@ -59,7 +59,7 @@ extern int run_mode;
# include "host.h"
# include "util-profiling.h"
static int DetectReplaceSetup ( DetectEngineCtx * , Signature * , char * ) ;
static int DetectReplaceSetup ( DetectEngineCtx * , Signature * , char * ) ;
void DetectReplaceRegisterTests ( void ) ;
void DetectReplaceRegister ( void )
@ -159,7 +159,9 @@ error:
* earlier changes . Thus the highest priority modifications should be
* applied last .
*/
DetectReplaceList * DetectReplaceAddToList ( DetectReplaceList * replist , uint8_t * found , DetectContentData * cd )
DetectReplaceList * DetectReplaceAddToList ( DetectReplaceList * replist ,
uint8_t * found ,
DetectContentData * cd )
{
DetectReplaceList * newlist ;
@ -184,7 +186,7 @@ void DetectReplaceExecuteInternal(Packet *p, DetectReplaceList *replist)
DetectReplaceList * tlist = NULL ;
SCLogDebug ( " replace: Executing match " ) ;
while ( replist ) {
while ( replist ) {
memcpy ( replist - > found , replist - > cd - > replace , replist - > cd - > replace_len ) ;
SCLogDebug ( " replace: injecting '%s' " , replist - > cd - > replace ) ;
p - > flags | = PKT_STREAM_MODIFIED ;
@ -199,7 +201,7 @@ void DetectReplaceExecuteInternal(Packet *p, DetectReplaceList *replist)
void DetectReplaceFreeInternal ( DetectReplaceList * replist )
{
DetectReplaceList * tlist = NULL ;
while ( replist ) {
while ( replist ) {
SCLogDebug ( " replace: Freeing match " ) ;
tlist = replist ;
replist = replist - > next ;
@ -218,8 +220,10 @@ void DetectReplaceFreeInternal(DetectReplaceList *replist)
* \ retval return 1 if match
* \ retval return 0 if not
*/
int DetectReplaceLongPatternMatchTest ( uint8_t * raw_eth_pkt , uint16_t pktsize , char * sig ,
uint32_t sid , uint8_t * pp , uint16_t * len )
static
int DetectReplaceLongPatternMatchTest ( uint8_t * raw_eth_pkt , uint16_t pktsize ,
char * sig , uint32_t sid , uint8_t * pp ,
uint16_t * len )
{
int result = 0 ;
@ -385,7 +389,7 @@ int DetectReplaceLongPatternMatchTestUDPWrp(char *sig, uint32_t sid, char *sig_r
/**
* \ test Check if replace is working
*/
int DetectReplaceMatchTest01 ( )
static int DetectReplaceMatchTest01 ( void )
{
char * sig = " alert tcp any any -> any any (msg: \" Nothing.. \" ; "
" content: \" big \" ; replace: \" pig \" ; sid:1;) " ;
@ -397,7 +401,7 @@ int DetectReplaceMatchTest01()
/**
* \ test Check if replace is working with offset
*/
int DetectReplaceMatchTest02 ( )
static int DetectReplaceMatchTest02 ( void )
{
char * sig = " alert tcp any any -> any any (msg: \" Nothing.. \" ; "
" content: \" th \" ; offset: 4; replace: \" TH \" ; sid:1;) " ;
@ -409,7 +413,7 @@ int DetectReplaceMatchTest02()
/**
* \ test Check if replace is working with offset and keyword inversion
*/
int DetectReplaceMatchTest03 ( )
static int DetectReplaceMatchTest03 ( void )
{
char * sig = " alert tcp any any -> any any (msg: \" Nothing.. \" ; "
" content: \" th \" ; replace: \" TH \" ; offset: 4; sid:1;) " ;
@ -421,7 +425,7 @@ int DetectReplaceMatchTest03()
/**
* \ test Check if replace is working with second content
*/
int DetectReplaceMatchTest04 ( )
static int DetectReplaceMatchTest04 ( void )
{
char * sig = " alert tcp any any -> any any (msg: \" Nothing.. \" ; "
" content: \" th \" ; replace: \" TH \" ; content: \" patter \" ; replace: \" matter \" ; sid:1;) " ;
@ -433,7 +437,7 @@ int DetectReplaceMatchTest04()
/**
* \ test Check if replace is not done when second content don ' t match
*/
int DetectReplaceMatchTest05 ( )
static int DetectReplaceMatchTest05 ( void )
{
char * sig = " alert tcp any any -> any any (msg: \" Nothing.. \" ; "
" content: \" th \" ; replace: \" TH \" ; content: \" nutella \" ; sid:1;) " ;
@ -446,7 +450,7 @@ int DetectReplaceMatchTest05()
* \ test Check if replace is not done when second content match and not
* first
*/
int DetectReplaceMatchTest06 ( )
static int DetectReplaceMatchTest06 ( void )
{
char * sig = " alert tcp any any -> any any (msg: \" Nothing.. \" ; "
" content: \" nutella \" ; replace: \" commode \" ; content: \" this is \" ; sid:1;) " ;
@ -458,7 +462,7 @@ int DetectReplaceMatchTest06()
/**
* \ test Check if replace is working when nocase used
*/
int DetectReplaceMatchTest07 ( )
static int DetectReplaceMatchTest07 ( void )
{
char * sig = " alert tcp any any -> any any (msg: \" Nothing.. \" ; "
" content: \" BiG \" ; nocase; replace: \" pig \" ; sid:1;) " ;
@ -470,7 +474,7 @@ int DetectReplaceMatchTest07()
/**
