rlpUtil.c

Go to the documentation of this file.

/** \file rlpUtil.c

\brief Routines for manipulating rules

******************************************************************************/

#include "rlp.h"

/**AutomaticStart*************************************************************/

/*---------------------------------------------------------------------------*/
/* Static function prototypes                                                */
/*---------------------------------------------------------------------------*/

static void setEntryType (Rlp_Formula_t * entry, char *attribute);
static int parseRawValue (Rlp_Formula_t * entry);
static int parseByteJump (Rlp_Formula_t * entry);
static int parseByteTest (Rlp_Formula_t * entry);
static int parseIpProto (Rlp_Formula_t * entry);
static int parseDsize (Rlp_Formula_t * entry);
static int parseSample (Rlp_Formula_t * entry);
static int parseInterface (Rlp_Formula_t * entry);
static int parseTtl (Rlp_Formula_t * entry);
static int parseIpOpts (Rlp_Formula_t * entry);
static int parseFragbits (Rlp_Formula_t * entry);
static int parseFlags (Rlp_Formula_t * entry);
static Rlp_FlagType_t parseIndividualFlag (char *rawValue, char flag);
static int parseRpc (Rlp_Formula_t * entry);
static int parseContent (Rlp_Formula_t * entry);
static int hexToInt (char hexChar);
static int parseUricontent (Rlp_Formula_t * entry);
static bool isComment (char *attribute);
static int parsePcre (Rlp_Formula_t * entry);

/**AutomaticEnd***************************************************************/

/**
  * \brief  Convert a rule parse tree to a formula text string.
  * 
  */

char *
Rlp_ConvertParseTreeToText (Rlp_Formula_t * aFormula)
{
  char tmpString[5000];
  char *text;

  if (aFormula == NIL (Rlp_Formula_t))
    {
      return util_strsav ("");
    }

  switch (aFormula->type)
    {

    case Rlp_Undef_c:
      return (util_strsav ("-UNDEF-"));
      break;

    case Rlp_Ack_c:
      sprintf (tmpString, "ack: ");
      text =
    util_strcat (tmpString,
             Rlp_ConvertParseTreeToText (aFormula->lchild));
      return text;
      break;

    case Rlp_Byte_Jump_c:
      sprintf (tmpString, "( byte_jump: ");
      text =
    util_strcat3 (tmpString,
              Rlp_ConvertParseTreeToText (aFormula->lchild), ")");
      return text;
    case Rlp_Byte_Test_c:
      sprintf (tmpString, "byte_test: ");
      text =
    util_strcat (tmpString,
             Rlp_ConvertParseTreeToText (aFormula->lchild));
      return text;
      break;

    case Rlp_Content_c:
      sprintf (tmpString, "content: ");
      text =
    util_strcat (tmpString,
             Rlp_ConvertParseTreeToText (aFormula->lchild));
      return text;
      break;

    case Rlp_Depth_c:
      sprintf (tmpString, "depth: ");
      text =
    util_strcat (tmpString,
             Rlp_ConvertParseTreeToText (aFormula->lchild));
      return text;
      break;

    case Rlp_Distance_c:
      sprintf (tmpString, "distance: ");
      text =
    util_strcat (tmpString,
             Rlp_ConvertParseTreeToText (aFormula->lchild));
      return text;
      break;

    case Rlp_Dsize_c:
      sprintf (tmpString, "dsize: ");
      text =
    util_strcat (tmpString,
             Rlp_ConvertParseTreeToText (aFormula->lchild));
      return text;
      break;

    case Rlp_Flags_c:
      sprintf (tmpString, "flags: ");
      text =
    util_strcat (tmpString,
             Rlp_ConvertParseTreeToText (aFormula->lchild));
      return text;
      break;

    case Rlp_Fragbits_c:
      sprintf (tmpString, "fragbits: ");
      text =
    util_strcat (tmpString,
             Rlp_ConvertParseTreeToText (aFormula->lchild));
      return text;
      break;

    case Rlp_Icmp_Id_c:
      sprintf (tmpString, "icmp_id: ");
      text =
    util_strcat (tmpString,
             Rlp_ConvertParseTreeToText (aFormula->lchild));
      return text;
      break;

    case Rlp_Icmp_Seq_c:
      sprintf (tmpString, "icmp_seq: ");
      text =
    util_strcat (tmpString,
             Rlp_ConvertParseTreeToText (aFormula->lchild));
      return text;
      break;

    case Rlp_Icode_c:
      sprintf (tmpString, "icode: ");
      text =
    util_strcat (tmpString,
             Rlp_ConvertParseTreeToText (aFormula->lchild));
      return text;
      break;

    case Rlp_Id_c:
      sprintf (tmpString, "id: ");
      text =
    util_strcat (tmpString,
             Rlp_ConvertParseTreeToText (aFormula->lchild));
      return text;
      break;

    case Rlp_Ip_Proto_c:
      sprintf (tmpString, "proto: ");
      text =
    util_strcat (tmpString,
             Rlp_ConvertParseTreeToText (aFormula->lchild));
      return text;
      break;

    case Rlp_IpOpts_c:
      sprintf (tmpString, "ipopts: ");
      text =
    util_strcat (tmpString,
             Rlp_ConvertParseTreeToText (aFormula->lchild));
      return text;
      break;

    case Rlp_Itype_c:
      sprintf (tmpString, "itype: ");
      text =
    util_strcat (tmpString,
             Rlp_ConvertParseTreeToText (aFormula->lchild));
      return text;
      break;

    case Rlp_Nocase_c:
      sprintf (tmpString, "case: ");
      text =
    util_strcat (tmpString,
             Rlp_ConvertParseTreeToText (aFormula->lchild));
      return text;
      break;

    case Rlp_Offset_c:
      sprintf (tmpString, "offset: ");
      text =
    util_strcat (tmpString,
             Rlp_ConvertParseTreeToText (aFormula->lchild));
      return text;
      break;

    case Rlp_Pcre_c:
      sprintf (tmpString, "pcre: ");
      text =
    util_strcat (tmpString,
             Rlp_ConvertParseTreeToText (aFormula->lchild));
      return text;
      break;

    case Rlp_Rpc_c:
      sprintf (tmpString, "rpc: ");
      text =
    util_strcat (tmpString,
             Rlp_ConvertParseTreeToText (aFormula->lchild));
      return text;
      break;

    case Rlp_Sameip_c:
      sprintf (tmpString, "sameip: ");
      text =
    util_strcat (tmpString,
             Rlp_ConvertParseTreeToText (aFormula->lchild));
      return text;
      break;

    case Rlp_Seq_c:
      sprintf (tmpString, "seq: ");
      text =
    util_strcat (tmpString,
             Rlp_ConvertParseTreeToText (aFormula->lchild));
      return text;
      break;

    case Rlp_Ttl_c:
      sprintf (tmpString, "ttl: ");
      text =
    util_strcat (tmpString,
             Rlp_ConvertParseTreeToText (aFormula->lchild));
      return text;
      break;

    case Rlp_Uricontent_c:
      sprintf (tmpString, "uricontent: ");
      text =
    util_strcat (tmpString,
             Rlp_ConvertParseTreeToText (aFormula->lchild));
      return text;
      break;

    case Rlp_Within_c:
      sprintf (tmpString, "within: ");
      text =
    util_strcat (tmpString,
             Rlp_ConvertParseTreeToText (aFormula->lchild));
      return text;
      break;

    case Rlp_Ip_c:
      return util_strsav (" ( ip ) ");

    case Rlp_Tcp_c:
      return util_strsav (" ( tcp ) ");

    case Rlp_Udp_c:
      return util_strsav (" ( udp ) ");

    case Rlp_Icmp_c:
      return util_strsav (" ( icmp ) ");

    case Rlp_IpBlock_c:
      return util_strcat5 (" ( ip ",
               Rlp_ConvertParseTreeToText (aFormula->lchild),
               " / ",
               Rlp_ConvertParseTreeToText (aFormula->rchild),
               " ) ");

