detect/content: cleanup nocase conversion

pull/9355/head
Victor Julien 2 years ago committed by Victor Julien
parent be324d7856
commit ef936acdba

@ -754,6 +754,29 @@ void DetectContentPatternPrettyPrint(const DetectContentData *cd, char *str, siz
}
}
int DetectContentConvertToNocase(DetectEngineCtx *de_ctx, DetectContentData *cd)
{
if (cd->flags & DETECT_CONTENT_NOCASE) {
SCLogError("can't use multiple nocase modifiers with the same content");
return -1;
}
/* for consistency in later use (e.g. by MPM construction and hashing),
* coerce the content string to lower-case. */
for (uint8_t *c = cd->content; c < cd->content + cd->content_len; c++) {
*c = u8_tolower(*c);
}
cd->flags |= DETECT_CONTENT_NOCASE;
/* Recreate the context with nocase chars */
SpmDestroyCtx(cd->spm_ctx);
cd->spm_ctx = SpmInitCtx(cd->content, cd->content_len, 1, de_ctx->spm_global_thread_ctx);
if (cd->spm_ctx == NULL) {
return -1;
}
return 0;
}
#ifdef UNITTESTS /* UNITTESTS */
#include "detect-engine-alert.h"
#include "packet.h"

@ -132,5 +132,6 @@ void DetectContentPropagateLimits(Signature *s);
void DetectContentPatternPrettyPrint(const DetectContentData *cd, char *str, size_t str_len);
void SigParseRequiredContentSize(
const Signature *s, const int max, const SigMatch *sm, int *len, int *offset);
int DetectContentConvertToNocase(DetectEngineCtx *de_ctx, DetectContentData *cd);
#endif /* __DETECT_CONTENT_H__ */

@ -74,30 +74,8 @@ static int DetectNocaseSetup (DetectEngineCtx *de_ctx, Signature *s, const char
goto end;
}
/* verify other conditions. */
DetectContentData *cd = (DetectContentData *)pm->ctx;
if (cd->flags & DETECT_CONTENT_NOCASE) {
SCLogError("can't use multiple nocase modifiers with the same content");
goto end;
}
/* for consistency in later use (e.g. by MPM construction and hashing),
* coerce the content string to lower-case. */
for (uint8_t *c = cd->content; c < cd->content + cd->content_len; c++) {
*c = u8_tolower(*c);
}
cd->flags |= DETECT_CONTENT_NOCASE;
/* Recreate the context with nocase chars */
SpmDestroyCtx(cd->spm_ctx);
cd->spm_ctx = SpmInitCtx(cd->content, cd->content_len, 1,
de_ctx->spm_global_thread_ctx);
if (cd->spm_ctx == NULL) {
goto end;
}
ret = 0;
ret = DetectContentConvertToNocase(de_ctx, cd);
end:
SCReturnInt(ret);
}

Loading…
Cancel
Save