code cleanup - remove DetectContentGetLastPattern. Replace it with SigMatchGetLastSMFromLists

remotes/origin/master
Anoop Saldanha 14 years ago committed by Victor Julien
parent d85ab5ab1f
commit ab35b98f76

@ -351,31 +351,6 @@ void DetectContentPrint(DetectContentData *cd)
SCLogDebug("-----------");
}
/**
* \brief Search the first DETECT_CONTENT
* \retval pointer to the SigMatch holding the DetectContent
* \param sm pointer to the current SigMatch of a parsing process
* \retval null if no applicable DetectContent was found
* \retval pointer to the SigMatch that has the previous SigMatch
* of type DetectContent
*/
SigMatch *DetectContentGetLastPattern(SigMatch *sm)
{
if (sm == NULL)
return NULL;
while (sm != NULL && sm->type != DETECT_CONTENT)
sm = sm->prev;
if (sm == NULL)
return NULL;
DetectContentData *cd = (DetectContentData*) sm->ctx;
if (cd == NULL)
return NULL;
return sm;
}
/**
* \brief Print list of DETECT_CONTENT SigMatch's allocated in a
* SigMatch list, from the current sm to the end

@ -104,11 +104,6 @@ DetectContentData *DetectContentParseEncloseQuotes(char *);
void DetectContentPrint(DetectContentData *);
/** This function search backwards the first applicable SigMatch holding
* a DETECT_CONTENT context (If it belongs to a chunk group, the first chunk
* of the group will be returned). Modifiers must call this */
SigMatch *DetectContentGetLastPattern(SigMatch *);
void DetectContentFree(void *);
#endif /* __DETECT_CONTENT_H__ */

@ -101,7 +101,8 @@ int DetectHttpClientBodySetup(DetectEngineCtx *de_ctx, Signature *s, char *arg)
return -1;
}
sm = DetectContentGetLastPattern(s->sm_lists_tail[DETECT_SM_LIST_PMATCH]);
sm = SigMatchGetLastSMFromLists(s, 2,
DETECT_CONTENT, s->sm_lists_tail[DETECT_SM_LIST_PMATCH]);
/* if still we are unable to find any content previous keywords, it is an
* invalid rule */
if (sm == NULL) {

@ -122,7 +122,8 @@ static int DetectHttpCookieSetup (DetectEngineCtx *de_ctx, Signature *s, char *s
return -1;
}
sm = DetectContentGetLastPattern(s->sm_lists_tail[DETECT_SM_LIST_PMATCH]);
sm = SigMatchGetLastSMFromLists(s, 2,
DETECT_CONTENT, s->sm_lists_tail[DETECT_SM_LIST_PMATCH]);
if (sm == NULL) {
SCLogWarning(SC_ERR_HTTP_COOKIE_NEEDS_PRECEEDING_CONTENT, "http_cookie "
"found inside the rule, without a content context. Please use a "

@ -107,7 +107,8 @@ static int DetectHttpMethodSetup(DetectEngineCtx *de_ctx, Signature *s, char *st
SCReturnInt(-1);
}
SigMatch *sm = DetectContentGetLastPattern(s->sm_lists_tail[DETECT_SM_LIST_PMATCH]);
SigMatch *sm = SigMatchGetLastSMFromLists(s, 2,
DETECT_CONTENT, s->sm_lists_tail[DETECT_SM_LIST_PMATCH]);
if (sm == NULL) {
SCLogError(SC_ERR_HTTP_METHOD_NEEDS_PRECEEDING_CONTENT, "http_method "
"modifies preceeding \"content\", but none was found");

@ -123,7 +123,8 @@ int DetectHttpRawHeaderSetup(DetectEngineCtx *de_ctx, Signature *s, char *arg)
return -1;
}
sm = DetectContentGetLastPattern(s->sm_lists_tail[DETECT_SM_LIST_PMATCH]);
sm = SigMatchGetLastSMFromLists(s, 2,
DETECT_CONTENT, s->sm_lists_tail[DETECT_SM_LIST_PMATCH]);
/* if still we are unable to find any previous content keywords, it is an
* invalid rule */
if (sm == NULL) {