    case Rlp_Num_c:
      printf ("Calling Rlp_Num_c:\n");
      sprintf (tmpString, "%d", (int) aFormula->lchild);
      return (util_strsav (tmpString));

    case Rlp_Text_c:
      sprintf (tmpString, "%s", (char *) aFormula->lchild);
      return (util_strsav (tmpString));

    case Rlp_PortUnion_c:
      return (util_strcat3 (Rlp_ConvertParseTreeToText (aFormula->lchild),
                ",",
                Rlp_ConvertParseTreeToText (aFormula->rchild)));

    case Rlp_IpUnion_c:
      return (util_strcat5 ("(",
                Rlp_ConvertParseTreeToText (aFormula->lchild),
                ",",
                Rlp_ConvertParseTreeToText (aFormula->rchild),
                ")"));

    case Rlp_Negation_c:
      sprintf (tmpString, "!%s",
           Rlp_ConvertParseTreeToText (aFormula->lchild));
      return (util_strsav (tmpString));


    case Rlp_PortRange_c:
      return (util_strcat5
          ("(", Rlp_ConvertParseTreeToText (aFormula->lchild), ":",
           Rlp_ConvertParseTreeToText (aFormula->rchild), ")"));

    case Rlp_List_c:
      return (util_strcat3 (Rlp_ConvertParseTreeToText (aFormula->lchild),
                " ",
                Rlp_ConvertParseTreeToText (aFormula->rchild)));

    default:
      printf ("Panic: no type\n");
      return util_strsav ("-UNRECOG TYPE-");
      break;

    }               // switch

  Rlp_PrintFormulaTree (aFormula->lchild);
  Rlp_PrintFormulaTree (aFormula->rchild);

  return 0;

}


/**
  * \brief  Print a rule parse tree.
  * 
  */

int
Rlp_PrintFormulaTree (Rlp_Formula_t * aFormula)
{
  if (aFormula == NIL (Rlp_Formula_t))
    {
      printf ("NODE: %p --- Nil\n", aFormula);
      return 0;
    }

  switch (aFormula->type)
    {

    case Rlp_Undef_c:
      printf ("NODE: %p --- Rlp_Undef_c:\n", aFormula);
      break;
    case Rlp_Ack_c:
      printf ("NODE: %p --- Rlp_Ack_c\n", aFormula);
      break;
    case Rlp_Byte_Jump_c:
      printf ("NODE: %p --- Rlp_Byte_Jump_c\n", aFormula);
      break;
    case Rlp_Byte_Test_c:
      printf ("NODE: %p --- Rlp_Byte_Test_c\n", aFormula);
      break;
    case Rlp_Content_c:
      printf ("NODE: %p --- Rlp_Content_c\n", aFormula);
      break;
    case Rlp_Depth_c:
      printf ("NODE: %p --- Rlp_Depth_c\n", aFormula);
      break;
    case Rlp_Distance_c:
      printf ("NODE: %p --- Rlp_Distance_c\n", aFormula);
      break;
    case Rlp_Dsize_c:
      printf ("NODE: %p --- Rlp_Dsize_c\n", aFormula);
      break;
    case Rlp_Flags_c:
      printf ("NODE: %p --- Rlp_Flags_c\n", aFormula);
      break;
    case Rlp_Fragbits_c:
      printf ("NODE: %p --- Rlp_Fragbits_c\n", aFormula);
      break;
    case Rlp_Icmp_Id_c:
      printf ("NODE: %p --- Rlp_Icmp_Id_c\n", aFormula);
      break;
    case Rlp_Icmp_Seq_c:
      printf ("NODE: %p --- Rlp_Icmp_Seq_c\n", aFormula);
      break;
    case Rlp_Icode_c:
      printf ("NODE: %p --- Rlp_Icode_c\n", aFormula);
      break;
    case Rlp_Id_c:
      printf ("NODE: %p --- Rlp_Id_c\n", aFormula);
      break;
    case Rlp_Ip_Proto_c:
      printf ("NODE: %p --- Rlp_Ip_Proto_c\n", aFormula);
      break;
    case Rlp_IpOpts_c:
      printf ("NODE: %p --- Rlp_IpOpts_c\n", aFormula);
      break;
    case Rlp_Itype_c:
      printf ("NODE: %p --- Rlp_Itype_c\n", aFormula);
      break;
    case Rlp_Nocase_c:
      printf ("NODE: %p --- Rlp_Nocase_c\n", aFormula);
      break;
    case Rlp_Offset_c:
      printf ("NODE: %p --- Rlp_Offset_c\n", aFormula);
      break;
    case Rlp_Rpc_c:
      printf ("NODE: %p --- Rlp_Rpc_c\n", aFormula);
      break;
    case Rlp_Sameip_c:
      printf ("NODE: %p --- Rlp_Sameip_c\n", aFormula);
      break;
    case Rlp_Seq_c:
      printf ("NODE: %p --- Rlp_Seq_c\n", aFormula);
      break;
    case Rlp_Ttl_c:
      printf ("NODE: %p --- Rlp_Ttl_c\n", aFormula);
      break;
    case Rlp_Uricontent_c:
      printf ("NODE: %p --- Rlp_Uricontent_c\n", aFormula);
      break;
    case Rlp_Within_c:
      printf ("NODE: %p --- Rlp_Within_c\n", aFormula);
      break;
    case Rlp_Tcp_c:
      printf ("NODE: %p --- Rlp_Tcp_c\n", aFormula);
      break;
    case Rlp_Udp_c:
      printf ("NODE: %p --- Rlp_Udp_c\n", aFormula);
      break;
    case Rlp_Icmp_c:
      printf ("NODE: %p --- Rlp_Icmp_c\n", aFormula);
      break;
    case Rlp_Ip_c:
      printf ("NODE: %p --- Rlp_Ip_c\n", aFormula);
      break;
    case Rlp_IpBlock_c:
      printf ("NODE: %p --- Rlp_IpBlock_c\n", aFormula);
      break;
    case Rlp_Num_c:
      printf ("NODE: %p --- Rlp_Num_c, value = %d\n", aFormula,
          (int) aFormula->lchild);
      return 0;
    case Rlp_Text_c:
      printf ("NODE: %p --- Rlp_Text_c, value = %s\n", aFormula,
          (char *) aFormula->lchild);
      return 0;
    case Rlp_PortUnion_c:
      printf ("NODE: %p --- Rlp_PortUnion_c\n", aFormula);
      break;
    case Rlp_IpUnion_c:
      printf ("NODE: %p --- Rlp_IpUnion_c\n", aFormula);
      break;
    case Rlp_Negation_c:
      printf ("NODE: %p --- Rlp_Negation_c\n", aFormula);
      break;
    case Rlp_PortRange_c:
      printf ("NODE: %p --- Rlp_PortRange_c\n", aFormula);
      break;
    case Rlp_List_c:
      printf ("NODE: %p --- Rlp_List_c\n", aFormula);
      break;
    default:
      printf ("Panic: no type\n");
      return -1;

    }               // switch

  Rlp_PrintFormulaTree (aFormula->lchild);
  Rlp_PrintFormulaTree (aFormula->rchild);

  return 0;

