Allow the use of relative without the presence of a related previous keyword.

diff --git a/src/detect-byte-extract.c b/src/detect-byte-extract.c
index 558822671c850c37ed77eae882ae5926e7f20e79..bda9cc34af011a1b27b69bd1ac9b45b46e927329 100644 (file)
--- a/src/detect-byte-extract.c
+++ b/src/detect-byte-extract.c
@@ -641,9 +641,8 @@ int DetectByteExtractSetup(DetectEngineCtx *de_ctx, Signature *s, char *arg)
                                            DETECT_BYTETEST, s->sm_lists_tail[DETECT_SM_LIST_DMATCH],
                                            DETECT_BYTE_EXTRACT, s->sm_lists_tail[DETECT_SM_LIST_DMATCH]);
             if (pm == NULL) {
-                SCLogError(SC_ERR_INVALID_SIGNATURE, "No preceding content "
-                           "or uricontent or pcre option");
-                return -1;
+                SigMatchAppendSMToList(s, sm, DETECT_SM_LIST_PMATCH);
+                return 0;
             }
             int list = SigMatchListSMBelongsTo(s, pm);
             if (list == DETECT_SM_LIST_UMATCH)

diff --git a/src/detect-bytejump.c b/src/detect-bytejump.c
index 9b7a051a5da94656f62ec79c4d91ff1636a2529d..48da92be7ce64b91198e0e5e9a353397ef819928 100644 (file)
--- a/src/detect-bytejump.c
+++ b/src/detect-bytejump.c
@@ -644,9 +644,7 @@ int DetectBytejumpSetup(DetectEngineCtx *de_ctx, Signature *s, char *optstr)
                        "since this is an alproto sig.");
             return 0;
         } else {
-            SCLogError(SC_ERR_INVALID_SIGNATURE, "No preceding content "
-                       "or uricontent or pcre option");
-            return -1;
+            return 0;
         }
     }
 

diff --git a/src/detect-bytetest.c b/src/detect-bytetest.c
index 391d3bbc05d7a2d3f8d27b34008e7966bfae06b6..2ffc18d7d0cea06583de0657531fd547a83f22ba 100644 (file)
--- a/src/detect-bytetest.c
+++ b/src/detect-bytetest.c
@@ -581,9 +581,7 @@ int DetectBytetestSetup(DetectEngineCtx *de_ctx, Signature *s, char *optstr)
                        "since this is an alproto sig.");
             return 0;
         } else {
-            SCLogError(SC_ERR_INVALID_SIGNATURE, "No preceding content "
-                       "or uricontent or pcre option");
-            return -1;
+            return 0;
         }
     }
 

diff --git a/src/detect-http-client-body.c b/src/detect-http-client-body.c
index 0f53fcba4d4ee49c0910bd3cf9fc7f97ffe934d4..4fd876722ba6630f48d5d371a01224c6b4a43863 100644 (file)
--- a/src/detect-http-client-body.c
+++ b/src/detect-http-client-body.c
@@ -2405,8 +2405,8 @@ int DetectHttpClientBodyTest33(void)
     de_ctx->flags |= DE_QUIET;
     de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any "
                                "(content:\"one\"; within:5; sid:1;)");
-    if (de_ctx->sig_list != NULL) {
-        printf("de_ctx->sig_list != NULL\n");
+    if (de_ctx->sig_list == NULL) {
+        printf("de_ctx->sig_list == NULL\n");
         goto end;
     }
 

diff --git a/src/detect-http-header.c b/src/detect-http-header.c
index 40d8d584fe2aacf49ecdc4f173f93b7fdf6a783c..79c5d6460de4a6166a47783f53b4a2f7478f178d 100644 (file)
--- a/src/detect-http-header.c
+++ b/src/detect-http-header.c
@@ -1617,8 +1617,8 @@ int DetectHttpHeaderTest24(void)
     de_ctx->flags |= DE_QUIET;
     de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any "
                                "(content:\"one\"; within:5; sid:1;)");
-    if (de_ctx->sig_list != NULL) {
-        printf("de_ctx->sig_list != NULL\n");
+    if (de_ctx->sig_list == NULL) {
+        printf("de_ctx->sig_list == NULL\n");
         goto end;
     }
 

