rlpL7.c

Go to the documentation of this file.

/** \file rlpL7.c

  \brief Routines for building a content check structure from an L7 formula.

The idea is to simplify having to walk through a list of checks, 
have a content struct with the case check, offset, etc. all in place.

*/

#include "rlp.h"


/*AutomaticStart*************************************************************/

static Rlp_Formula_t *computeContentCheck (Rlp_Formula_t * walkFormula,
                       Rlp_ContentCheck_t * contentCheck);
static Rlp_ContentCheck_t *mallocContentCheckStruct ();

/*AutomaticEnd***************************************************************/


/** \brief  Walk an L7 formula, build the list of checks.  */

array_t *
Rlp_BuildContentCheckArrayFromL7Formula (Rlp_Formula_t * aL7Formula)
{
  Rlp_Formula_t *walkFormula = aL7Formula;
  Rlp_Formula_t *componentFormula;

  array_t *result = array_alloc (Rlp_L7Check_t *, 0);

  Rlp_L7Check_t *l7Check;
  Rlp_ContentCheck_t *contentCheck;

  while (walkFormula != NIL (Rlp_Formula_t))
    {
      componentFormula = car (walkFormula);
      switch (componentFormula->type)
    {

    case Rlp_Content_c:
    case Rlp_Uricontent_c:
      l7Check = (Rlp_L7Check_t *) malloc (sizeof (Rlp_L7Check_t));
      contentCheck = mallocContentCheckStruct ();
      if (componentFormula->type == Rlp_Content_c)
        {
          l7Check->type = Rlp_L7ContentCheck_c;
          l7Check->entryData.contentCheck = contentCheck;
        }
      else
        {
          l7Check->type = Rlp_L7UriContentCheck_c;
          l7Check->entryData.contentCheck = contentCheck;
        }
      walkFormula = computeContentCheck (walkFormula, contentCheck);
      array_insert_last (Rlp_L7Check_t *, result, l7Check);
      break;

    case Rlp_Byte_Test_c:
    case Rlp_Byte_Jump_c:
      l7Check = (Rlp_L7Check_t *) malloc (sizeof (Rlp_L7Check_t));
      if (componentFormula->type == Rlp_Byte_Test_c)
        {
          l7Check->type = Rlp_L7ByteTestCheck_c;
          l7Check->entryData.byteTestCheck =
        (Rlp_ByteTestAttribute_t *) (componentFormula->rchild);
        }
      else
        {
          l7Check->type = Rlp_L7ByteJumpCheck_c;
          l7Check->entryData.byteJumpCheck =
        (Rlp_ByteJumpAttribute_t *) (componentFormula->rchild);
        }
      array_insert_last (Rlp_L7Check_t *, result, l7Check);
      walkFormula = cdr (walkFormula);
      break;

    case Rlp_Pcre_c:
      l7Check = (Rlp_L7Check_t *) malloc (sizeof (Rlp_L7Check_t));
      l7Check->type = Rlp_L7PcreCheck_c;
      l7Check->entryData.pcreCheck =
        (Rlp_PcreAttribute_t *) (componentFormula->rchild);
      array_insert_last (Rlp_L7Check_t *, result, l7Check);
      walkFormula = cdr (walkFormula);
      break;
    default:
      walkFormula = cdr (walkFormula);
      break;        // all the non content/byte checks are ignored
    }
    }

  return result;
}


/** \brief  Free an array containing content check structs */

int
Rlp_FreeL7CheckArray (array_t * L7CheckArray)
{
  int i;
  for (i = 0; i < array_n (L7CheckArray); i++)
    {
      Rlp_L7Check_t *l7Check = array_fetch (Rlp_L7Check_t *, L7CheckArray, i);
      if ((l7Check->type == Rlp_L7ContentCheck_c) ||
      (l7Check->type == Rlp_L7UriContentCheck_c))
    {
      free (l7Check->entryData.contentCheck);
    }
      free (l7Check);
    }
  array_free (L7CheckArray);
  return 0;
}


/** \brief  Extract the content fields from an Rlp_ContentAttribute_t struct */

static Rlp_Formula_t *
computeContentCheck (Rlp_Formula_t * walkFormula,
             Rlp_ContentCheck_t * contentCheck)
{
  Rlp_Formula_t *result = walkFormula;
  bool processedContent = false;
  bool processedUriContent = false;

  while (result != NIL (Rlp_Formula_t))
    {
      Rlp_Formula_t *componentFormula = car (result);
      switch (componentFormula->type)
    {
    case Rlp_Content_c:
      if ((processedContent == true) || (processedUriContent == true))
        {
          // we've finished the content or uricontent field we were working on
          return result;
        }
      processedContent = true;

      contentCheck->negated = ((Rlp_ContentAttribute_t *)
                   componentFormula->rchild)->negated;
      contentCheck->content = ((Rlp_ContentAttribute_t *)
                   componentFormula->rchild)->byteArray;
      result = cdr (result);
      break;
    case Rlp_Uricontent_c:
      if ((processedContent == true) || (processedUriContent == true))
        {
          // we've finished the content or uricontent field we were working on
          return result;
        }
      processedUriContent = true;
      contentCheck->negated = ((Rlp_ContentAttribute_t *)
                   componentFormula->rchild)->negated;
      contentCheck->content = ((Rlp_ContentAttribute_t *)
                   componentFormula->rchild)->byteArray;
      result = cdr (result);
      break;
    case Rlp_Depth_c:
      contentCheck->depth = ((Rlp_IntAttribute_t *)
                 (componentFormula->rchild))->intEntry;
      result = cdr (result);
      break;
    case Rlp_Offset_c:
      contentCheck->offset = ((Rlp_IntAttribute_t *)
                  (componentFormula->rchild))->intEntry;
      result = cdr (result);
      break;
    case Rlp_Within_c:
      contentCheck->within = ((Rlp_IntAttribute_t *)
                  (componentFormula->rchild))->intEntry;
      result = cdr (result);
      break;
    case Rlp_Distance_c:
      contentCheck->distance = ((Rlp_IntAttribute_t *)
                    (componentFormula->rchild))->intEntry;
      result = cdr (result);
      break;
    case Rlp_Nocase_c:
      contentCheck->nocase = true;
      result = cdr (result);
      break;
    default:
      assert (contentCheck->content != NIL (util_byte_array_t));
      return result;
    }
    }
  return result;
}


/** \brief  Return an allocated contentCheck struct - initialize 
all integer entries to -1, pointers to NIL.
*/

static Rlp_ContentCheck_t *
mallocContentCheckStruct ()
{
  Rlp_ContentCheck_t *result =
    (Rlp_ContentCheck_t *) malloc (sizeof (Rlp_ContentCheck_t));

  result->nocase = false;
  result->depth = -1;
  result->offset = -1;
  result->distance = -1;
  result->within = -1;
  result->content = NIL (util_byte_array_t);

  return result;
}