/* Copyright (C) 2007-2020 Open Information Security Foundation

 *

 * You can copy, redistribute or modify this Program under the terms of

 * the GNU General Public License version 2 as published by the Free

 * Software Foundation.

 *

 * This program is distributed in the hope that it will be useful,

 * but WITHOUT ANY WARRANTY; without even the implied warranty of

 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the

 * GNU General Public License for more details.

 *

 * You should have received a copy of the GNU General Public License

 * version 2 along with this program; if not, write to the Free Software

 * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA

 * 02110-1301, USA.

 */

/**

 * \file

 *

 * \author Anoop Saldanha <anoopsaldanha@gmail.com>

 */

#include "suricata-common.h"

#include "threads.h"

#include "decode.h"

#include "detect.h"

#include "detect-parse.h"

#include "detect-engine.h"

#include "detect-engine-mpm.h"

#include "detect-engine-state.h"

#include "detect-content.h"

#include "detect-pcre.h"

#include "detect-bytejump.h"

#include "detect-bytetest.h"

#include "detect-byte-extract.h"

#include "detect-isdataat.h"

#include "detect-engine-build.h"

#include "app-layer-protos.h"

#include "flow.h"

#include "flow-var.h"

#include "flow-util.h"

#include "util-byte.h"

#include "util-debug.h"

#include "util-unittest.h"

#include "util-unittest-helper.h"

#include "util-spm.h"

/* the default value of endianness to be used, if none's specified */

#define DETECT_BYTE_EXTRACT_ENDIAN_DEFAULT DETECT_BYTE_EXTRACT_ENDIAN_BIG

/* the base to be used if string mode is specified.  These options would be

 * specified in DetectByteParseData->base */

#define DETECT_BYTE_EXTRACT_BASE_NONE 0

#define DETECT_BYTE_EXTRACT_BASE_HEX  16

#define DETECT_BYTE_EXTRACT_BASE_DEC  10

#define DETECT_BYTE_EXTRACT_BASE_OCT   8

/* the default value for multiplier.  Either ways we always store a

 * multiplier, 1 or otherwise, so that we can always multiply the extracted

 * value and store it, instead of checking if a multiplier is set or not */

#define DETECT_BYTE_EXTRACT_MULTIPLIER_DEFAULT 1

/* the min/max limit for multiplier */

#define DETECT_BYTE_EXTRACT_MULTIPLIER_MIN_LIMIT 1

#define DETECT_BYTE_EXTRACT_MULTIPLIER_MAX_LIMIT 65535

/* the max no of bytes that can be extracted in string mode - (string, hex)

 * (string, oct) or (string, dec) */

#define STRING_MAX_BYTES_TO_EXTRACT_FOR_OCT 23

#define STRING_MAX_BYTES_TO_EXTRACT_FOR_DEC 20

#define STRING_MAX_BYTES_TO_EXTRACT_FOR_HEX 14

/* the max no of bytes that can be extracted in non-string mode */

#define NO_STRING_MAX_BYTES_TO_EXTRACT 8

#define PARSE_REGEX "^"                                                  \

    "\\s*([0-9]+)\\s*"                                                   \

    ",\\s*(-?[0-9]+)\\s*"                                               \

    ",\\s*([^\\s,]+)\\s*"                                                \

    "(?:(?:,\\s*([^\\s,]+)\\s*)|(?:,\\s*([^\\s,]+)\\s+([^\\s,]+)\\s*))?" \

    "(?:(?:,\\s*([^\\s,]+)\\s*)|(?:,\\s*([^\\s,]+)\\s+([^\\s,]+)\\s*))?" \

    "(?:(?:,\\s*([^\\s,]+)\\s*)|(?:,\\s*([^\\s,]+)\\s+([^\\s,]+)\\s*))?" \

    "(?:(?:,\\s*([^\\s,]+)\\s*)|(?:,\\s*([^\\s,]+)\\s+([^\\s,]+)\\s*))?" \

    "(?:(?:,\\s*([^\\s,]+)\\s*)|(?:,\\s*([^\\s,]+)\\s+([^\\s,]+)\\s*))?" \

    "$"

static DetectParseRegex parse_regex;

static int DetectByteExtractSetup(DetectEngineCtx *, Signature *, const char *);

#ifdef UNITTESTS

static void DetectByteExtractRegisterTests(void);

#endif

static void DetectByteExtractFree(DetectEngineCtx *, void *);

/**

 * \brief Registers the keyword handlers for the "byte_extract" keyword.

