From 6eab3f0a41a6727749b1399d0679e47de236ead4 Mon Sep 17 00:00:00 2001
From: Pablo Rincon <pablo.rincon.crespo@gmail.com>
Date: Mon, 15 Mar 2010 18:52:54 +0100
Subject: [PATCH] Moving back to .c files the functions that gcc cannot inline (Thanks Steve)

---
 src/counters.c           |  112 ++++++++++++++++++++
 src/counters.h           |  112 +-------------------
 src/decode.c             |   10 ++
 src/decode.h             |   13 +--
 src/detect-content.c     |   56 ++++++++++
 src/detect-content.h     |   59 +----------
 src/detect-stream_size.c |   45 ++++++++
 src/detect-stream_size.h |   45 +--------
 src/detect-uricontent.c  |   45 ++++++++
 src/detect-uricontent.h  |   52 +--------
 src/detect.c             |   55 ++++++++++
 src/detect.h             |   58 +----------
 src/suricata.c           |    8 +-
 src/tm-threads.c         |   35 ++++++
 src/tm-threads.h         |   40 +-------
 src/util-bloomfilter.c   |   16 ---
 src/util-bloomfilter.h   |   21 ++++-
 src/util-byte.c          |  241 ++++++++++++++++++++++++++++++++++++++++++
 src/util-byte.h          |  261 ++--------------------------------------------
 src/util-debug-filters.c |  112 ++++++++++++++++++++
 src/util-debug-filters.h |  112 --------------------
 src/util-debug.c         |   20 ++++
 src/util-debug.h         |   21 +----
 src/util-mpm-b2g.c       |  108 +++++++++++++++++++
 src/util-mpm-b2g.h       |  106 -------------------
 src/util-mpm-b3g.c       |   15 +++
 src/util-mpm-b3g.h       |   14 ---
 src/util-mpm-wumanber.c  |  105 +++++++++++++++++++
 src/util-mpm-wumanber.h  |  107 +------------------
 src/util-mpm.c           |   86 +++++++++++++++
 src/util-mpm.h           |   90 +---------------
 src/util-radix-tree.c    |   16 +++
 src/util-radix-tree.h    |   19 +---
 src/util-spm-bs.c        |   43 ++++++++
 src/util-spm-bs.h        |   45 +--------
 src/util-spm.c           |   44 ++++++++
 src/util-spm.h           |   48 +--------
 37 files changed, 1214 insertions(+), 1181 deletions(-)

diff --git a/src/counters.c b/src/counters.c
index 56e4df1..9d7ad17 100644
--- a/src/counters.c
+++ b/src/counters.c
@@ -102,6 +102,118 @@ static void SCPerfInitOPCtx(void)
 }
 
 /**
+ * \brief Adds a value of type uint64_t to the local counter.
+ *
+ * \param id  ID of the counter as set by the API
+ * \param pca Counter array that holds the local counter for this TM
+ * \param x   Value to add to this local counter
+ */
+void SCPerfCounterAddUI64(uint16_t id, SCPerfCounterArray *pca, uint64_t x)
+{
+    if (!pca) {
+        SCLogDebug("counterarray is NULL");
+        return;
+    }
+    if ((id < 1) || (id > pca->size)) {
+        SCLogDebug("counter doesn't exist");
+        return;
+    }
+
+    switch (pca->head[id].pc->value->type) {
+        case SC_PERF_TYPE_UINT64:
+            pca->head[id].ui64_cnt += x;
+            break;
+        case SC_PERF_TYPE_DOUBLE:
+            pca->head[id].d_cnt += x;
+            break;
+    }
+
+    if (pca->head[id].syncs == ULONG_MAX) {
+        pca->head[id].syncs = 0;
+        pca->head[id].wrapped_syncs++;
+    }
+    pca->head[id].syncs++;
+
+    return;
+}
+
+
+/**
+ * \brief Increments the local counter
+ *
+ * \param id  Index of the counter in the counter array
+ * \param pca Counter array that holds the local counters for this TM
+ */
+void SCPerfCounterIncr(uint16_t id, SCPerfCounterArray *pca)
+{
+    if (pca == NULL) {
+        SCLogDebug("counterarray is NULL");
+        return;
+    }
+    if ((id < 1) || (id > pca->size)) {
+        SCLogDebug("counter doesn't exist");
+        return;
+    }
+
+    switch (pca->head[id].pc->value->type) {
+        case SC_PERF_TYPE_UINT64:
+            pca->head[id].ui64_cnt++;
+            break;
+        case SC_PERF_TYPE_DOUBLE:
+            pca->head[id].d_cnt++;
+            break;
+    }
+
+    if (pca->head[id].syncs == ULONG_MAX) {
+        pca->head[id].syncs = 0;
+        pca->head[id].wrapped_syncs++;
+    }
+    pca->head[id].syncs++;
+
+    return;
+}
+
+
+/**
+ * \brief Adds a value of type double to the local counter
+ *
+ * \param id  ID of the counter as set by the API
+ * \param pca Counter array that holds the local counter for this TM
+ * \param x   Value to add to this local counter
+ */
+void SCPerfCounterAddDouble(uint16_t id, SCPerfCounterArray *pca, double x)
+{
+    if (!pca) {
+        SCLogDebug("counterarray is NULL");
+        return;
+    }
+    if ((id < 1) || (id > pca->size)) {
+        SCLogDebug("counter doesn't exist");
+        return;
+    }
+
+    /* incase you are trying to add a double to a counter of type SC_PERF_TYPE_UINT64
+     * it will be truncated */
+    switch (pca->head[id].pc->value->type) {
+        case SC_PERF_TYPE_UINT64:
+            pca->head[id].ui64_cnt += x;
+            break;
+        case SC_PERF_TYPE_DOUBLE:
+            pca->head[id].d_cnt += x;
+            break;
+    }
+
+    if (pca->head[id].syncs == ULONG_MAX) {
+        pca->head[id].syncs = 0;
+        pca->head[id].wrapped_syncs++;
+    }
+    pca->head[id].syncs++;
+
+    return;
+}
+
+
+/**
  * \brief Releases the resources alloted to the output context of the Perf
  *        Counter API
  */
diff --git a/src/counters.h b/src/counters.h
index e95dbf1..803fc9a 100644
--- a/src/counters.h
+++ b/src/counters.h
@@ -220,6 +220,9 @@ int SCPerfAddToClubbedTMTable(char *, SCPerfContext *);
 SCPerfCounterArray *SCPerfGetCounterArrayRange(uint16_t, uint16_t, SCPerfContext *);
 SCPerfCounterArray * SCPerfGetAllCountersArray(SCPerfContext *);
 int SCPerfCounterDisplay(uint16_t, SCPerfContext *, int);
+void SCPerfCounterAddDouble(uint16_t, SCPerfCounterArray *, double);
+void SCPerfCounterIncr(uint16_t, SCPerfCounterArray *);
+void SCPerfCounterAddUI64(uint16_t, SCPerfCounterArray *, uint64_t);
 
 int SCPerfUpdateCounterArray(SCPerfCounterArray *, SCPerfContext *, int);
 
@@ -336,114 +339,5 @@ static inline void SCPerfCounterSetUI64(uint16_t id, SCPerfCounterArray *pca,
     return;
 }
 
-/**
- * \brief Adds a value of type double to the local counter
- *
- * \param id  ID of the counter as set by the API
- * \param pca Counter array that holds the local counter for this TM
- * \param x   Value to add to this local counter
- */
-static inline void SCPerfCounterAddDouble(uint16_t id, SCPerfCounterArray *pca, double x)
-{
-    if (!pca) {
-        SCLogDebug("counterarray is NULL");
-        return;
-    }
-    if ((id < 1) || (id > pca->size)) {
-        SCLogDebug("counter doesn't exist");
-        return;
-    }
-
-    /* incase you are trying to add a double to a counter of type SC_PERF_TYPE_UINT64
-     * it will be truncated */
-    switch (pca->head[id].pc->value->type) {
-        case SC_PERF_TYPE_UINT64:
-            pca->head[id].ui64_cnt += x;
-            break;
-        case SC_PERF_TYPE_DOUBLE:
-            pca->head[id].d_cnt += x;
-            break;
-    }
-
-    if (pca->head[id].syncs == ULONG_MAX) {
-        pca->head[id].syncs = 0;
-        pca->head[id].wrapped_syncs++;
-    }
-    pca->head[id].syncs++;
-
-    return;
-}
-
-/**
- * \brief Adds a value of type uint64_t to the local counter.
- *
- * \param id  ID of the counter as set by the API
- * \param pca Counter array that holds the local counter for this TM
- * \param x   Value to add to this local counter
- */
-static inline void SCPerfCounterAddUI64(uint16_t id, SCPerfCounterArray *pca, uint64_t x)
-{
-    if (!pca) {
-        SCLogDebug("counterarray is NULL");
-        return;
-    }
-    if ((id < 1) || (id > pca->size)) {
-        SCLogDebug("counter doesn't exist");
-        return;
-    }
-
-    switch (pca->head[id].pc->value->type) {
-        case SC_PERF_TYPE_UINT64:
-            pca->head[id].ui64_cnt += x;
-            break;
-        case SC_PERF_TYPE_DOUBLE:
-            pca->head[id].d_cnt += x;
-            break;
-    }
-
-    if (pca->head[id].syncs == ULONG_MAX) {
-        pca->head[id].syncs = 0;
-        pca->head[id].wrapped_syncs++;
-    }
-    pca->head[id].syncs++;
-
-    return;
-}
-
-/**
- * \brief Increments the local counter
- *
- * \param id  Index of the counter in the counter array
- * \param pca Counter array that holds the local counters for this TM
- */
-static inline void SCPerfCounterIncr(uint16_t id, SCPerfCounterArray *pca)
-{
-    if (pca == NULL) {
-        SCLogDebug("counterarray is NULL");
-        return;
-    }
-    if ((id < 1) || (id > pca->size)) {
-        SCLogDebug("counter doesn't exist");
-        return;
-    }
-
-    switch (pca->head[id].pc->value->type) {
-        case SC_PERF_TYPE_UINT64:
-            pca->head[id].ui64_cnt++;
-            break;
-        case SC_PERF_TYPE_DOUBLE:
-            pca->head[id].d_cnt++;
-            break;
-    }
-
-    if (pca->head[id].syncs == ULONG_MAX) {
-        pca->head[id].syncs = 0;
-        pca->head[id].wrapped_syncs++;
-    }
-    pca->head[id].syncs++;
-
-    return;
-}
-
 
 #endif /* __COUNTERS_H__ */
diff --git a/src/decode.c b/src/decode.c
index 7112704..5f55406 100644
--- a/src/decode.c
+++ b/src/decode.c
@@ -23,6 +23,16 @@ void DecodeTunnel(ThreadVars *tv, DecodeThreadVars *dtv, Packet *p, uint8_t *pkt
     }
 }
 
