|
|
@ -11,6 +11,7 @@
|
|
|
|
#include "detect-content.h"
|
|
|
|
#include "detect-content.h"
|
|
|
|
#include "detect-uricontent.h"
|
|
|
|
#include "detect-uricontent.h"
|
|
|
|
#include "detect-pcre.h"
|
|
|
|
#include "detect-pcre.h"
|
|
|
|
|
|
|
|
#include "util-debug.h"
|
|
|
|
|
|
|
|
|
|
|
|
int DetectWithinSetup (DetectEngineCtx *, Signature *s, SigMatch *m, char *withinstr);
|
|
|
|
int DetectWithinSetup (DetectEngineCtx *, Signature *s, SigMatch *m, char *withinstr);
|
|
|
|
|
|
|
|
|
|
|
@ -40,58 +41,38 @@ int DetectWithinSetup (DetectEngineCtx *de_ctx, Signature *s, SigMatch *m, char
|
|
|
|
|
|
|
|
|
|
|
|
SigMatch *pm = m;
|
|
|
|
SigMatch *pm = m;
|
|
|
|
if (pm == NULL) {
|
|
|
|
if (pm == NULL) {
|
|
|
|
printf("DetectWithinSetup: No previous match!\n");
|
|
|
|
SCLogError(SC_ERR_WITHIN_MISSING_CONTENT, "within needs two preceeding content options");
|
|
|
|
goto error;
|
|
|
|
goto error;
|
|
|
|
}
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
|
|
/* Set the within flag on the Sigmatch */
|
|
|
|
/** Search for the first previous DetectContent
|
|
|
|
if (pm->type == DETECT_PCRE) {
|
|
|
|
* SigMatch (it can be the same as this one) */
|
|
|
|
DetectPcreData *pe = (DetectPcreData *)pm->ctx;
|
|
|
|
pm = DetectContentFindPrevApplicableSM(m);
|
|
|
|
|
|
|
|
if (pm == NULL || DetectContentHasPrevSMPattern(pm) == NULL) {
|
|
|
|
pe->within = strtol(str, NULL, 10);
|
|
|
|
SCLogError(SC_ERR_WITHIN_MISSING_CONTENT, "within needs two preceeding content options");
|
|
|
|
pe->flags |= DETECT_PCRE_WITHIN;
|
|
|
|
goto error;
|
|
|
|
//printf("DetectWithinSetup: set within %" PRId32 " for previous pcre\n", pe->within);
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
|
|
} else if (pm->type == DETECT_CONTENT) {
|
|
|
|
|
|
|
|
/** Search for the first previous DetectContent
|
|
|
|
|
|
|
|
* SigMatch (it can be the same as this one) */
|
|
|
|
|
|
|
|
pm = DetectContentFindPrevApplicableSM(m);
|
|
|
|
|
|
|
|
if (pm == NULL || DetectContentHasPrevSMPattern(pm) == NULL) {
|
|
|
|
|
|
|
|
printf("DetectWithinSetup: Unknown previous keyword!\n");
|
|
|
|
|
|
|
|
return -1;
|
|
|
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
DetectContentData *cd = (DetectContentData *)pm->ctx;
|
|
|
|
|
|
|
|
if (cd == NULL) {
|
|
|
|
|
|
|
|
printf("DetectWithinSetup: Unknown previous keyword!\n");
|
|
|
|
|
|
|
|
return -1;
|
|
|
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
cd->within = strtol(str, NULL, 10);
|
|
|
|
|
|
|
|
cd->flags |= DETECT_CONTENT_WITHIN;
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
/** Propagate the modifiers through the first chunk
|
|
|
|
|
|
|
|
* (SigMatch) if we're dealing with chunks */
|
|
|
|
|
|
|
|
if (cd->flags & DETECT_CONTENT_IS_CHUNK)
|
|
|
|
|
|
|
|
DetectContentPropagateWithin(pm);
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
//DetectContentPrint(cd);
|
|
|
|
|
|
|
|
//printf("DetectWithinSetup: set within %" PRId32 " for previous content\n", cd->within);
|
|
|
|
|
|
|
|
} else if (pm->type == DETECT_URICONTENT) {
|
|
|
|
|
|
|
|
DetectUricontentData *ud = (DetectUricontentData *)pm->ctx;
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
ud->within = strtol(str, NULL, 10);
|
|
|
|
|
|
|
|
ud->flags |= DETECT_URICONTENT_WITHIN;
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
//printf("DetectWithinSetup: set within %" PRId32 " for previous content\n", cd->within);
|
|
|
|
DetectContentData *cd = (DetectContentData *)pm->ctx;
|
|
|
|
} else {
|
|
|
|
if (cd == NULL) {
|
|
|
|
printf("DetectWithinSetup: Unknown previous keyword!\n");
|
|
|
|
printf("DetectWithinSetup: Unknown previous keyword!\n");
|
|
|
|
goto error;
|
|
|
|
goto error;
|
|
|
|
}
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
|
|
pm = m->prev;
|
|
|
|
cd->within = strtol(str, NULL, 10);
|
|
|
|
|
|
|
|
cd->flags |= DETECT_CONTENT_WITHIN;
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
/** Propagate the modifiers through the first chunk
|
|
|
|
|
|
|
|
* (SigMatch) if we're dealing with chunks */
|
|
|
|
|
|
|
|
if (cd->flags & DETECT_CONTENT_IS_CHUNK)
|
|
|
|
|
|
|
|
DetectContentPropagateWithin(pm);
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
//DetectContentPrint(cd);
|
|
|
|
|
|
|
|
//printf("DetectWithinSetup: set within %" PRId32 " for previous content\n", cd->within);
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
pm = DetectContentFindPrevApplicableSM(m->prev);
|
|
|
|
if (pm == NULL) {
|
|
|
|
if (pm == NULL) {
|
|
|
|
printf("DetectWithinSetup: No previous-previous match!\n");
|
|
|
|
SCLogError(SC_ERR_WITHIN_MISSING_CONTENT, "within needs two preceeding content options");
|
|
|
|
goto error;
|
|
|
|
goto error;
|
|
|
|
}
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
|
|