 */

void DetectByteExtractRegister(void)

{

    sigmatch_table[DETECT_BYTE_EXTRACT].name = "byte_extract";

    sigmatch_table[DETECT_BYTE_EXTRACT].desc = "extract <num of bytes> at a particular <offset> and store it in <var_name>";

    sigmatch_table[DETECT_BYTE_EXTRACT].url = "/rules/payload-keywords.html#byte-extract";

    sigmatch_table[DETECT_BYTE_EXTRACT].Match = NULL;

    sigmatch_table[DETECT_BYTE_EXTRACT].Setup = DetectByteExtractSetup;

    sigmatch_table[DETECT_BYTE_EXTRACT].Free = DetectByteExtractFree;

#ifdef UNITTESTS

    sigmatch_table[DETECT_BYTE_EXTRACT].RegisterTests = DetectByteExtractRegisterTests;

#endif

    DetectSetupParseRegexes(PARSE_REGEX, &parse_regex);

}

int DetectByteExtractDoMatch(DetectEngineThreadCtx *det_ctx, const SigMatchData *smd,

        const Signature *s, const uint8_t *payload, uint32_t payload_len, uint64_t *value,

        uint8_t endian)

{

    DetectByteExtractData *data = (DetectByteExtractData *)smd->ctx;

    const uint8_t *ptr = NULL;

    int32_t len = 0;

    uint64_t val = 0;

    int extbytes;

    if (payload_len == 0) {

        return 0;

    }

    /* Calculate the ptr value for the bytetest and length remaining in

     * the packet from that point.

     */

    if (data->flags & DETECT_BYTE_EXTRACT_FLAG_RELATIVE) {

        SCLogDebug("relative, working with det_ctx->buffer_offset %"PRIu32", "

                   "data->offset %"PRIu32"", det_ctx->buffer_offset, data->offset);

        ptr = payload + det_ctx->buffer_offset;

        len = payload_len - det_ctx->buffer_offset;

        ptr += data->offset;

        len -= data->offset;

        /* No match if there is no relative base */

        if (len <= 0) {

            return 0;

        }

        //PrintRawDataFp(stdout,ptr,len);

    } else {

        SCLogDebug("absolute, data->offset %"PRIu32"", data->offset);

        ptr = payload + data->offset;

        len = payload_len - data->offset;

    }

    /* Validate that the to-be-extracted is within the packet */

    if (ptr < payload || data->nbytes > len) {

        SCLogDebug("Data not within payload pkt=%p, ptr=%p, len=%"PRIu32", nbytes=%d",

                    payload, ptr, len, data->nbytes);

        return 0;

    }

    /* Extract the byte data */

    if (data->flags & DETECT_BYTE_EXTRACT_FLAG_STRING) {

        extbytes = ByteExtractStringUint64(&val, data->base,

                                           data->nbytes, (const char *)ptr);

        if (extbytes <= 0) {

            /* strtoull() return 0 if there is no numeric value in data string */

            if (val == 0) {

                SCLogDebug("No Numeric value");

                return 0;

            } else {

                SCLogDebug("error extracting %d bytes of string data: %d",

                        data->nbytes, extbytes);

                return -1;

            }

        }

    } else {

        int endianness = (endian == DETECT_BYTE_EXTRACT_ENDIAN_BIG) ?

                          BYTE_BIG_ENDIAN : BYTE_LITTLE_ENDIAN;

        extbytes = ByteExtractUint64(&val, endianness, data->nbytes, ptr);

        if (extbytes != data->nbytes) {

            SCLogDebug("error extracting %d bytes of numeric data: %d",

                    data->nbytes, extbytes);

            return 0;

        }

    }

    /* Adjust the jump value based on flags */

    val *= data->multiplier_value;

    if (data->flags & DETECT_BYTE_EXTRACT_FLAG_ALIGN) {

        if ((val % data->align_value) != 0) {

            val += data->align_value - (val % data->align_value);

        }

    }

    ptr += extbytes;

    det_ctx->buffer_offset = ptr - payload;

    *value = val;

    SCLogDebug("extracted value is %"PRIu64, val);

    return 1;

}

/**

 * \internal

 * \brief Used to parse byte_extract arg.

 *

 * \param de_ctx Pointer to the detection engine context

 * \arg The argument to parse.

 *

 * \param bed On success an instance containing the parsed data.

 *            On failure, NULL.

 */

static inline DetectByteExtractData *DetectByteExtractParse(DetectEngineCtx *de_ctx, const char *arg)

{

    DetectByteExtractData *bed = NULL;

    int res = 0;

    size_t pcre2len;

    int i = 0;

    pcre2_match_data *match = NULL;

    int ret = DetectParsePcreExec(&parse_regex, &match, arg, 0, 0);

    if (ret < 3 || ret > 19) {

        SCLogError("parse error, ret %" PRId32 ", string \"%s\"", ret, arg);

        SCLogError("Invalid arg to byte_extract : %s "

                   "for byte_extract",

                arg);

        goto error;

    }

    bed = SCMalloc(sizeof(DetectByteExtractData));

    if (unlikely(bed == NULL))

        goto error;

    memset(bed, 0, sizeof(DetectByteExtractData));

    /* no of bytes to extract */

    char nbytes_str[64] = "";

    pcre2len = sizeof(nbytes_str);

    res = pcre2_substring_copy_bynumber(match, 1, (PCRE2_UCHAR8 *)nbytes_str, &pcre2len);

    if (res < 0) {

        SCLogError("pcre2_substring_copy_bynumber failed "

                   "for arg 1 for byte_extract");

        goto error;

    }

    if (StringParseUint8(&bed->nbytes, 10, 0,

                               (const char *)nbytes_str) < 0) {

        SCLogError("Invalid value for number of bytes"

                   " to be extracted: \"%s\".",

                nbytes_str);

        goto error;

