From: Victor Julien <vjulien@oisf.net>
Date: Fri, 4 Aug 2023 12:18:20 +0000 (+0200)
Subject: detect/content: cleanup nocase conversion
X-Git-Tag: suricata-6.0.14~14
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=71ec1c85ff7b503a2e7c70502f226dcd4b219dbf;p=thirdparty%2Fsuricata.git

detect/content: cleanup nocase conversion

(cherry picked from commit ef936acdba0cda1da09ff4b7ea35281bd8f18429)
---

diff --git a/src/detect-content.c b/src/detect-content.c
index d0c71755fb..0391ba9e8f 100644
--- a/src/detect-content.c
+++ b/src/detect-content.c
@@ -658,6 +658,30 @@ void DetectContentPropagateLimits(Signature *s)
 #undef VALIDATE
 }
 
+int DetectContentConvertToNocase(DetectEngineCtx *de_ctx, DetectContentData *cd)
+{
+    if (cd->flags & DETECT_CONTENT_NOCASE) {
+        SCLogError(SC_ERR_INVALID_SIGNATURE,
+                "can't use multiple nocase modifiers with the same content");
+        return -1;
+    }
+
+    /* for consistency in later use (e.g. by MPM construction and hashing),
+     * coerce the content string to lower-case. */
+    for (uint8_t *c = cd->content; c < cd->content + cd->content_len; c++) {
+        *c = u8_tolower(*c);
+    }
+
+    cd->flags |= DETECT_CONTENT_NOCASE;
+    /* Recreate the context with nocase chars */
+    SpmDestroyCtx(cd->spm_ctx);
+    cd->spm_ctx = SpmInitCtx(cd->content, cd->content_len, 1, de_ctx->spm_global_thread_ctx);
+    if (cd->spm_ctx == NULL) {
+        return -1;
+    }
+    return 0;
+}
+
 #ifdef UNITTESTS /* UNITTESTS */
 
 static bool TestLastContent(const Signature *s, uint16_t o, uint16_t d)
diff --git a/src/detect-content.h b/src/detect-content.h
index 83589fd6ea..ef87d7f7f4 100644
--- a/src/detect-content.h
+++ b/src/detect-content.h
@@ -123,4 +123,6 @@ void DetectContentFree(DetectEngineCtx *, void *);
 bool DetectContentPMATCHValidateCallback(const Signature *s);
 void DetectContentPropagateLimits(Signature *s);
 
+int DetectContentConvertToNocase(DetectEngineCtx *de_ctx, DetectContentData *cd);
+
 #endif /* __DETECT_CONTENT_H__ */
diff --git a/src/detect-nocase.c b/src/detect-nocase.c
index 60f7330597..65d6b83e82 100644
--- a/src/detect-nocase.c
+++ b/src/detect-nocase.c
@@ -73,30 +73,8 @@ static int DetectNocaseSetup (DetectEngineCtx *de_ctx, Signature *s, const char
         goto end;
     }
 
-    /* verify other conditions. */
-    DetectContentData *cd = (DetectContentData *)pm->ctx;;
-
-    if (cd->flags & DETECT_CONTENT_NOCASE) {
-        SCLogError(SC_ERR_INVALID_SIGNATURE, "can't use multiple nocase modifiers with the same content");
-        goto end;
-    }
-
-    /* for consistency in later use (e.g. by MPM construction and hashing),
-     * coerce the content string to lower-case. */
-    for (uint8_t *c = cd->content; c < cd->content + cd->content_len; c++) {
-        *c = u8_tolower(*c);
-    }
-
-    cd->flags |= DETECT_CONTENT_NOCASE;
-    /* Recreate the context with nocase chars */
-    SpmDestroyCtx(cd->spm_ctx);
-    cd->spm_ctx = SpmInitCtx(cd->content, cd->content_len, 1,
-                             de_ctx->spm_global_thread_ctx);
-    if (cd->spm_ctx == NULL) {
-        goto end;
-    }
-
-    ret = 0;
+    DetectContentData *cd = (DetectContentData *)pm->ctx;
+    ret = DetectContentConvertToNocase(de_ctx, cd);
  end:
     SCReturnInt(ret);
 }