+/** \brief Set the No payload inspection Flag for the packet.
+ *
+ * \param p Packet to set the flag in
+ */
+void DecodeSetNoPayloadInspectionFlag(Packet *p) {
+    SCEnter();
+    p->flags |= PKT_NOPAYLOAD_INSPECTION;
+    SCReturn;
+}
+
 void DecodeRegisterPerfCounters(DecodeThreadVars *dtv, ThreadVars *tv)
 {
     /* register counters */
diff --git a/src/decode.h b/src/decode.h
index 0aa2af2..099a507 100644
--- a/src/decode.h
+++ b/src/decode.h
@@ -538,20 +538,11 @@ Packet *TunnelPktSetup(ThreadVars *, DecodeThreadVars *, Packet *, uint8_t *, ui
 #define PKT_NOPACKET_INSPECTION         0x01    /**< Flag to indicate that packet header or contents should not be inspected*/
 #define PKT_NOPAYLOAD_INSPECTION        0x02    /**< Flag to indicate that packet contents should not be inspected*/
 
+void DecodeSetNoPayloadInspectionFlag(Packet *);
+
 /** ------ inline functions ------ */
-static inline void DecodeSetNoPayloadInspectionFlag(Packet *);
 static inline void DecodeSetNoPacketInspectionFlag(Packet *);
 
-/** \brief Set the No payload inspection Flag for the packet.
- *
- * \param p Packet to set the flag in
- */
-static inline void DecodeSetNoPayloadInspectionFlag(Packet *p) {
-    SCEnter();
-    p->flags |= PKT_NOPAYLOAD_INSPECTION;
-    SCReturn;
-}
-
 /** \brief Set the No packet inspection Flag for the packet.
  *
  * \param p Packet to set the flag in
diff --git a/src/detect-content.c b/src/detect-content.c
index 8e925fb..4deddc7 100644
--- a/src/detect-content.c
+++ b/src/detect-content.c
@@ -103,6 +103,62 @@ static void DetectContentPrintMatches(DetectEngineThreadCtx *det_ctx, DetectCont
 }
 #endif
 
+int TestOffsetDepth(MpmMatch *m, DetectContentData *co, uint16_t pktoff) {
+    SCEnter();
+
+    if (m->offset >= pktoff) {
+        if (co->offset == 0 || (m->offset >= co->offset)) {
+            if (co->depth == 0 || ((m->offset + co->content_len) <= co->depth)) {
+                SCLogDebug("depth %" PRIu32 ", offset %" PRIu32 ", m->offset "
+                           "%" PRIu32 ", return 1", co->depth, co->offset,
+                           m->offset);
+
+                /* If we reach this point, it means we have obtained a depth and
+                 * offset match, which indicates that we have a FAILURE if the
+                 * content is negated, and SUCCESS if the content is not negated */
+                if (co->negated == 1)
+                    SCReturnInt(0);
+                else
+                    SCReturnInt(1);
+            } else {
+                /* We have success so far with offset, but a failure with
+                 * depth.  We can return a match at the bottom of this function
+                 * for negated_content, provided offset is 0.  If offset
+                 * isn't 0 for negated_content, we have a failure and we return
+                 * a no match here.  If the content is not negated, we have a no
+                 * match, which we return at the end of this function. */
+                if (co->offset && co->negated == 1)
+                    SCReturnInt(0);
+            }
+        } else {
+            /* If offset fails, and if the content is negated, we check if depth
+             * succeeds.  If it succeeds, we have a no match for negated content.
+             * Else we have a success for negated content.  If the content is
+             * not negated, we go down till the end and return a no match. */
+            if (co->negated == 1) {
+                if (co->offset != 0) {
+                    SCReturnInt(1);
+                } else if (co->depth && (m->offset+co->content_len) <= co->depth) {
+                    SCLogDebug("depth %" PRIu32 ", offset %" PRIu32 ", m->offset %" PRIu32 ", "
+                            "return 0", co->depth, co->offset, m->offset);
+                    SCReturnInt(0);
+                }
+            }
+        }
+    }
+    SCLogDebug("depth %" PRIu32 ", offset %" PRIu32 ", m->offset %" PRIu32 ", "
+               "return 0 (or 1 if negated)", co->depth, co->offset, m->offset);
+
+    /* If we reach this point, we have a match for negated content and no match
+     * otherwise */
+    if (co->negated == 1)
+        SCReturnInt(1);
+    else
+        SCReturnInt(0);
+}
+
+
+
 /**
  * \brief test the within, distance, offset and depth of a match
  *
diff --git a/src/detect-content.h b/src/detect-content.h
index 8efa3a6..8c31174 100644
--- a/src/detect-content.h
+++ b/src/detect-content.h
@@ -83,64 +83,7 @@ int DetectContentPropagateIsdataat(SigMatch *);
 int DetectContentPropagateModifiers(SigMatch *);
 
 void DetectContentFree(void *);
-
-/** ------ inline functions ------ */
-
-static inline int
-TestOffsetDepth(MpmMatch *m, DetectContentData *co, uint16_t pktoff) {
-    SCEnter();
-
-    if (m->offset >= pktoff) {
-        if (co->offset == 0 || (m->offset >= co->offset)) {
-            if (co->depth == 0 || ((m->offset + co->content_len) <= co->depth)) {
-                SCLogDebug("depth %" PRIu32 ", offset %" PRIu32 ", m->offset "
-                           "%" PRIu32 ", return 1", co->depth, co->offset,
-                           m->offset);
-
-                /* If we reach this point, it means we have obtained a depth and
-                 * offset match, which indicates that we have a FAILURE if the
-                 * content is negated, and SUCCESS if the content is not negated */
-                if (co->negated == 1)
-                    SCReturnInt(0);
-                else
-                    SCReturnInt(1);
-            } else {
-                /* We have success so far with offset, but a failure with
-                 * depth.  We can return a match at the bottom of this function
-                 * for negated_content, provided offset is 0.  If offset
-                 * isn't 0 for negated_content, we have a failure and we return
-                 * a no match here.  If the content is not negated, we have a no
-                 * match, which we return at the end of this function. */
-                if (co->offset && co->negated == 1)
-                    SCReturnInt(0);
-            }
-        } else {
-            /* If offset fails, and if the content is negated, we check if depth
-             * succeeds.  If it succeeds, we have a no match for negated content.
-             * Else we have a success for negated content.  If the content is
-             * not negated, we go down till the end and return a no match. */
-            if (co->negated == 1) {
-                if (co->offset != 0) {
-                    SCReturnInt(1);
-                } else if (co->depth && (m->offset+co->content_len) <= co->depth) {
-                    SCLogDebug("depth %" PRIu32 ", offset %" PRIu32 ", m->offset %" PRIu32 ", "
-                            "return 0", co->depth, co->offset, m->offset);
-                    SCReturnInt(0);
-                }
-            }
-        }
-    }
-    SCLogDebug("depth %" PRIu32 ", offset %" PRIu32 ", m->offset %" PRIu32 ", "
-               "return 0 (or 1 if negated)", co->depth, co->offset, m->offset);
-
-    /* If we reach this point, we have a match for negated content and no match
-     * otherwise */
-    if (co->negated == 1)
-        SCReturnInt(1);
-    else
-        SCReturnInt(0);
-}
-
+int TestOffsetDepth(MpmMatch *, DetectContentData *, uint16_t);
 
 
 #endif /* __DETECT_CONTENT_H__ */
diff --git a/src/detect-stream_size.c b/src/detect-stream_size.c
index f9b4946..52e28f2 100644
--- a/src/detect-stream_size.c
+++ b/src/detect-stream_size.c
@@ -63,6 +63,51 @@ error:
 }
 
 /**
+ * \brief Function to comapre the stream size against defined size in the user
+ *  options.
+ *
+ *  \param  diff    The stream size of server or client stream.
+ *  \param  stream_size User defined stream size
+ *  \param  mode    The mode defined by user.
+ *
+ *  \retval 1 on success and 0 on failure.
+ */
+
+int DetectStreamSizeCompare (uint32_t diff, uint32_t stream_size, uint8_t mode) {
+
+    int ret = 0;
+    switch (mode) {
+        case DETECTSSIZE_LT:
+            if (diff < stream_size)
+                ret = 1;
+            break;
+        case DETECTSSIZE_LEQ:
+            if (diff <= stream_size)
+                ret = 1;
+            break;
+        case DETECTSSIZE_EQ:
+            if (diff == stream_size)
+                ret = 1;
+            break;
+        case DETECTSSIZE_NEQ:
+            if (diff != stream_size)
+                ret = 1;
+            break;
+        case DETECTSSIZE_GEQ:
+            if (diff >= stream_size)
+                ret = 1;
+            break;
+        case DETECTSSIZE_GT:
+            if (diff > stream_size)
+                ret = 1;
+            break;
+    }
+
+    return ret;
+}
+
+
+/**
  * \brief This function is used to match Stream size rule option on a packet with those passed via stream_size:
  *
  * \param t pointer to thread vars
diff --git a/src/detect-stream_size.h b/src/detect-stream_size.h
index 1201830..9ba31b6 100644
--- a/src/detect-stream_size.h
+++ b/src/detect-stream_size.h
@@ -27,53 +27,10 @@ typedef struct DetectStreamSizeData_ {
 }DetectStreamSizeData;
 
 void DetectStreamSizeRegister(void);
+int DetectStreamSizeCompare (uint32_t, uint32_t, uint8_t);
 
 /** ------ inline functions ------ */
 
-/**
- * \brief Function to comapre the stream size against defined size in the user
- *  options.
- *
- *  \param  diff    The stream size of server or client stream.
- *  \param  stream_size User defined stream size
- *  \param  mode    The mode defined by user.
- *
- *  \retval 1 on success and 0 on failure.
- */
-
-static inline int DetectStreamSizeCompare (uint32_t diff, uint32_t stream_size, uint8_t mode) {
-
-    int ret = 0;
-    switch (mode) {
-        case DETECTSSIZE_LT:
-            if (diff < stream_size)
-                ret = 1;
-            break;
-        case DETECTSSIZE_LEQ:
-            if (diff <= stream_size)
-                ret = 1;
-            break;
-        case DETECTSSIZE_EQ:
-            if (diff == stream_size)
-                ret = 1;
-            break;
-        case DETECTSSIZE_NEQ:
-            if (diff != stream_size)
-                ret = 1;
-            break;
-        case DETECTSSIZE_GEQ:
-            if (diff >= stream_size)
-                ret = 1;
-            break;
-        case DETECTSSIZE_GT:
-            if (diff > stream_size)
-                ret = 1;
-            break;
-    }
-
-    return ret;
-}
-
 
 #endif	/* _DETECT_STREAM_SIZE_H */
 
diff --git a/src/detect-uricontent.c b/src/detect-uricontent.c
index ac366e8..5e5defb 100644
--- a/src/detect-uricontent.c
+++ b/src/detect-uricontent.c
@@ -85,6 +85,51 @@ void PktHttpUriFree(Packet *p)
     p->http_uri.cnt = 0;
 }
 