    }

    /* offset */

    char offset_str[64] = "";

    pcre2len = sizeof(offset_str);

    res = pcre2_substring_copy_bynumber(match, 2, (PCRE2_UCHAR8 *)offset_str, &pcre2len);

    if (res < 0) {

        SCLogError("pcre2_substring_copy_bynumber failed "

                   "for arg 2 for byte_extract");

        goto error;

    }

    int32_t offset;

    if (StringParseI32RangeCheck(&offset, 10, 0, (const char *)offset_str, -65535, 65535) < 0) {

        SCLogError("Invalid value for offset: \"%s\".", offset_str);

        goto error;

    }

    bed->offset = offset;

    /* var name */

    char varname_str[256] = "";

    pcre2len = sizeof(varname_str);

    res = pcre2_substring_copy_bynumber(match, 3, (PCRE2_UCHAR8 *)varname_str, &pcre2len);

    if (res < 0) {

        SCLogError("pcre2_substring_copy_bynumber failed "

                   "for arg 3 for byte_extract");

        goto error;

    }

    bed->name = SCStrdup(varname_str);

    if (bed->name == NULL)

        goto error;

    /* check out other optional args */

    for (i = 4; i < ret; i++) {

        char opt_str[64] = "";

        pcre2len = sizeof(opt_str);

        res = SC_Pcre2SubstringCopy(match, i, (PCRE2_UCHAR8 *)opt_str, &pcre2len);

        if (res < 0) {

            SCLogError("pcre2_substring_copy_bynumber failed "

                       "for arg %d for byte_extract with %d",

                    i, res);

            goto error;

        }

        if (strcmp("relative", opt_str) == 0) {

            if (bed->flags & DETECT_BYTE_EXTRACT_FLAG_RELATIVE) {

                SCLogError("relative specified more "

                           "than once for byte_extract");

                goto error;

            }

            bed->flags |= DETECT_BYTE_EXTRACT_FLAG_RELATIVE;

        } else if (strcmp("multiplier", opt_str) == 0) {

            if (bed->flags & DETECT_BYTE_EXTRACT_FLAG_MULTIPLIER) {

                SCLogError("multiplier specified more "

                           "than once for byte_extract");

                goto error;

            }

            bed->flags |= DETECT_BYTE_EXTRACT_FLAG_MULTIPLIER;

            i++;

            char multiplier_str[16] = "";

            pcre2len = sizeof(multiplier_str);

            res = pcre2_substring_copy_bynumber(

                    match, i, (PCRE2_UCHAR8 *)multiplier_str, &pcre2len);

            if (res < 0) {

                SCLogError("pcre2_substring_copy_bynumber failed "

                           "for arg %d for byte_extract",

                        i);

                goto error;

            }

            uint16_t multiplier;

            if (StringParseU16RangeCheck(&multiplier, 10, 0, (const char *)multiplier_str,

                        DETECT_BYTE_EXTRACT_MULTIPLIER_MIN_LIMIT,

                        DETECT_BYTE_EXTRACT_MULTIPLIER_MAX_LIMIT) < 0) {

                SCLogError("Invalid value for"

                           "multiplier: \"%s\".",

                        multiplier_str);

                goto error;

            }

            bed->multiplier_value = multiplier;

        } else if (strcmp("big", opt_str) == 0) {

            if (bed->flags & DETECT_BYTE_EXTRACT_FLAG_ENDIAN) {

                SCLogError("endian option specified "

                           "more than once for byte_extract");

                goto error;

            }

            bed->flags |= DETECT_BYTE_EXTRACT_FLAG_ENDIAN;

            bed->endian = DETECT_BYTE_EXTRACT_ENDIAN_BIG;

        } else if (strcmp("little", opt_str) == 0) {

            if (bed->flags & DETECT_BYTE_EXTRACT_FLAG_ENDIAN) {

                SCLogError("endian option specified "

                           "more than once for byte_extract");

                goto error;

            }

            bed->flags |= DETECT_BYTE_EXTRACT_FLAG_ENDIAN;

            bed->endian = DETECT_BYTE_EXTRACT_ENDIAN_LITTLE;

        } else if (strcmp("dce", opt_str) == 0) {

            if (bed->flags & DETECT_BYTE_EXTRACT_FLAG_ENDIAN) {

                SCLogError("endian option specified "

                           "more than once for byte_extract");

                goto error;

            }

            bed->flags |= DETECT_BYTE_EXTRACT_FLAG_ENDIAN;

            bed->endian = DETECT_BYTE_EXTRACT_ENDIAN_DCE;

        } else if (strcmp("string", opt_str) == 0) {

            if (bed->flags & DETECT_BYTE_EXTRACT_FLAG_STRING) {

                SCLogError("string specified more "

                           "than once for byte_extract");

                goto error;

            }

            if (bed->base != DETECT_BYTE_EXTRACT_BASE_NONE) {

                SCLogError("The right way to specify "

                           "base is (string, base) and not (base, string) "

                           "for byte_extract");

                goto error;

            }

            bed->flags |= DETECT_BYTE_EXTRACT_FLAG_STRING;