diff --git a/src/detect-http-hh.c b/src/detect-http-hh.c
index fbb426232febfbdb470e444651ec70e158669755..00bab6a1cfcf38abbcc15e5f47b55135ca189c28 100644 (file)
--- a/src/detect-http-hh.c
+++ b/src/detect-http-hh.c
@@ -2137,8 +2137,8 @@ int DetectHttpHHTest33(void)
     de_ctx->flags |= DE_QUIET;
     de_ctx->sig_list = SigInit(de_ctx, "alert tcp any any -> any any "
                                "(content:\"one\"; within:5; sid:1;)");
-    if (de_ctx->sig_list != NULL) {
-        printf("de_ctx->sig_list != NULL\n");
+    if (de_ctx->sig_list == NULL) {
+        printf("de_ctx->sig_list == NULL\n");
         goto end;
     }
 

diff --git a/src/detect-http-hrh.c b/src/detect-http-hrh.c
index 4b7a1ca6e0d178de6e7cb23a5e4b058561b7ef6d..84a37b6cd031665b59bb6e751880c714e3129226 100644 (file)
--- a/src/detect-http-hrh.c
+++ b/src/detect-http-hrh.c
@@ -2137,8 +2137,8 @@ int DetectHttpHRHTest33(void)
     de_ctx->flags |= DE_QUIET;
     de_ctx->sig_list = SigInit(de_ctx, "alert tcp any any -> any any "
                                "(content:\"one\"; within:5; sid:1;)");
-    if (de_ctx->sig_list != NULL) {
-        printf("de_ctx->sig_list != NULL\n");
+    if (de_ctx->sig_list == NULL) {
+        printf("de_ctx->sig_list == NULL\n");
         goto end;
     }
 

diff --git a/src/detect-http-raw-header.c b/src/detect-http-raw-header.c
index 2bd8150eff52764584e1bca6d42c04db2270f825..417aaf0fd7d9b9170087085d361a0dfe5b7f42b4 100644 (file)
--- a/src/detect-http-raw-header.c
+++ b/src/detect-http-raw-header.c
@@ -1612,8 +1612,8 @@ int DetectHttpRawHeaderTest24(void)
     de_ctx->flags |= DE_QUIET;
     de_ctx->sig_list = SigInit(de_ctx, "alert http any any -> any any "
                                "(flow:to_server; content:\"one\"; within:5; sid:1;)");
-    if (de_ctx->sig_list != NULL) {
-        printf("de_ctx->sig_list != NULL\n");
+    if (de_ctx->sig_list == NULL) {
+        printf("de_ctx->sig_list == NULL\n");
         goto end;
     }
 

diff --git a/src/detect-http-raw-uri.c b/src/detect-http-raw-uri.c
index 4ffc9825cf4f1fda02b7d8baa353da1309d07f08..bf0edb4e2f7a71c084615598296bc8245ed697b4 100644 (file)
--- a/src/detect-http-raw-uri.c
+++ b/src/detect-http-raw-uri.c
@@ -774,8 +774,8 @@ int DetectHttpRawUriTest16(void)
     de_ctx->flags |= DE_QUIET;
     de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any "
                                "(content:\"one\"; within:5; sid:1;)");
-    if (de_ctx->sig_list != NULL) {
-        printf("de_ctx->sig_list != NULL\n");
+    if (de_ctx->sig_list == NULL) {
+        printf("de_ctx->sig_list == NULL\n");
         goto end;
     }
 