* \ test Check if replace is working when depth is used
*/
int DetectReplaceMatchTest08 ( )
static int DetectReplaceMatchTest08 ( void )
{
char * sig = " alert tcp any any -> any any (msg: \" Nothing.. \" ; "
" content: \" big \" ; depth:17; replace: \" pig \" ; sid:1;) " ;
@ -482,7 +486,7 @@ int DetectReplaceMatchTest08()
/**
* \ test Check if replace is working when depth block match used
*/
int DetectReplaceMatchTest09 ( )
static int DetectReplaceMatchTest09 ( void )
{
char * sig = " alert tcp any any -> any any (msg: \" Nothing.. \" ; "
" content: \" big \" ; depth:16; replace: \" pig \" ; sid:1;) " ;
@ -494,7 +498,7 @@ int DetectReplaceMatchTest09()
/**
* \ test Check if replace is working when depth block match used
*/
int DetectReplaceMatchTest10 ( )
static int DetectReplaceMatchTest10 ( void )
{
char * sig = " alert tcp any any -> any any (msg: \" Nothing.. \" ; "
" content: \" big \" ; depth:17; replace: \" pig \" ; offset: 14; sid:1;) " ;
@ -506,7 +510,7 @@ int DetectReplaceMatchTest10()
/**
* \ test Check if replace is working with within
*/
int DetectReplaceMatchTest11 ( )
static int DetectReplaceMatchTest11 ( void )
{
char * sig = " alert tcp any any -> any any (msg: \" Nothing.. \" ; "
" content: \" big \" ; replace: \" pig \" ; content: \" to \" ; within: 11; sid:1;) " ;
@ -518,7 +522,7 @@ int DetectReplaceMatchTest11()
/**
* \ test Check if replace is working with within
*/
int DetectReplaceMatchTest12 ( )
static int DetectReplaceMatchTest12 ( void )
{
char * sig = " alert tcp any any -> any any (msg: \" Nothing.. \" ; "
" content: \" big \" ; replace: \" pig \" ; content: \" to \" ; within: 4; sid:1;) " ;
@ -530,7 +534,7 @@ int DetectReplaceMatchTest12()
/**
* \ test Check if replace is working with within
*/
int DetectReplaceMatchTest13 ( )
static int DetectReplaceMatchTest13 ( void )
{
char * sig = " alert tcp any any -> any any (msg: \" Nothing.. \" ; "
" content: \" big \" ; replace: \" pig \" ; content: \" test \" ; distance: 1; sid:1;) " ;
@ -542,7 +546,7 @@ int DetectReplaceMatchTest13()
/**
* \ test Check if replace is working with within
*/
int DetectReplaceMatchTest14 ( )
static int DetectReplaceMatchTest14 ( void )
{
char * sig = " alert tcp any any -> any any (msg: \" Nothing.. \" ; "
" content: \" big \" ; replace: \" pig \" ; content: \" test \" ; distance: 2; sid:1;) " ;
@ -554,7 +558,7 @@ int DetectReplaceMatchTest14()
/**
* \ test Check if replace is working with within
*/
int DetectReplaceMatchTest15 ( )
static int DetectReplaceMatchTest15 ( void )
{
char * sig = " alert udp any any -> any any (msg: \" Nothing.. \" ; "
" content: \" com \" ; replace: \" org \" ; sid:1;) " ;
@ -567,7 +571,7 @@ int DetectReplaceMatchTest15()
/**
* \ test Parsing test
*/
int DetectReplaceParseTest01 ( void )
static int DetectReplaceParseTest01 ( void )
{
int run_mode_backup = run_mode ;
run_mode = RUNMODE_NFQ ;
@ -601,7 +605,7 @@ int DetectReplaceParseTest01(void)
/**
* \ test Parsing test : non valid because of http protocol
*/
int DetectReplaceParseTest02 ( void )
static int DetectReplaceParseTest02 ( void )
{
int run_mode_backup = run_mode ;
run_mode = RUNMODE_NFQ ;
@ -636,7 +640,7 @@ int DetectReplaceParseTest02(void)
* \ test Parsing test : non valid because of http_header on same content
* as replace keyword
*/
int DetectReplaceParseTest03 ( void )
static int DetectReplaceParseTest03 ( void )
{
int run_mode_backup = run_mode ;
run_mode = RUNMODE_NFQ ;
@ -670,7 +674,7 @@ int DetectReplaceParseTest03(void)
/**
* \ test Parsing test no content
*/
int DetectReplaceParseTest04 ( void )
static int DetectReplaceParseTest04 ( void )
{
int run_mode_backup = run_mode ;
run_mode = RUNMODE_NFQ ;
@ -704,7 +708,7 @@ int DetectReplaceParseTest04(void)
/**
* \ test Parsing test content after replace
*/
int DetectReplaceParseTest05 ( void )
static int DetectReplaceParseTest05 ( void )
{
int run_mode_backup = run_mode ;
run_mode = RUNMODE_NFQ ;
@ -738,7 +742,7 @@ int DetectReplaceParseTest05(void)
/**
* \ test Parsing test content and replace length differ
*/
int DetectReplaceParseTest06 ( void )
static int DetectReplaceParseTest06 ( void )
{
int run_mode_backup = run_mode ;
run_mode = RUNMODE_NFQ ;
@ -772,7 +776,7 @@ int DetectReplaceParseTest06(void)
/**
* \ test Parsing test content and replace length differ
*/
int DetectReplaceParseTest07 ( void )
static int DetectReplaceParseTest07 ( void )
{
int run_mode_backup = run_mode ;
run_mode = RUNMODE_NFQ ;