From: Victor Julien <vjulien@oisf.net>
Date: Fri, 17 Mar 2023 16:36:53 +0000 (+0100)
Subject: detect/http_client_body: use list util in tests
X-Git-Tag: suricata-7.0.0-rc2~384
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=5cb2e6ad6a1688c5eb0caecba263d5074b313ccc;p=thirdparty%2Fsuricata.git

detect/http_client_body: use list util in tests

Cleanups.
---

diff --git a/src/tests/detect-http-client-body.c b/src/tests/detect-http-client-body.c
index 2fdf1fe7d9..a93894eb37 100644
--- a/src/tests/detect-http-client-body.c
+++ b/src/tests/detect-http-client-body.c
@@ -2202,109 +2202,84 @@ end:
 
 static int DetectHttpClientBodyTest22(void)
 {
-    DetectEngineCtx *de_ctx = NULL;
-    int result = 0;
-
-    if ( (de_ctx = DetectEngineCtxInit()) == NULL)
-        goto end;
-
+    DetectEngineCtx *de_ctx = DetectEngineCtxInit();
+    FAIL_IF_NULL(de_ctx);
     de_ctx->flags |= DE_QUIET;
-    de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any "
-                               "(content:\"one\"; content:\"two\"; http_client_body; "
-                               "content:\"three\"; distance:10; http_client_body; content:\"four\"; sid:1;)");
-    if (de_ctx->sig_list == NULL) {
-        printf("de_ctx->sig_list == NULL\n");
-        goto end;
-    }
-
-    if (de_ctx->sig_list->sm_lists[DETECT_SM_LIST_PMATCH] == NULL) {
-        printf("de_ctx->sig_list->sm_lists[DETECT_SM_LIST_PMATCH] == NULL\n");
-        goto end;
-    }
-
-    if (de_ctx->sig_list->sm_lists[g_http_client_body_buffer_id] == NULL) {
-        printf("de_ctx->sig_list->sm_lists[g_http_client_body_buffer_id] == NULL\n");
-        goto end;
-    }
-
-    DetectContentData *cd1 = (DetectContentData *)de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_PMATCH]->prev->ctx;
-    DetectContentData *cd2 = (DetectContentData *)de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_PMATCH]->ctx;
-    DetectContentData *hcbd1 = (DetectContentData *)de_ctx->sig_list->sm_lists_tail[g_http_client_body_buffer_id]->prev->ctx;
-    DetectContentData *hcbd2 = (DetectContentData *)de_ctx->sig_list->sm_lists_tail[g_http_client_body_buffer_id]->ctx;
-    if (cd1->flags != 0 || memcmp(cd1->content, "one", cd1->content_len) != 0 ||
-        cd2->flags != 0 || memcmp(cd2->content, "four", cd2->content_len) != 0 ||
-        hcbd1->flags != DETECT_CONTENT_RELATIVE_NEXT ||
-        memcmp(hcbd1->content, "two", hcbd1->content_len) != 0 ||
-        hcbd2->flags != DETECT_CONTENT_DISTANCE ||
-        memcmp(hcbd2->content, "three", hcbd1->content_len) != 0) {
-        goto end;
-    }
-
-    if (!DETECT_CONTENT_IS_SINGLE(cd1) ||
-        !DETECT_CONTENT_IS_SINGLE(cd2) ||
-        DETECT_CONTENT_IS_SINGLE(hcbd1) ||
-        DETECT_CONTENT_IS_SINGLE(hcbd2)) {
-        goto end;
-    }
+    Signature *s = DetectEngineAppendSig(de_ctx,
+            "alert icmp any any -> any any "
+            "(content:\"one\"; content:\"two\"; http_client_body; "
+            "content:\"three\"; distance:10; http_client_body; content:\"four\"; sid:1;)");
+    FAIL_IF_NULL(s);
+    FAIL_IF_NULL(s->init_data->smlists[DETECT_SM_LIST_PMATCH]);
+    FAIL_IF(DetectBufferGetFirstSigMatch(s, g_http_client_body_buffer_id) == NULL);
+    SigMatch *sm = DetectBufferGetFirstSigMatch(s, g_http_client_body_buffer_id);
+    FAIL_IF_NULL(sm);
 
-    result = 1;
+    DetectContentData *cd1 =
+            (DetectContentData *)s->init_data->smlists_tail[DETECT_SM_LIST_PMATCH]->prev->ctx;
+    DetectContentData *cd2 =
+            (DetectContentData *)s->init_data->smlists_tail[DETECT_SM_LIST_PMATCH]->ctx;
+    DetectContentData *hcbd1 =
+            (DetectContentData *)DetectBufferGetLastSigMatch(s, g_http_client_body_buffer_id)
+                    ->prev->ctx;
+    DetectContentData *hcbd2 =
+            (DetectContentData *)DetectBufferGetLastSigMatch(s, g_http_client_body_buffer_id)->ctx;
+    FAIL_IF(cd1->flags != 0);
+    FAIL_IF(memcmp(cd1->content, "one", cd1->content_len) != 0);
+    FAIL_IF(cd2->flags != 0);
+    FAIL_IF(memcmp(cd2->content, "four", cd2->content_len) != 0);
+    FAIL_IF(hcbd1->flags != DETECT_CONTENT_RELATIVE_NEXT);
+    FAIL_IF(memcmp(hcbd1->content, "two", hcbd1->content_len) != 0);
+    FAIL_IF(hcbd2->flags != DETECT_CONTENT_DISTANCE);
+    FAIL_IF(memcmp(hcbd2->content, "three", hcbd1->content_len) != 0);
+
+    FAIL_IF(!DETECT_CONTENT_IS_SINGLE(cd1));
+    FAIL_IF(!DETECT_CONTENT_IS_SINGLE(cd2));
+    FAIL_IF(DETECT_CONTENT_IS_SINGLE(hcbd1));
+    FAIL_IF(DETECT_CONTENT_IS_SINGLE(hcbd2));
 
