Bug 1230: Check all SigMatch lists for a named byte_extract variable.

diff --git a/src/detect-byte-extract.c b/src/detect-byte-extract.c
index 8d0c1bffac77cb29dab517f65ba6d5c577c9dd1f..8dda193aa00fb7a472803d6d30af7f64745ff28d 100644 (file)
--- a/src/detect-byte-extract.c
+++ b/src/detect-byte-extract.c
@@ -770,22 +770,30 @@ void DetectByteExtractFree(void *ptr)
     return;
 }
 
-SigMatch *DetectByteExtractRetrieveSMVar(const char *arg, Signature *s, int list)
+/**
+ * \brief Lookup the SigMatch for a named byte_extract variable.
+ *
+ * \param arg The name of the byte_extract variable to lookup.
+ * \param s Pointer the signature to look in.
+ *
+ * \retval A pointer to the SigMatch if found, otherwise NULL.
+ */
+SigMatch *DetectByteExtractRetrieveSMVar(const char *arg, Signature *s)
 {
-    if (list == -1)
-        return NULL;
-
     DetectByteExtractData *bed = NULL;
-    SigMatch *sm = s->sm_lists[list];
-
-    while (sm != NULL) {
-        if (sm->type == DETECT_BYTE_EXTRACT) {
-            bed = (DetectByteExtractData *)sm->ctx;
-            if (strcmp(bed->name, arg) == 0) {
-                return sm;
+    int list;
+
+    for (list = 0; list < DETECT_SM_LIST_MAX; list++) {
+        SigMatch *sm = s->sm_lists[list];
+        while (sm != NULL) {
+            if (sm->type == DETECT_BYTE_EXTRACT) {
+                bed = (DetectByteExtractData *)sm->ctx;
+                if (strcmp(bed->name, arg) == 0) {
+                    return sm;
+                }
             }
+            sm = sm->next;
         }
-        sm = sm->next;
     }
 
     return NULL;

diff --git a/src/detect-byte-extract.h b/src/detect-byte-extract.h
index eb889d7384b93462072220069be4e810648e9c95..020494da0e5e2556654765a1a447ce0c737b1778 100644 (file)
--- a/src/detect-byte-extract.h
+++ b/src/detect-byte-extract.h
@@ -64,7 +64,7 @@ int DetectByteExtractSetup(DetectEngineCtx *, Signature *, char *);
 void DetectByteExtractFree(void *);
 int DetectByteExtractMatch(ThreadVars *, DetectEngineThreadCtx *,
                            Packet *, Signature *, SigMatch *);
-SigMatch *DetectByteExtractRetrieveSMVar(const char *, Signature *, int);
+SigMatch *DetectByteExtractRetrieveSMVar(const char *, Signature *);
 int DetectByteExtractDoMatch(DetectEngineThreadCtx *, SigMatch *, Signature *,
                              uint8_t *, uint16_t, uint64_t *, uint8_t);
 

diff --git a/src/detect-bytejump.c b/src/detect-bytejump.c
index f138f74ad046f893014e57d3d45ea1cb2545466f..0542af6675ada1a4f495169344055ac1ce9c6937 100644 (file)
--- a/src/detect-bytejump.c
+++ b/src/detect-bytejump.c
@@ -698,7 +698,7 @@ int DetectBytejumpSetup(DetectEngineCtx *de_ctx, Signature *s, char *optstr)
     }
 
     if (offset != NULL) {
-        SigMatch *bed_sm = DetectByteExtractRetrieveSMVar(offset, s, sm_list);
+        SigMatch *bed_sm = DetectByteExtractRetrieveSMVar(offset, s);
         if (bed_sm == NULL) {
             SCLogError(SC_ERR_INVALID_SIGNATURE, "Unknown byte_extract var "
                        "seen in byte_jump - %s\n", offset);

diff --git a/src/detect-bytetest.c b/src/detect-bytetest.c
index 718a84788e57a2c1b44a83bb082506d49f280e93..47ede78f9cf86867f9c8e2f8208f98f983cf3530 100644 (file)
--- a/src/detect-bytetest.c
+++ b/src/detect-bytetest.c
@@ -623,7 +623,7 @@ int DetectBytetestSetup(DetectEngineCtx *de_ctx, Signature *s, char *optstr)
     }
 
     if (value != NULL) {
-        SigMatch *bed_sm = DetectByteExtractRetrieveSMVar(value, s, sm_list);
+        SigMatch *bed_sm = DetectByteExtractRetrieveSMVar(value, s);
         if (bed_sm == NULL) {
             SCLogError(SC_ERR_INVALID_SIGNATURE, "Unknown byte_extract var "
                        "seen in byte_test - %s\n", value);
@@ -635,7 +635,7 @@ int DetectBytetestSetup(DetectEngineCtx *de_ctx, Signature *s, char *optstr)
     }
 
     if (offset != NULL) {
-        SigMatch *bed_sm = DetectByteExtractRetrieveSMVar(offset, s, sm_list);
+        SigMatch *bed_sm = DetectByteExtractRetrieveSMVar(offset, s);
         if (bed_sm == NULL) {
             SCLogError(SC_ERR_INVALID_SIGNATURE, "Unknown byte_extract var "
                        "seen in byte_test - %s\n", offset);