@ -96,7 +96,8 @@ static int DetectHttpRawUriSetup(DetectEngineCtx *de_ctx, Signature *s, char *ar
goto error;
}
sm = DetectContentGetLastPattern(s->sm_lists_tail[DETECT_SM_LIST_PMATCH]);
sm = SigMatchGetLastSMFromLists(s, 2,
DETECT_CONTENT, s->sm_lists_tail[DETECT_SM_LIST_PMATCH]);
if (sm == NULL) {
SCLogError(SC_ERR_INVALID_SIGNATURE, "\"http_raw_uri\" keyword "
"found inside the rule without a content context. "

@ -102,7 +102,8 @@ int DetectHttpServerBodySetup(DetectEngineCtx *de_ctx, Signature *s, char *arg)
return -1;
}
sm = DetectContentGetLastPattern(s->sm_lists_tail[DETECT_SM_LIST_PMATCH]);
sm = SigMatchGetLastSMFromLists(s, 2,
DETECT_CONTENT, s->sm_lists_tail[DETECT_SM_LIST_PMATCH]);
/* if still we are unable to find any content previous keywords, it is an
* invalid rule */
if (sm == NULL) {

@ -223,7 +223,8 @@ static int DetectHttpStatCodeSetup (DetectEngineCtx *de_ctx, Signature *s, char
return -1;
}
sm = DetectContentGetLastPattern(s->sm_lists_tail[DETECT_SM_LIST_PMATCH]);
sm = SigMatchGetLastSMFromLists(s, 2,
DETECT_CONTENT, s->sm_lists_tail[DETECT_SM_LIST_PMATCH]);
/* if still we are unable to find any content previous keywords, it is an
* invalid rule */
if (sm == NULL) {

@ -217,7 +217,8 @@ static int DetectHttpStatMsgSetup (DetectEngineCtx *de_ctx, Signature *s, char *
return -1;
}
sm = DetectContentGetLastPattern(s->sm_lists_tail[DETECT_SM_LIST_PMATCH]);
sm = SigMatchGetLastSMFromLists(s, 2,
DETECT_CONTENT, s->sm_lists_tail[DETECT_SM_LIST_PMATCH]);
/* if still we are unable to find any content previous keywords, it is an
* invalid rule */
if (sm == NULL) {

@ -97,7 +97,8 @@ static int DetectHttpUriSetup (DetectEngineCtx *de_ctx, Signature *s, char *str)
return -1;
}
sm = DetectContentGetLastPattern(s->sm_lists_tail[DETECT_SM_LIST_PMATCH]);
sm = SigMatchGetLastSMFromLists(s, 2,
DETECT_CONTENT, s->sm_lists_tail[DETECT_SM_LIST_PMATCH]);
if (sm == NULL) {
SCLogError(SC_ERR_INVALID_SIGNATURE, "\"http_uri\" keyword "
"found inside the rule without a content context. "