- end:
     DetectEngineCtxFree(de_ctx);
-    return result;
+    PASS;
 }
 
 static int DetectHttpClientBodyTest23(void)
 {
-    DetectEngineCtx *de_ctx = NULL;
-    int result = 0;
-
-    if ( (de_ctx = DetectEngineCtxInit()) == NULL)
-        goto end;
-
+    DetectEngineCtx *de_ctx = DetectEngineCtxInit();
+    FAIL_IF_NULL(de_ctx);
     de_ctx->flags |= DE_QUIET;
-    de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any "
-                               "(content:\"one\"; http_client_body; pcre:/two/; "
-                               "content:\"three\"; distance:10; http_client_body; content:\"four\"; sid:1;)");
-    if (de_ctx->sig_list == NULL) {
-        printf("de_ctx->sig_list == NULL\n");
-        goto end;
-    }
-
-    if (de_ctx->sig_list->sm_lists[DETECT_SM_LIST_PMATCH] == NULL) {
-        printf("de_ctx->sig_list->sm_lists[DETECT_SM_LIST_PMATCH] == NULL\n");
-        goto end;
-    }
-
-    if (de_ctx->sig_list->sm_lists[g_http_client_body_buffer_id] == NULL) {
-        printf("de_ctx->sig_list->sm_lists[g_http_client_body_buffer_id] == NULL\n");
-        goto end;
-    }
-
-    DetectPcreData *pd1 = (DetectPcreData *)de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_PMATCH]->prev->ctx;
-    DetectContentData *cd2 = (DetectContentData *)de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_PMATCH]->ctx;
-    DetectContentData *hcbd1 = (DetectContentData *)de_ctx->sig_list->sm_lists_tail[g_http_client_body_buffer_id]->prev->ctx;
-    DetectContentData *hcbd2 = (DetectContentData *)de_ctx->sig_list->sm_lists_tail[g_http_client_body_buffer_id]->ctx;
-    if (pd1->flags != 0 ||
-        cd2->flags != 0 || memcmp(cd2->content, "four", cd2->content_len) != 0 ||
-        hcbd1->flags != DETECT_CONTENT_RELATIVE_NEXT ||
-        memcmp(hcbd1->content, "one", hcbd1->content_len) != 0 ||
-        hcbd2->flags != DETECT_CONTENT_DISTANCE ||
-        memcmp(hcbd2->content, "three", hcbd1->content_len) != 0) {
-        goto end;
-    }
-
-    if (!DETECT_CONTENT_IS_SINGLE(cd2) ||
-        DETECT_CONTENT_IS_SINGLE(hcbd1) ||
-        DETECT_CONTENT_IS_SINGLE(hcbd2)) {
-        goto end;
-    }
 
-    result = 1;
+    Signature *s = DetectEngineAppendSig(de_ctx,
+            "alert icmp any any -> any any "
+            "(content:\"one\"; http_client_body; pcre:/two/; "
+            "content:\"three\"; distance:10; http_client_body; content:\"four\"; sid:1;)");
+    FAIL_IF_NULL(s);
+    FAIL_IF_NULL(s->init_data->smlists[DETECT_SM_LIST_PMATCH]);
+    FAIL_IF_NULL(DetectBufferGetFirstSigMatch(s, g_http_client_body_buffer_id));
+
+    DetectPcreData *pd1 =
+            (DetectPcreData *)de_ctx->sig_list->init_data->smlists_tail[DETECT_SM_LIST_PMATCH]
+                    ->prev->ctx;
+    DetectContentData *cd2 =
+            (DetectContentData *)de_ctx->sig_list->init_data->smlists_tail[DETECT_SM_LIST_PMATCH]
+                    ->ctx;
+    DetectContentData *hcbd1 =
+            (DetectContentData *)DetectBufferGetLastSigMatch(s, g_http_client_body_buffer_id)
+                    ->prev->ctx;
+    DetectContentData *hcbd2 =
+            (DetectContentData *)DetectBufferGetLastSigMatch(s, g_http_client_body_buffer_id)->ctx;
+    FAIL_IF(pd1->flags != 0);
+    FAIL_IF(cd2->flags != 0);
+    FAIL_IF(memcmp(cd2->content, "four", cd2->content_len) != 0);
+    FAIL_IF(hcbd1->flags != DETECT_CONTENT_RELATIVE_NEXT);
+    FAIL_IF(memcmp(hcbd1->content, "one", hcbd1->content_len) != 0);
+    FAIL_IF(hcbd2->flags != DETECT_CONTENT_DISTANCE);
+    FAIL_IF(memcmp(hcbd2->content, "three", hcbd1->content_len) != 0);
+    FAIL_IF(!DETECT_CONTENT_IS_SINGLE(cd2));
+    FAIL_IF(DETECT_CONTENT_IS_SINGLE(hcbd1));
+    FAIL_IF(DETECT_CONTENT_IS_SINGLE(hcbd2));
 
