From ab35b98f76a7a271f0598944a36e98aa4a0dcc3a Mon Sep 17 00:00:00 2001 From: Anoop Saldanha Date: Sat, 18 Feb 2012 12:47:35 +0530 Subject: [PATCH] code cleanup - remove DetectContentGetLastPattern. Replace it with SigMatchGetLastSMFromLists --- src/detect-content.c | 25 -------- src/detect-content.h | 5 -- src/detect-http-client-body.c | 3 +- src/detect-http-cookie.c | 3 +- src/detect-http-method.c | 3 +- src/detect-http-raw-header.c | 3 +- src/detect-http-raw-uri.c | 3 +- src/detect-http-server-body.c | 3 +- src/detect-http-stat-code.c | 3 +- src/detect-http-stat-msg.c | 3 +- src/detect-http-uri.c | 3 +- src/detect-nocase.c | 106 ---------------------------------- src/detect-rawbytes.c | 4 +- 13 files changed, 21 insertions(+), 146 deletions(-) diff --git a/src/detect-content.c b/src/detect-content.c index 1d4d64eeff..7f4da628bd 100644 --- a/src/detect-content.c +++ b/src/detect-content.c @@ -351,31 +351,6 @@ void DetectContentPrint(DetectContentData *cd) SCLogDebug("-----------"); } -/** - * \brief Search the first DETECT_CONTENT - * \retval pointer to the SigMatch holding the DetectContent - * \param sm pointer to the current SigMatch of a parsing process - * \retval null if no applicable DetectContent was found - * \retval pointer to the SigMatch that has the previous SigMatch - * of type DetectContent - */ -SigMatch *DetectContentGetLastPattern(SigMatch *sm) -{ - if (sm == NULL) - return NULL; - while (sm != NULL && sm->type != DETECT_CONTENT) - sm = sm->prev; - - if (sm == NULL) - return NULL; - - DetectContentData *cd = (DetectContentData*) sm->ctx; - if (cd == NULL) - return NULL; - - return sm; -} - /** * \brief Print list of DETECT_CONTENT SigMatch's allocated in a * SigMatch list, from the current sm to the end diff --git a/src/detect-content.h b/src/detect-content.h index 0ee8e0d2f1..0e5f3b581d 100644 --- a/src/detect-content.h +++ b/src/detect-content.h @@ -104,11 +104,6 @@ DetectContentData *DetectContentParseEncloseQuotes(char *); void DetectContentPrint(DetectContentData *); -/** This function search backwards the first applicable SigMatch holding - * a DETECT_CONTENT context (If it belongs to a chunk group, the first chunk - * of the group will be returned). Modifiers must call this */ -SigMatch *DetectContentGetLastPattern(SigMatch *); - void DetectContentFree(void *); #endif /* __DETECT_CONTENT_H__ */ diff --git a/src/detect-http-client-body.c b/src/detect-http-client-body.c index 21bcfbdad8..806128412f 100644 --- a/src/detect-http-client-body.c +++ b/src/detect-http-client-body.c @@ -101,7 +101,8 @@ int DetectHttpClientBodySetup(DetectEngineCtx *de_ctx, Signature *s, char *arg) return -1; } - sm = DetectContentGetLastPattern(s->sm_lists_tail[DETECT_SM_LIST_PMATCH]); + sm = SigMatchGetLastSMFromLists(s, 2, + DETECT_CONTENT, s->sm_lists_tail[DETECT_SM_LIST_PMATCH]); /* if still we are unable to find any content previous keywords, it is an * invalid rule */ if (sm == NULL) { diff --git a/src/detect-http-cookie.c b/src/detect-http-cookie.c index 2e48132c65..f32404eb01 100644 --- a/src/detect-http-cookie.c +++ b/src/detect-http-cookie.c @@ -122,7 +122,8 @@ static int DetectHttpCookieSetup (DetectEngineCtx *de_ctx, Signature *s, char *s return -1; } - sm = DetectContentGetLastPattern(s->sm_lists_tail[DETECT_SM_LIST_PMATCH]); + sm = SigMatchGetLastSMFromLists(s, 2, + DETECT_CONTENT, s->sm_lists_tail[DETECT_SM_LIST_PMATCH]); if (sm == NULL) { SCLogWarning(SC_ERR_HTTP_COOKIE_NEEDS_PRECEEDING_CONTENT, "http_cookie " "found inside the rule, without a content context. Please use a " diff --git a/src/detect-http-method.c b/src/detect-http-method.c index d0ae792289..a1174a0e1b 100644 --- a/src/detect-http-method.c +++ b/src/detect-http-method.c @@ -107,7 +107,8 @@ static int DetectHttpMethodSetup(DetectEngineCtx *de_ctx, Signature *s, char *st SCReturnInt(-1); } - SigMatch *sm = DetectContentGetLastPattern(s->sm_lists_tail[DETECT_SM_LIST_PMATCH]); + SigMatch *sm = SigMatchGetLastSMFromLists(s, 2, + DETECT_CONTENT, s->sm_lists_tail[DETECT_SM_LIST_PMATCH]); if (sm == NULL) { SCLogError(SC_ERR_HTTP_METHOD_NEEDS_PRECEEDING_CONTENT, "http_method " "modifies preceeding \"content\", but none was found"); diff --git a/src/detect-http-raw-header.c b/src/detect-http-raw-header.c index 993c2c2399..fffc14d04f 100644 --- a/src/detect-http-raw-header.c +++ b/src/detect-http-raw-header.c @@ -123,7 +123,8 @@ int DetectHttpRawHeaderSetup(DetectEngineCtx *de_ctx, Signature *s, char *arg) return -1; } - sm = DetectContentGetLastPattern(s->sm_lists_tail[DETECT_SM_LIST_PMATCH]); + sm = SigMatchGetLastSMFromLists(s, 2, + DETECT_CONTENT, s->sm_lists_tail[DETECT_SM_LIST_PMATCH]); /* if still we are unable to find any previous content keywords, it is an * invalid rule */ if (sm == NULL) { diff --git a/src/detect-http-raw-uri.c b/src/detect-http-raw-uri.c index 9804ea873a..c52942e2f2 100644 --- a/src/detect-http-raw-uri.c +++ b/src/detect-http-raw-uri.c @@ -96,7 +96,8 @@ static int DetectHttpRawUriSetup(DetectEngineCtx *de_ctx, Signature *s, char *ar goto error; } - sm = DetectContentGetLastPattern(s->sm_lists_tail[DETECT_SM_LIST_PMATCH]); + sm = SigMatchGetLastSMFromLists(s, 2, + DETECT_CONTENT, s->sm_lists_tail[DETECT_SM_LIST_PMATCH]); if (sm == NULL) { SCLogError(SC_ERR_INVALID_SIGNATURE, "\"http_raw_uri\" keyword " "found inside the rule without a content context. " diff --git a/src/detect-http-server-body.c b/src/detect-http-server-body.c index ef87f8961c..daf3ea0345 100644 --- a/src/detect-http-server-body.c +++ b/src/detect-http-server-body.c @@ -102,7 +102,8 @@ int DetectHttpServerBodySetup(DetectEngineCtx *de_ctx, Signature *s, char *arg) return -1; } - sm = DetectContentGetLastPattern(s->sm_lists_tail[DETECT_SM_LIST_PMATCH]); + sm = SigMatchGetLastSMFromLists(s, 2, + DETECT_CONTENT, s->sm_lists_tail[DETECT_SM_LIST_PMATCH]); /* if still we are unable to find any content previous keywords, it is an * invalid rule */ if (sm == NULL) { diff --git a/src/detect-http-stat-code.c b/src/detect-http-stat-code.c index 82b1df26e7..f2c2f46429 100644 --- a/src/detect-http-stat-code.c +++ b/src/detect-http-stat-code.c @@ -223,7 +223,8 @@ static int DetectHttpStatCodeSetup (DetectEngineCtx *de_ctx, Signature *s, char