SigMatchGetLastSMFromLists(s, 2,
DETECT_CONTENT, s->sm_lists_tail[DETECT_SM_LIST_PMATCH]);
/* if still we are unable to find any content previous keywords, it is an
* invalid rule */
if (sm == NULL) {

3
src/detect-http-uri.c
Unescape Escape View File

@ -97,7 +97,8 @@ static int DetectHttpUriSetup (DetectEngineCtx *de_ctx, Signature *s, char *str)
return -1;
}
sm = DetectContentGetLastPattern(s->sm_lists_tail[DETECT_SM_LIST_PMATCH]);
sm = SigMatchGetLastSMFromLists(s, 2,
DETECT_CONTENT, s->sm_lists_tail[DETECT_SM_LIST_PMATCH]);
if (sm == NULL) {
SCLogError(SC_ERR_INVALID_SIGNATURE, "\"http_uri\" keyword "
"found inside the rule without a content context. "

106
src/detect-nocase.c
Unescape Escape View File

@ -55,112 +55,6 @@ void DetectNocaseRegister (void) {
sigmatch_table[DETECT_NOCASE].flags |= SIGMATCH_PAYLOAD;
}
/**
* \internal
* \brief get the last pattern sigmatch that supports nocase:
* content, uricontent, http_client_body, http_cookie
*
* \param s signature
*
* \retval sm sigmatch of either content or uricontent that is the last
* or NULL if none was found
*/
//static SigMatch *SigMatchGetLastNocasePattern(Signature *s) {
// SCEnter();
//
// BUG_ON(s == NULL);
//
// SigMatch *co_sm = DetectContentGetLastPattern(s->sm_lists_tail[DETECT_SM_LIST_PMATCH]);
// SigMatch *ur_sm = SigMatchGetLastSM(s->sm_lists_tail[DETECT_SM_LIST_UMATCH], DETECT_URICONTENT);
// /* http client body SigMatch */
// SigMatch *hcbd_sm = SigMatchGetLastSM(s->sm_lists_tail[DETECT_SM_LIST_AMATCH], DETECT_AL_HTTP_CLIENT_BODY);
// /* http cookie SigMatch */
// SigMatch *hcd_sm = SigMatchGetLastSM(s->sm_lists_tail[DETECT_SM_LIST_AMATCH], DETECT_AL_HTTP_COOKIE);
// /* http header SigMatch */
// SigMatch *hhd_sm = SigMatchGetLastSM(s->sm_lists_tail[DETECT_SM_LIST_AMATCH], DETECT_AL_HTTP_HEADER);
// /* http method SigMatch */
// SigMatch *hmd_sm = SigMatchGetLastSM(s->sm_lists_tail[DETECT_SM_LIST_AMATCH], DETECT_AL_HTTP_METHOD);
//
// SigMatch *temp_sm = NULL;
//
// SigMatch **sm_list = NULL;
// uint8_t sm_list_count = 0;
//
// if (co_sm != NULL) {
// sm_list_count++;
// if ( (sm_list = SCRealloc(sm_list, sizeof(SigMatch *) * sm_list_count)) == NULL) {
// SCLogError(SC_ERR_FATAL, "Fatal error encountered in SigMatchGetLastNocasePattern. Exiting...");
// exit(EXIT_FAILURE);
// }
// sm_list[sm_list_count - 1] = co_sm;
// }
// if (ur_sm != NULL) {
// sm_list_count++;
// if ( (sm_list = SCRealloc(sm_list, sizeof(SigMatch *) * sm_list_count)) == NULL) {
// SCLogError(SC_ERR_FATAL, "Fatal error encountered in SigMatchGetLastNocasePattern. Exiting...");
// exit(EXIT_FAILURE);
// }
// sm_list[sm_list_count - 1] = ur_sm;
// }
// if (hcbd_sm != NULL) {
// sm_list_count++;
// if ( (sm_list = SCRealloc(sm_list, sizeof(SigMatch *) * sm_list_count)) == NULL) {
// SCLogError(SC_ERR_FATAL, "Fatal error encountered in SigMatchGetLastNocasePattern. Exiting...");
// exit(EXIT_FAILURE);
// }
// sm_list[sm_list_count - 1] = hcbd_sm;
// }
// if (hcd_sm != NULL) {
// sm_list_count++;
// if ( (sm_list = SCRealloc(sm_list, sizeof(SigMatch *) * sm_list_count)) == NULL) {
// SCLogError(SC_ERR_FATAL, "Fatal error encountered in SigMatchGetLastNocasePattern. Exiting...");
// exit(EXIT_FAILURE);
// }
// sm_list[sm_list_count - 1] = hcd_sm;
// }
// if (hhd_sm != NULL) {
// sm_list_count++;
// if ( (sm_list = SCRealloc(sm_list, sizeof(SigMatch *) * sm_list_count)) == NULL) {
// SCLogError(SC_ERR_FATAL, "Fatal error encountered in SigMatchGetLastNocasePattern. Exiting...");
// exit(EXIT_FAILURE);
// }
// sm_list[sm_list_count - 1] = hhd_sm;
// }
//
// if (hmd_sm != NULL) {
// sm_list_count++;
// if ( (sm_list = SCRealloc(sm_list, sizeof(SigMatch *) * sm_list_count)) == NULL) {
// SCLogError(SC_ERR_FATAL, "Fatal error encountered in SigMatchGetLastNocasePattern. Exiting...");
// exit(EXIT_FAILURE);
// }
// sm_list[sm_list_count - 1] = hmd_sm;
// }
//
// if (sm_list_count == 0)
// SCReturnPtr(NULL, "SigMatch");
//
// /* find the highest idx sm, so we apply to the last sm that we support */
// int i = 0, j = 0;
// int swapped = 1;
// while (swapped) {
// swapped = 0;
// for (j = i; j < sm_list_count - 1; j++) {
// if (sm_list[j]->idx < sm_list[j + 1]->idx) {
// temp_sm = sm_list[j];
// sm_list[j] = sm_list[j + 1];
// sm_list[j + 1] = temp_sm;
// swapped = 1;
// i++;
// }
// }
// }
//
// temp_sm = sm_list[0];
// SCFree(sm_list);
//
// SCReturnPtr(temp_sm, "SigMatch");
//}
/**
* \internal
* \brief Apply the nocase keyword to the last pattern match, either content or uricontent

4
src/detect-rawbytes.c
Unescape Escape View File

@ -29,6 +29,7 @@
#include "decode.h"
#include "detect.h"
#include "detect-parse.h"
#include "flow-var.h"
#include "detect-content.h"
@ -63,7 +64,8 @@ static int DetectRawbytesSetup (DetectEngineCtx *de_ctx, Signature *s, char *nul
SCReturnInt(-1);
}
SigMatch *pm = DetectContentGetLastPattern(s->sm_lists_tail[DETECT_SM_LIST_PMATCH]);
SigMatch *pm = SigMatchGetLastSMFromLists(s, 2,
DETECT_CONTENT, s->sm_lists_tail[DETECT_SM_LIST_PMATCH]);
if (pm == NULL) {
SCLogError(SC_ERR_RAWBYTES_MISSING_CONTENT, "\"rawbytes\" needs a preceeding content option");
SCReturnInt(-1);

Write Preview
Loading…
Cancel
Save