- end:
     DetectEngineCtxFree(de_ctx);
-    return result;
+    PASS;
 }
 
 static int DetectHttpClientBodyTest24(void)
@@ -2316,28 +2291,36 @@ static int DetectHttpClientBodyTest24(void)
         goto end;
 
     de_ctx->flags |= DE_QUIET;
-    de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any "
-                               "(content:\"one\"; http_client_body; pcre:/two/; "
-                               "content:\"three\"; distance:10; within:15; http_client_body; content:\"four\"; sid:1;)");
+    Signature *s = DetectEngineAppendSig(de_ctx, "alert icmp any any -> any any "
+                                                 "(content:\"one\"; http_client_body; pcre:/two/; "
+                                                 "content:\"three\"; distance:10; within:15; "
+                                                 "http_client_body; content:\"four\"; sid:1;)");
     if (de_ctx->sig_list == NULL) {
         printf("de_ctx->sig_list == NULL\n");
         goto end;
     }
 
-    if (de_ctx->sig_list->sm_lists[DETECT_SM_LIST_PMATCH] == NULL) {
-        printf("de_ctx->sig_list->sm_lists[DETECT_SM_LIST_PMATCH] == NULL\n");
+    if (de_ctx->sig_list->init_data->smlists[DETECT_SM_LIST_PMATCH] == NULL) {
+        printf("de_ctx->sig_list->init_data->smlists[DETECT_SM_LIST_PMATCH] == NULL\n");
         goto end;
     }
 
-    if (de_ctx->sig_list->sm_lists[g_http_client_body_buffer_id] == NULL) {
-        printf("de_ctx->sig_list->sm_lists[g_http_client_body_buffer_id] == NULL\n");
+    if (DetectBufferGetFirstSigMatch(s, g_http_client_body_buffer_id) == NULL) {
+        printf("DetectBufferGetFirstSigMatch(s, g_http_client_body_buffer_id) == NULL\n");
         goto end;
     }
 
-    DetectPcreData *pd1 = (DetectPcreData *)de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_PMATCH]->prev->ctx;
-    DetectContentData *cd2 = (DetectContentData *)de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_PMATCH]->ctx;
-    DetectContentData *hcbd1 = (DetectContentData *)de_ctx->sig_list->sm_lists_tail[g_http_client_body_buffer_id]->prev->ctx;
-    DetectContentData *hcbd2 = (DetectContentData *)de_ctx->sig_list->sm_lists_tail[g_http_client_body_buffer_id]->ctx;
+    DetectPcreData *pd1 =
+            (DetectPcreData *)de_ctx->sig_list->init_data->smlists_tail[DETECT_SM_LIST_PMATCH]
+                    ->prev->ctx;
+    DetectContentData *cd2 =
+            (DetectContentData *)de_ctx->sig_list->init_data->smlists_tail[DETECT_SM_LIST_PMATCH]
+                    ->ctx;
+    DetectContentData *hcbd1 =
+            (DetectContentData *)DetectBufferGetLastSigMatch(s, g_http_client_body_buffer_id)
+                    ->prev->ctx;
+    DetectContentData *hcbd2 =
+            (DetectContentData *)DetectBufferGetLastSigMatch(s, g_http_client_body_buffer_id)->ctx;
     if (pd1->flags != 0 ||
         cd2->flags != 0 || memcmp(cd2->content, "four", cd2->content_len) != 0 ||
         hcbd1->flags != DETECT_CONTENT_RELATIVE_NEXT ||
@@ -2369,29 +2352,37 @@ static int DetectHttpClientBodyTest25(void)
         goto end;
 
     de_ctx->flags |= DE_QUIET;
-    de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any "
-                               "(content:\"one\"; http_client_body; pcre:/two/; "
-                               "content:\"three\"; distance:10; http_client_body; "
-                               "content:\"four\"; distance:10; sid:1;)");
+    Signature *s =
+            DetectEngineAppendSig(de_ctx, "alert icmp any any -> any any "
+                                          "(content:\"one\"; http_client_body; pcre:/two/; "
+                                          "content:\"three\"; distance:10; http_client_body; "
+                                          "content:\"four\"; distance:10; sid:1;)");
     if (de_ctx->sig_list == NULL) {
         printf("de_ctx->sig_list == NULL\n");
         goto end;
     }
 