+/* This function is called recursively (if necessary) to be able
+ * to determite whether or not a chain of content matches connected
+ * with 'within' and 'distance' options fully matches. The reason it
+ * was done like this is to make sure we can handle partial matches
+ * that turn out to fail being followed by full matches later in the
+ * packet. This adds some runtime complexity however. */
+int TestWithinDistanceOffsetDepthUri(ThreadVars *t,
+                                     DetectEngineThreadCtx *det_ctx,
+                                     MpmMatch *m, SigMatch *nsm)
+{
+    //printf("test_nextsigmatch m:%p, nsm:%p\n", m,nsm);
+    if (nsm == NULL)
+        return 1;
+
+    DetectUricontentData *co = (DetectUricontentData *)nsm->ctx;
+    MpmMatch *nm = det_ctx->mtcu.match[co->id].top;
+
+    for (; nm; nm = nm->next) {
+        SCLogDebug("(nm->offset+1) %" PRIu32 ", (m->offset+1) %" PRIu32 "",
+                    (nm->offset+1), (m->offset+1));
+
+        if ((co->within == 0 || (co->within &&
+           ((nm->offset+1) > (m->offset+1)) &&
+           ((nm->offset+1) - (m->offset+1) <= co->within))))
+        {
+             SCLogDebug("WITHIN (nm->offset+1) %" PRIu32 ", (m->offset+1) "
+                        "%" PRIu32 "", (nm->offset+1), (m->offset+1));
+
+            if (co->distance == 0 || (co->distance &&
+               ((nm->offset+1) > (m->offset+1)) &&
+               ((nm->offset+1) - (m->offset+1) >= co->distance)))
+            {
+                if (TestOffsetDepthUri(nm, co) == 1) {
+                      SCLogDebug("DISTANCE (nm->offset+1) %" PRIu32 ", "
+                                 "(m->offset+1) %" PRIu32 "", (nm->offset+1),
+                                 (m->offset+1));
+                    return TestWithinDistanceOffsetDepthUri(t, det_ctx, nm,
+                                                         nsm->next);
+                }
+            }
+        }
+    }
+    return 0;
+}
+
 
 /**
  * \brief   Checks if the packet sent as the argument, has a uricontent which
diff --git a/src/detect-uricontent.h b/src/detect-uricontent.h
index 67c117e..c2400d3 100644
--- a/src/detect-uricontent.h
+++ b/src/detect-uricontent.h
@@ -25,8 +25,11 @@ typedef struct DetectUricontentData_ {
 /* prototypes */
 void DetectUricontentRegister (void);
 uint32_t DetectUricontentMaxId(DetectEngineCtx *);
-void PktHttpUriFree(Packet *p);
-uint32_t DetectUricontentInspectMpm(ThreadVars *th_v, DetectEngineThreadCtx *det_ctx, void *alstate);
+void PktHttpUriFree(Packet *);
+uint32_t DetectUricontentInspectMpm(ThreadVars *, DetectEngineThreadCtx *, void *);
+int TestWithinDistanceOffsetDepthUri(ThreadVars *,
+                                     DetectEngineThreadCtx *,
+                                     MpmMatch *, SigMatch *);
 
 /** ------ inline functions ------ */
 
@@ -45,51 +48,6 @@ static inline int TestOffsetDepthUri(MpmMatch *m, DetectUricontentData *co)
     return 0;
 }
 
-/* This function is called recursively (if necessary) to be able
- * to determite whether or not a chain of content matches connected
- * with 'within' and 'distance' options fully matches. The reason it
- * was done like this is to make sure we can handle partial matches
- * that turn out to fail being followed by full matches later in the
- * packet. This adds some runtime complexity however. */
-static inline int TestWithinDistanceOffsetDepthUri(ThreadVars *t,
-                                                DetectEngineThreadCtx *det_ctx,
-                                                MpmMatch *m, SigMatch *nsm)
-{
-    //printf("test_nextsigmatch m:%p, nsm:%p\n", m,nsm);
-    if (nsm == NULL)
-        return 1;
-
-    DetectUricontentData *co = (DetectUricontentData *)nsm->ctx;
-    MpmMatch *nm = det_ctx->mtcu.match[co->id].top;
-
-    for (; nm; nm = nm->next) {
-        SCLogDebug("(nm->offset+1) %" PRIu32 ", (m->offset+1) %" PRIu32 "",
-                    (nm->offset+1), (m->offset+1));
-
-        if ((co->within == 0 || (co->within &&
-           ((nm->offset+1) > (m->offset+1)) &&
-           ((nm->offset+1) - (m->offset+1) <= co->within))))
-        {
-             SCLogDebug("WITHIN (nm->offset+1) %" PRIu32 ", (m->offset+1) "
-                        "%" PRIu32 "", (nm->offset+1), (m->offset+1));
-
-            if (co->distance == 0 || (co->distance &&
-               ((nm->offset+1) > (m->offset+1)) &&
-               ((nm->offset+1) - (m->offset+1) >= co->distance)))
-            {
-                if (TestOffsetDepthUri(nm, co) == 1) {
-                      SCLogDebug("DISTANCE (nm->offset+1) %" PRIu32 ", "
-                                 "(m->offset+1) %" PRIu32 "", (nm->offset+1),
-                                 (m->offset+1));
-                    return TestWithinDistanceOffsetDepthUri(t, det_ctx, nm,
-                                                         nsm->next);
-                }
-            }
-        }
-    }
-    return 0;
-}
-
 static inline int DoDetectUricontent(ThreadVars *t, DetectEngineThreadCtx *det_ctx,
                                      Packet *p, SigMatch *sm,
                                      DetectUricontentData *co)
diff --git a/src/detect.c b/src/detect.c
index 8770174..f7a6e09 100644
--- a/src/detect.c
+++ b/src/detect.c
@@ -389,6 +389,61 @@ int SigLoadSignatures (DetectEngineCtx *de_ctx, char *sig_file)
     SCReturnInt(0);
 }
 
+SigGroupHead *SigMatchSignaturesGetSgh(ThreadVars *th_v, DetectEngineCtx *de_ctx, DetectEngineThreadCtx *det_ctx, Packet *p) {
+    SCEnter();
+
+    int ds,f;
+    SigGroupHead *sgh = NULL;
+
+    /* select the dsize_gh */
+    if (p->payload_len <= 100)
+        ds = 0;
+    else
+        ds = 1;
+
+    /* select the flow_gh */
+    if (p->flowflags & FLOW_PKT_TOCLIENT)
+        f = 0;
+    else
+        f = 1;
+
+    SCLogDebug("ds %d, f %d", ds, f);
+
+    /* find the right mpm instance */
+    DetectAddress *ag = DetectAddressLookupInHead(de_ctx->dsize_gh[ds].flow_gh[f].src_gh[p->proto],&p->src);
+    if (ag != NULL) {
+        /* source group found, lets try a dst group */
+        ag = DetectAddressLookupInHead(ag->dst_gh,&p->dst);
+        if (ag != NULL) {
+            if (ag->port == NULL) {
+                SCLogDebug("we don't have ports");
+                sgh = ag->sh;
+            } else {
+                SCLogDebug("we have ports");
+
+                DetectPort *sport = DetectPortLookupGroup(ag->port,p->sp);
+                if (sport != NULL) {
+                    DetectPort *dport = DetectPortLookupGroup(sport->dst_ph,p->dp);
+                    if (dport != NULL) {
+                        sgh = dport->sh;
+                    } else {
+                        SCLogDebug("no dst port group found for the packet");
+                    }
+                } else {
+                    SCLogDebug("no src port group found for the packet");
+                }
+            }
+        } else {
+            SCLogDebug("no dst address group found for the packet");
+        }
+    } else {
+        SCLogDebug("no src address group found for the packet");
+    }
+
+    SCReturnPtr(sgh, "SigGroupHead");
+}
+
+
 /**
  * \brief Check if a certain sid alerted, this is used in the test functions
  *
diff --git a/src/detect.h b/src/detect.h
index 12d4099..b1468e2 100644
--- a/src/detect.h
+++ b/src/detect.h
@@ -586,67 +586,13 @@ void SigTableSetup(void);
 int PacketAlertCheck(Packet *p, uint32_t sid);
 int SigMatchSignatures(ThreadVars *th_v, DetectEngineCtx *de_ctx,
                        DetectEngineThreadCtx *det_ctx, Packet *p);
+SigGroupHead *SigMatchSignaturesGetSgh(ThreadVars *, DetectEngineCtx *,
+                                DetectEngineThreadCtx *, Packet *);
 
 int PacketAlertCheck(Packet *p, uint32_t sid);
 int SigMatchSignatures(ThreadVars *th_v, DetectEngineCtx *de_ctx,
                        DetectEngineThreadCtx *det_ctx, Packet *p);
 int SignatureIsIPOnly(DetectEngineCtx *de_ctx, Signature *s);
 
-/** ------ inline functions ------ */
-
-static inline SigGroupHead *SigMatchSignaturesGetSgh(ThreadVars *th_v, DetectEngineCtx *de_ctx, DetectEngineThreadCtx *det_ctx, Packet *p) {
-    SCEnter();
-
-    int ds,f;
-    SigGroupHead *sgh = NULL;
-
-    /* select the dsize_gh */
-    if (p->payload_len <= 100)
-        ds = 0;
-    else
-        ds = 1;
-
-    /* select the flow_gh */
-    if (p->flowflags & FLOW_PKT_TOCLIENT)
-        f = 0;
-    else
-        f = 1;
-
-    SCLogDebug("ds %d, f %d", ds, f);
-
-    /* find the right mpm instance */
-    DetectAddress *ag = DetectAddressLookupInHead(de_ctx->dsize_gh[ds].flow_gh[f].src_gh[p->proto],&p->src);
-    if (ag != NULL) {
-        /* source group found, lets try a dst group */
-        ag = DetectAddressLookupInHead(ag->dst_gh,&p->dst);
-        if (ag != NULL) {
-            if (ag->port == NULL) {
-                SCLogDebug("we don't have ports");
-                sgh = ag->sh;
-            } else {
-                SCLogDebug("we have ports");
-
-                DetectPort *sport = DetectPortLookupGroup(ag->port,p->sp);
-                if (sport != NULL) {
-                    DetectPort *dport = DetectPortLookupGroup(sport->dst_ph,p->dp);
-                    if (dport != NULL) {
-                        sgh = dport->sh;
-                    } else {
-                        SCLogDebug("no dst port group found for the packet");
-                    }
-                } else {
-                    SCLogDebug("no src port group found for the packet");
-                }
-            }
-        } else {
-            SCLogDebug("no dst address group found for the packet");
-        }
-    } else {
-        SCLogDebug("no src address group found for the packet");
-    }
-
-    SCReturnPtr(sgh, "SigGroupHead");
-}
-
 #endif /* __DETECT_H__ */
 
diff --git a/src/suricata.c b/src/suricata.c
index e5d886d..64136f9 100644
--- a/src/suricata.c
+++ b/src/suricata.c
@@ -133,9 +133,11 @@ int RunmodeIsUnittests(void) {
     return 0;
 }
 
