return;
}
-/** \brief Pull a content 'old' from the pmatch list, append 'new' to amatch list.
- * Used for replacing contents that have http_cookie, etc modifiers.
- */
-void SigMatchReplaceContent(Signature *s, SigMatch *old, SigMatch *new) {
- BUG_ON(old == NULL);
-
- SigMatch *m = s->sm_lists[DETECT_SM_LIST_PMATCH];
- SigMatch *pm = m;
-
- for ( ; m != NULL; m = m->next) {
- if (m == old) {
- if (m == s->sm_lists[DETECT_SM_LIST_PMATCH]) {
- s->sm_lists[DETECT_SM_LIST_PMATCH] = m->next;
- if (m->next != NULL) {
- m->next->prev = NULL;
- }
- } else {
- pm->next = m->next;
- if (m->next != NULL) {
- m->next->prev = pm;
- }
- }
-
- if (m == s->sm_lists_tail[DETECT_SM_LIST_PMATCH]) {
- if (pm == m) {
- s->sm_lists_tail[DETECT_SM_LIST_PMATCH] = NULL;
- } else {
- s->sm_lists_tail[DETECT_SM_LIST_PMATCH] = pm;
- }
- }
-
- //printf("m %p s->sm_lists[DETECT_SM_LIST_PMATCH] %p s->sm_lists_tail[DETECT_SM_LIST_PMATCH] %p\n", m, s->sm_lists[DETECT_SM_LIST_PMATCH], s->sm_lists_tail[DETECT_SM_LIST_PMATCH]);
- break;
- }
-
- pm = m;
- }
-
- /* finally append the "new" sig match to the app layer list */
- /** \todo if the app layer gets it's own list, adapt this code */
- if (s->sm_lists[DETECT_SM_LIST_AMATCH] == NULL) {
- s->sm_lists[DETECT_SM_LIST_AMATCH] = new;
- s->sm_lists_tail[DETECT_SM_LIST_AMATCH] = new;
- new->next = NULL;
- new->prev = NULL;
- } else {
- SigMatch *cur = s->sm_lists[DETECT_SM_LIST_AMATCH];
-
- for ( ; cur->next != NULL; cur = cur->next);
-
- cur->next = new;
- new->next = NULL;
- new->prev = cur;
- s->sm_lists_tail[DETECT_SM_LIST_AMATCH] = new;
- }
-
- /* move over the idx */
- if (pm != NULL)
- new->idx = pm->idx;
-}
-
-/**
- * \brief Pull a content 'old' from the pmatch list, append 'new' to umatch list.
- *
- * Used for replacing contents that have the http_uri modifier that need to be
- * moved to the uri inspection list.
- */
-void SigMatchReplaceContentToUricontent(Signature *s, SigMatch *old, SigMatch *new) {
- BUG_ON(old == NULL);
-
- SigMatch *m = s->sm_lists[DETECT_SM_LIST_PMATCH];
- SigMatch *pm = m;
-
- for ( ; m != NULL; m = m->next) {
- if (m == old) {
- if (m == s->sm_lists[DETECT_SM_LIST_PMATCH]) {
- s->sm_lists[DETECT_SM_LIST_PMATCH] = m->next;
- if (m->next != NULL) {
- m->next->prev = NULL;
- }
- } else {
- pm->next = m->next;
- if (m->next != NULL) {
- m->next->prev = pm;
- }
- }
-
- if (m == s->sm_lists_tail[DETECT_SM_LIST_PMATCH]) {
- if (pm == m) {
- s->sm_lists_tail[DETECT_SM_LIST_PMATCH] = NULL;
- } else {
- s->sm_lists_tail[DETECT_SM_LIST_PMATCH] = pm;
- }
- }
-
- //printf("m %p s->sm_lists[DETECT_SM_LIST_PMATCH] %p s->sm_lists_tail[DETECT_SM_LIST_PMATCH] %p\n", m, s->sm_lists[DETECT_SM_LIST_PMATCH], s->sm_lists_tail[DETECT_SM_LIST_PMATCH]);
- break;
- }
-
- pm = m;
- }
-
- /* finally append the "new" sig match to the app layer list */
- /** \todo if the app layer gets it's own list, adapt this code */
- if (s->sm_lists[DETECT_SM_LIST_UMATCH] == NULL) {
- s->sm_lists[DETECT_SM_LIST_UMATCH] = new;
- s->sm_lists_tail[DETECT_SM_LIST_UMATCH] = new;
- new->next = NULL;
- new->prev = NULL;
- } else {
- SigMatch *cur = s->sm_lists[DETECT_SM_LIST_UMATCH];
-
- for ( ; cur->next != NULL; cur = cur->next);
-
- cur->next = new;
- new->next = NULL;
- new->prev = cur;
- s->sm_lists_tail[DETECT_SM_LIST_UMATCH] = new;
- }
-
- /* move over the idx */
- if (pm != NULL)
- new->idx = pm->idx;
-}
-
-/**
- * \brief Replaces the old sigmatch with the new sigmatch in the current
- * signature.
- *
- * \param s pointer to the current signature
- * \param m pointer to the old sigmatch
- * \param new pointer to the new sigmatch, which will replace m
- */
-void SigMatchReplace(Signature *s, SigMatch *m, SigMatch *new) {
- if (s->sm_lists[DETECT_SM_LIST_MATCH] == NULL) {
- s->sm_lists[DETECT_SM_LIST_MATCH] = new;
- return;
- }
-
- if (m == NULL) {
- s->sm_lists[DETECT_SM_LIST_MATCH] = new;
- } else if (m->prev == NULL) {
- if (m->next != NULL) {
- m->next->prev = new;
- new->next = m->next;
- }
- s->sm_lists[DETECT_SM_LIST_MATCH] = new;
- } else {
- m->prev->next = new;
- new->prev = m->prev;
- if (m->next != NULL) {
- m->next->prev = new;
- new->next = m->next;
- }
- }
-}
-
/**
* \brief Returns a pointer to the last SigMatch instance of a particular type
* in a Signature of the payload list.
void SigParseRegisterTests(void);
Signature *DetectEngineAppendSig(DetectEngineCtx *, char *);
-void SigMatchReplace(Signature *, SigMatch *, SigMatch *);
-void SigMatchReplaceContent(Signature *, SigMatch *, SigMatch *);
-void SigMatchReplaceContentToUricontent(Signature *, SigMatch *, SigMatch *);
-
void SigMatchAppendSMToList(Signature *, SigMatch *, int);
void SigMatchRemoveSMFromList(Signature *, SigMatch *, int);
int SigMatchListSMBelongsTo(Signature *, SigMatch *);