-    if (de_ctx->sig_list->sm_lists[DETECT_SM_LIST_PMATCH] == NULL) {
-        printf("de_ctx->sig_list->sm_lists[DETECT_SM_LIST_PMATCH] == NULL\n");
+    if (de_ctx->sig_list->init_data->smlists[DETECT_SM_LIST_PMATCH] == NULL) {
+        printf("de_ctx->sig_list->init_data->smlists[DETECT_SM_LIST_PMATCH] == NULL\n");
         goto end;
     }
 
-    if (de_ctx->sig_list->sm_lists[g_http_client_body_buffer_id] == NULL) {
-        printf("de_ctx->sig_list->sm_lists[g_http_client_body_buffer_id] == NULL\n");
+    if (DetectBufferGetFirstSigMatch(s, g_http_client_body_buffer_id) == NULL) {
+        printf("DetectBufferGetFirstSigMatch(s, g_http_client_body_buffer_id) == NULL\n");
         goto end;
     }
 
-    DetectPcreData *pd1 = (DetectPcreData *)de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_PMATCH]->prev->ctx;
-    DetectContentData *cd2 = (DetectContentData *)de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_PMATCH]->ctx;
-    DetectContentData *hcbd1 = (DetectContentData *)de_ctx->sig_list->sm_lists_tail[g_http_client_body_buffer_id]->prev->ctx;
-    DetectContentData *hcbd2 = (DetectContentData *)de_ctx->sig_list->sm_lists_tail[g_http_client_body_buffer_id]->ctx;
+    DetectPcreData *pd1 =
+            (DetectPcreData *)de_ctx->sig_list->init_data->smlists_tail[DETECT_SM_LIST_PMATCH]
+                    ->prev->ctx;
+    DetectContentData *cd2 =
+            (DetectContentData *)de_ctx->sig_list->init_data->smlists_tail[DETECT_SM_LIST_PMATCH]
+                    ->ctx;
+    DetectContentData *hcbd1 =
+            (DetectContentData *)DetectBufferGetLastSigMatch(s, g_http_client_body_buffer_id)
+                    ->prev->ctx;
+    DetectContentData *hcbd2 =
+            (DetectContentData *)DetectBufferGetLastSigMatch(s, g_http_client_body_buffer_id)->ctx;
     if (pd1->flags != DETECT_PCRE_RELATIVE_NEXT ||
         cd2->flags != DETECT_CONTENT_DISTANCE ||
         memcmp(cd2->content, "four", cd2->content_len) != 0 ||
@@ -2424,29 +2415,37 @@ static int DetectHttpClientBodyTest26(void)
         goto end;
 
     de_ctx->flags |= DE_QUIET;
-    de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any "
-                               "(content:\"one\"; offset:10; http_client_body; pcre:/two/; "
-                               "content:\"three\"; distance:10; http_client_body; within:10; "
-                               "content:\"four\"; distance:10; sid:1;)");
+    Signature *s = DetectEngineAppendSig(de_ctx,
+            "alert icmp any any -> any any "
+            "(content:\"one\"; offset:10; http_client_body; pcre:/two/; "
+            "content:\"three\"; distance:10; http_client_body; within:10; "
+            "content:\"four\"; distance:10; sid:1;)");
     if (de_ctx->sig_list == NULL) {
         printf("de_ctx->sig_list == NULL\n");
         goto end;
     }
 
-    if (de_ctx->sig_list->sm_lists[DETECT_SM_LIST_PMATCH] == NULL) {
-        printf("de_ctx->sig_list->sm_lists[DETECT_SM_LIST_PMATCH] == NULL\n");
+    if (de_ctx->sig_list->init_data->smlists[DETECT_SM_LIST_PMATCH] == NULL) {
+        printf("de_ctx->sig_list->init_data->smlists[DETECT_SM_LIST_PMATCH] == NULL\n");
         goto end;
     }
 
-    if (de_ctx->sig_list->sm_lists[g_http_client_body_buffer_id] == NULL) {
-        printf("de_ctx->sig_list->sm_lists[g_http_client_body_buffer_id] == NULL\n");
+    if (DetectBufferGetFirstSigMatch(s, g_http_client_body_buffer_id) == NULL) {
+        printf("DetectBufferGetFirstSigMatch(s, g_http_client_body_buffer_id) == NULL\n");
         goto end;
     }
 
-    DetectPcreData *pd1 = (DetectPcreData *)de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_PMATCH]->prev->ctx;
-    DetectContentData *cd2 = (DetectContentData *)de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_PMATCH]->ctx;
-    DetectContentData *hcbd1 = (DetectContentData *)de_ctx->sig_list->sm_lists_tail[g_http_client_body_buffer_id]->prev->ctx;
-    DetectContentData *hcbd2 = (DetectContentData *)de_ctx->sig_list->sm_lists_tail[g_http_client_body_buffer_id]->ctx;
+    DetectPcreData *pd1 =
+            (DetectPcreData *)de_ctx->sig_list->init_data->smlists_tail[DETECT_SM_LIST_PMATCH]
+                    ->prev->ctx;
+    DetectContentData *cd2 =
+            (DetectContentData *)de_ctx->sig_list->init_data->smlists_tail[DETECT_SM_LIST_PMATCH]
+                    ->ctx;
+    DetectContentData *hcbd1 =
+            (DetectContentData *)DetectBufferGetLastSigMatch(s, g_http_client_body_buffer_id)
+                    ->prev->ctx;
+    DetectContentData *hcbd2 =
+            (DetectContentData *)DetectBufferGetLastSigMatch(s, g_http_client_body_buffer_id)->ctx;
     if (pd1->flags != (DETECT_PCRE_RELATIVE_NEXT) ||
         cd2->flags != DETECT_CONTENT_DISTANCE ||
         memcmp(cd2->content, "four", cd2->content_len) != 0 ||
@@ -2503,29 +2502,36 @@ static int DetectHttpClientBodyTest28(void)
         goto end;
 