}


/**
  * \brief  Free a parse tree
  * 
  */

void
Rlp_FormulaFree (Rlp_Formula_t * aFormula)
{
  if (aFormula == NIL (Rlp_Formula_t))
    {
      return;
    }

  switch (aFormula->type)
    {

    case Rlp_Undef_c:
    case Rlp_Ack_c:
    case Rlp_Byte_Jump_c:
    case Rlp_Byte_Test_c:
    case Rlp_Content_c:
    case Rlp_Depth_c:
    case Rlp_Distance_c:
    case Rlp_Dsize_c:
    case Rlp_Flags_c:
    case Rlp_Fragbits_c:
    case Rlp_Icmp_Id_c:
    case Rlp_Icmp_Seq_c:
    case Rlp_Icode_c:
    case Rlp_Id_c:
    case Rlp_Ip_Proto_c:
    case Rlp_IpOpts_c:
    case Rlp_Itype_c:
    case Rlp_Nocase_c:
    case Rlp_Offset_c:
    case Rlp_Rpc_c:
    case Rlp_Sameip_c:
    case Rlp_Seq_c:
    case Rlp_Ttl_c:
    case Rlp_Uricontent_c:
    case Rlp_Within_c:
    case Rlp_Ip_c:
    case Rlp_Tcp_c:
    case Rlp_Udp_c:
    case Rlp_Icmp_c:
    case Rlp_IpBlock_c:
    case Rlp_PortUnion_c:
    case Rlp_IpUnion_c:
    case Rlp_Negation_c:
    case Rlp_PortRange_c:
    case Rlp_List_c:
      Rlp_FormulaFree (aFormula->lchild);
      Rlp_FormulaFree (aFormula->rchild);
      free (aFormula);
      return;

    case Rlp_Num_c:
      free (aFormula);      // can't recur since lchild is an int
      return;

    case Rlp_Text_c:
      free (aFormula->lchild);  // free the text stored here first
      free (aFormula);
      return;

    default:
      printf ("Panic: no type\n");
      return;

    }               // switch

}


/**
  * \brief  Create a parse tree for an L7 formula from raw text of formula
  * 
  */

Rlp_Formula_t *
Rlp_CreateParseTreeFromText (char *text)
{
  // this is done in two stages - Rlp_L7StringParse 
  // tokenizes the input rule into attrib value pairs (char *)
  // then Rlp_CreateParseTreeFromAttribValuePairArray parses the attrib-value pairs
  array_t *attribValueArray = Rlp_L7StringParse (text);
  Rlp_Formula_t *L7Formula =
    Rlp_CreateParseTreeFromAttribValuePairArray (attribValueArray);
  Rlp_FreeArrayOfStrings (attribValueArray);

  return L7Formula;
}


/** \brief  Create a parse tree from a L7 formula that is presented
  as an array of (attribute,value) pairs.
  
Returns NIL if the array is of length 0, otherwise list has as many
entries as the array has members.
*/

Rlp_Formula_t *
Rlp_CreateParseTreeFromAttribValuePairArray (array_t * aRule)
{
  if (array_n (aRule) == 0)
    {
      return NIL (Rlp_Formula_t);
    }

  Rlp_Formula_t *listNode;
  Rlp_Formula_t *nextNode;
  array_t *listNodeArray = array_alloc (Rlp_Formula_t *, 0);

  int i;
  for (i = 0; i < array_n (aRule); i++)
    {

      Rlp_RuleComponent_t *aComponent =
    array_fetch (Rlp_RuleComponent_t *, aRule, i);

      if (isComment (aComponent->rawAttribute))
    {
      continue;
    }

      Rlp_Formula_t *entry =
    new_node (Rlp_Undef_c, NIL (Rlp_Formula_t), NIL (Rlp_Formula_t));
      setEntryType (entry, aComponent->rawAttribute);
      entry->lchild = (Rlp_Formula_t *) aComponent->rawValue;
      parseRawValue (entry);

      listNode = new_node (Rlp_List_c, entry, NIL (Rlp_Formula_t));
      array_insert_last (Rlp_Formula_t *, listNodeArray, listNode);
    }

  if (array_n (listNodeArray) > 0)
    {
      for (i = 0; i < array_n (listNodeArray) - 1; i++)
    {
      listNode = array_fetch (Rlp_Formula_t *, listNodeArray, i);
      nextNode = array_fetch (Rlp_Formula_t *, listNodeArray, i + 1);
      listNode->rchild = nextNode;
    }
      Rlp_Formula_t *result = array_fetch (Rlp_Formula_t *, listNodeArray, 0);
      return result;
    }
  else
    {
      return NIL (Rlp_Formula_t);
    }
}


/** \brief  Set the type of a given Rlp_Formula_t based on the attribute
  */

static void
setEntryType (Rlp_Formula_t * entry, char *attribute)
{
  if (util_strequal (attribute, "ack"))
    {
      entry->type = Rlp_Ack_c;
      return;
    }
  if (util_strequal (attribute, "byte_jump"))
    {
      entry->type = Rlp_Byte_Jump_c;
      return;
    }
  if (util_strequal (attribute, "byte_test"))
    {
      entry->type = Rlp_Byte_Test_c;
      return;
    }
  if (util_strequal (attribute, "content"))
    {
      entry->type = Rlp_Content_c;
      return;
    }
  if (util_strequal (attribute, "depth"))
    {
      entry->type = Rlp_Depth_c;
      return;
    }
  if (util_strequal (attribute, "distance"))
    {
      entry->type = Rlp_Distance_c;
      return;
    }
  if (util_strequal (attribute, "dsize"))
    {
      entry->type = Rlp_Dsize_c;
      return;
    }
  if (util_strequal (attribute, "flags"))
    {
      entry->type = Rlp_Flags_c;
      return;
    }
  if (util_strequal (attribute, "fragbits"))
    {
      entry->type = Rlp_Fragbits_c;
      return;
    }
  if (util_strequal (attribute, "icmp_id"))
    {
      entry->type = Rlp_Icmp_Id_c;
      return;
    }
  if (util_strequal (attribute, "icmp_seq"))
    {
      entry->type = Rlp_Icmp_Seq_c;
      return;
    }
  if (util_strequal (attribute, "icode"))
    {
      entry->type = Rlp_Icode_c;
      return;
    }
  if (util_strequal (attribute, "id"))
    {
      entry->type = Rlp_Id_c;
      return;
    }
  if (util_strequal (attribute, "ipopts"))
    {
      entry->type = Rlp_IpOpts_c;
      return;
    }
  if (util_strequal (attribute, "ip_proto"))
    {
      entry->type = Rlp_Ip_Proto_c;
      return;
    }
  if (util_strequal (attribute, "itype"))
    {
      entry->type = Rlp_Itype_c;
      return;
    }
  if (util_strequal (attribute, "nocase"))
    {
      entry->type = Rlp_Nocase_c;
      return;
    }
  if (util_strequal (attribute, "offset"))
    {
      entry->type = Rlp_Offset_c;
      return;
    }
  if (util_strequal (attribute, "pcre"))
    {
      entry->type = Rlp_Pcre_c;
      return;
    }
  if (util_strequal (attribute, "rpc"))
    {
      entry->type = Rlp_Rpc_c;
      return;
    }
  if (util_strequal (attribute, "sameip"))
    {
      entry->type = Rlp_Sameip_c;
      return;
    }
  if (util_strequal (attribute, "seq"))
    {
      entry->type = Rlp_Seq_c;
      return;
    }
  if (util_strequal (attribute, "ttl"))
    {
      entry->type = Rlp_Ttl_c;
      return;
    }
  if (util_strequal (attribute, "uricontent"))
    {
      entry->type = Rlp_Uricontent_c;
      return;
    }
  if (util_strequal (attribute, "within"))
    {
      entry->type = Rlp_Within_c;
      return;
    }
  if (util_strequal (attribute, "interface"))
    {
      entry->type = Rlp_Interface_c;
      return;
    }
  if (util_strequal (attribute, "sample"))
    {
      entry->type = Rlp_Sample_c;
      return;
    }
  fprintf (stderr, "Problem: unrecognized attribute %s, ignoring\n",
       attribute);
}


/**
  * \brief  Print a parse tree
  */

int
Rlp_ParsedRulePrint (Rlp_Formula_t * aTree)
{
  while (aTree != NIL (Rlp_Formula_t))
    {
      Rlp_NodePrint (aTree->lchild);
      printf ("\n");
      aTree = cdr (aTree);
    }
  return 1;
}


/** \brief  Parse the raw text string that makes up the value.
 
