detect/file: use util to turn keyword to nocase

This changes the way the pattern is stored by making it lowercase.

diff --git a/src/detect-filemagic.c b/src/detect-filemagic.c
index 84979d6d917c80caa539a1d381195e6856a49b06..b1c53593dced2d8954db7775b5b6198b20408313 100644 (file)
--- a/src/detect-filemagic.c
+++ b/src/detect-filemagic.c
@@ -222,13 +222,8 @@ static int DetectFilemagicSetup (DetectEngineCtx *de_ctx, Signature *s, const ch
         return -1;
 
     DetectContentData *cd = (DetectContentData *)sm->ctx;
-    cd->flags |= DETECT_CONTENT_NOCASE;
-    /* Recreate the context with nocase chars */
-    SpmDestroyCtx(cd->spm_ctx);
-    cd->spm_ctx = SpmInitCtx(cd->content, cd->content_len, 1, de_ctx->spm_global_thread_ctx);
-    if (cd->spm_ctx == NULL) {
+    if (DetectContentConvertToNocase(de_ctx, cd) != 0)
         return -1;
-    }
     if (DetectEngineContentModifierBufferSetup(
                 de_ctx, s, NULL, DETECT_FILE_MAGIC, g_file_magic_buffer_id, s->alproto) < 0)
         return -1;

diff --git a/src/detect-filename.c b/src/detect-filename.c
index ec9f81d457e609267a515a7f66d457a7fea5ebef..fc6e2fc7189eab283ae73a8c43e837c6efc2c5a3 100644 (file)
--- a/src/detect-filename.c
+++ b/src/detect-filename.c
@@ -148,14 +148,9 @@ static int DetectFileextSetup(DetectEngineCtx *de_ctx, Signature *s, const char
         return -1;
 
     DetectContentData *cd = (DetectContentData *)sm->ctx;
-    cd->flags |= DETECT_CONTENT_NOCASE;
     cd->flags |= DETECT_CONTENT_ENDS_WITH;
-    /* Recreate the context with nocase chars */
-    SpmDestroyCtx(cd->spm_ctx);
-    cd->spm_ctx = SpmInitCtx(cd->content, cd->content_len, 1, de_ctx->spm_global_thread_ctx);
-    if (cd->spm_ctx == NULL) {
+    if (DetectContentConvertToNocase(de_ctx, cd) != 0)
         return -1;
-    }
     if (DetectEngineContentModifierBufferSetup(
                 de_ctx, s, NULL, DETECT_FILE_NAME, g_file_name_buffer_id, s->alproto) < 0)
         return -1;
@@ -191,13 +186,8 @@ static int DetectFilenameSetup (DetectEngineCtx *de_ctx, Signature *s, const cha
         return -1;
 
     DetectContentData *cd = (DetectContentData *)sm->ctx;
-    cd->flags |= DETECT_CONTENT_NOCASE;
-    /* Recreate the context with nocase chars */
-    SpmDestroyCtx(cd->spm_ctx);
-    cd->spm_ctx = SpmInitCtx(cd->content, cd->content_len, 1, de_ctx->spm_global_thread_ctx);
-    if (cd->spm_ctx == NULL) {
+    if (DetectContentConvertToNocase(de_ctx, cd) != 0)
         return -1;
-    }
     if (DetectEngineContentModifierBufferSetup(
                 de_ctx, s, NULL, DETECT_FILE_NAME, g_file_name_buffer_id, s->alproto) < 0)
         return -1;