     de_ctx->flags |= DE_QUIET;
-    de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any "
-                               "(content:\"one\"; http_client_body; pcre:/two/; "
-                               "content:\"three\"; http_client_body; depth:10; "
-                               "content:\"four\"; distance:10; sid:1;)");
+    Signature *s = DetectEngineAppendSig(de_ctx, "alert icmp any any -> any any "
+                                                 "(content:\"one\"; http_client_body; pcre:/two/; "
+                                                 "content:\"three\"; http_client_body; depth:10; "
+                                                 "content:\"four\"; distance:10; sid:1;)");
     if (de_ctx->sig_list == NULL) {
         printf("de_ctx->sig_list == NULL\n");
         goto end;
     }
 
-    if (de_ctx->sig_list->sm_lists[DETECT_SM_LIST_PMATCH] == NULL) {
-        printf("de_ctx->sig_list->sm_lists[DETECT_SM_LIST_PMATCH] == NULL\n");
+    if (de_ctx->sig_list->init_data->smlists[DETECT_SM_LIST_PMATCH] == NULL) {
+        printf("de_ctx->sig_list->init_data->smlists[DETECT_SM_LIST_PMATCH] == NULL\n");
         goto end;
     }
 
-    if (de_ctx->sig_list->sm_lists[g_http_client_body_buffer_id] == NULL) {
-        printf("de_ctx->sig_list->sm_lists[g_http_client_body_buffer_id] == NULL\n");
+    if (DetectBufferGetFirstSigMatch(s, g_http_client_body_buffer_id) == NULL) {
+        printf("DetectBufferGetFirstSigMatch(s, g_http_client_body_buffer_id) == NULL\n");
         goto end;
     }
 
-    DetectPcreData *pd1 = (DetectPcreData *)de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_PMATCH]->prev->ctx;
-    DetectContentData *cd2 = (DetectContentData *)de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_PMATCH]->ctx;
-    DetectContentData *hcbd1 = (DetectContentData *)de_ctx->sig_list->sm_lists_tail[g_http_client_body_buffer_id]->prev->ctx;
-    DetectContentData *hcbd2 = (DetectContentData *)de_ctx->sig_list->sm_lists_tail[g_http_client_body_buffer_id]->ctx;
+    DetectPcreData *pd1 =
+            (DetectPcreData *)de_ctx->sig_list->init_data->smlists_tail[DETECT_SM_LIST_PMATCH]
+                    ->prev->ctx;
+    DetectContentData *cd2 =
+            (DetectContentData *)de_ctx->sig_list->init_data->smlists_tail[DETECT_SM_LIST_PMATCH]
+                    ->ctx;
+    DetectContentData *hcbd1 =
+            (DetectContentData *)DetectBufferGetLastSigMatch(s, g_http_client_body_buffer_id)
+                    ->prev->ctx;
+    DetectContentData *hcbd2 =
+            (DetectContentData *)DetectBufferGetLastSigMatch(s, g_http_client_body_buffer_id)->ctx;
     if (pd1->flags != (DETECT_PCRE_RELATIVE_NEXT) ||
         cd2->flags != DETECT_CONTENT_DISTANCE ||
         memcmp(cd2->content, "four", cd2->content_len) != 0 ||
@@ -2558,26 +2564,30 @@ static int DetectHttpClientBodyTest29(void)
         goto end;
 
     de_ctx->flags |= DE_QUIET;
-    de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any "
-                               "(content:\"one\"; http_client_body; "
-                               "content:\"two\"; distance:0; http_client_body; sid:1;)");
+    Signature *s =
+            DetectEngineAppendSig(de_ctx, "alert icmp any any -> any any "
+                                          "(content:\"one\"; http_client_body; "
+                                          "content:\"two\"; distance:0; http_client_body; sid:1;)");
     if (de_ctx->sig_list == NULL) {
         printf("de_ctx->sig_list == NULL\n");
         goto end;
     }
 
-    if (de_ctx->sig_list->sm_lists[DETECT_SM_LIST_PMATCH] != NULL) {
-        printf("de_ctx->sig_list->sm_lists[DETECT_SM_LIST_PMATCH] != NULL\n");
+    if (de_ctx->sig_list->init_data->smlists[DETECT_SM_LIST_PMATCH] != NULL) {
+        printf("de_ctx->sig_list->init_data->smlists[DETECT_SM_LIST_PMATCH] != NULL\n");
         goto end;
     }
 