Implement by switch on the type of the entry.
*/

static int
parseRawValue (Rlp_Formula_t * entry)
{
  switch (entry->type)
    {

    case Rlp_Nocase_c:
    case Rlp_Sameip_c:
      return 0;

    case Rlp_Ack_c:
    case Rlp_Depth_c:
    case Rlp_Distance_c:
    case Rlp_Icmp_Id_c:
    case Rlp_Icmp_Seq_c:
    case Rlp_Icode_c:
    case Rlp_Itype_c:
    case Rlp_Offset_c:
    case Rlp_Seq_c:
    case Rlp_Within_c:
      entry->rchild =
    (Rlp_Formula_t *) (Rlp_IntAttribute_t *)
    malloc (sizeof (Rlp_IntAttribute_t));
      sscanf ((char *) entry->lchild, "%d",
          (int *) &((Rlp_IntAttribute_t *) entry->rchild)->intEntry);
      return 0;

    case Rlp_Byte_Jump_c:
      return parseByteJump (entry);
    case Rlp_Byte_Test_c:
      return parseByteTest (entry);
    case Rlp_Content_c:
      return parseContent (entry);
    case Rlp_Pcre_c:
      return parsePcre (entry);
    case Rlp_Id_c:
      return parseIpProto (entry);  // this is not a cut and paste error, we can use the exact same struct
    case Rlp_Ip_Proto_c:
      return parseIpProto (entry);
    case Rlp_Dsize_c:
      return parseDsize (entry);
    case Rlp_Flags_c:
      return parseFlags (entry);
    case Rlp_Fragbits_c:
      return parseFragbits (entry);
    case Rlp_IpOpts_c:
      return parseIpOpts (entry);
    case Rlp_Rpc_c:
      return parseRpc (entry);
    case Rlp_Ttl_c:
      return parseTtl (entry);
    case Rlp_Uricontent_c:
      return parseUricontent (entry);
    case Rlp_Interface_c:
      return parseInterface (entry);
    case Rlp_Sample_c:
      return parseSample (entry);

    default:
      printf ("Problem - passed in an unknown type of formula, ignoring\n");
      assert (0);
    }

  printf ("Should never be here\n");
  return -1;
}


/**
  * \brief  Parse bytejump value string.
  * 
  * We aren't checking that big/little or dec/oct/hex etc are exclusive, relying
  * on input to be well formed.
  * 
  */

static int
parseByteJump (Rlp_Formula_t * entry)
{
  entry->rchild =
    (Rlp_Formula_t *) (Rlp_ByteJumpAttribute_t *)
    malloc (sizeof (Rlp_ByteJumpAttribute_t));

  Rlp_ByteJumpAttribute_t *result = (Rlp_ByteJumpAttribute_t *) entry->rchild;

  result->bytesToConvert = result->offset = -1;

  result->relative = result->useLittleEndian = result->isString =
    result->isHex = result->isDec = result->isOct = result->doAlign = false;

  char *rawValue = (char *) entry->lchild;

  sscanf (rawValue, "%d , %d", &(result->bytesToConvert), &(result->offset));

  if (strstr (rawValue, "relative"))
    {
      result->relative = true;
    }
  if (strstr (rawValue, "big"))
    {
      result->useLittleEndian = false;
    }
  if (strstr (rawValue, "little"))
    {
      result->useLittleEndian = true;
    }
  if (strstr (rawValue, "string"))
    {
      result->isString = true;
    }
  if (strstr (rawValue, "hex"))
    {
      result->isHex = true;
    }
  if (strstr (rawValue, "dec"))
    {
      result->isDec = true;
    }
  if (strstr (rawValue, "oct"))
    {
      result->isOct = true;
    }
  if (strstr (rawValue, "align"))
    {
      result->doAlign = true;
    }

  return 0;

};


/**
  * \brief  Parse bytetest string.
  * 
  * We aren't checking that 
  * big/little or dec/oct/hex etc are exclusive, relying
  * on input to be well formed.
  * 
  */

static int
parseByteTest (Rlp_Formula_t * entry)
{
  entry->rchild =
    (Rlp_Formula_t *) (Rlp_ByteTestAttribute_t *)
    malloc (sizeof (Rlp_ByteTestAttribute_t));

  Rlp_ByteTestAttribute_t *result = (Rlp_ByteTestAttribute_t *) entry->rchild;

  //  <bytes_to_convert>, <operator>, <value>, <offset>
  // [, [relative],[big],[little],[string],[hex],[dec],[oct] ]

  result->relative = result->useLittleEndian = result->isString =
    result->isHex = result->isDec = result->isOct = false;

  char *rawValue = (char *) entry->lchild;

  // this needs to be fixed - since value may be encoded in hex or oct
  sscanf (rawValue, "%d , %c , %d , %d", &(result->bytesToConvert),
      &(result->check ), &(result->value), &(result->offset));

  if (strstr (rawValue, "relative"))
    {
      result->relative = true;
    }
  if (strstr (rawValue, "big"))
    {
      result->useLittleEndian = false;
    }
  if (strstr (rawValue, "little"))
    {
      result->useLittleEndian = true;
    }
  if (strstr (rawValue, "string"))
    {
      result->isString = true;
    }
  if (strstr (rawValue, "hex"))
    {
      result->isHex = true;
    }
  if (strstr (rawValue, "dec"))
    {
      result->isDec = true;
    }
  if (strstr (rawValue, "oct"))
    {
      result->isOct = true;
    }

  return 0;
}


/**
  * \brief  Parse ip_proto string
  * 
  */

static int
parseIpProto (Rlp_Formula_t * entry)
{
  char *rawValue = (char *) entry->lchild;

  entry->rchild =
    (Rlp_Formula_t *) (Rlp_IpProtoAttribute_t *)
    malloc (sizeof (Rlp_IpProtoAttribute_t));
  Rlp_IpProtoAttribute_t *result = (Rlp_IpProtoAttribute_t *) entry->rchild;

  result->greaterThan = result->lessThan = false;
  result->negated = false;

  if (strchr (rawValue, '<'))
    {
      result->lessThan = true;
    }
  if (strchr (rawValue, '>'))
    {
      result->greaterThan = true;
    }
  if (strchr (rawValue, '!'))
    {
      result->negated = true;
    }

  while (!isdigit (*rawValue))
    rawValue++;

  sscanf (rawValue, "%d", &(result->value));

  return 0;
}


/** \brief  Parse dvalue string */

static int
parseDsize (Rlp_Formula_t * entry)
{
  char *rawValue = (char *) entry->lchild;

  entry->rchild =
    (Rlp_Formula_t *) (Rlp_DsizeAttribute_t *)
    malloc (sizeof (Rlp_DsizeAttribute_t));
  Rlp_DsizeAttribute_t *result = (Rlp_DsizeAttribute_t *) entry->rchild;

  result->greaterThan = result->lessThan = false;
  result->dsize = -1;

  if (strchr (rawValue, '<'))
    {
      result->lessThan = true;
    }
  if (strchr (rawValue, '>'))
    {
      result->greaterThan = true;
    }

  while (!isdigit (*rawValue))
    rawValue++;

  sscanf (rawValue, "%d", &(result->dsize));

  return 0;
}


/** \brief  Parse sample */

static int
parseSample (Rlp_Formula_t * entry)
{
  char *rawValue = (char *) entry->lchild;

  Rlp_SampleAttribute_t *result =
    (Rlp_SampleAttribute_t *) malloc (sizeof (Rlp_SampleAttribute_t));

  entry->rchild = (Rlp_Formula_t *) result;

  sscanf (rawValue, "%lf", &result->threshold);
  if (result->threshold > 1.0)
    {
      printf
    ("Warning, sampling threshold %f is bigger than 1.0, using 1.0\n",
     result->threshold);
      result->threshold = 1.0;
    }
  else if (result->threshold < 0.0)
    {
      printf
    ("Warning, sampling threshold %f is smaller than 0.0, using 0.0\n",
     result->threshold);
      result->threshold = 0.0;
    }

  return 0;
}


/** \brief  Parse interface */

static int
parseInterface (Rlp_Formula_t * entry)
{
  char *rawValue = (char *) entry->lchild;