diff --git a/src/detect-http-server-body.c b/src/detect-http-server-body.c
index afaca64d5970e62bb1216944f5ae6e2d02230dbd..9c417def01a0cb22fe6f01c34f51209ac4019442 100644 (file)
--- a/src/detect-http-server-body.c
+++ b/src/detect-http-server-body.c
@@ -2441,8 +2441,8 @@ int DetectHttpServerBodyTest33(void)
     de_ctx->flags |= DE_QUIET;
     de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any "
                                "(content:\"one\"; within:5; sid:1;)");
-    if (de_ctx->sig_list != NULL) {
-        printf("de_ctx->sig_list != NULL\n");
+    if (de_ctx->sig_list == NULL) {
+        printf("de_ctx->sig_list == NULL\n");
         goto end;
     }
 

diff --git a/src/detect-http-ua.c b/src/detect-http-ua.c
index d9bf9c348466276dfb1079594909b2a7b56f6121..9e361763e9b02b8e56a221d322fc4ab5aaa5685f 100644 (file)
--- a/src/detect-http-ua.c
+++ b/src/detect-http-ua.c
@@ -2138,8 +2138,8 @@ int DetectHttpUATest33(void)
     de_ctx->flags |= DE_QUIET;
     de_ctx->sig_list = SigInit(de_ctx, "alert tcp any any -> any any "
                                "(content:\"one\"; within:5; sid:1;)");
-    if (de_ctx->sig_list != NULL) {
-        printf("de_ctx->sig_list != NULL\n");
+    if (de_ctx->sig_list == NULL) {
+        printf("de_ctx->sig_list == NULL\n");
         goto end;
     }
 

diff --git a/src/detect-http-uri.c b/src/detect-http-uri.c
index ad1d9c823aa2647ff98339e9c3bfea586bf09d93..1fcb302030008f3b67632fffc42a0351e7178746 100644 (file)
--- a/src/detect-http-uri.c
+++ b/src/detect-http-uri.c
@@ -738,8 +738,8 @@ int DetectHttpUriTest16(void)
     de_ctx->flags |= DE_QUIET;
     de_ctx->sig_list = SigInit(de_ctx, "alert icmp any any -> any any "
                                 "(content:\"one\"; within:5; sid:1;)");
-    if (de_ctx->sig_list != NULL) {
-        printf("de_ctx->sig_list != NULL\n");
+    if (de_ctx->sig_list == NULL) {
+        printf("de_ctx->sig_list == NULL\n");
         goto end;
     }
 

diff --git a/src/detect-isdataat.c b/src/detect-isdataat.c
index df934bc4d24a9934797f51debdd8dfa7969c20d6..2aed585148b3b21ea71bd8674880addb449a6dac 100644 (file)
--- a/src/detect-isdataat.c
+++ b/src/detect-isdataat.c
@@ -388,14 +388,22 @@ int DetectIsdataatSetup (DetectEngineCtx *de_ctx, Signature *s, char *isdataatst
                 DETECT_BYTETEST, s->sm_lists_tail[DETECT_SM_LIST_DMATCH],
                 DETECT_BYTETEST, s->sm_lists_tail[DETECT_SM_LIST_UMATCH]);
         if (pm == NULL) {
-            SCLogError(SC_ERR_INVALID_SIGNATURE, "isdataat relative seen "
-                       "without a previous content uricontent, "
-                       "http_client_body, http_header, http_raw_header, "
-                       "http_method, http_cookie, http_raw_uri, "
-                       "http_stat_msg, http_stat_code, byte_test, "
-                       "byte_extract, byte_jump, http_user_agent, "
-                       "http_host or http_raw_host keyword");
-            goto error;
+            SigMatchAppendSMToList(s, sm, DETECT_SM_LIST_PMATCH);
+            if (offset != NULL) {
+                SigMatch *bed_sm =
+                    DetectByteExtractRetrieveSMVar(offset, s,
+                                                   SigMatchListSMBelongsTo(s, sm));
+                if (bed_sm == NULL) {
+                    SCLogError(SC_ERR_INVALID_SIGNATURE, "Unknown byte_extract var "
+                               "seen in isdataat - %s\n", offset);
+                    goto error;
+                }
+                DetectIsdataatData *isdd = sm->ctx;
+                isdd->dataat = ((DetectByteExtractData *)bed_sm->ctx)->local_id;
+                isdd->flags |= ISDATAAT_OFFSET_BE;
+                SCFree(offset);
+            }
+            SCReturnInt(0);
         } else {
             int list_type = SigMatchListSMBelongsTo(s, pm);
             if (list_type == -1) {