@ -55,112 +55,6 @@ void DetectNocaseRegister (void) {
sigmatch_table[DETECT_NOCASE].flags |= SIGMATCH_PAYLOAD;
}
/**
* \internal
* \brief get the last pattern sigmatch that supports nocase:
* content, uricontent, http_client_body, http_cookie
*
* \param s signature
*
* \retval sm sigmatch of either content or uricontent that is the last
* or NULL if none was found
*/
//static SigMatch *SigMatchGetLastNocasePattern(Signature *s) {
// SCEnter();
//
// BUG_ON(s == NULL);
//
// SigMatch *co_sm = DetectContentGetLastPattern(s->sm_lists_tail[DETECT_SM_LIST_PMATCH]);
// SigMatch *ur_sm = SigMatchGetLastSM(s->sm_lists_tail[DETECT_SM_LIST_UMATCH], DETECT_URICONTENT);
// /* http client body SigMatch */
// SigMatch *hcbd_sm = SigMatchGetLastSM(s->sm_lists_tail[DETECT_SM_LIST_AMATCH], DETECT_AL_HTTP_CLIENT_BODY);
// /* http cookie SigMatch */
// SigMatch *hcd_sm = SigMatchGetLastSM(s->sm_lists_tail[DETECT_SM_LIST_AMATCH], DETECT_AL_HTTP_COOKIE);
// /* http header SigMatch */
// SigMatch *hhd_sm = SigMatchGetLastSM(s->sm_lists_tail[DETECT_SM_LIST_AMATCH], DETECT_AL_HTTP_HEADER);
// /* http method SigMatch */
// SigMatch *hmd_sm = SigMatchGetLastSM(s->sm_lists_tail[DETECT_SM_LIST_AMATCH], DETECT_AL_HTTP_METHOD);
//
// SigMatch *temp_sm = NULL;
//
// SigMatch **sm_list = NULL;
// uint8_t sm_list_count = 0;
//
// if (co_sm != NULL) {
// sm_list_count++;
// if ( (sm_list = SCRealloc(sm_list, sizeof(SigMatch *) * sm_list_count)) == NULL) {
// SCLogError(SC_ERR_FATAL, "Fatal error encountered in SigMatchGetLastNocasePattern. Exiting...");
// exit(EXIT_FAILURE);
// }
// sm_list[sm_list_count - 1] = co_sm;
// }
// if (ur_sm != NULL) {
// sm_list_count++;
// if ( (sm_list = SCRealloc(sm_list, sizeof(SigMatch *) * sm_list_count)) == NULL) {
// SCLogError(SC_ERR_FATAL, "Fatal error encountered in SigMatchGetLastNocasePattern. Exiting...");
// exit(EXIT_FAILURE);
// }
// sm_list[sm_list_count - 1] = ur_sm;
// }
// if (hcbd_sm != NULL) {
// sm_list_count++;
// if ( (sm_list = SCRealloc(sm_list, sizeof(SigMatch *) * sm_list_count)) == NULL) {
// SCLogError(SC_ERR_FATAL, "Fatal error encountered in SigMatchGetLastNocasePattern. Exiting...");
// exit(EXIT_FAILURE);
// }
// sm_list[sm_list_count - 1] = hcbd_sm;
// }
// if (hcd_sm != NULL) {
// sm_list_count++;
// if ( (sm_list = SCRealloc(sm_list, sizeof(SigMatch *) * sm_list_count)) == NULL) {
// SCLogError(SC_ERR_FATAL, "Fatal error encountered in SigMatchGetLastNocasePattern. Exiting...");
// exit(EXIT_FAILURE);
// }
// sm_list[sm_list_count - 1] = hcd_sm;
// }
// if (hhd_sm != NULL) {
// sm_list_count++;
// if ( (sm_list = SCRealloc(sm_list, sizeof(SigMatch *) * sm_list_count)) == NULL) {
// SCLogError(SC_ERR_FATAL, "Fatal error encountered in SigMatchGetLastNocasePattern. Exiting...");
// exit(EXIT_FAILURE);
// }
// sm_list[sm_list_count - 1] = hhd_sm;
// }
//
// if (hmd_sm != NULL) {
// sm_list_count++;
// if ( (sm_list = SCRealloc(sm_list, sizeof(SigMatch *) * sm_list_count)) == NULL) {
// SCLogError(SC_ERR_FATAL, "Fatal error encountered in SigMatchGetLastNocasePattern. Exiting...");
// exit(EXIT_FAILURE);
// }
// sm_list[sm_list_count - 1] = hmd_sm;
// }
//
// if (sm_list_count == 0)
// SCReturnPtr(NULL, "SigMatch");
//
// /* find the highest idx sm, so we apply to the last sm that we support */
// int i = 0, j = 0;
// int swapped = 1;
// while (swapped) {
// swapped = 0;
// for (j = i; j < sm_list_count - 1; j++) {
// if (sm_list[j]->idx < sm_list[j + 1]->idx) {
// temp_sm = sm_list[j];
// sm_list[j] = sm_list[j + 1];
// sm_list[j + 1] = temp_sm;
// swapped = 1;
// i++;
// }
// }
// }
//
// temp_sm = sm_list[0];
// SCFree(sm_list);
//
// SCReturnPtr(temp_sm, "SigMatch");
//}
/**
* \internal
* \brief Apply the nocase keyword to the last pattern match, either content or uricontent

@ -29,6 +29,7 @@
#include "decode.h"
#include "detect.h"
#include "detect-parse.h"
#include "flow-var.h"
#include "detect-content.h"
@ -63,7 +64,8 @@ static int DetectRawbytesSetup (DetectEngineCtx *de_ctx, Signature *s, char *nul
SCReturnInt(-1);
}
SigMatch *pm = DetectContentGetLastPattern(s->sm_lists_tail[DETECT_SM_LIST_PMATCH]);
SigMatch *pm = SigMatchGetLastSMFromLists(s, 2,
DETECT_CONTENT, s->sm_lists_tail[DETECT_SM_LIST_PMATCH]);
if (pm == NULL) {
SCLogError(SC_ERR_RAWBYTES_MISSING_CONTENT, "\"rawbytes\" needs a preceeding content option");
SCReturnInt(-1);

Loading…
Cancel
Save