  Rlp_IfAttribute_t *result =
    (Rlp_IfAttribute_t *) malloc (sizeof (Rlp_IfAttribute_t));

  entry->rchild = (Rlp_Formula_t *) result;

  result->ifName = strdup (rawValue);
  result->interface = NIL (Pkt_LibPcap_t);

  return 0;
}


/** \brief  Parse TTL */

static int
parseTtl (Rlp_Formula_t * entry)
{
  char *rawValue = (char *) entry->lchild;

  Rlp_TtlAttribute_t *result =
    (Rlp_TtlAttribute_t *) malloc (sizeof (Rlp_TtlAttribute_t));

  entry->rchild = (Rlp_Formula_t *) result;

  result->lessThan = result->greaterThan = false;
  result->ttl = -1;

  if (strchr (rawValue, '<'))
    {
      result->lessThan = true;
    }
  if (strchr (rawValue, '>'))
    {
      result->greaterThan = true;
    }

  while (!isdigit (*rawValue))
    rawValue++;

  sscanf (rawValue, "%d", &(result->ttl));

  return 0;
}


/** \brief  Parse ipopts */

static int
parseIpOpts (Rlp_Formula_t * entry)
{
  char *rawValue = (char *) entry->lchild;
  char rawValueWithoutSpaces[1000];

  Rlp_IpOptsAttribute_t *result =
    (Rlp_IpOptsAttribute_t *) malloc (sizeof (Rlp_IpOptsAttribute_t));

  entry->rchild = (Rlp_Formula_t *) result;

  result->ipOpt = Rlp_unassigned_c;

  int i;
  int length = 0;
  for (i = 0; i < (int) strlen (rawValue); i++)
    {
      if (!isspace (rawValue[i]))
    {
      rawValueWithoutSpaces[i] = rawValue[i];
      length++;
    }
    }
  rawValueWithoutSpaces[length] = '\0';

  if (util_strequal (rawValueWithoutSpaces, "rr"))
    {
      result->ipOpt = Rlp_rr_c;
    }
  if (util_strequal (rawValueWithoutSpaces, "eol"))
    {
      result->ipOpt = Rlp_eol_c;
    }
  if (util_strequal (rawValueWithoutSpaces, "nop"))
    {
      result->ipOpt = Rlp_nop_c;
    }
  if (util_strequal (rawValueWithoutSpaces, "ts"))
    {
      result->ipOpt = Rlp_ts_c;
    }
  if (util_strequal (rawValueWithoutSpaces, "sec"))
    {
      result->ipOpt = Rlp_sec_c;
    }
  if (util_strequal (rawValueWithoutSpaces, "lsrr"))
    {
      result->ipOpt = Rlp_lsrr_c;
    }
  if (util_strequal (rawValueWithoutSpaces, "lsrre"))
    {
      result->ipOpt = Rlp_lsrre_c;
    }
  if (util_strequal (rawValueWithoutSpaces, "ssrr"))
    {
      result->ipOpt = Rlp_ssrr_c;
    }
  if (util_strequal (rawValueWithoutSpaces, "satid"))
    {
      result->ipOpt = Rlp_satid_c;
    }
  if (result->ipOpt == Rlp_unassigned_c)
    {
      printf ("Hit unassigned ipOpt\n");
      assert (0);
    }

  return 0;
}


/**
  * \brief  Parse fragbits. 
  * 
  * \todo Not clear what is meant by 
  * + or -, so simply checking which chars are present.
  * 
  */

static int
parseFragbits (Rlp_Formula_t * entry)
{
  char *rawValue = (char *) entry->lchild;

  Rlp_FragbitsAttribute_t *result =
    (Rlp_FragbitsAttribute_t *) malloc (sizeof (Rlp_FragbitsAttribute_t));

  entry->rchild = (Rlp_Formula_t *) result;

  result->RB = parseIndividualFlag (rawValue, 'R');
  result->MF = parseIndividualFlag (rawValue, 'M');
  result->DF = parseIndividualFlag (rawValue, 'D');

  return 0;
}


/** \brief  Parse tcp flags. 
  
\todo Not clear what is meant by 
+ or -, so simply checking which chars are present.
If a char is not present, the default is don't care.
Consequently, we're not differentiating wrt A and A+.
*/


static int
parseFlags (Rlp_Formula_t * entry)
{
  char *rawValue = (char *) entry->lchild;

  Rlp_FlagsAttribute_t *result =
    (Rlp_FlagsAttribute_t *) malloc (sizeof (Rlp_FlagsAttribute_t));

  entry->rchild = (Rlp_Formula_t *) result;

  result->noFlagsSet = one_c;

  result->F = parseIndividualFlag (rawValue, 'F');
  result->S = parseIndividualFlag (rawValue, 'S');
  result->R = parseIndividualFlag (rawValue, 'R');
  result->P = parseIndividualFlag (rawValue, 'P');
  result->A = parseIndividualFlag (rawValue, 'A');
  result->U = parseIndividualFlag (rawValue, 'U');
  result->r_2 = parseIndividualFlag (rawValue, 'E');
  result->r_1 = parseIndividualFlag (rawValue, 'C');

  if ((result->F != X_c) ||
      (result->S != X_c) ||
      (result->R != X_c) ||
      (result->P != X_c) ||
      (result->A != X_c) ||
      (result->U != X_c) || (result->r_2 != X_c) || (result->r_1 != X_c))
    {
      result->noFlagsSet = zero_c;
    }

  return 0;
}


/** \brief Utility function to parse tcp flags */

static Rlp_FlagType_t
parseIndividualFlag (char *rawValue, char flag)
{
  char *loc = strchr (rawValue, flag);
  if (loc == NIL (char))
    {
      return X_c;
    }
  if (loc == rawValue)
    {
      // cant be negated;
      return one_c;
    }
  if (loc[-1] == '!')
    {
      return zero_c;
    }
  return one_c;
}


/** \brief  Parse rpc */

static int
parseRpc (Rlp_Formula_t * entry)
{
  char *rawValue = (char *) entry->lchild;
  Rlp_RpcAttribute_t *result =
    (Rlp_RpcAttribute_t *) malloc (sizeof (Rlp_RpcAttribute_t));
  entry->rchild = (Rlp_Formula_t *) result;

  result->application = result->procedure = result->version = -1;
  result->anyProcedure = result->anyVersion = false;

  char tmp1Buf[100];
  char tmp2Buf[100];
  char tmp3Buf[100];

  int length = 0;
  while (*rawValue != ',')
    {
      tmp1Buf[length] = *rawValue;
      rawValue++;
      length++;
    }
  tmp1Buf[length] = '\0';
  rawValue++;           // get past the comma

  length = 0;
  while (*rawValue != ',')
    {
      *tmp2Buf = *rawValue;
      rawValue++;
      length++;
    }
  tmp2Buf[length] = '\0';
  rawValue++;           // get past the comma

  length = 0;
  while (*rawValue != '\0')
    {
      *tmp3Buf = *rawValue;
      rawValue++;
      length++;
    }
  tmp2Buf[length] = '\0';

  sscanf (tmp1Buf, "%d", &(result->application));

  if (strchr (tmp2Buf, '*'))
    {
      result->anyProcedure = true;
    }
  else
    {
      sscanf (tmp2Buf, "%d", &(result->procedure));
    }

  if (strchr (tmp3Buf, '*'))
    {
      result->anyVersion = true;
    }
  else
    {
      sscanf (tmp3Buf, "%d", &(result->version));
    }

  return 0;
}


/**
  * \brief  Parse content into a byte string
  * 
  * The value is in quotes, because the content
  * is specified using content:"abc" so we need to remove
  * the trailing and starting quotes before parsing.
  * 
  * \todo are we handling escaped | correctly?
  * 
  */

static int
parseContent (Rlp_Formula_t * entry)
{
  util_byte_array_t *tmpResult;
  util_byte_array_t *result = util_byte_array_create (NIL (char), 0);

  bool negated = false;
  util_byte_array_t *tmpByteArray;

