From: Victor Julien <vjulien@oisf.net>
Date: Fri, 4 Aug 2023 15:08:06 +0000 (+0200)
Subject: detect/file: use util to turn keyword to nocase
X-Git-Tag: suricata-6.0.14~13
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=21c987434127b14f7310961d004f24d910550777;p=thirdparty%2Fsuricata.git

detect/file: use util to turn keyword to nocase

This changes the way the pattern is stored by making it lowercase.

(cherry picked from commit c5d83d081e9cd77e49d1477b26e276c979e29dab)
---

diff --git a/src/detect-filemagic.c b/src/detect-filemagic.c
index f8e1bc6174..2af09b48ef 100644
--- a/src/detect-filemagic.c
+++ b/src/detect-filemagic.c
@@ -236,13 +236,8 @@ static int DetectFilemagicSetup (DetectEngineCtx *de_ctx, Signature *s, const ch
         return -1;
 
     DetectContentData *cd = (DetectContentData *)sm->ctx;
-    cd->flags |= DETECT_CONTENT_NOCASE;
-    /* Recreate the context with nocase chars */
-    SpmDestroyCtx(cd->spm_ctx);
-    cd->spm_ctx = SpmInitCtx(cd->content, cd->content_len, 1, de_ctx->spm_global_thread_ctx);
-    if (cd->spm_ctx == NULL) {
+    if (DetectContentConvertToNocase(de_ctx, cd) != 0)
         return -1;
-    }
     if (DetectEngineContentModifierBufferSetup(
                 de_ctx, s, NULL, DETECT_FILE_MAGIC, g_file_magic_buffer_id, s->alproto) < 0)
         return -1;
diff --git a/src/detect-filename.c b/src/detect-filename.c
index 2df4fd478a..6cd111ceff 100644
--- a/src/detect-filename.c
+++ b/src/detect-filename.c
@@ -201,14 +201,9 @@ static int DetectFileextSetup(DetectEngineCtx *de_ctx, Signature *s, const char
         return -1;
 
     DetectContentData *cd = (DetectContentData *)sm->ctx;
-    cd->flags |= DETECT_CONTENT_NOCASE;
     cd->flags |= DETECT_CONTENT_ENDS_WITH;
-    /* Recreate the context with nocase chars */
-    SpmDestroyCtx(cd->spm_ctx);
-    cd->spm_ctx = SpmInitCtx(cd->content, cd->content_len, 1, de_ctx->spm_global_thread_ctx);
-    if (cd->spm_ctx == NULL) {
+    if (DetectContentConvertToNocase(de_ctx, cd) != 0)
         return -1;
-    }
     if (DetectEngineContentModifierBufferSetup(
                 de_ctx, s, NULL, DETECT_FILE_NAME, g_file_name_buffer_id, s->alproto) < 0)
         return -1;
@@ -244,13 +239,8 @@ static int DetectFilenameSetup (DetectEngineCtx *de_ctx, Signature *s, const cha
         return -1;
 
     DetectContentData *cd = (DetectContentData *)sm->ctx;
-    cd->flags |= DETECT_CONTENT_NOCASE;
-    /* Recreate the context with nocase chars */
-    SpmDestroyCtx(cd->spm_ctx);
-    cd->spm_ctx = SpmInitCtx(cd->content, cd->content_len, 1, de_ctx->spm_global_thread_ctx);
-    if (cd->spm_ctx == NULL) {
+    if (DetectContentConvertToNocase(de_ctx, cd) != 0)
         return -1;
-    }
     if (DetectEngineContentModifierBufferSetup(
                 de_ctx, s, NULL, DETECT_FILE_NAME, g_file_name_buffer_id, s->alproto) < 0)
         return -1;