-    if (de_ctx->sig_list->sm_lists[g_http_client_body_buffer_id] == NULL) {
-        printf("de_ctx->sig_list->sm_lists[g_http_client_body_buffer_id] == NULL\n");
+    if (DetectBufferGetFirstSigMatch(s, g_http_client_body_buffer_id) == NULL) {
+        printf("DetectBufferGetFirstSigMatch(s, g_http_client_body_buffer_id) == NULL\n");
         goto end;
     }
 
-    DetectContentData *hcbd1 = (DetectContentData *)de_ctx->sig_list->sm_lists_tail[g_http_client_body_buffer_id]->prev->ctx;
-    DetectContentData *hcbd2 = (DetectContentData *)de_ctx->sig_list->sm_lists_tail[g_http_client_body_buffer_id]->ctx;
+    DetectContentData *hcbd1 =
+            (DetectContentData *)DetectBufferGetLastSigMatch(s, g_http_client_body_buffer_id)
+                    ->prev->ctx;
+    DetectContentData *hcbd2 =
+            (DetectContentData *)DetectBufferGetLastSigMatch(s, g_http_client_body_buffer_id)->ctx;
     if (hcbd1->flags != DETECT_CONTENT_RELATIVE_NEXT ||
         memcmp(hcbd1->content, "one", hcbd1->content_len) != 0 ||
         hcbd2->flags != DETECT_CONTENT_DISTANCE ||
@@ -2601,26 +2611,30 @@ static int DetectHttpClientBodyTest30(void)
         goto end;
 
     de_ctx->flags |= DE_QUIET;
-    de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any "
-                               "(content:\"one\"; http_client_body; "
-                               "content:\"two\"; within:5; http_client_body; sid:1;)");
+    Signature *s =
+            DetectEngineAppendSig(de_ctx, "alert icmp any any -> any any "
+                                          "(content:\"one\"; http_client_body; "
+                                          "content:\"two\"; within:5; http_client_body; sid:1;)");
     if (de_ctx->sig_list == NULL) {
         printf("de_ctx->sig_list == NULL\n");
         goto end;
     }
 
-    if (de_ctx->sig_list->sm_lists[DETECT_SM_LIST_PMATCH] != NULL) {
-        printf("de_ctx->sig_list->sm_lists[DETECT_SM_LIST_PMATCH] != NULL\n");
+    if (de_ctx->sig_list->init_data->smlists[DETECT_SM_LIST_PMATCH] != NULL) {
+        printf("de_ctx->sig_list->init_data->smlists[DETECT_SM_LIST_PMATCH] != NULL\n");
         goto end;
     }
 
-    if (de_ctx->sig_list->sm_lists[g_http_client_body_buffer_id] == NULL) {
-        printf("de_ctx->sig_list->sm_lists[g_http_client_body_buffer_id] == NULL\n");
+    if (DetectBufferGetFirstSigMatch(s, g_http_client_body_buffer_id) == NULL) {
+        printf("DetectBufferGetFirstSigMatch(s, g_http_client_body_buffer_id) == NULL\n");
         goto end;
     }
 
-    DetectContentData *hcbd1 = (DetectContentData *)de_ctx->sig_list->sm_lists_tail[g_http_client_body_buffer_id]->prev->ctx;
-    DetectContentData *hcbd2 = (DetectContentData *)de_ctx->sig_list->sm_lists_tail[g_http_client_body_buffer_id]->ctx;
+    DetectContentData *hcbd1 =
+            (DetectContentData *)DetectBufferGetLastSigMatch(s, g_http_client_body_buffer_id)
+                    ->prev->ctx;
+    DetectContentData *hcbd2 =
+            (DetectContentData *)DetectBufferGetLastSigMatch(s, g_http_client_body_buffer_id)->ctx;
     if (hcbd1->flags != DETECT_CONTENT_RELATIVE_NEXT ||
         memcmp(hcbd1->content, "one", hcbd1->content_len) != 0 ||
         hcbd2->flags != DETECT_CONTENT_WITHIN ||
@@ -2706,34 +2720,39 @@ static int DetectHttpClientBodyTest34(void)
         goto end;
 
     de_ctx->flags |= DE_QUIET;
-    de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any "
-                               "(pcre:/one/P; "
-                               "content:\"two\"; within:5; http_client_body; sid:1;)");
+    Signature *s =
+            DetectEngineAppendSig(de_ctx, "alert icmp any any -> any any "
+                                          "(pcre:/one/P; "
+                                          "content:\"two\"; within:5; http_client_body; sid:1;)");
     if (de_ctx->sig_list == NULL) {
         printf("de_ctx->sig_list == NULL\n");
         goto end;
     }
 
-    if (de_ctx->sig_list->sm_lists[DETECT_SM_LIST_PMATCH] != NULL) {
-        printf("de_ctx->sig_list->sm_lists[DETECT_SM_LIST_PMATCH] != NULL\n");
+    if (de_ctx->sig_list->init_data->smlists[DETECT_SM_LIST_PMATCH] != NULL) {
+        printf("de_ctx->sig_list->init_data->smlists[DETECT_SM_LIST_PMATCH] != NULL\n");
         goto end;
     }
 