  // this is to remove the beginning and trailing " 
  char *rawValue = strdup (((char *) (entry->lchild)));
  RLP_SKIP_SPACE (rawValue);    // get rid of any leading spaces
  if (*rawValue == '!')
    {
      // this is a negated formula
      negated = true;
      rawValue++;
      RLP_SKIP_SPACE (rawValue);
    }
  assert (*rawValue == '"');

  // there may be space between the quote and the semicolon!
  // hard bug to find ( content:" --use-compress-program" ; )
  int lastQuoteIndex = strlen (rawValue) - 1;
  while (rawValue[lastQuoteIndex] != '"')
    {
      lastQuoteIndex--;
    }
  rawValue[lastQuoteIndex] = '\0';
  rawValue++;           // rawValue past the first quote

  entry->rchild =
    (Rlp_Formula_t *) (Rlp_ContentAttribute_t *)
    malloc (sizeof (Rlp_ContentAttribute_t));
  ((Rlp_ContentAttribute_t *) entry->rchild)->negated = negated;
  ((Rlp_ContentAttribute_t *) entry->rchild)->byteArray = result;

  // first split into a series of strings, some bytecode, some strings
  // then convert bytecode to byte-array, then de-escape strings, then
  // merge to one

  char byteCodeBuffer[1000];
  char textBuffer[1000];
  char tmpBuffer[1000];
  char *tmpPtr;

  while (1)
    {

      if (*rawValue == '|')
    {
      rawValue++;
      tmpPtr = byteCodeBuffer;
      while (*rawValue != '|')
        {
          *tmpPtr = *rawValue;
          rawValue++;
          tmpPtr++;
        }
      rawValue++;       // get past the ending |
      *tmpPtr = '\0';

      tmpPtr = strdup (byteCodeBuffer);
      tmpByteArray = Rlp_ByteCodeToByteArray (byteCodeBuffer);
      tmpResult = util_byte_array_join (result, tmpByteArray);
      util_byte_array_free (tmpByteArray);
      util_byte_array_free (result);
      result = tmpResult;
      ((Rlp_ContentAttribute_t *) entry->rchild)->byteArray = result;
    }
      if (*rawValue == '\0')
    {
      break;
    }
      tmpPtr = textBuffer;
      while (1)
    {
      if (*rawValue == '\0')
        {
          break;
        }
      if (*rawValue == '|' && rawValue[-1] != '\\')
        {
          break;
        }
      *tmpPtr = *rawValue;
      tmpPtr++;
      rawValue++;
    }
      *tmpPtr = '\0';

      int j = 0;
      int i;
      for (i = 0; i < (int) strlen (textBuffer); i++)
    {
      if ((textBuffer[i] == '\\' && textBuffer[i + 1] == ':')
          || (textBuffer[i] == '\\' && textBuffer[i + 1] == ';')
          || (textBuffer[i] == '\\' && textBuffer[i + 1] == '\\')
          || (textBuffer[i] == '\\' && textBuffer[i + 1] == '|')
          || (textBuffer[i] == '\\' && textBuffer[i + 1] == '"'))
        {
          i++;
        }
      tmpBuffer[j] = textBuffer[i];
      j++;
    }

      tmpByteArray = util_byte_array_create (tmpBuffer, j);
      tmpResult = util_byte_array_join (result, tmpByteArray);
      util_byte_array_free (tmpByteArray);
      util_byte_array_free (result);
      result = tmpResult;
      ((Rlp_ContentAttribute_t *) entry->rchild)->byteArray = result;
    }

  if (false)
    util_byte_array_print (result);

  return 0;
}

/**
  * \brief  Convert byte code to a byte array.
  * 
  * Input assumed to be in hex, with possible whitespace.
  * 
  */

util_byte_array_t *
Rlp_ByteCodeToByteArray (char *byteCode)
{
  util_byte_array_t *result =
    (util_byte_array_t *) malloc (sizeof (util_byte_array_t));

  int length = 0;
  unsigned char tmpBuf[1000];
  unsigned char *tmpPtr = (unsigned char *) byteCode;

  while (1)
    {
      while (isspace (*tmpPtr))
    {
      tmpPtr++;
    }
      if (*tmpPtr == '\0')
    {
      break;
    }
      assert ((('0' <= *tmpPtr) && (*tmpPtr <= '9')) ||
          (('a' <= *tmpPtr) && (*tmpPtr <= 'f')) ||
          (('A' <= *tmpPtr) && (*tmpPtr <= 'F')));
      int msb = hexToInt (*tmpPtr);
      tmpPtr++;

      // there are examples where the bytecode has white space between
      // succ chars

      while (isspace (*tmpPtr))
    {
      tmpPtr++;
    }
      if (*tmpPtr == '\0')
    {
      printf ("Malformed bytecode - odd number of hex entries\n");
      assert (0);
    }

      int lsb = hexToInt (*tmpPtr);
      unsigned char byte = 16 * msb + lsb;
      tmpPtr++;
      tmpBuf[length] = byte;
      length++;
    }
  result->length = length;
  result->bytes = (char *) malloc (length * sizeof (unsigned char));
  memcpy (result->bytes, tmpBuf, length);

  return result;
}


/**
  * \brief  Convert a char representing an integer in hex to corresp int
  */

static int
hexToInt (char hexChar)
{
  int result = -1;
  if (('0' <= hexChar) && (hexChar <= '9'))
    {
      result = hexChar - '0';
    }
  if (('a' <= hexChar) && (hexChar <= 'f'))
    {
      result = 10 + (hexChar - 'a');
    }
  if (('A' <= hexChar) && (hexChar <= 'F'))
    {
      result = 10 + (hexChar - 'A');
    }
  assert (result != -1);

  return result;
}


/**
  * \brief  Parse uricontent
  * 
  * Handle exactly as a content string; 
  * the difference is in the checking.
  * 
  */

static int
parseUricontent (Rlp_Formula_t * entry)
{
  return parseContent (entry);
}


/**
  * \brief  Print a node, which is assumed to be an entry in a parse tree.
  * 
  */

int
Rlp_NodePrint (Rlp_Formula_t * entry)
{
  Rlp_ByteJumpAttribute_t *byteJumpAttrib;
  Rlp_ByteTestAttribute_t *byteTestAttrib;
  Rlp_DsizeAttribute_t *dsizeAttrib;
  util_byte_array_t *byteArray;
  Rlp_FlagsAttribute_t *flagsAttrib;
  Rlp_FragbitsAttribute_t *fragbitsAttrib;
  Rlp_IpOptsAttribute_t *ipoptsAttrib;
  char *ipoptsString;
  Rlp_TtlAttribute_t *ttlAttrib;
  Rlp_RpcAttribute_t *rpcAttrib;

  if (entry == NIL (Rlp_Formula_t))
    {
      return 0;
    }

  printf ("Adnan ");

  switch (entry->type)
    {


    case Rlp_Nocase_c:
      printf ("nocase; ");
      break;
    case Rlp_Sameip_c:
      printf ("sameip; ");
      break;