-static void SignalHandlerSigint(/*@unused@*/ int sig) { sigint_count = 1; sigflags |= SURICATA_SIGINT; }
-static void SignalHandlerSigterm(/*@unused@*/ int sig) { sigterm_count = 1; sigflags |= SURICATA_SIGTERM; }
-static void SignalHandlerSighup(/*@unused@*/ int sig) { sighup_count = 1; sigflags |= SURICATA_SIGHUP; }
+/* Added sig = 0 just to avoid warnings of not used
+ * (it's a local copy, should not affect) */
+static void SignalHandlerSigint(/*@unused@*/ int sig) { sigint_count = 1; sigflags |= SURICATA_SIGINT; sig = 0; }
+static void SignalHandlerSigterm(/*@unused@*/ int sig) { sigterm_count = 1; sigflags |= SURICATA_SIGTERM; sig = 0; }
+static void SignalHandlerSighup(/*@unused@*/ int sig) { sighup_count = 1; sigflags |= SURICATA_SIGHUP; sig = 0; }
 
 #ifdef DBG_MEM_ALLOC
 #ifndef _GLOBAL_MEM_
diff --git a/src/tm-threads.c b/src/tm-threads.c
index 926623b..0e73fd0 100644
--- a/src/tm-threads.c
+++ b/src/tm-threads.c
@@ -49,6 +49,41 @@ uint8_t tv_aof = THV_RESTART_THREAD;
 
 /* 1 slot functions */
 
+void TmThreadsSetFlag(ThreadVars *tv, uint8_t flag) {
+    if (SCSpinLock(&tv->flags_spinlock) != 0) {
+        SCLogError(SC_ERR_SPINLOCK,"spin lock errno=%d",errno);
+        return;
+    }
+
+    tv->flags |= flag;
+   SCSpinUnlock(&tv->flags_spinlock);
+}
+
+/** \retval 1 flag is set
+ *  \retval 0 flag is not set
+ */
+int TmThreadsCheckFlag(ThreadVars *tv, uint8_t flag) {
+    int r;
+    if (SCSpinLock(&tv->flags_spinlock) != 0) {
+        SCLogError(SC_ERR_SPINLOCK,"spin lock errno=%d",errno);
+        return 0;
+    }
+
+    r = (tv->flags & flag);
+   SCSpinUnlock(&tv->flags_spinlock);
+    return r;
+}
+
+void TmThreadsUnsetFlag(ThreadVars *tv, uint8_t flag) {
+    if (SCSpinLock(&tv->flags_spinlock) != 0) {
+        SCLogError(SC_ERR_SPINLOCK,"spin lock errno=%d",errno);
+        return;
+    }
+
+    tv->flags &= ~flag;
+   SCSpinUnlock(&tv->flags_spinlock);
+}
+
 void *TmThreadsSlot1NoIn(void *td) {
     ThreadVars *tv = (ThreadVars *)td;
     Tm1Slot *s = (Tm1Slot *)tv->tm_slots;
diff --git a/src/tm-threads.h b/src/tm-threads.h
index c5b186f..899e707 100644
--- a/src/tm-threads.h
+++ b/src/tm-threads.h
@@ -65,6 +65,7 @@ TmEcode TmThreadSetCPUAffinity(ThreadVars *, uint16_t);
 TmEcode TmThreadSetThreadPriority(ThreadVars *, int);
 TmEcode TmThreadSetupOptions(ThreadVars *);
 void TmThreadSetPrio(ThreadVars *);
+void TmThreadsSetFlag(ThreadVars *, uint8_t);
 
 void TmThreadInitMC(ThreadVars *);
 void TmThreadTestThreadUnPaused(ThreadVars *);
@@ -74,49 +75,14 @@ void TmThreadPause(ThreadVars *);
 void TmThreadPauseThreads(void);
 void TmThreadCheckThreadState(void);
 TmEcode TmThreadWaitOnThreadInit(void);
-static inline int TmThreadsCheckFlag(ThreadVars *, uint8_t);
-static inline void TmThreadsSetFlag(ThreadVars *, uint8_t);
 ThreadVars *TmThreadsGetCallingThread(void);
+int TmThreadsCheckFlag(ThreadVars *, uint8_t);
+void TmThreadsUnsetFlag(ThreadVars *, uint8_t);
 
 /** ------ inline functions ------ */
 
 static inline TmEcode TmThreadsSlotVarRun (ThreadVars *, Packet *, TmSlot *);
 
-/** \retval 1 flag is set
- *  \retval 0 flag is not set
- */
-static inline int TmThreadsCheckFlag(ThreadVars *tv, uint8_t flag) {
-    int r;
-    if (SCSpinLock(&tv->flags_spinlock) != 0) {
-        SCLogError(SC_ERR_SPINLOCK,"spin lock errno=%d",errno);
-        return 0;
-    }
-
-    r = (tv->flags & flag);
-   SCSpinUnlock(&tv->flags_spinlock);
-    return r;
-}
-
-static inline void TmThreadsSetFlag(ThreadVars *tv, uint8_t flag) {
-    if (SCSpinLock(&tv->flags_spinlock) != 0) {
-        SCLogError(SC_ERR_SPINLOCK,"spin lock errno=%d",errno);
-        return;
-    }
-
-    tv->flags |= flag;
-   SCSpinUnlock(&tv->flags_spinlock);
-}
-
-static inline void TmThreadsUnsetFlag(ThreadVars *tv, uint8_t flag) {
-    if (SCSpinLock(&tv->flags_spinlock) != 0) {
-        SCLogError(SC_ERR_SPINLOCK,"spin lock errno=%d",errno);
-        return;
-    }
-
-    tv->flags &= ~flag;
-   SCSpinUnlock(&tv->flags_spinlock);
-}
-
 /* separate run function so we can call it recursively */
 static inline TmEcode TmThreadsSlotVarRun (ThreadVars *tv, Packet *p, TmSlot *slot) {
     TmEcode r = TM_ECODE_OK;
diff --git a/src/util-bloomfilter.c b/src/util-bloomfilter.c
index 079ab06..222253e 100644
--- a/src/util-bloomfilter.c
+++ b/src/util-bloomfilter.c
@@ -77,22 +77,6 @@ int BloomFilterAdd(BloomFilter *bf, void *data, uint16_t datalen) {
     return 0;
 }
 
-inline int BloomFilterTest(BloomFilter *bf, void *data, uint16_t datalen) {
-    uint8_t iter = 0;
-    uint32_t hash = 0;
-    int hit = 1;
-
-    for (iter = 0; iter < bf->hash_iterations; iter++) {
-        hash = bf->Hash(data, datalen, iter, bf->bitarray_size);
-        if (!(bf->bitarray[hash/8] & (1<<hash%8))) {
-            hit = 0;
-            break;
-        }
-    }
-
-    return hit;
-}
-
 uint32_t BloomFilterMemoryCnt(BloomFilter *bf) {
      if (bf == NULL)
          return 0;
diff --git a/src/util-bloomfilter.h b/src/util-bloomfilter.h
index 7a1fa11..37f2988 100644
--- a/src/util-bloomfilter.h
+++ b/src/util-bloomfilter.h
@@ -16,11 +16,30 @@ BloomFilter *BloomFilterInit(uint32_t, uint8_t, uint32_t (*Hash)(void *, uint16_
 void BloomFilterFree(BloomFilter *);
 void BloomFilterPrint(BloomFilter *);
 int BloomFilterAdd(BloomFilter *, void *, uint16_t);
-inline int BloomFilterTest(BloomFilter *, void *, uint16_t);
 uint32_t BloomFilterMemoryCnt(BloomFilter *);
 uint32_t BloomFilterMemorySize(BloomFilter *);
 
 void BloomFilterRegisterTests(void);
 
+/** ---- Inline functions ---- */
+static inline int BloomFilterTest(BloomFilter *, void *, uint16_t);
+
+static inline int BloomFilterTest(BloomFilter *bf, void *data, uint16_t datalen) {
+    uint8_t iter = 0;
+    uint32_t hash = 0;
+    int hit = 1;
+
+    for (iter = 0; iter < bf->hash_iterations; iter++) {
+        hash = bf->Hash(data, datalen, iter, bf->bitarray_size);
+        if (!(bf->bitarray[hash/8] & (1<<hash%8))) {
+            hit = 0;
+            break;
+        }
+    }
+
+    return hit;
+}
+
+
 #endif /* __BLOOMFILTER_H__ */
 
diff --git a/src/util-byte.c b/src/util-byte.c
index 4cfdf22..8b18240 100644
--- a/src/util-byte.c
+++ b/src/util-byte.c
@@ -4,6 +4,247 @@
 #include "util-debug.h"
 