return -1; } - sm = DetectContentGetLastPattern(s->sm_lists_tail[DETECT_SM_LIST_PMATCH]); + sm = SigMatchGetLastSMFromLists(s, 2, + DETECT_CONTENT, s->sm_lists_tail[DETECT_SM_LIST_PMATCH]); /* if still we are unable to find any content previous keywords, it is an * invalid rule */ if (sm == NULL) { diff --git a/src/detect-http-stat-msg.c b/src/detect-http-stat-msg.c index c9140eb231..9e05a4bfc5 100644 --- a/src/detect-http-stat-msg.c +++ b/src/detect-http-stat-msg.c @@ -217,7 +217,8 @@ static int DetectHttpStatMsgSetup (DetectEngineCtx *de_ctx, Signature *s, char * return -1; } - sm = DetectContentGetLastPattern(s->sm_lists_tail[DETECT_SM_LIST_PMATCH]); + sm = SigMatchGetLastSMFromLists(s, 2, + DETECT_CONTENT, s->sm_lists_tail[DETECT_SM_LIST_PMATCH]); /* if still we are unable to find any content previous keywords, it is an * invalid rule */ if (sm == NULL) { diff --git a/src/detect-http-uri.c b/src/detect-http-uri.c index 9657536648..ae75740ec0 100644 --- a/src/detect-http-uri.c +++ b/src/detect-http-uri.c @@ -97,7 +97,8 @@ static int DetectHttpUriSetup (DetectEngineCtx *de_ctx, Signature *s, char *str) return -1; } - sm = DetectContentGetLastPattern(s->sm_lists_tail[DETECT_SM_LIST_PMATCH]); + sm = SigMatchGetLastSMFromLists(s, 2, + DETECT_CONTENT, s->sm_lists_tail[DETECT_SM_LIST_PMATCH]); if (sm == NULL) { SCLogError(SC_ERR_INVALID_SIGNATURE, "\"http_uri\" keyword " "found inside the rule without a content context. " diff --git a/src/detect-nocase.c b/src/detect-nocase.c index b7a7141c2c..9b1102c23b 100644 --- a/src/detect-nocase.c +++ b/src/detect-nocase.c @@ -55,112 +55,6 @@ void DetectNocaseRegister (void) { sigmatch_table[DETECT_NOCASE].flags |= SIGMATCH_PAYLOAD; } -/** - * \internal - * \brief get the last pattern sigmatch that supports nocase: - * content, uricontent, http_client_body, http_cookie - * - * \param s signature - * - * \retval sm sigmatch of either content or uricontent that is the last - * or NULL if none was found - */ -//static SigMatch *SigMatchGetLastNocasePattern(Signature *s) { -// SCEnter(); -// -// BUG_ON(s == NULL); -// -// SigMatch *co_sm = DetectContentGetLastPattern(s->sm_lists_tail[DETECT_SM_LIST_PMATCH]); -// SigMatch *ur_sm = SigMatchGetLastSM(s->sm_lists_tail[DETECT_SM_LIST_UMATCH], DETECT_URICONTENT); -// /* http client body SigMatch */ -// SigMatch *hcbd_sm = SigMatchGetLastSM(s->sm_lists_tail[DETECT_SM_LIST_AMATCH], DETECT_AL_HTTP_CLIENT_BODY); -// /* http cookie SigMatch */ -// SigMatch *hcd_sm = SigMatchGetLastSM(s->sm_lists_tail[DETECT_SM_LIST_AMATCH], DETECT_AL_HTTP_COOKIE); -// /* http header SigMatch */ -// SigMatch *hhd_sm = SigMatchGetLastSM(s->sm_lists_tail[DETECT_SM_LIST_AMATCH], DETECT_AL_HTTP_HEADER); -// /* http method SigMatch */ -// SigMatch *hmd_sm = SigMatchGetLastSM(s->sm_lists_tail[DETECT_SM_LIST_AMATCH], DETECT_AL_HTTP_METHOD); -// -// SigMatch *temp_sm = NULL; -// -// SigMatch **sm_list = NULL; -// uint8_t sm_list_count = 0; -// -// if (co_sm != NULL) { -// sm_list_count++; -// if ( (sm_list = SCRealloc(sm_list, sizeof(SigMatch *) * sm_list_count)) == NULL) { -// SCLogError(SC_ERR_FATAL, "Fatal