        } else if (strcmp("hex", opt_str) == 0) {

            if (!(bed->flags & DETECT_BYTE_EXTRACT_FLAG_STRING)) {

                SCLogError("Base(hex) specified "

                           "without specifying string.  The right way is "

                           "(string, base) and not (base, string)");

                goto error;

            }

            if (bed->base != DETECT_BYTE_EXTRACT_BASE_NONE) {

                SCLogError("More than one base "

                           "specified for byte_extract");

                goto error;

            }

            bed->base = DETECT_BYTE_EXTRACT_BASE_HEX;

        } else if (strcmp("oct", opt_str) == 0) {

            if (!(bed->flags & DETECT_BYTE_EXTRACT_FLAG_STRING)) {

                SCLogError("Base(oct) specified "

                           "without specifying string.  The right way is "

                           "(string, base) and not (base, string)");

                goto error;

            }

            if (bed->base != DETECT_BYTE_EXTRACT_BASE_NONE) {

                SCLogError("More than one base "

                           "specified for byte_extract");

                goto error;

            }

            bed->base = DETECT_BYTE_EXTRACT_BASE_OCT;

        } else if (strcmp("dec", opt_str) == 0) {

            if (!(bed->flags & DETECT_BYTE_EXTRACT_FLAG_STRING)) {

                SCLogError("Base(dec) specified "

                           "without specifying string.  The right way is "

                           "(string, base) and not (base, string)");

                goto error;

            }

            if (bed->base != DETECT_BYTE_EXTRACT_BASE_NONE) {

                SCLogError("More than one base "

                           "specified for byte_extract");

                goto error;

            }

            bed->base = DETECT_BYTE_EXTRACT_BASE_DEC;

        } else if (strcmp("align", opt_str) == 0) {

            if (bed->flags & DETECT_BYTE_EXTRACT_FLAG_ALIGN) {

                SCLogError("Align specified more "

                           "than once for byte_extract");

                goto error;

            }

            bed->flags |= DETECT_BYTE_EXTRACT_FLAG_ALIGN;

            i++;

            char align_str[16] = "";

            pcre2len = sizeof(align_str);

            res = pcre2_substring_copy_bynumber(match, i, (PCRE2_UCHAR8 *)align_str, &pcre2len);

            if (res < 0) {

                SCLogError("pcre2_substring_copy_bynumber failed "

                           "for arg %d in byte_extract",

                        i);

                goto error;

            }

            if (StringParseUint8(&bed->align_value, 10, 0,

                                       (const char *)align_str) < 0) {

                SCLogError("Invalid align_value: "

                           "\"%s\".",

                        align_str);

                goto error;

            }

            if (!(bed->align_value == 2 || bed->align_value == 4)) {

                SCLogError("Invalid align_value for "

                           "byte_extract - \"%d\"",

                        bed->align_value);

                goto error;

            }

        } else if (strcmp("", opt_str) == 0) {

            ;

        } else {

            SCLogError("Invalid option - \"%s\" "

                       "specified in byte_extract",

                    opt_str);

            goto error;

        }

    } /* for (i = 4; i < ret; i++) */

    /* validation */

    if (!(bed->flags & DETECT_BYTE_EXTRACT_FLAG_MULTIPLIER)) {

        /* default value */

        bed->multiplier_value = DETECT_BYTE_EXTRACT_MULTIPLIER_DEFAULT;

    }

    if (bed->flags & DETECT_BYTE_EXTRACT_FLAG_STRING) {

        if (bed->base == DETECT_BYTE_EXTRACT_BASE_NONE) {

            /* Default to decimal if base not specified. */

            bed->base = DETECT_BYTE_EXTRACT_BASE_DEC;

        }

        if (bed->endian != DETECT_BYTE_EXTRACT_ENDIAN_NONE) {

            SCLogError("byte_extract can't have "

                       "endian \"big\" or \"little\" specified along with "

                       "\"string\"");

            goto error;

        }

        if (bed->base == DETECT_BYTE_EXTRACT_BASE_OCT) {

            /* if are dealing with octal nos, the max no that can fit in a 8

             * byte value is 01777777777777777777777 */

            if (bed->nbytes > STRING_MAX_BYTES_TO_EXTRACT_FOR_OCT) {

                SCLogError("byte_extract can't process "

                           "more than %d bytes in \"string\" extraction",

                        STRING_MAX_BYTES_TO_EXTRACT_FOR_OCT);

                goto error;

            }

        } else if (bed->base == DETECT_BYTE_EXTRACT_BASE_DEC) {

            /* if are dealing with decimal nos, the max no that can fit in a 8

             * byte value is 18446744073709551615 */

            if (bed->nbytes > STRING_MAX_BYTES_TO_EXTRACT_FOR_DEC) {

                SCLogError("byte_extract can't process "

                           "more than %d bytes in \"string\" extraction",

                        STRING_MAX_BYTES_TO_EXTRACT_FOR_DEC);

                goto error;

            }

        } else if (bed->base == DETECT_BYTE_EXTRACT_BASE_HEX) {

            /* if are dealing with hex nos, the max no that can fit in a 8

             * byte value is 0xFFFFFFFFFFFFFFFF */

            if (bed->nbytes > STRING_MAX_BYTES_TO_EXTRACT_FOR_HEX) {

                SCLogError("byte_extract can't process "

                           "more than %d bytes in \"string\" extraction",

                        STRING_MAX_BYTES_TO_EXTRACT_FOR_HEX);

                goto error;

            }

        } else {

            ; // just a placeholder.  we won't reach here.