 /** \todo: Remove the fprintf errors in favor of logging */
+int ByteExtractStringInt64(int64_t *res, int base, uint16_t len, const char *str)
+{
+    return ByteExtractStringSigned(res, base, len, str);
+}
+
+int ByteExtractStringUint64(uint64_t *res, int base, uint16_t len, const char *str)
+{
+    return ByteExtractString(res, base, len, str);
+}
+
+
+int ByteExtractString(uint64_t *res, int base, uint16_t len, const char *str)
+{
+    const char *ptr = str;
+    char *endptr = NULL;
+
+    /* 23 - This is the largest string (octal, with a zero prefix) that
+     *      will not overflow uint64_t.  The only way this length
+     *      could be over 23 and still not overflow is if it were zero
+     *      prefixed and we only support 1 byte of zero prefix for octal.
+     *
+     * "01777777777777777777777" = 0xffffffffffffffff
+     */
+    char strbuf[24];
+
+    if (len > 23) {
+        SCLogError(SC_ERR_ARG_LEN_LONG, "len too large (23 max)");
+        return -1;
+    }
+
+    if (len) {
+        /* Extract out the string so it can be null terminated */
+        memcpy(strbuf, str, len);
+        strbuf[len] = '\0';
+        ptr = strbuf;
+    }
+
+    errno = 0;
+    *res = strtoull(ptr, &endptr, base);
+
+    if (errno == ERANGE) {
+        SCLogError(SC_ERR_NUMERIC_VALUE_ERANGE, "Numeric value out of range");
+        return -1;
+    } else if (endptr == str) {
+        SCLogError(SC_ERR_INVALID_NUMERIC_VALUE, "Invalid numeric value");
+        return -1;
+    /* If there is no numeric value in the given string then strtoull(), makes
+       endptr equals to ptr and return 0 as result */
+    } else if (endptr == ptr && *res == 0) {
+        SCLogDebug("No numeric value");
+        return -1;
+    }
+    /* This will interfere with some rules that do not know the length
+     * in advance and instead are just using the max.
+     */
+#if 0
+    else if (len && *endptr != '\0') {
+        fprintf(stderr, "ByteExtractString: Extra characters following numeric value\n");
+        return -1;
+    }
+#endif
+
+    return (endptr - ptr);
+}
+
+int ByteExtractStringSigned(int64_t *res, int base, uint16_t len, const char *str)
+{
+    const char *ptr = str;
+    char *endptr;
+
+    /* 23 - This is the largest string (octal, with a zero prefix) that
+     *      will not overflow int64_t.  The only way this length
+     *      could be over 23 and still not overflow is if it were zero
+     *      prefixed and we only support 1 byte of zero prefix for octal.
+     *
+     * "-0777777777777777777777" = 0xffffffffffffffff
+     */
+    char strbuf[24];
+
+    if (len > 23) {
+        SCLogError(SC_ERR_ARG_LEN_LONG, "len too large (23 max)");
+        return -1;
+    }
+
+    if (len) {
+        /* Extract out the string so it can be null terminated */
+        memcpy(strbuf, str, len);
+        strbuf[len] = '\0';
+        ptr = strbuf;
+    }
+
+    errno = 0;
+    *res = strtoll(ptr, &endptr, base);
+
+    if (errno == ERANGE) {
+        SCLogError(SC_ERR_NUMERIC_VALUE_ERANGE, "Numeric value out of range");
+        return -1;
+    } else if (endptr == str) {
+        SCLogError(SC_ERR_INVALID_NUMERIC_VALUE, "Invalid numeric value");
+        return -1;
+    }
+    /* This will interfere with some rules that do not know the length
+     * in advance and instead are just using the max.
+     */
+#if 0
+    else if (len && *endptr != '\0') {
+        fprintf(stderr, "ByteExtractStringSigned: Extra characters following numeric value\n");
+        return -1;
+    }
+#endif
+
+    //fprintf(stderr, "ByteExtractStringSigned: Extracted base %d: 0x%" PRIx64 "\n", base, *res);
+
+    return (endptr - ptr);
+}
+
+int ByteExtractStringUint32(uint32_t *res, int base, uint16_t len, const char *str)
+{
+    uint64_t i64;
+    int ret;
+
+    ret = ByteExtractString(&i64, base, len, str);
+    if (ret <= 0) {
+        return ret;
+    }
+
+    *res = (uint32_t)i64;
+
+    if ((uint64_t)(*res) != i64) {
+        SCLogError(SC_ERR_NUMERIC_VALUE_ERANGE, "Numeric value out of range "
+                   "(%" PRIx64 " != %" PRIx64 ")", (uint64_t)(*res), i64);
+        return -1;
+    }
+
+    return ret;
+}
+
+int ByteExtractStringUint16(uint16_t *res, int base, uint16_t len, const char *str)
+{
+    uint64_t i64;
+    int ret;
+
+    ret = ByteExtractString(&i64, base, len, str);
+    if (ret <= 0) {
+        return ret;
+    }
+
+    *res = (uint16_t)i64;
+
+    if ((uint64_t)(*res) != i64) {
+        SCLogError(SC_ERR_NUMERIC_VALUE_ERANGE, "Numeric value out of range "
+                   "(%" PRIx64 " != %" PRIx64 ")", (uint64_t)(*res), i64);
+        return -1;
+    }
+
+    return ret;
+}
+
+int ByteExtractStringUint8(uint8_t *res, int base, uint16_t len, const char *str)
+{
+    uint64_t i64;
+    int ret;
+
+    ret = ByteExtractString(&i64, base, len, str);
+    if (ret <= 0) {
+        return ret;
+    }
+
+    *res = (uint8_t)i64;
+
+    if ((uint64_t)(*res) != i64) {
+        SCLogError(SC_ERR_NUMERIC_VALUE_ERANGE, "Numeric value out of range "
+                   "(%" PRIx64 " != %" PRIx64 ")", (uint64_t)(*res), i64);
+        return -1;
+    }
+
+    return ret;
+}
+
+int ByteExtractStringInt32(int32_t *res, int base, uint16_t len, const char *str)
+{
+    int64_t i64;
+    int ret;
+
+    ret = ByteExtractStringSigned(&i64, base, len, str);
+    if (ret <= 0) {
+        return ret;
+    }
+
+    *res = (int32_t)i64;
+
+    if ((int64_t)(*res) != i64) {
+        SCLogError(SC_ERR_NUMERIC_VALUE_ERANGE, "Numeric value out of range "
+                   "(%" PRIx64 " != %" PRIx64 ")\n", (int64_t)(*res), i64);
+        return -1;
+    }
+
+    return ret;
+}
+
+int ByteExtractStringInt16(int16_t *res, int base, uint16_t len, const char *str)
+{
+    int64_t i64;
+    int ret;
+
+    ret = ByteExtractStringSigned(&i64, base, len, str);
+    if (ret <= 0) {
+        return ret;
+    }
+
+    *res = (int16_t)i64;
+
+    if ((int64_t)(*res) != i64) {
+        SCLogError(SC_ERR_NUMERIC_VALUE_ERANGE, "Numeric value out of range "
+                   "(%" PRIx64 " != %" PRIx64 ")\n", (int64_t)(*res), i64);
+        return -1;
+    }
+
+    return ret;
+}
+
+int ByteExtractStringInt8(int8_t *res, int base, uint16_t len, const char *str)
+{
+    int64_t i64;
+    int ret;
+
+    ret = ByteExtractStringSigned(&i64, base, len, str);
+    if (ret <= 0) {
+        return ret;
+    }
+
+    *res = (int8_t)i64;
+
+    if ((int64_t)(*res) != i64) {
+        SCLogError(SC_ERR_NUMERIC_VALUE_ERANGE, "Numeric value out of range "
+                   "(%" PRIx64 " != %" PRIx64 ")\n", (int64_t)(*res), i64);
+        return -1;
+    }
+
+    return ret;
+}
 
 #ifdef UNITTESTS
 
diff --git a/src/util-byte.h b/src/util-byte.h
index 704fd90..91b6978 100644
--- a/src/util-byte.h
+++ b/src/util-byte.h
@@ -98,7 +98,7 @@ static inline int ByteExtractUint16(uint16_t *res, int e, uint16_t len, const ui
  * \return n Number of bytes extracted on success
  * \return -1 On error
  */
-static inline int ByteExtractString(uint64_t *res, int base, uint16_t len, const char *str);
+int ByteExtractString(uint64_t *res, int base, uint16_t len, const char *str);
 
 /**
  * Extract unsigned integer value from a string as uint64_t.
@@ -112,7 +112,7 @@ static inline int ByteExtractString(uint64_t *res, int base, uint16_t len, const
  * \return n Number of bytes extracted on success
  * \return -1 On error
  */
-static inline int ByteExtractStringUint64(uint64_t *res, int base, uint16_t len, const char *str);
+int ByteExtractStringUint64(uint64_t *res, int base, uint16_t len, const char *str);
 
 /**
  * Extract unsigned integer value from a string as uint32_t.
@@ -125,7 +125,7 @@ static inline int ByteExtractStringUint64(uint64_t *res, int base, uint16_t len,
  * \return n Number of bytes extracted on success
  * \return -1 On error
  */
-static inline int ByteExtractStringUint32(uint32_t *res, int base, uint16_t len, const char *str);
+int ByteExtractStringUint32(uint32_t *res, int base, uint16_t len, const char *str);
 
 /**
  * Extract unsigned integer value from a string as uint16_t.
@@ -138,7 +138,7 @@ static inline int ByteExtractStringUint32(uint32_t *res, int base, uint16_t len,
  * \return n Number of bytes extracted on success
  * \return -1 On error
  */
-static inline int ByteExtractStringUint16(uint16_t *res, int base, uint16_t len, const char *str);
+int ByteExtractStringUint16(uint16_t *res, int base, uint16_t len, const char *str);
 
 /**
  * Extract unsigned integer value from a string as uint8_t.
@@ -151,7 +151,7 @@ static inline int ByteExtractStringUint16(uint16_t *res, int base, uint16_t len,
  * \return n Number of bytes extracted on success
  * \return -1 On error
  */
-static inline int ByteExtractStringUint8(uint8_t *res, int base, uint16_t len, const char *str);
+int ByteExtractStringUint8(uint8_t *res, int base, uint16_t len, const char *str);
 
 /**
  * Extract signed integer value from a string.
@@ -164,7 +164,7 @@ static inline int ByteExtractStringUint8(uint8_t *res, int base, uint16_t len, c
  * \return n Number of bytes extracted on success
  * \return -1 On error
  */
-static inline int ByteExtractStringSigned(int64_t *res, int base, uint16_t len, const char *str);
+int ByteExtractStringSigned(int64_t *res, int base, uint16_t len, const char *str);
 
 /**
  * Extract signed integer value from a string as uint64_t.
@@ -177,7 +177,7 @@ static inline int ByteExtractStringSigned(int64_t *res, int base, uint16_t len,
  * \return n Number of bytes extracted on success
  * \return -1 On error
  */
-static inline int ByteExtractStringInt64(int64_t *res, int base, uint16_t len, const char *str);
+int ByteExtractStringInt64(int64_t *res, int base, uint16_t len, const char *str);
 
 /**
  * Extract signed integer value from a string as uint32_t.
@@ -190,7 +190,7 @@ static inline int ByteExtractStringInt64(int64_t *res, int base, uint16_t len, c
  * \return n Number of bytes extracted on success
  * \return -1 On error
  */
-static inline int ByteExtractStringInt32(int32_t *res, int base, uint16_t len, const char *str);
+int ByteExtractStringInt32(int32_t *res, int base, uint16_t len, const char *str);
 
 /**
  * Extract signed integer value from a string as uint16_t.
@@ -203,7 +203,7 @@ static inline int ByteExtractStringInt32(int32_t *res, int base, uint16_t len, c
  * \return n Number of bytes extracted on success
  * \return -1 On error
  */
-static inline int ByteExtractStringInt16(int16_t *res, int base, uint16_t len, const char *str);
+int ByteExtractStringInt16(int16_t *res, int base, uint16_t len, const char *str);
 
 /**
  * Extract signed integer value from a string as uint8_t.
@@ -216,7 +216,7 @@ static inline int ByteExtractStringInt16(int16_t *res, int base, uint16_t len, c
  * \return n Number of bytes extracted on success
  * \return -1 On error
  */
-static inline int ByteExtractStringInt8(int8_t *res, int base, uint16_t len, const char *str);
+int ByteExtractStringInt8(int8_t *res, int base, uint16_t len, const char *str);
 
 /** ------ Definitions of Inline functions ------ */
 
@@ -251,60 +251,6 @@ static inline int ByteExtract(uint64_t *res, int e, uint16_t len, const uint8_t
     return len;
 }
 
-static inline int ByteExtractString(uint64_t *res, int base, uint16_t len, const char *str)
-{
-    const char *ptr = str;
-    char *endptr = NULL;
-
-    /* 23 - This is the largest string (octal, with a zero prefix) that
-     *      will not overflow uint64_t.  The only way this length
-     *      could be over 23 and still not overflow is if it were zero
-     *      prefixed and we only support 1 byte of zero prefix for octal.
-     *
-     * "01777777777777777777777" = 0xffffffffffffffff
-     */
-    char strbuf[24];
-
-    if (len > 23) {
-        SCLogError(SC_ERR_ARG_LEN_LONG, "len too large (23 max)");
-        return -1;
-    }
-
-    if (len) {
-        /* Extract out the string so it can be null terminated */
-        memcpy(strbuf, str, len);
-        strbuf[len] = '\0';
-        ptr = strbuf;
-    }
-
-    errno = 0;
-    *res = strtoull(ptr, &endptr, base);
-
-    if (errno == ERANGE) {
-        SCLogError(SC_ERR_NUMERIC_VALUE_ERANGE, "Numeric value out of range");
-        return -1;
-    } else if (endptr == str) {
-        SCLogError(SC_ERR_INVALID_NUMERIC_VALUE, "Invalid numeric value");
-        return -1;
-    /* If there is no numeric value in the given string then strtoull(), makes
-       endptr equals to ptr and return 0 as result */
-    } else if (endptr == ptr && *res == 0) {
-        SCLogDebug("No numeric value");
-        return -1;
-    }
-    /* This will interfere with some rules that do not know the length
-     * in advance and instead are just using the max.
-     */
-#if 0
-    else if (len && *endptr != '\0') {
-        fprintf(stderr, "ByteExtractString: Extra characters following numeric value\n");
-        return -1;
-    }
-#endif
-
-    return (endptr - ptr);
-}
-
 static inline int ByteExtractUint64(uint64_t *res, int e, uint16_t len, const uint8_t *bytes)
 {
     uint64_t i64;
@@ -368,193 +314,6 @@ static inline int ByteExtractUint16(uint16_t *res, int e, uint16_t len, const ui
     return ret;
 }
 
-
-static inline int ByteExtractStringInt64(int64_t *res, int base, uint16_t len, const char *str)
-{
-    return ByteExtractStringSigned(res, base, len, str);
-}
-
-static inline int ByteExtractStringInt32(int32_t *res, int base, uint16_t len, const char *str)
-{
-    int64_t i64;
-    int ret;
-
-    ret = ByteExtractStringSigned(&i64, base, len, str);
-    if (ret <= 0) {
-        return ret;
-    }
-
-    *res = (int32_t)i64;
-
-    if ((int64_t)(*res) != i64) {
-        SCLogError(SC_ERR_NUMERIC_VALUE_ERANGE, "Numeric value out of range "
-                   "(%" PRIx64 " != %" PRIx64 ")\n", (int64_t)(*res), i64);
-        return -1;
-    }
-
-    return ret;
-}
-
-static inline int ByteExtractStringInt16(int16_t *res, int base, uint16_t len, const char *str)
-{
-    int64_t i64;
-    int ret;
-
-    ret = ByteExtractStringSigned(&i64, base, len, str);
-    if (ret <= 0) {
-        return ret;
-    }
-
-    *res = (int16_t)i64;
-
-    if ((int64_t)(*res) != i64) {
-        SCLogError(SC_ERR_NUMERIC_VALUE_ERANGE, "Numeric value out of range "
-                   "(%" PRIx64 " != %" PRIx64 ")\n", (int64_t)(*res), i64);
-        return -1;
-    }
-
-    return ret;
-}
-
-static inline int ByteExtractStringInt8(int8_t *res, int base, uint16_t len, const char *str)
-{
-    int64_t i64;
-    int ret;
-
-    ret = ByteExtractStringSigned(&i64, base, len, str);
-    if (ret <= 0) {
-        return ret;
-    }
-
-    *res = (int8_t)i64;
-
-    if ((int64_t)(*res) != i64) {
-        SCLogError(SC_ERR_NUMERIC_VALUE_ERANGE, "Numeric value out of range "
-                   "(%" PRIx64 " != %" PRIx64 ")\n", (int64_t)(*res), i64);
-        return -1;
-    }
-
-    return ret;
-}
-
-static inline int ByteExtractStringUint64(uint64_t *res, int base, uint16_t len, const char *str)
-{
-    return ByteExtractString(res, base, len, str);
-}
-
-static inline int ByteExtractStringUint32(uint32_t *res, int base, uint16_t len, const char *str)
-{
-    uint64_t i64;
-    int ret;
-
-    ret = ByteExtractString(&i64, base, len, str);
-    if (ret <= 0) {
-        return ret;
-    }
-
-    *res = (uint32_t)i64;
-
-    if ((uint64_t)(*res) != i64) {
-        SCLogError(SC_ERR_NUMERIC_VALUE_ERANGE, "Numeric value out of range "
-                   "(%" PRIx64 " != %" PRIx64 ")", (uint64_t)(*res), i64);
-        return -1;
-    }
-
-    return ret;
-}
-
-static inline int ByteExtractStringUint16(uint16_t *res, int base, uint16_t len, const char *str)
-{
-    uint64_t i64;
-    int ret;
-
-    ret = ByteExtractString(&i64, base, len, str);
-    if (ret <= 0) {
-        return ret;
-    }
-
-    *res = (uint16_t)i64;
-
-    if ((uint64_t)(*res) != i64) {
-        SCLogError(SC_ERR_NUMERIC_VALUE_ERANGE, "Numeric value out of range "
-                   "(%" PRIx64 " != %" PRIx64 ")", (uint64_t)(*res), i64);
-        return -1;
-    }
-
-    return ret;
-}
-
-static inline int ByteExtractStringUint8(uint8_t *res, int base, uint16_t len, const char *str)
-{
-    uint64_t i64;
-    int ret;
-
-    ret = ByteExtractString(&i64, base, len, str);
-    if (ret <= 0) {
-        return ret;
-    }
-
-    *res = (uint8_t)i64;
-
-    if ((uint64_t)(*res) != i64) {
-        SCLogError(SC_ERR_NUMERIC_VALUE_ERANGE, "Numeric value out of range "
-                   "(%" PRIx64 " != %" PRIx64 ")", (uint64_t)(*res), i64);
-        return -1;
-    }
-
-    return ret;
-}
-
-static inline int ByteExtractStringSigned(int64_t *res, int base, uint16_t len, const char *str)
-{
-    const char *ptr = str;
-    char *endptr;
-
-    /* 23 - This is the largest string (octal, with a zero prefix) that
-     *      will not overflow int64_t.  The only way this length
-     *      could be over 23 and still not overflow is if it were zero
-     *      prefixed and we only support 1 byte of zero prefix for octal.
-     *
-     * "-0777777777777777777777" = 0xffffffffffffffff
-     */
-    char strbuf[24];
-
-    if (len > 23) {
-        SCLogError(SC_ERR_ARG_LEN_LONG, "len too large (23 max)");
-        return -1;
-    }
-
-    if (len) {
-        /* Extract out the string so it can be null terminated */
-        memcpy(strbuf, str, len);
-        strbuf[len] = '\0';
-        ptr = strbuf;
-    }
-
-    errno = 0;
-    *res = strtoll(ptr, &endptr, base);
-
-    if (errno == ERANGE) {
-        SCLogError(SC_ERR_NUMERIC_VALUE_ERANGE, "Numeric value out of range");
-        return -1;
-    } else if (endptr == str) {
-        SCLogError(SC_ERR_INVALID_NUMERIC_VALUE, "Invalid numeric value");
-        return -1;
-    }
-    /* This will interfere with some rules that do not know the length
-     * in advance and instead are just using the max.
-     */
-#if 0
-    else if (len && *endptr != '\0') {
-        fprintf(stderr, "ByteExtractStringSigned: Extra characters following numeric value\n");
-        return -1;
-    }
-#endif
-
-    //fprintf(stderr, "ByteExtractStringSigned: Extracted base %d: 0x%" PRIx64 "\n", base, *res);
-
-    return (endptr - ptr);
-}
 /* UNITTESTS */
 
 #ifdef UNITTESTS
diff --git a/src/util-debug-filters.c b/src/util-debug-filters.c
index dbdf4bf..f16d2f6 100644
--- a/src/util-debug-filters.c
+++ b/src/util-debug-filters.c
@@ -56,6 +56,118 @@ static SCLogFDFilterThreadList *sc_log_fd_filters_tl = NULL;
 static SCMutex sc_log_fd_filters_tl_m = PTHREAD_MUTEX_INITIALIZER;
 
 /**
+ * \brief Helper function used internally to add a FG filter
+ *
+ * \param file     File_name of the filter
+ * \param function Function_name of the filter
+ * \param line     Line number of the filter
+ * \param listtype The filter listtype.  Can be either a blacklist or whitelist
+ *                 filter listtype(SC_LOG_FILTER_BL or SC_LOG_FILTER_WL)
+ *
+ * \retval  0 on successfully adding the filter;
+ * \retval -1 on failure
+ */
+int SCLogAddFGFilter(const char *file, const char *function,
+                                   int line, int listtype)
+{
+    SCLogFGFilterFile *fgf_file = NULL;
+    SCLogFGFilterFile *prev_fgf_file = NULL;
+
+    SCLogFGFilterFunc *fgf_func = NULL;
+    SCLogFGFilterFunc *prev_fgf_func = NULL;
+
+    SCLogFGFilterLine *fgf_line = NULL;
+    SCLogFGFilterLine *prev_fgf_line = NULL;
+
+    int found = 0;
+
+    if (sc_log_module_initialized != 1) {
+        printf("Logging module not initialized.  Call SCLogInitLogModule() "
+               "first before using the debug API\n");
+        return -1 ;
+    }
+
+    if (file == NULL && function == NULL && line < 0) {
+        printf("Error: Invalid arguments supplied to SCLogAddFGFilter\n");
+        return -1;
+    }
+
+    SCMutex *m = &sc_log_fg_filters_m[listtype];
+
+    SCMutexLock(m);
+
+    fgf_file = sc_log_fg_filters[listtype];
+
+    prev_fgf_file = fgf_file;
+    while (fgf_file != NULL) {
+        prev_fgf_file = fgf_file;
+        if (file == NULL && fgf_file->file == NULL)
+            found = 1;
+        else if (file != NULL && fgf_file->file != NULL)
+            found = (strcmp(file, fgf_file->file) == 0);
+        else
+            found = 0;
+
+        if (found == 1)
+            break;
+
+        fgf_file = fgf_file->next;
+    }
+
+    if (found == 0) {
+        SCLogAddToFGFFileList(prev_fgf_file, file, function, line, listtype);
+        goto done;
+    }
+
+    found = 0;
+    fgf_func = fgf_file->func;
+    prev_fgf_func = fgf_func;
+    while (fgf_func != NULL) {
+        prev_fgf_func = fgf_func;
+        if (function == NULL && fgf_func->func == NULL)
+            found = 1;
+        else if (function != NULL && fgf_func->func != NULL)
+            found = (strcmp(function, fgf_func->func) == 0);
+        else
+            found = 0;
+
+        if (found == 1)
+            break;
+
+        fgf_func = fgf_func->next;
+    }
+
+    if (found == 0) {
+        SCLogAddToFGFFuncList(fgf_file, prev_fgf_func, function, line);
+        goto done;
+    }
+
+    found = 0;
+    fgf_line = fgf_func->line;
+    prev_fgf_line = fgf_line;
+    while(fgf_line != NULL) {
+        prev_fgf_line = fgf_line;
+        if (line == fgf_line->line) {
+            found = 1;
+            break;
+        }
+
+        fgf_line = fgf_line->next;
+    }
+
+    if (found == 0) {
+        SCLogAddToFGFLineList(fgf_func, prev_fgf_line, line);
+        goto done;
+    }
+
+ done:
+    SCMutexUnlock(&sc_log_fg_filters_m[listtype]);
+    sc_log_fg_filters_present = 1;
+
+    return 0;
+}
+
+/**
  * \brief Internal function used to check for matches against registered FG
  *        filters.  Checks if there is a match for the incoming log_message with
  *        any of the FG filters.  Based on whether the filter type is whitelist
diff --git a/src/util-debug-filters.h b/src/util-debug-filters.h
index f76a722..42c6f13 100644
--- a/src/util-debug-filters.h
+++ b/src/util-debug-filters.h
@@ -201,118 +201,6 @@ static inline void SCLogAddToFGFLineList(SCLogFGFilterFunc *fgf_func,
     return;
 }
 
-/**
- * \brief Helper function used internally to add a FG filter
- *
- * \param file     File_name of the filter
- * \param function Function_name of the filter
- * \param line     Line number of the filter
- * \param listtype The filter listtype.  Can be either a blacklist or whitelist
- *                 filter listtype(SC_LOG_FILTER_BL or SC_LOG_FILTER_WL)
- *
- * \retval  0 on successfully adding the filter;
- * \retval -1 on failure
- */
-static inline int SCLogAddFGFilter(const char *file, const char *function,
-                                   int line, int listtype)
-{
-    SCLogFGFilterFile *fgf_file = NULL;
-    SCLogFGFilterFile *prev_fgf_file = NULL;
-
-    SCLogFGFilterFunc *fgf_func = NULL;
-    SCLogFGFilterFunc *prev_fgf_func = NULL;
-
-    SCLogFGFilterLine *fgf_line = NULL;
-    SCLogFGFilterLine *prev_fgf_line = NULL;
-
-    int found = 0;
-
-    if (sc_log_module_initialized != 1) {
-        printf("Logging module not initialized.  Call SCLogInitLogModule() "
-               "first before using the debug API\n");
-        return -1 ;
-    }
-
-    if (file == NULL && function == NULL && line < 0) {
-        printf("Error: Invalid arguments supplied to SCLogAddFGFilter\n");
-        return -1;
-    }
-
-    SCMutex *m = &sc_log_fg_filters_m[listtype];
-
-    SCMutexLock(m);
-
-    fgf_file = sc_log_fg_filters[listtype];
-
-    prev_fgf_file = fgf_file;
-    while (fgf_file != NULL) {
-        prev_fgf_file = fgf_file;
-        if (file == NULL && fgf_file->file == NULL)
-            found = 1;
-        else if (file != NULL && fgf_file->file != NULL)
-            found = (strcmp(file, fgf_file->file) == 0);
-        else
-            found = 0;
-
-        if (found == 1)
-            break;
-
-        fgf_file = fgf_file->next;
-    }
-
-    if (found == 0) {
-        SCLogAddToFGFFileList(prev_fgf_file, file, function, line, listtype);
-        goto done;
-    }
-
-    found = 0;
-    fgf_func = fgf_file->func;
-    prev_fgf_func = fgf_func;
-    while (fgf_func != NULL) {
-        prev_fgf_func = fgf_func;
-        if (function == NULL && fgf_func->func == NULL)
-            found = 1;
-        else if (function != NULL && fgf_func->func != NULL)
-            found = (strcmp(function, fgf_func->func) == 0);
-        else
-            found = 0;
-
-        if (found == 1)
-            break;
-
-        fgf_func = fgf_func->next;
-    }
-
-    if (found == 0) {
-        SCLogAddToFGFFuncList(fgf_file, prev_fgf_func, function, line);
-        goto done;
-    }
-
-    found = 0;
-    fgf_line = fgf_func->line;
-    prev_fgf_line = fgf_line;
-    while(fgf_line != NULL) {
-        prev_fgf_line = fgf_line;
-        if (line == fgf_line->line) {
-            found = 1;
-            break;
-        }
-
-        fgf_line = fgf_line->next;
-    }
-
-    if (found == 0) {
-        SCLogAddToFGFLineList(fgf_func, prev_fgf_line, line);
-        goto done;
-    }
-
- done:
-    SCMutexUnlock(&sc_log_fg_filters_m[listtype]);
-    sc_log_fg_filters_present = 1;
-
-    return 0;
-}
-
 
 /**
  * \brief Helper function used internally to add a FG filter.  This function is
diff --git a/src/util-debug.c b/src/util-debug.c
index e22c00f..dcad877 100644
--- a/src/util-debug.c
+++ b/src/util-debug.c
@@ -159,6 +159,26 @@ void SCLogOutputBuffer(SCLogLevel log_level, char *msg)
 }
 
 /**
+ * \brief Output function that logs a character string throught the syslog iface
+ *
+ * \param syslog_log_level Holds the syslog_log_level that the message should be
+ *                         logged as
+ * \param msg              Pointer to the char string, that should be logged
+ *
+ * \todo syslog is thread-safe according to POSIX manual and glibc code, but we
+ *       we will have to look into non POSIX compliant boxes like freeBSD
+ */
+void SCLogPrintToSyslog(int syslog_log_level, const char *msg)
+{
+    //static struct syslog_data data = SYSLOG_DATA_INIT;
+    //syslog_r(syslog_log_level, NULL, "%s", msg);
+
+    syslog(syslog_log_level, "%s", msg);
+
+    return;
+}
+
+/**
  * \brief Adds the global log_format to the outgoing buffer
  *
  * \param log_level log_level of the message that has to be logged
diff --git a/src/util-debug.h b/src/util-debug.h
index 959dc2a..8c97256 100644
--- a/src/util-debug.h
+++ b/src/util-debug.h
@@ -22,6 +22,7 @@ extern SCEnumCharMap sc_syslog_facility_map[22];
  * \brief Returns the full path given a file and configured log dir
  */
 char *SCLogGetLogFilename(char *);
+void SCLogPrintToSyslog(int, const char *);
 
 /**
  * \brief ENV vars that can be used to set the properties for the logging module
@@ -978,25 +979,5 @@ static inline void SCLogPrintToStream(FILE *fd, char *msg)
     return;
 }
 
-/**
- * \brief Output function that logs a character string throught the syslog iface
- *
- * \param syslog_log_level Holds the syslog_log_level that the message should be
- *                         logged as
- * \param msg              Pointer to the char string, that should be logged
- *
- * \todo syslog is thread-safe according to POSIX manual and glibc code, but we
- *       we will have to look into non POSIX compliant boxes like freeBSD
- */
-static inline void SCLogPrintToSyslog(int syslog_log_level, const char *msg)
-{
-    //static struct syslog_data data = SYSLOG_DATA_INIT;
-    //syslog_r(syslog_log_level, NULL, "%s", msg);
-
-    syslog(syslog_log_level, "%s", msg);
-
-    return;
-}
-
 
 #endif /* __UTIL_DEBUG_H__ */
diff --git a/src/util-mpm-b2g.c b/src/util-mpm-b2g.c
index da9f1d1..4a56da9 100644
--- a/src/util-mpm-b2g.c
+++ b/src/util-mpm-b2g.c
@@ -59,6 +59,7 @@ uint32_t B2gSearchBNDMq(MpmCtx *mpm_ctx, MpmThreadCtx *mpm_thread_ctx, PatternMa
 uint32_t B2gSearch(MpmCtx *mpm_ctx, MpmThreadCtx *mpm_thread_ctx, PatternMatcherQueue *, uint8_t *buf, uint16_t buflen);
 void B2gPrintInfo(MpmCtx *mpm_ctx);
 void B2gPrintSearchStats(MpmThreadCtx *mpm_thread_ctx);
+int B2gAddPattern(MpmCtx *, uint8_t *, uint16_t, uint16_t, uint16_t, char, char, uint32_t, uint32_t, uint8_t);
 void B2gRegisterTests(void);
 
 void MpmB2gRegister (void) {
@@ -129,6 +130,113 @@ static void B2gHashFree(MpmCtx *mpm_ctx, B2gHashItem *hi) {
  * INIT HASH END
  */
 