diff --git a/src/detect-depth.c b/src/detect-depth.c
index 53adf46063570670a1e4627a5b0ee4dc77912e00..4aa33dee12c01b0c96fc9d34fd50d0c2053dce01 100644 (file)
--- a/src/detect-depth.c
+++ b/src/detect-depth.c
@@ -127,7 +127,7 @@ static int DetectDepthSetup (DetectEngineCtx *de_ctx, Signature *s, char *depths
         goto end;
     }
     if (str[0] != '-' && isalpha((unsigned char)str[0])) {
-        SigMatch *bed_sm = DetectByteExtractRetrieveSMVar(str, s, SigMatchListSMBelongsTo(s, pm));
+        SigMatch *bed_sm = DetectByteExtractRetrieveSMVar(str, s);
         if (bed_sm == NULL) {
             SCLogError(SC_ERR_INVALID_SIGNATURE, "unknown byte_extract var "
                        "seen in depth - %s\n", str);

diff --git a/src/detect-distance.c b/src/detect-distance.c
index 2877deead8b93dacb2b46b5055eeac178d16979c..14af5c27ee0d25106b4c2d02749c4d38c8870d4a 100644 (file)
--- a/src/detect-distance.c
+++ b/src/detect-distance.c
@@ -133,7 +133,7 @@ static int DetectDistanceSetup (DetectEngineCtx *de_ctx, Signature *s,
         goto end;
     }
     if (str[0] != '-' && isalpha((unsigned char)str[0])) {
-        SigMatch *bed_sm = DetectByteExtractRetrieveSMVar(str, s, SigMatchListSMBelongsTo(s, pm));
+        SigMatch *bed_sm = DetectByteExtractRetrieveSMVar(str, s);
         if (bed_sm == NULL) {
             SCLogError(SC_ERR_INVALID_SIGNATURE, "unknown byte_extract var "
                        "seen in distance - %s\n", str);

diff --git a/src/detect-isdataat.c b/src/detect-isdataat.c
index 9c515c145dbed1187502bd70b7f0920ce6071d5a..e8e11df1c17c341691be906a6802871228f3c3fd 100644 (file)
--- a/src/detect-isdataat.c
+++ b/src/detect-isdataat.c
@@ -375,7 +375,7 @@ int DetectIsdataatSetup (DetectEngineCtx *de_ctx, Signature *s, char *isdataatst
     }
 
     if (offset != NULL) {
-        SigMatch *bed_sm = DetectByteExtractRetrieveSMVar(offset, s, sm_list);
+        SigMatch *bed_sm = DetectByteExtractRetrieveSMVar(offset, s);
         if (bed_sm == NULL) {
             SCLogError(SC_ERR_INVALID_SIGNATURE, "Unknown byte_extract var "
                        "seen in isdataat - %s\n", offset);

diff --git a/src/detect-offset.c b/src/detect-offset.c
index 5786ac3f2f099c368ea99dd7eaf08c8db9f531d1..6797267d052377327185057f064b3e3041fc1b19 100644 (file)
--- a/src/detect-offset.c
+++ b/src/detect-offset.c
@@ -127,7 +127,7 @@ int DetectOffsetSetup (DetectEngineCtx *de_ctx, Signature *s, char *offsetstr)
     }
     if (str[0] != '-' && isalpha((unsigned char)str[0])) {
         SigMatch *bed_sm =
-            DetectByteExtractRetrieveSMVar(str, s, SigMatchListSMBelongsTo(s, pm));
+            DetectByteExtractRetrieveSMVar(str, s);
         if (bed_sm == NULL) {
             SCLogError(SC_ERR_INVALID_SIGNATURE, "unknown byte_extract var "
                        "seen in offset - %s\n", str);

diff --git a/src/detect-within.c b/src/detect-within.c
index cdea61142f6fb2351f4a86649d9b82a2bdb57833..0aefdffc8162a76ec2a5b5597af38fbc939cc601 100644 (file)
--- a/src/detect-within.c
+++ b/src/detect-within.c
@@ -138,7 +138,7 @@ static int DetectWithinSetup(DetectEngineCtx *de_ctx, Signature *s, char *within
         goto end;
     }
     if (str[0] != '-' && isalpha((unsigned char)str[0])) {
-        SigMatch *bed_sm = DetectByteExtractRetrieveSMVar(str, s, SigMatchListSMBelongsTo(s, pm));
+        SigMatch *bed_sm = DetectByteExtractRetrieveSMVar(str, s);
         if (bed_sm == NULL) {
             SCLogError(SC_ERR_INVALID_SIGNATURE, "unknown byte_extract var "
                        "seen in within - %s\n", str);
@@ -251,7 +251,6 @@ static int DetectWithinTestVarSetup(void)
 {
     DetectEngineCtx *de_ctx = NULL;
     int result = 0;
-#if 1 /* FAILs */
     char sig[] = "alert tcp any any -> any any ( "
         "msg:\"test rule\"; "
         "content:\"abc\"; "
@@ -261,17 +260,6 @@ static int DetectWithinTestVarSetup(void)
         "within:somevar; "
         "http_client_body; "
         "sid:4; rev:1;)";
-#else /* WORKs */
-    char sig[] = "alert tcp any any -> any any ( "
-        "msg:\"test rule\"; "
-        "content:\"abc\"; "
-        "http_client_body; "
-        "byte_extract:2,0,somevar,relative; "
-        "content:\"def\"; "
-        "http_client_body; "
-        "within:somevar; "
-        "sid:4; rev:1;)";
-#endif
 
     de_ctx = DetectEngineCtxInit();
     if (de_ctx == NULL) {