        }

    } else {

        if (bed->nbytes > NO_STRING_MAX_BYTES_TO_EXTRACT) {

            SCLogError("byte_extract can't process "

                       "more than %d bytes in \"non-string\" extraction",

                    NO_STRING_MAX_BYTES_TO_EXTRACT);

            goto error;

        }

        /* if string has not been specified and no endian option has been

         * specified, then set the default endian level of BIG */

        if (!(bed->flags & DETECT_BYTE_EXTRACT_FLAG_ENDIAN))

            bed->endian = DETECT_BYTE_EXTRACT_ENDIAN_DEFAULT;

    }

    pcre2_match_data_free(match);

    return bed;

 error:

    if (bed != NULL)

        DetectByteExtractFree(de_ctx, bed);

    if (match) {

        pcre2_match_data_free(match);

    }

    return NULL;

}

/**

 * \brief The setup function for the byte_extract keyword for a signature.

 *

 * \param de_ctx Pointer to the detection engine context.

 * \param s      Pointer to signature for the current Signature being parsed

 *               from the rules.

 * \param m      Pointer to the head of the SigMatch for the current rule

 *               being parsed.

 * \param arg    Pointer to the string holding the keyword value.

 *

 * \retval  0 On success.

 * \retval -1 On failure.

 */

static int DetectByteExtractSetup(DetectEngineCtx *de_ctx, Signature *s, const char *arg)

{

    SigMatch *sm = NULL;

    SigMatch *prev_pm = NULL;

    DetectByteExtractData *data = NULL;

    int ret = -1;

    data = DetectByteExtractParse(de_ctx, arg);

    if (data == NULL)

        goto error;

    int sm_list;

    if (s->init_data->list != DETECT_SM_LIST_NOTSET) {

        sm_list = s->init_data->list;

        if (data->flags & DETECT_BYTE_EXTRACT_FLAG_RELATIVE) {

            prev_pm = DetectGetLastSMFromLists(s, DETECT_CONTENT, DETECT_PCRE, -1);

        }

    } else if (data->endian == DETECT_BYTE_EXTRACT_ENDIAN_DCE) {

        if (data->flags & DETECT_BYTE_EXTRACT_FLAG_RELATIVE) {

            prev_pm = DetectGetLastSMFromLists(s, DETECT_CONTENT, DETECT_PCRE,

                    DETECT_BYTETEST, DETECT_BYTEJUMP, DETECT_BYTE_EXTRACT,

                    DETECT_BYTEMATH, DETECT_ISDATAAT, -1);

            if (prev_pm == NULL) {

                sm_list = DETECT_SM_LIST_PMATCH;

            } else {

                sm_list = SigMatchListSMBelongsTo(s, prev_pm);

                if (sm_list < 0)

                    goto error;

            }

        } else {

            sm_list = DETECT_SM_LIST_PMATCH;

        }

        if (DetectSignatureSetAppProto(s, ALPROTO_DCERPC) < 0)

            goto error;

        s->flags |= SIG_FLAG_APPLAYER;

    } else if (data->flags & DETECT_BYTE_EXTRACT_FLAG_RELATIVE) {

        prev_pm = DetectGetLastSMFromLists(s,

                DETECT_CONTENT, DETECT_PCRE,

                DETECT_BYTETEST, DETECT_BYTEJUMP, DETECT_BYTE_EXTRACT,

                DETECT_BYTEMATH, DETECT_ISDATAAT, -1);

        if (prev_pm == NULL) {

            sm_list = DETECT_SM_LIST_PMATCH;

        } else {

            sm_list = SigMatchListSMBelongsTo(s, prev_pm);

            if (sm_list < 0)

                goto error;

            if (sm_list != DETECT_SM_LIST_PMATCH)

                s->flags |= SIG_FLAG_APPLAYER;

        }

    } else {

        sm_list = DETECT_SM_LIST_PMATCH;

    }

    if (data->endian == DETECT_BYTE_EXTRACT_ENDIAN_DCE) {

        if (DetectSignatureSetAppProto(s, ALPROTO_DCERPC) != 0)

            goto error;

        if ((data->flags & DETECT_BYTE_EXTRACT_FLAG_STRING) ||

            (data->base == DETECT_BYTE_EXTRACT_BASE_DEC) ||

            (data->base == DETECT_BYTE_EXTRACT_BASE_HEX) ||

            (data->base == DETECT_BYTE_EXTRACT_BASE_OCT) ) {

            SCLogError("Invalid option. "

                       "A byte_jump keyword with dce holds other invalid modifiers.");

            goto error;

        }

    }

    SigMatch *prev_bed_sm = DetectGetLastSMByListId(s, sm_list,

            DETECT_BYTE_EXTRACT, -1);

    if (prev_bed_sm == NULL)

        data->local_id = 0;

    else

        data->local_id = ((DetectByteExtractData *)prev_bed_sm->ctx)->local_id + 1;

    if (data->local_id > de_ctx->byte_extract_max_local_id)

        de_ctx->byte_extract_max_local_id = data->local_id;

    sm = SigMatchAlloc();

    if (sm == NULL)

        goto error;

    sm->type = DETECT_BYTE_EXTRACT;

    sm->ctx = (void *)data;