-    if (de_ctx->sig_list->sm_lists[g_http_client_body_buffer_id] == NULL) {
-        printf("de_ctx->sig_list->sm_lists[g_http_client_body_buffer_id] == NULL\n");
+    if (DetectBufferGetFirstSigMatch(s, g_http_client_body_buffer_id) == NULL) {
+        printf("DetectBufferGetFirstSigMatch(s, g_http_client_body_buffer_id) == NULL\n");
         goto end;
     }
 
-    if (de_ctx->sig_list->sm_lists_tail[g_http_client_body_buffer_id] == NULL ||
-        de_ctx->sig_list->sm_lists_tail[g_http_client_body_buffer_id]->type != DETECT_CONTENT ||
-        de_ctx->sig_list->sm_lists_tail[g_http_client_body_buffer_id]->prev == NULL ||
-        de_ctx->sig_list->sm_lists_tail[g_http_client_body_buffer_id]->prev->type != DETECT_PCRE) {
+    if (DetectBufferGetLastSigMatch(s, g_http_client_body_buffer_id) == NULL ||
+            DetectBufferGetLastSigMatch(s, g_http_client_body_buffer_id)->type != DETECT_CONTENT ||
+            DetectBufferGetLastSigMatch(s, g_http_client_body_buffer_id)->prev == NULL ||
+            DetectBufferGetLastSigMatch(s, g_http_client_body_buffer_id)->prev->type !=
+                    DETECT_PCRE) {
 
         goto end;
     }
 
-    DetectPcreData *pd1 = (DetectPcreData *)de_ctx->sig_list->sm_lists_tail[g_http_client_body_buffer_id]->prev->ctx;
-    DetectContentData *hcbd2 = (DetectContentData *)de_ctx->sig_list->sm_lists_tail[g_http_client_body_buffer_id]->ctx;
+    DetectPcreData *pd1 =
+            (DetectPcreData *)DetectBufferGetLastSigMatch(s, g_http_client_body_buffer_id)
+                    ->prev->ctx;
+    DetectContentData *hcbd2 =
+            (DetectContentData *)DetectBufferGetLastSigMatch(s, g_http_client_body_buffer_id)->ctx;
     if (pd1->flags != (DETECT_PCRE_RELATIVE_NEXT) ||
         hcbd2->flags != DETECT_CONTENT_WITHIN ||
         memcmp(hcbd2->content, "two", hcbd2->content_len) != 0) {
@@ -2756,34 +2775,38 @@ static int DetectHttpClientBodyTest35(void)
         goto end;
 
     de_ctx->flags |= DE_QUIET;
-    de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any "
-                               "(content:\"two\"; http_client_body; "
-                               "pcre:/one/PR; sid:1;)");
+    Signature *s = DetectEngineAppendSig(de_ctx, "alert icmp any any -> any any "
+                                                 "(content:\"two\"; http_client_body; "
+                                                 "pcre:/one/PR; sid:1;)");
     if (de_ctx->sig_list == NULL) {
         printf("de_ctx->sig_list == NULL\n");
         goto end;
     }
 
-    if (de_ctx->sig_list->sm_lists[DETECT_SM_LIST_PMATCH] != NULL) {
-        printf("de_ctx->sig_list->sm_lists[DETECT_SM_LIST_PMATCH] != NULL\n");
+    if (de_ctx->sig_list->init_data->smlists[DETECT_SM_LIST_PMATCH] != NULL) {
+        printf("de_ctx->sig_list->init_data->smlists[DETECT_SM_LIST_PMATCH] != NULL\n");
         goto end;
     }
 
-    if (de_ctx->sig_list->sm_lists[g_http_client_body_buffer_id] == NULL) {
-        printf("de_ctx->sig_list->sm_lists[g_http_client_body_buffer_id] == NULL\n");
+    if (DetectBufferGetFirstSigMatch(s, g_http_client_body_buffer_id) == NULL) {
+        printf("DetectBufferGetFirstSigMatch(s, g_http_client_body_buffer_id) == NULL\n");
         goto end;
     }
 
-    if (de_ctx->sig_list->sm_lists_tail[g_http_client_body_buffer_id] == NULL ||
-        de_ctx->sig_list->sm_lists_tail[g_http_client_body_buffer_id]->type != DETECT_PCRE ||
-        de_ctx->sig_list->sm_lists_tail[g_http_client_body_buffer_id]->prev == NULL ||
-        de_ctx->sig_list->sm_lists_tail[g_http_client_body_buffer_id]->prev->type != DETECT_CONTENT) {
+    if (DetectBufferGetLastSigMatch(s, g_http_client_body_buffer_id) == NULL ||
+            DetectBufferGetLastSigMatch(s, g_http_client_body_buffer_id)->type != DETECT_PCRE ||
+            DetectBufferGetLastSigMatch(s, g_http_client_body_buffer_id)->prev == NULL ||
+            DetectBufferGetLastSigMatch(s, g_http_client_body_buffer_id)->prev->type !=
+                    DETECT_CONTENT) {
 