    case Rlp_Ack_c:
      printf ("ack:%d ", ((Rlp_IntAttribute_t *) (entry->rchild))->intEntry);
      break;
    case Rlp_Depth_c:
      printf ("depth:%d ",
          ((Rlp_IntAttribute_t *) (entry->rchild))->intEntry);
      break;
    case Rlp_Distance_c:
      printf ("distance:%d ",
          ((Rlp_IntAttribute_t *) (entry->rchild))->intEntry);
      break;
    case Rlp_Icmp_Id_c:
      printf ("icmp:%d ", ((Rlp_IntAttribute_t *) (entry->rchild))->intEntry);
      break;
    case Rlp_Icmp_Seq_c:
      printf ("icmp_seq:%d ",
          ((Rlp_IntAttribute_t *) (entry->rchild))->intEntry);
      break;
    case Rlp_Icode_c:
      printf ("icode:%d ",
          ((Rlp_IntAttribute_t *) (entry->rchild))->intEntry);
      break;
    case Rlp_Ip_Proto_c:
      printf ("ip:%d ", ((Rlp_IntAttribute_t *) (entry->rchild))->intEntry);
      break;
    case Rlp_Itype_c:
      printf ("itype:%d ",
          ((Rlp_IntAttribute_t *) (entry->rchild))->intEntry);
      break;
    case Rlp_Id_c:
      printf ("id:%d ", ((Rlp_IntAttribute_t *) (entry->rchild))->intEntry);
      break;
    case Rlp_Offset_c:
      printf ("offset:%d ",
          ((Rlp_IntAttribute_t *) (entry->rchild))->intEntry);
      break;
    case Rlp_Seq_c:
      printf ("seq:%d ", ((Rlp_IntAttribute_t *) (entry->rchild))->intEntry);
      break;
    case Rlp_Within_c:
      printf ("within:%d ",
          ((Rlp_IntAttribute_t *) (entry->rchild))->intEntry);
      break;

    case Rlp_Byte_Jump_c:
      byteJumpAttrib = (Rlp_ByteJumpAttribute_t *) entry->rchild;
      printf ("byte_jump:%d,%d", byteJumpAttrib->bytesToConvert,
          byteJumpAttrib->offset);
      if (byteJumpAttrib->relative)
    {
      printf (",relative");
    }
      if (byteJumpAttrib->useLittleEndian)
    {
      printf (",little");
    }
      if (byteJumpAttrib->isString)
    {
      printf (",string");
    }
      if (byteJumpAttrib->isHex)
    {
      printf (",hex");
    }
      if (byteJumpAttrib->isOct)
    {
      printf (",oct");
    }
      if (byteJumpAttrib->isDec)
    {
      printf (",dec");
    }
      if (byteJumpAttrib->doAlign)
    {
      printf (",align");
    }
      printf (" ");
      break;

    case Rlp_Byte_Test_c:
      byteTestAttrib = (Rlp_ByteTestAttribute_t *) entry->rchild;
      printf ("byte_test:%d,%c,%d,%d", byteTestAttrib->bytesToConvert,
          byteTestAttrib->check,
          byteTestAttrib->value, byteTestAttrib->offset);
      if (byteTestAttrib->relative)
    {
      printf (",relative");
    }
      if (byteTestAttrib->useLittleEndian)
    {
      printf (",little");
    }
      if (byteTestAttrib->isString)
    {
      printf (",string");
    }
      if (byteTestAttrib->isHex)
    {
      printf (",hex");
    }
      if (byteTestAttrib->isOct)
    {
      printf (",oct");
    }
      if (byteTestAttrib->isDec)
    {
      printf (",dec");
    }
      printf (" ");
      break;

    case Rlp_Content_c:
    case Rlp_Uricontent_c:
      byteArray = (util_byte_array_t *) entry->rchild;
      printf ("%s: ",
          (entry->type == Rlp_Content_c) ? "content" : "uricontent");
      util_byte_array_free (byteArray);
      break;

    case Rlp_Dsize_c:
      dsizeAttrib = (Rlp_DsizeAttribute_t *) entry->rchild;
      printf ("dsize:%s%d ", (dsizeAttrib->greaterThan ? ">" :
                  (dsizeAttrib->lessThan ? "<" : "")),
          dsizeAttrib->dsize);
      break;

    case Rlp_Flags_c:
      flagsAttrib = (Rlp_FlagsAttribute_t *) entry->rchild;
      printf ("flags:%s%s%s%s%s%s%s%s ",
          flagsAttrib->F ? "F" : "",
          flagsAttrib->S ? "S" : "",
          flagsAttrib->R ? "R" : "",
          flagsAttrib->P ? "P" : "",
          flagsAttrib->A ? "A" : "",
          flagsAttrib->U ? "U" : "",
          flagsAttrib->r_2 ? "2" : "", flagsAttrib->r_1 ? "1" : "");
      break;

    case Rlp_Fragbits_c:
      fragbitsAttrib = (Rlp_FragbitsAttribute_t *) entry->rchild;
      printf ("flags:%s%s%s ",
          fragbitsAttrib->RB ? "R" : "",
          fragbitsAttrib->MF ? "M" : "", fragbitsAttrib->DF ? "D" : "");
      break;

    case Rlp_IpOpts_c:
      ipoptsAttrib = (Rlp_IpOptsAttribute_t *) entry->rchild;
      switch (ipoptsAttrib->ipOpt)
    {
    case Rlp_unassigned_c:
      ipoptsString = "---UNASSIGNED";
      break;
    case Rlp_rr_c:
      ipoptsString = "rr";
      break;
    case Rlp_eol_c:
      ipoptsString = "eol";
      break;
    case Rlp_nop_c:
      ipoptsString = "nop";
      break;
    case Rlp_ts_c:
      ipoptsString = "ts";
      break;
    case Rlp_sec_c:
      ipoptsString = "sec";
      break;
    case Rlp_lsrr_c:
      ipoptsString = "lsrr";
      break;
    case Rlp_lsrre_c:
      ipoptsString = "lsrre";
      break;
    case Rlp_ssrr_c:
      ipoptsString = "ssrr";
      break;
    case Rlp_satid_c:
      ipoptsString = "satid";
      break;
    default:
      printf ("panic, reached unknown case\n");
      assert (0);
    }
      printf ("ipopts:%s ", ipoptsString);
      break;

    case Rlp_Rpc_c:
      rpcAttrib = (Rlp_RpcAttribute_t *) entry->rchild;
      char application[100];
      char procedure[100];
      char version[100];
      sprintf (application, "%d", rpcAttrib->application);
      if (rpcAttrib->anyProcedure)
    {
      sprintf (procedure, "%s", "*");
    }
      else
    {
      sprintf (procedure, "%d", rpcAttrib->procedure);
    }
      if (rpcAttrib->anyVersion)
    {
      sprintf (version, "%s", "*");
    }
      else
    {
      sprintf (version, "%d", rpcAttrib->version);
    }
      printf ("rpc:%s,%s,%s ", application, procedure, version);
      break;

    case Rlp_Ttl_c:
      ttlAttrib = (Rlp_TtlAttribute_t *) entry->rchild;
      printf ("ttl:%s%d ", (ttlAttrib->greaterThan ? ">" :
                (ttlAttrib->lessThan ? "<" : "")),
          ttlAttrib->ttl);
      break;

    default:
      printf ("Panic - passed in an unknown type of formula\n");
      assert (0);
    }
  return 0;
}

/** \brief  Read a bunch of L7 formulas from a file, return them in an array */

array_t *
Rlp_TestReadL7FormulasFromFile (char *fileName)
{

  FILE *l7File = fopen (fileName, "r");

  if (l7File == NIL (FILE))
    {
      printf ("Could not open file %s, returning NIL\n", fileName);
    }
  array_t *result = array_alloc (Rlp_Formula_t *, 0);

  char tmpBuf[10000];
  while (1)
    {
      if (!fgets (tmpBuf, 10000, l7File))
    {
      return result;
    }
      array_t *aRule = Rlp_L7StringParse (tmpBuf);
      Rlp_Formula_t *aParsedRule =
    Rlp_CreateParseTreeFromAttribValuePairArray (aRule);
      array_insert_last (Rlp_Formula_t *, result, aParsedRule);
    }
  return result;
}