    SigMatchAppendSMToList(s, sm, sm_list);

    if (!(data->flags & DETECT_BYTE_EXTRACT_FLAG_RELATIVE))

        goto okay;

    if (prev_pm == NULL)

        goto okay;

    if (prev_pm->type == DETECT_CONTENT) {

        DetectContentData *cd = (DetectContentData *)prev_pm->ctx;

        cd->flags |= DETECT_CONTENT_RELATIVE_NEXT;

    } else if (prev_pm->type == DETECT_PCRE) {

        DetectPcreData *pd = (DetectPcreData *)prev_pm->ctx;

        pd->flags |= DETECT_PCRE_RELATIVE_NEXT;

    }

 okay:

    ret = 0;

    return ret;

 error:

    DetectByteExtractFree(de_ctx, data);

    return ret;

}

/**

 * \brief Used to free instances of DetectByteExtractData.

 *

 * \param ptr Instance of DetectByteExtractData to be freed.

 */

static void DetectByteExtractFree(DetectEngineCtx *de_ctx, void *ptr)

{

    if (ptr != NULL) {

        DetectByteExtractData *bed = ptr;

        if (bed->name != NULL)

            SCFree((void *)bed->name);

        SCFree(bed);

    }

    return;

}

/**

 * \brief Lookup the SigMatch for a named byte_extract variable.

 *

 * \param arg The name of the byte_extract variable to lookup.

 * \param s Pointer the signature to look in.

 *

 * \retval A pointer to the SigMatch if found, otherwise NULL.

 */

SigMatch *DetectByteExtractRetrieveSMVar(const char *arg, const Signature *s)

{

    for (uint32_t x = 0; x < s->init_data->buffer_index; x++) {

        SigMatch *sm = s->init_data->buffers[x].head;

        while (sm != NULL) {

            if (sm->type == DETECT_BYTE_EXTRACT) {

                const DetectByteExtractData *bed = (const DetectByteExtractData *)sm->ctx;

                if (strcmp(bed->name, arg) == 0) {

                    return sm;

                }

            }

            sm = sm->next;

        }

    }

    for (int list = 0; list < DETECT_SM_LIST_MAX; list++) {

        SigMatch *sm = s->init_data->smlists[list];

        while (sm != NULL) {

            if (sm->type == DETECT_BYTE_EXTRACT) {

                const DetectByteExtractData *bed = (const DetectByteExtractData *)sm->ctx;

                if (strcmp(bed->name, arg) == 0) {

                    return sm;

                }

            }

            sm = sm->next;

        }

    }

    return NULL;

}

/*************************************Unittests********************************/

#ifdef UNITTESTS

static int g_file_data_buffer_id = 0;

static int g_http_uri_buffer_id = 0;

static int DetectByteExtractTest01(void)

{

    int result = 0;

    DetectByteExtractData *bed = DetectByteExtractParse(NULL, "4, 2, one");

    if (bed == NULL)

        goto end;

    if (bed->nbytes != 4 ||

        bed->offset != 2 ||

        strcmp(bed->name, "one") != 0 ||

        bed->flags != 0 ||

        bed->endian != DETECT_BYTE_EXTRACT_ENDIAN_DEFAULT ||

        bed->base != DETECT_BYTE_EXTRACT_BASE_NONE ||

        bed->align_value != 0 ||

        bed->multiplier_value != DETECT_BYTE_EXTRACT_MULTIPLIER_DEFAULT) {

        goto end;

    }

    result = 1;

 end:

    if (bed != NULL)

        DetectByteExtractFree(NULL, bed);

    return result;

}

static int DetectByteExtractTest02(void)

{

    int result = 0;

    DetectByteExtractData *bed = DetectByteExtractParse(NULL, "4, 2, one, relative");

    if (bed == NULL)

        goto end;

    if (bed->nbytes != 4 ||

        bed->offset != 2 ||

        strcmp(bed->name, "one") != 0 ||

        bed->flags != DETECT_BYTE_EXTRACT_FLAG_RELATIVE ||

        bed->endian != DETECT_BYTE_EXTRACT_ENDIAN_DEFAULT ||

        bed->base != DETECT_BYTE_EXTRACT_BASE_NONE ||

        bed->align_value != 0 ||

        bed->multiplier_value != DETECT_BYTE_EXTRACT_MULTIPLIER_DEFAULT) {

        goto end;

    }

    result = 1;

 end:

    if (bed != NULL)

        DetectByteExtractFree(NULL, bed);

    return result;

}

static int DetectByteExtractTest03(void)

{

    int result = 0;