diff --git a/src/detect-parse.c b/src/detect-parse.c
index ede6811b19513edabbd9801fedc20b50ae232328..ccae056039522bccbec47d40499a2a47ed1cb5bb 100644 (file)
--- a/src/detect-parse.c
+++ b/src/detect-parse.c
@@ -1052,35 +1052,6 @@ static int SigValidate(Signature *s) {
 #endif /* HAVE_HTP_TX_GET_RESPONSE_HEADERS_RAW */
     }
 
-    if (s->alproto == ALPROTO_DCERPC) {
-        /* \todo We haven't covered dce rpc cases now.  They need special
-         * treatment, since they do allow distance, within without a
-         * previous content, but with respect to the stub buffer */
-        ;
-    } else {
-        SigMatch *sm;
-        for (sm = s->sm_lists[DETECT_SM_LIST_PMATCH]; sm != NULL; sm = sm->next) {
-            if (sm->type == DETECT_CONTENT) {
-                DetectContentData *cd = (DetectContentData *)sm->ctx;
-                if ((cd->flags & DETECT_CONTENT_DISTANCE) ||
-                    (cd->flags & DETECT_CONTENT_WITHIN)) {
-                    SigMatch *pm = SigMatchGetLastSMFromLists(s, 4,
-                                                              DETECT_PCRE, sm->prev,
-                                                              DETECT_BYTEJUMP, sm->prev);
-                    if (pm == NULL) {
-                        SCLogError(SC_ERR_DISTANCE_MISSING_CONTENT, "within needs two "
-                                   "preceding content or uricontent options");
-                        SCReturnInt(0);
-                    } else {
-                        break;
-                    }
-                } else {
-                    break;
-                }
-            }
-        }
-    }
-
     if (s->sm_lists[DETECT_SM_LIST_HHHDMATCH] != NULL) {
         for (SigMatch *sm = s->sm_lists[DETECT_SM_LIST_HHHDMATCH];
              sm != NULL; sm = sm->next) {

diff --git a/src/detect-pcre.c b/src/detect-pcre.c
index beb8248ece24c142ba8e352c95aeb544d9e55707..45e5e19f22ee9357b9fea398d9dbe53057ba81d5 100644 (file)
--- a/src/detect-pcre.c
+++ b/src/detect-pcre.c
@@ -846,9 +846,7 @@ static int DetectPcreSetup (DetectEngineCtx *de_ctx, Signature *s, char *regexst
                 pd->flags &= ~DETECT_PCRE_RELATIVE;
                 SCReturnInt(0);
             } else {
-                SCLogError(SC_ERR_INVALID_SIGNATURE, "No preceding content "
-                        "or uricontent or pcre option");
-                SCReturnInt(-1);
+                SCReturnInt(0);
             }
         }
     }
@@ -1655,10 +1653,10 @@ int DetectPcreParseTest23(void)
                                "content:\"GET\"; "
                                "http_cookie; pcre:\"/abc/RM\"; sid:1;)");
 
-    if (de_ctx->sig_list == NULL) {
+    if (de_ctx->sig_list != NULL) {
         result = 1;
     } else {
-        printf("sig parse should have failed: ");
+        printf("sig parse shouldn't have failed: ");
     }
 
  end: