|
|
|
@ -74,30 +74,8 @@ static int DetectNocaseSetup (DetectEngineCtx *de_ctx, Signature *s, const char
|
|
|
|
|
goto end;
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
/* verify other conditions. */
|
|
|
|
|
DetectContentData *cd = (DetectContentData *)pm->ctx;
|
|
|
|
|
|
|
|
|
|
if (cd->flags & DETECT_CONTENT_NOCASE) {
|
|
|
|
|
SCLogError("can't use multiple nocase modifiers with the same content");
|
|
|
|
|
goto end;
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
/* for consistency in later use (e.g. by MPM construction and hashing),
|
|
|
|
|
* coerce the content string to lower-case. */
|
|
|
|
|
for (uint8_t *c = cd->content; c < cd->content + cd->content_len; c++) {
|
|
|
|
|
*c = u8_tolower(*c);
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
cd->flags |= DETECT_CONTENT_NOCASE;
|
|
|
|
|
/* Recreate the context with nocase chars */
|
|
|
|
|
SpmDestroyCtx(cd->spm_ctx);
|
|
|
|
|
cd->spm_ctx = SpmInitCtx(cd->content, cd->content_len, 1,
|
|
|
|
|
de_ctx->spm_global_thread_ctx);
|
|
|
|
|
if (cd->spm_ctx == NULL) {
|
|
|
|
|
goto end;
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
ret = 0;
|
|
|
|
|
ret = DetectContentConvertToNocase(de_ctx, cd);
|
|
|
|
|
end:
|
|
|
|
|
SCReturnInt(ret);
|
|
|
|
|
}
|
|
|
|
|