    DetectByteExtractData *bed = DetectByteExtractParse(NULL, "4, 2, one, multiplier 10");

    if (bed == NULL)

        goto end;

    if (bed->nbytes != 4 ||

        bed->offset != 2 ||

        strcmp(bed->name, "one") != 0 ||

        bed->flags != DETECT_BYTE_EXTRACT_FLAG_MULTIPLIER ||

        bed->endian != DETECT_BYTE_EXTRACT_ENDIAN_DEFAULT ||

        bed->base != DETECT_BYTE_EXTRACT_BASE_NONE ||

        bed->align_value != 0 ||

        bed->multiplier_value != 10) {

        goto end;

    }

    result = 1;

 end:

    if (bed != NULL)

        DetectByteExtractFree(NULL, bed);

    return result;

}

static int DetectByteExtractTest04(void)

{

    int result = 0;

    DetectByteExtractData *bed = DetectByteExtractParse(NULL, "4, 2, one, relative, multiplier 10");

    if (bed == NULL)

        goto end;

    if (bed->nbytes != 4 ||

        bed->offset != 2 ||

        strcmp(bed->name, "one") != 0 ||

        bed->flags != (DETECT_BYTE_EXTRACT_FLAG_RELATIVE |

                       DETECT_BYTE_EXTRACT_FLAG_MULTIPLIER) ||

        bed->endian != DETECT_BYTE_EXTRACT_ENDIAN_DEFAULT ||

        bed->base != DETECT_BYTE_EXTRACT_BASE_NONE ||

        bed->align_value != 0 ||

        bed->multiplier_value != 10) {

        goto end;

    }

    result = 1;

 end:

    if (bed != NULL)

        DetectByteExtractFree(NULL, bed);

    return result;

}

static int DetectByteExtractTest05(void)

{

    int result = 0;

    DetectByteExtractData *bed = DetectByteExtractParse(NULL, "4, 2, one, big");

    if (bed == NULL)

        goto end;

    if (bed->nbytes != 4 ||

        bed->offset != 2 ||

        strcmp(bed->name, "one") != 0 ||

        bed->flags != DETECT_BYTE_EXTRACT_FLAG_ENDIAN ||

        bed->endian != DETECT_BYTE_EXTRACT_ENDIAN_BIG ||

        bed->base != DETECT_BYTE_EXTRACT_BASE_NONE ||

        bed->align_value != 0 ||

        bed->multiplier_value != DETECT_BYTE_EXTRACT_MULTIPLIER_DEFAULT) {

        goto end;

    }

    result = 1;

 end:

    if (bed != NULL)

        DetectByteExtractFree(NULL, bed);

    return result;

}

static int DetectByteExtractTest06(void)

{

    int result = 0;

    DetectByteExtractData *bed = DetectByteExtractParse(NULL, "4, 2, one, little");

    if (bed == NULL)

        goto end;

    if (bed->nbytes != 4 ||

        bed->offset != 2 ||

        strcmp(bed->name, "one") != 0 ||

        bed->flags != DETECT_BYTE_EXTRACT_FLAG_ENDIAN ||

        bed->endian != DETECT_BYTE_EXTRACT_ENDIAN_LITTLE ||

        bed->base != DETECT_BYTE_EXTRACT_BASE_NONE ||

        bed->align_value != 0 ||

        bed->multiplier_value != DETECT_BYTE_EXTRACT_MULTIPLIER_DEFAULT) {

        goto end;

    }

    result = 1;

 end:

    if (bed != NULL)

        DetectByteExtractFree(NULL, bed);

    return result;

}

static int DetectByteExtractTest07(void)

{

    int result = 0;

    DetectByteExtractData *bed = DetectByteExtractParse(NULL, "4, 2, one, dce");

    if (bed == NULL)

        goto end;

    if (bed->nbytes != 4 ||

        bed->offset != 2 ||

        strcmp(bed->name, "one") != 0 ||

        bed->flags != DETECT_BYTE_EXTRACT_FLAG_ENDIAN ||

        bed->endian != DETECT_BYTE_EXTRACT_ENDIAN_DCE ||

        bed->base != DETECT_BYTE_EXTRACT_BASE_NONE ||

        bed->align_value != 0 ||

        bed->multiplier_value != DETECT_BYTE_EXTRACT_MULTIPLIER_DEFAULT) {

        goto end;

    }

    result = 1;

 end:

    if (bed != NULL)

        DetectByteExtractFree(NULL, bed);

    return result;

}

static int DetectByteExtractTest08(void)

{

    int result = 0;

    DetectByteExtractData *bed = DetectByteExtractParse(NULL, "4, 2, one, string, hex");

    if (bed == NULL)

        goto end;

    if (bed->nbytes != 4 ||

        bed->offset != 2 ||

        strcmp(bed->name, "one") != 0 ||

        bed->flags != DETECT_BYTE_EXTRACT_FLAG_STRING ||

        bed->endian != DETECT_BYTE_EXTRACT_ENDIAN_NONE ||

        bed->base != DETECT_BYTE_EXTRACT_BASE_HEX ||

        bed->align_value != 0 ||

        bed->multiplier_value != DETECT_BYTE_EXTRACT_MULTIPLIER_DEFAULT) {

        goto end;

    }

    result = 1;

 end:

    if (bed != NULL)

        DetectByteExtractFree(NULL, bed);

    return result;

}

static int DetectByteExtractTest09(void)

{

    int result = 0;