         goto end;
     }
 
-    DetectContentData *hcbd1 = (DetectContentData *)de_ctx->sig_list->sm_lists_tail[g_http_client_body_buffer_id]->prev->ctx;
-    DetectPcreData *pd2 = (DetectPcreData *)de_ctx->sig_list->sm_lists_tail[g_http_client_body_buffer_id]->ctx;
+    DetectContentData *hcbd1 =
+            (DetectContentData *)DetectBufferGetLastSigMatch(s, g_http_client_body_buffer_id)
+                    ->prev->ctx;
+    DetectPcreData *pd2 =
+            (DetectPcreData *)DetectBufferGetLastSigMatch(s, g_http_client_body_buffer_id)->ctx;
     if (pd2->flags != (DETECT_PCRE_RELATIVE) ||
         hcbd1->flags != DETECT_CONTENT_RELATIVE_NEXT ||
         memcmp(hcbd1->content, "two", hcbd1->content_len) != 0) {
@@ -2806,34 +2829,39 @@ static int DetectHttpClientBodyTest36(void)
         goto end;
 
     de_ctx->flags |= DE_QUIET;
-    de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any "
-                               "(pcre:/one/P; "
-                               "content:\"two\"; distance:5; http_client_body; sid:1;)");
+    Signature *s =
+            DetectEngineAppendSig(de_ctx, "alert icmp any any -> any any "
+                                          "(pcre:/one/P; "
+                                          "content:\"two\"; distance:5; http_client_body; sid:1;)");
     if (de_ctx->sig_list == NULL) {
         printf("de_ctx->sig_list == NULL\n");
         goto end;
     }
 
-    if (de_ctx->sig_list->sm_lists[DETECT_SM_LIST_PMATCH] != NULL) {
-        printf("de_ctx->sig_list->sm_lists[DETECT_SM_LIST_PMATCH] != NULL\n");
+    if (de_ctx->sig_list->init_data->smlists[DETECT_SM_LIST_PMATCH] != NULL) {
+        printf("de_ctx->sig_list->init_data->smlists[DETECT_SM_LIST_PMATCH] != NULL\n");
         goto end;
     }
 
-    if (de_ctx->sig_list->sm_lists[g_http_client_body_buffer_id] == NULL) {
-        printf("de_ctx->sig_list->sm_lists[g_http_client_body_buffer_id] == NULL\n");
+    if (DetectBufferGetFirstSigMatch(s, g_http_client_body_buffer_id) == NULL) {
+        printf("DetectBufferGetFirstSigMatch(s, g_http_client_body_buffer_id) == NULL\n");
         goto end;
     }
 
-    if (de_ctx->sig_list->sm_lists_tail[g_http_client_body_buffer_id] == NULL ||
-        de_ctx->sig_list->sm_lists_tail[g_http_client_body_buffer_id]->type != DETECT_CONTENT ||
-        de_ctx->sig_list->sm_lists_tail[g_http_client_body_buffer_id]->prev == NULL ||
-        de_ctx->sig_list->sm_lists_tail[g_http_client_body_buffer_id]->prev->type != DETECT_PCRE) {
+    if (DetectBufferGetLastSigMatch(s, g_http_client_body_buffer_id) == NULL ||
+            DetectBufferGetLastSigMatch(s, g_http_client_body_buffer_id)->type != DETECT_CONTENT ||
+            DetectBufferGetLastSigMatch(s, g_http_client_body_buffer_id)->prev == NULL ||
+            DetectBufferGetLastSigMatch(s, g_http_client_body_buffer_id)->prev->type !=
+                    DETECT_PCRE) {
 
         goto end;
     }
 
-    DetectPcreData *pd1 = (DetectPcreData *)de_ctx->sig_list->sm_lists_tail[g_http_client_body_buffer_id]->prev->ctx;
-    DetectContentData *hcbd2 = (DetectContentData *)de_ctx->sig_list->sm_lists_tail[g_http_client_body_buffer_id]->ctx;
+    DetectPcreData *pd1 =
+            (DetectPcreData *)DetectBufferGetLastSigMatch(s, g_http_client_body_buffer_id)
+                    ->prev->ctx;
+    DetectContentData *hcbd2 =
+            (DetectContentData *)DetectBufferGetLastSigMatch(s, g_http_client_body_buffer_id)->ctx;
     if (pd1->flags != (DETECT_PCRE_RELATIVE_NEXT) ||
         hcbd2->flags != DETECT_CONTENT_DISTANCE ||
         memcmp(hcbd2->content, "two", hcbd2->content_len) != 0) {
@@ -2859,7 +2887,7 @@ static int DetectHttpClientBodyIsdataatParseTest(void)
             "isdataat:!4,relative; sid:1;)");
     FAIL_IF_NULL(s);
 
-    SigMatch *sm = s->init_data->smlists_tail[g_http_client_body_buffer_id];
+    SigMatch *sm = DetectBufferGetLastSigMatch(s, g_http_client_body_buffer_id);
     FAIL_IF_NULL(sm);
     FAIL_IF_NOT(sm->type == DETECT_ISDATAAT);