/** \brief  Get the L4 text from a rule */

char *
Rlp_GetL4ComponentFromRawRule (char *rawRule)
{
  char tmpBuf[10000];

  strcpy (tmpBuf, rawRule);

  char *tmpPtr = strchr (tmpBuf, '(');
  *tmpPtr = '\0';

  tmpPtr = tmpBuf;
  while (*tmpPtr == ' ')
    {
      tmpPtr++;
    }
  if (util_strequalN (tmpPtr, "preprocess", strlen ("preprocess")))
    {
      tmpPtr += strlen ("preprocess");
      while (*tmpPtr == ' ')
    {
      tmpPtr++;
    }
    }

  return strdup (tmpPtr);
}


/** \brief  Get the L7 text from a rule */

char *
Rlp_GetL7ComponentFromRawRule (char *rawRule)
{
  char tmpBuf[10000];
  char *beginPtr = strchr (rawRule, '(');
  char *endPtr = strrchr (rawRule, ')');

  assert (beginPtr != NIL (char));
  assert (endPtr != NIL (char));

  /* 

     '(' 'x' 's' 'a' ')'
     4   5   6   7   8
     ( 8 - 4 )  - 1 = 4 - 1 = 3


   */

  int length = (endPtr - beginPtr) - 1;

  strncpy (tmpBuf, beginPtr + 1, length);
  tmpBuf[length] = '\0';

  return strdup (tmpBuf);

}


/**
  * \brief  Get the action component from a rule
  * 
  * The assumption is that the rule consists of
  * layer 4 string, layer 7 string, which is enclosed
  * in parens, and then action string.  The right
  * parens symbol should NOT appear in the action string.
  * 
  */

char *
Rlp_GetActionComponentFromRawRule (char *rawRule)
{
  char *beginPtr = strrchr (rawRule, ')');
  assert (beginPtr != NIL (char));

  // add + 1 to go pass the ) parens
  return strdup (beginPtr + 1);
}


/** \brief  Check if a given rule attribute is a comment */

static bool
isComment (char *attribute)
{
  if (util_strequal (attribute, "msg") ||
      util_strequal (attribute, "classtype") ||
      util_strequal (attribute, "sid") ||
      util_strequal (attribute, "rev") ||
      util_strequal (attribute, "flow") ||
      util_strequal (attribute, "reference"))
    {
      return true;
    }
  else
    {
      return false;
    }
}


/** \brief  Free an array_t and the strings in it */

int
Rlp_FreeArrayOfStrings (array_t * stringArray)
{
  int i;
  for (i = 0; i < array_n (stringArray); i++)
    {
      char *aString = array_fetch (char *, stringArray, i);
      free (aString);
    }
  array_free (stringArray);
  return 0;
}


/**
  * \brief  Return a hash containing all the content checks for in the given rule
  * 
  * We're passing in an array containing Rlp_L7Check_t entries - these
  * are all the L7 checks in the corresponding rule.
  */

st_table *
Rlp_L7CheckGetContentChecks (array_t * L7CheckArray)
{
  st_table *result = Hash_InitTable ( (int(*)()) st_ptrcmp, (int(*)()) st_ptrhash);

  int i;
  for (i = 0; i < array_n (L7CheckArray); i++)
    {
      Rlp_L7Check_t *aCheck = array_fetch (Rlp_L7Check_t *, L7CheckArray, i);
      if ((aCheck->type == Rlp_L7ContentCheck_c) ||
      (aCheck->type == Rlp_L7UriContentCheck_c))
    {
      // Hash_Insert( result, ( char * ) aCheck->entryData.contentCheck->content, (char * ) 0 );
      // We are inserting the check itself, rather than just the strings 
      // because there is (at least) one place where we need to know
      // more thenan the string - specifically, we need to know if the check 
      // is negated to not put the string in the DFA
      Hash_Insert (result, (char *) aCheck->entryData.contentCheck,
             (char *) 0);
    }
    }
  return result;
}


/** \brief  Code to test parsing of content */

void
Rlp_TestParseContent (char *fileName)
{
  FILE *fp = fopen (fileName, "r");
  util_byte_array_t USE *aByteArray;
  st_table *uniqStrings =
    Hash_InitTable ( (int(*)()) util_byte_array_cmp,  (int(*)()) util_byte_array_hash);
  st_table *dups = Hash_InitTable ( (int(*)()) strcmp,  (int(*)()) st_strhash);
  int count;

  char tmpBuf[10000];
  int i = 0;
  while (1)
    {
      i++;
      if (!fgets (tmpBuf, 10000, fp))
    {
      break;
    }
      // get rid of trailing newline
      tmpBuf[strlen (tmpBuf) - 1] = '\0';
      Rlp_Formula_t tmpNode;
      tmpNode.lchild = (Rlp_Formula_t *) strdup (tmpBuf);
      parseContent (&tmpNode);
      if (Hash_Lookup
      (uniqStrings,
       (char *) ((Rlp_ContentAttribute_t *) tmpNode.rchild)->byteArray,
       (char **) &count))
    {
      Hash_Insert (uniqStrings,
             (char *) ((Rlp_ContentAttribute_t *) tmpNode.rchild)->
             byteArray, (char *) count + 1);
      Hash_Insert (dups, (char *) tmpNode.lchild,
             (char *) ((Rlp_ContentAttribute_t *) tmpNode.rchild)->
             byteArray);
    }
      else
    {
      Hash_Insert (uniqStrings,
             (char *) ((Rlp_ContentAttribute_t *) tmpNode.rchild)->
             byteArray, (char *) 1);
    }
    }

}


/** \brief  Adds a mapping from a macro name to definition
  *
  *     Typically anEntry will be "var foo 192.168.1.1"
  *     We will add "foo" to the
  *     table, and map it to "192.168.1.1"
  *
  */

int
Rlp_UpdateDefineTable (st_table * aTable, char *anEntry)
{
  char varBuf[1000];
  // say anEntry is "var   foo   80"
  char *beginSymbolPtr = anEntry + 3;   // points to "   foo 80"
  while (isspace (*beginSymbolPtr))
    {
      beginSymbolPtr++;
    }
  // now it's pointing to "foo 80"

  char *endSymbolPtr = strchr (beginSymbolPtr, ' ');
  // endSymbolPtr is pointing to " 80"
  while (isspace (*endSymbolPtr))
    {
      endSymbolPtr--;
    }
  // now endSymbolPointer is pointing to "o 80"
  endSymbolPtr++;
  // now endSymbolPointer is pointing to " 80"

  int length = endSymbolPtr - beginSymbolPtr;
  strncpy (varBuf, beginSymbolPtr, length);
  varBuf[length] = '\0';
  char *symbolName = strdup (varBuf);

  char *symbolValue;
  while (isspace (*endSymbolPtr))
    {
      endSymbolPtr++;
    }
  // now endSymbolPtr points to "80"
  symbolValue = strdup (endSymbolPtr);
  // remove any trailing whitespace
  char *tmpPtr = symbolValue + strlen (symbolValue) - 1;
  while (isspace (*tmpPtr))
    {
      *tmpPtr = '\0';
      tmpPtr--;
    }
  Hash_Insert (aTable, symbolName, symbolValue);
  return 0;
}


/** \brief  Parse pcre */

static int
parsePcre (Rlp_Formula_t * entry)
{
  int errorOffset;
  const char *error;

  // this is to remove the beginning and trailing "
  char *rawValue = strdup (((char *) (entry->lchild)));
  RLP_SKIP_SPACE (rawValue);    // get rid of any leading spaces
  assert (*rawValue == '"');
  // there may be space between the quote and the semicolon!
  // hard bug to find ( content:" --use-compress-program" ; )
  int lastQuoteIndex = strlen (rawValue) - 1;
  while (rawValue[lastQuoteIndex] != '"')
    {
      lastQuoteIndex--;
    }
  rawValue[lastQuoteIndex] = '\0';
  rawValue++;           // rawValue past the first quote

  Rlp_PcreAttribute_t *result =
    (Rlp_PcreAttribute_t *) malloc (sizeof (Rlp_PcreAttribute_t));
  entry->rchild = (Rlp_Formula_t *) result;

  result->reText = rawValue;
  result->re = pcre_compile (result->reText, 0, &error, &errorOffset, NULL);
  result->pe = pcre_study (result->re, 0, &error);

  return 0;
}