    DetectByteExtractData *bed = DetectByteExtractParse(NULL, "4, 2, one, string, oct");

    if (bed == NULL)

        goto end;

    if (bed->nbytes != 4 ||

        bed->offset != 2 ||

        strcmp(bed->name, "one") != 0 ||

        bed->flags != DETECT_BYTE_EXTRACT_FLAG_STRING ||

        bed->endian != DETECT_BYTE_EXTRACT_ENDIAN_NONE ||

        bed->base != DETECT_BYTE_EXTRACT_BASE_OCT ||

        bed->align_value != 0 ||

        bed->multiplier_value != DETECT_BYTE_EXTRACT_MULTIPLIER_DEFAULT) {

        goto end;

    }

    result = 1;

 end:

    if (bed != NULL)

        DetectByteExtractFree(NULL, bed);

    return result;

}

static int DetectByteExtractTest10(void)

{

    int result = 0;

    DetectByteExtractData *bed = DetectByteExtractParse(NULL, "4, 2, one, string, dec");

    if (bed == NULL)

        goto end;

    if (bed->nbytes != 4 ||

        bed->offset != 2 ||

        strcmp(bed->name, "one") != 0 ||

        bed->flags != DETECT_BYTE_EXTRACT_FLAG_STRING ||

        bed->endian != DETECT_BYTE_EXTRACT_ENDIAN_NONE ||

        bed->base != DETECT_BYTE_EXTRACT_BASE_DEC ||

        bed->align_value != 0 ||

        bed->multiplier_value != DETECT_BYTE_EXTRACT_MULTIPLIER_DEFAULT) {

        goto end;

    }

    result = 1;

 end:

    if (bed != NULL)

        DetectByteExtractFree(NULL, bed);

    return result;

}

static int DetectByteExtractTest11(void)

{

    int result = 0;

    DetectByteExtractData *bed = DetectByteExtractParse(NULL, "4, 2, one, align 4");

    if (bed == NULL)

        goto end;

    if (bed->nbytes != 4 ||

        bed->offset != 2 ||

        strcmp(bed->name, "one") != 0 ||

        bed->flags != DETECT_BYTE_EXTRACT_FLAG_ALIGN ||

        bed->endian != DETECT_BYTE_EXTRACT_ENDIAN_DEFAULT ||

        bed->base != DETECT_BYTE_EXTRACT_BASE_NONE ||

        bed->align_value != 4 ||

        bed->multiplier_value != DETECT_BYTE_EXTRACT_MULTIPLIER_DEFAULT) {

        goto end;

    }

    result = 1;

 end:

    if (bed != NULL)

        DetectByteExtractFree(NULL, bed);

    return result;

}

static int DetectByteExtractTest12(void)

{

    int result = 0;

    DetectByteExtractData *bed = DetectByteExtractParse(NULL, "4, 2, one, align 4, relative");

    if (bed == NULL)

        goto end;

    if (bed->nbytes != 4 ||

        bed->offset != 2 ||

        strcmp(bed->name, "one") != 0 ||

        bed->flags != (DETECT_BYTE_EXTRACT_FLAG_ALIGN |

                       DETECT_BYTE_EXTRACT_FLAG_RELATIVE) ||

        bed->endian != DETECT_BYTE_EXTRACT_ENDIAN_DEFAULT ||

        bed->base != DETECT_BYTE_EXTRACT_BASE_NONE ||

        bed->align_value != 4 ||

        bed->multiplier_value != DETECT_BYTE_EXTRACT_MULTIPLIER_DEFAULT) {

        goto end;

    }

    result = 1;

 end:

    if (bed != NULL)

        DetectByteExtractFree(NULL, bed);

    return result;

}

static int DetectByteExtractTest13(void)

{

    int result = 0;

    DetectByteExtractData *bed = DetectByteExtractParse(NULL, "4, 2, one, align 4, relative, big");

    if (bed == NULL)

        goto end;

    if (bed->nbytes != 4 ||

        bed->offset != 2 ||

        strcmp(bed->name, "one") != 0 ||

        bed->flags != (DETECT_BYTE_EXTRACT_FLAG_ALIGN |

                       DETECT_BYTE_EXTRACT_FLAG_ENDIAN |

                       DETECT_BYTE_EXTRACT_FLAG_RELATIVE) ||

        bed->endian != DETECT_BYTE_EXTRACT_ENDIAN_BIG ||

        bed->base != DETECT_BYTE_EXTRACT_BASE_NONE ||

        bed->align_value != 4 ||

        bed->multiplier_value != DETECT_BYTE_EXTRACT_MULTIPLIER_DEFAULT) {

        goto end;

    }

    result = 1;

 end:

    if (bed != NULL)

        DetectByteExtractFree(NULL, bed);

    return result;

}

static int DetectByteExtractTest14(void)

{

    int result = 0;

    DetectByteExtractData *bed = DetectByteExtractParse(NULL, "4, 2, one, align 4, relative, dce");

    if (bed == NULL)

        goto end;

    if (bed->nbytes != 4 ||

        bed->offset != 2 ||

        strcmp(bed->name, "one") != 0 ||

        bed->flags != (DETECT_BYTE_EXTRACT_FLAG_ALIGN |