error encountered in SigMatchGetLastNocasePattern. Exiting..."); -// exit(EXIT_FAILURE); -// } -// sm_list[sm_list_count - 1] = co_sm; -// } -// if (ur_sm != NULL) { -// sm_list_count++; -// if ( (sm_list = SCRealloc(sm_list, sizeof(SigMatch *) * sm_list_count)) == NULL) { -// SCLogError(SC_ERR_FATAL, "Fatal error encountered in SigMatchGetLastNocasePattern. Exiting..."); -// exit(EXIT_FAILURE); -// } -// sm_list[sm_list_count - 1] = ur_sm; -// } -// if (hcbd_sm != NULL) { -// sm_list_count++; -// if ( (sm_list = SCRealloc(sm_list, sizeof(SigMatch *) * sm_list_count)) == NULL) { -// SCLogError(SC_ERR_FATAL, "Fatal error encountered in SigMatchGetLastNocasePattern. Exiting..."); -// exit(EXIT_FAILURE); -// } -// sm_list[sm_list_count - 1] = hcbd_sm; -// } -// if (hcd_sm != NULL) { -// sm_list_count++; -// if ( (sm_list = SCRealloc(sm_list, sizeof(SigMatch *) * sm_list_count)) == NULL) { -// SCLogError(SC_ERR_FATAL, "Fatal error encountered in SigMatchGetLastNocasePattern. Exiting..."); -// exit(EXIT_FAILURE); -// } -// sm_list[sm_list_count - 1] = hcd_sm; -// } -// if (hhd_sm != NULL) { -// sm_list_count++; -// if ( (sm_list = SCRealloc(sm_list, sizeof(SigMatch *) * sm_list_count)) == NULL) { -// SCLogError(SC_ERR_FATAL, "Fatal error encountered in SigMatchGetLastNocasePattern. Exiting..."); -// exit(EXIT_FAILURE); -// } -// sm_list[sm_list_count - 1] = hhd_sm; -// } -// -// if (hmd_sm != NULL) { -// sm_list_count++; -// if ( (sm_list = SCRealloc(sm_list, sizeof(SigMatch *) * sm_list_count)) == NULL) { -// SCLogError(SC_ERR_FATAL, "Fatal error encountered in SigMatchGetLastNocasePattern. Exiting..."); -// exit(EXIT_FAILURE); -// } -// sm_list[sm_list_count - 1] = hmd_sm; -// } -// -// if (sm_list_count == 0) -// SCReturnPtr(NULL, "SigMatch"); -// -// /* find the highest idx sm, so we apply to the last sm that we support */ -// int i = 0, j = 0; -// int swapped = 1; -// while (swapped) { -// swapped = 0; -// for (j = i; j < sm_list_count - 1; j++) { -// if (sm_list[j]->idx < sm_list[j + 1]->idx) { -// temp_sm = sm_list[j]; -// sm_list[j] = sm_list[j + 1]; -// sm_list[j + 1] = temp_sm; -// swapped = 1; -// i++; -// } -// } -// } -// -// temp_sm = sm_list[0]; -// SCFree(sm_list); -// -// SCReturnPtr(temp_sm, "SigMatch"); -//} - /** * \internal * \brief Apply the nocase keyword to the last pattern match, either content or uricontent diff --git a/src/detect-rawbytes.c b/src/detect-rawbytes.c index 85f82f4466..480c9ba40c 100644 --- a/src/detect-rawbytes.c +++ b/src/detect-rawbytes.c @@ -29,6 +29,7 @@ #include "decode.h" #include "detect.h" +#include "detect-parse.h" #include "flow-var.h" #include "detect-content.h" @@ -63,7 +64,8 @@ static int DetectRawbytesSetup (DetectEngineCtx *de_ctx, Signature *s, char *nul SCReturnInt(-1); } - SigMatch *pm = DetectContentGetLastPattern(s->sm_lists_tail[DETECT_SM_LIST_PMATCH]); + SigMatch *pm = SigMatchGetLastSMFromLists(s, 2, + DETECT_CONTENT, s->sm_lists_tail[DETECT_SM_LIST_PMATCH]); if (pm == NULL) { SCLogError(SC_ERR_RAWBYTES_MISSING_CONTENT, "\"rawbytes\" needs a preceeding content option"); SCReturnInt(-1);