+/* B2gAddPattern
+ *
+ * pat: ptr to the pattern
+ * patlen: length of the pattern
+ * nocase: nocase flag: 1 enabled, 0 disable
+ * pid: pattern id
+ * sid: signature id (internal id)
+ */
+int B2gAddPattern(MpmCtx *mpm_ctx, uint8_t *pat, uint16_t patlen, uint16_t offset, uint16_t depth, char nocase, char scan, uint32_t pid, uint32_t sid, uint8_t nosearch) {
+    B2gCtx *ctx = (B2gCtx *)mpm_ctx->ctx;
+
+    SCLogDebug("ctx %p len %"PRIu16" pid %" PRIu32 ", nocase %s", ctx, patlen, pid, nocase ? "true" : "false");
+
+    if (patlen == 0)
+        return 0;
+
+    /* get a memory piece */
+    B2gPattern *p = B2gInitHashLookup(ctx, pat, patlen, nocase);
+    if (p == NULL) {
+        SCLogDebug("allocing new pattern");
+
+        p = B2gAllocPattern(mpm_ctx);
+        if (p == NULL)
+            goto error;
+
+        p->len = patlen;
+
+        if (nocase) p->flags |= B2G_NOCASE;
+
+        /* setup the case insensitive part of the pattern */
+        p->ci = SCMalloc(patlen);
+        if (p->ci == NULL) goto error;
+        mpm_ctx->memory_cnt++;
+        mpm_ctx->memory_size += patlen;
+        memcpy_tolower(p->ci, pat, patlen);
+
+        /* setup the case sensitive part of the pattern */
+        if (p->flags & B2G_NOCASE) {
+            /* nocase means no difference between cs and ci */
+            p->cs = p->ci;
+        } else {
+            if (memcmp(p->ci,pat,p->len) == 0) {
+                /* no diff between cs and ci: pat is lowercase */
+                p->cs = p->ci;
+            } else {
+                p->cs = SCMalloc(patlen);
+                if (p->cs == NULL) goto error;
+                mpm_ctx->memory_cnt++;
+                mpm_ctx->memory_size += patlen;
+                memcpy(p->cs, pat, patlen);
+            }
+        }
+
+        //printf("B2gAddPattern: ci \""); prt(p->ci,p->len);
+        //printf("\" cs \""); prt(p->cs,p->len);
+        //printf("\"\n");
+
+        /* put in the pattern hash */
+        B2gInitHashAdd(ctx, p);
+
+        if (mpm_ctx->pattern_cnt == 65535) {
+            printf("Max search words reached\n");
+            exit(1);
+        }
+        if (scan) mpm_ctx->scan_pattern_cnt++;
+        mpm_ctx->pattern_cnt++;
+
+        if (scan) { /* SCAN */
+            if (mpm_ctx->scan_maxlen < patlen) mpm_ctx->scan_maxlen = patlen;
+            if (mpm_ctx->scan_minlen == 0) mpm_ctx->scan_minlen = patlen;
+            else if (mpm_ctx->scan_minlen > patlen) mpm_ctx->scan_minlen = patlen;
+            p->flags |= B2G_SCAN;
+        } else { /* SEARCH */
+            if (mpm_ctx->search_maxlen < patlen) mpm_ctx->search_maxlen = patlen;
+            if (mpm_ctx->search_minlen == 0) mpm_ctx->search_minlen = patlen;
+            else if (mpm_ctx->search_minlen > patlen) mpm_ctx->search_minlen = patlen;
+        }
+    } else {
+        /* if we're reusing a pattern, check we need to check that it is a
+         * scan pattern if that is what we're adding. If so we set the pattern
+         * to be a scan pattern. */
+
+        //printf("reusing B2gAddPattern: ci \""); prt(p->ci,p->len);
+        //printf("\" cs \""); prt(p->cs,p->len);
+        //printf("\"\n");
+
+        if (scan) {
+            p->flags |= B2G_SCAN;
+
+            if (mpm_ctx->scan_maxlen < patlen) mpm_ctx->scan_maxlen = patlen;
+            if (mpm_ctx->scan_minlen == 0) mpm_ctx->scan_minlen = patlen;
+            else if (mpm_ctx->scan_minlen > patlen) mpm_ctx->scan_minlen = patlen;
+        }
+    }
+
+    /* we need a match */
+    B2gEndMatchAppend(mpm_ctx, p, offset, depth, pid, sid, nosearch);
+
+    mpm_ctx->total_pattern_cnt++;
+    return 0;
+
+error:
+    B2gFreePattern(mpm_ctx, p);
+    return -1;
+}
+
+
 void B2gFreePattern(MpmCtx *mpm_ctx, B2gPattern *p) {
     if (p && p->em) {
         MpmEndMatchFreeAll(mpm_ctx, p->em);
diff --git a/src/util-mpm-b2g.h b/src/util-mpm-b2g.h
index b114482..1a3f865 100644
--- a/src/util-mpm-b2g.h
+++ b/src/util-mpm-b2g.h
@@ -297,112 +297,6 @@ static inline int B2gCmpPattern(B2gPattern *p, uint8_t *pat, uint16_t patlen, ch
     return 1;
 }
 
-/* B2gAddPattern
- *
- * pat: ptr to the pattern
- * patlen: length of the pattern
- * nocase: nocase flag: 1 enabled, 0 disable
- * pid: pattern id
- * sid: signature id (internal id)
- */
-static inline int B2gAddPattern(MpmCtx *mpm_ctx, uint8_t *pat, uint16_t patlen, uint16_t offset, uint16_t depth, char nocase, char scan, uint32_t pid, uint32_t sid, uint8_t nosearch) {
-    B2gCtx *ctx = (B2gCtx *)mpm_ctx->ctx;
-
-    SCLogDebug("ctx %p len %"PRIu16" pid %" PRIu32 ", nocase %s", ctx, patlen, pid, nocase ? "true" : "false");
-
-    if (patlen == 0)
-        return 0;
-
-    /* get a memory piece */
-    B2gPattern *p = B2gInitHashLookup(ctx, pat, patlen, nocase);
-    if (p == NULL) {
-        SCLogDebug("allocing new pattern");
-
-        p = B2gAllocPattern(mpm_ctx);
-        if (p == NULL)
-            goto error;
-
-        p->len = patlen;
-
-        if (nocase) p->flags |= B2G_NOCASE;
-
-        /* setup the case insensitive part of the pattern */
-        p->ci = SCMalloc(patlen);
-        if (p->ci == NULL) goto error;
-        mpm_ctx->memory_cnt++;
-        mpm_ctx->memory_size += patlen;
-        memcpy_tolower(p->ci, pat, patlen);
-
-        /* setup the case sensitive part of the pattern */
-        if (p->flags & B2G_NOCASE) {
-            /* nocase means no difference between cs and ci */
-            p->cs = p->ci;
-        } else {
-            if (memcmp(p->ci,pat,p->len) == 0) {
-                /* no diff between cs and ci: pat is lowercase */
-                p->cs = p->ci;
-            } else {
-                p->cs = SCMalloc(patlen);
-                if (p->cs == NULL) goto error;
-                mpm_ctx->memory_cnt++;
-                mpm_ctx->memory_size += patlen;
-                memcpy(p->cs, pat, patlen);
-            }
-        }
-
-        //printf("B2gAddPattern: ci \""); prt(p->ci,p->len);
-        //printf("\" cs \""); prt(p->cs,p->len);
-        //printf("\"\n");
-
-        /* put in the pattern hash */
-        B2gInitHashAdd(ctx, p);
-
-        if (mpm_ctx->pattern_cnt == 65535) {
-            printf("Max search words reached\n");
-            exit(1);
-        }
-        if (scan) mpm_ctx->scan_pattern_cnt++;
-        mpm_ctx->pattern_cnt++;
-
-        if (scan) { /* SCAN */
-            if (mpm_ctx->scan_maxlen < patlen) mpm_ctx->scan_maxlen = patlen;
-            if (mpm_ctx->scan_minlen == 0) mpm_ctx->scan_minlen = patlen;
-            else if (mpm_ctx->scan_minlen > patlen) mpm_ctx->scan_minlen = patlen;
-            p->flags |= B2G_SCAN;
-        } else { /* SEARCH */
-            if (mpm_ctx->search_maxlen < patlen) mpm_ctx->search_maxlen = patlen;
-            if (mpm_ctx->search_minlen == 0) mpm_ctx->search_minlen = patlen;
-            else if (mpm_ctx->search_minlen > patlen) mpm_ctx->search_minlen = patlen;
-        }
-    } else {
-        /* if we're reusing a pattern, check we need to check that it is a
-         * scan pattern if that is what we're adding. If so we set the pattern
-         * to be a scan pattern. */
-
-        //printf("reusing B2gAddPattern: ci \""); prt(p->ci,p->len);
-        //printf("\" cs \""); prt(p->cs,p->len);
-        //printf("\"\n");
-
-        if (scan) {
-            p->flags |= B2G_SCAN;
-
-            if (mpm_ctx->scan_maxlen < patlen) mpm_ctx->scan_maxlen = patlen;
-            if (mpm_ctx->scan_minlen == 0) mpm_ctx->scan_minlen = patlen;
-            else if (mpm_ctx->scan_minlen > patlen) mpm_ctx->scan_minlen = patlen;
-        }
-    }
-
-    /* we need a match */
-    B2gEndMatchAppend(mpm_ctx, p, offset, depth, pid, sid, nosearch);
-
-    mpm_ctx->total_pattern_cnt++;
-    return 0;
-
-error:
-    B2gFreePattern(mpm_ctx, p);
-    return -1;
-}
-
 static inline uint32_t B2gBloomHash(void *data, uint16_t datalen, uint8_t iter, uint32_t hash_size) {
      uint8_t *d = (uint8_t *)data;
      uint16_t i;
diff --git a/src/util-mpm-b3g.c b/src/util-mpm-b3g.c
index 12d046a..3f1c76b 100644
--- a/src/util-mpm-b3g.c
+++ b/src/util-mpm-b3g.c
@@ -53,6 +53,7 @@ uint32_t B3gSearch(MpmCtx *, MpmThreadCtx *, PatternMatcherQueue *, uint8_t *, u
 uint32_t B3gSearchBNDMq(MpmCtx *, MpmThreadCtx *, PatternMatcherQueue *, uint8_t *, uint16_t);
 void B3gPrintInfo(MpmCtx *);
 void B3gPrintSearchStats(MpmThreadCtx *);
+B3gHashItem* B3gAllocHashItem(MpmCtx *);
 void B3gRegisterTests(void);
 
 void MpmB3gRegister (void) {
@@ -120,6 +121,20 @@ static void B3gHashFree(MpmCtx *mpm_ctx, B3gHashItem *hi) {
     SCFree(hi);
 }
 
+B3gHashItem *
+B3gAllocHashItem(MpmCtx *mpm_ctx) {
+    B3gHashItem *hi = SCMalloc(sizeof(B3gHashItem));
+    if (hi == NULL) {
+        printf("ERROR: B3gAllocHashItem: SCMalloc failed\n");
+        exit(EXIT_FAILURE);
+    }
+    memset(hi,0,sizeof(B3gHashItem));
+
+    mpm_ctx->memory_cnt++;
+    mpm_ctx->memory_size += sizeof(B3gHashItem);
+    return hi;
+}
+
 /*
  * INIT HASH END
  */
diff --git a/src/util-mpm-b3g.h b/src/util-mpm-b3g.h
index 4eccdeb..e66d1a5 100644
--- a/src/util-mpm-b3g.h
+++ b/src/util-mpm-b3g.h
@@ -179,20 +179,6 @@ static inline B3gPattern *B3gAllocPattern(MpmCtx *mpm_ctx) {
     return p;
 }
 
-static inline B3gHashItem *
-B3gAllocHashItem(MpmCtx *mpm_ctx) {
-    B3gHashItem *hi = SCMalloc(sizeof(B3gHashItem));
-    if (hi == NULL) {
-        printf("ERROR: B3gAllocHashItem: SCMalloc failed\n");
-        exit(EXIT_FAILURE);
-    }
-    memset(hi,0,sizeof(B3gHashItem));
-
-    mpm_ctx->memory_cnt++;
-    mpm_ctx->memory_size += sizeof(B3gHashItem);
-    return hi;
-}
-
 /*
 static inline void memcpy_tolower(uint8_t *d, uint8_t *s, uint16_t len) {
     uint16_t i;
diff --git a/src/util-mpm-wumanber.c b/src/util-mpm-wumanber.c
index 777589d..d4d472b 100644
--- a/src/util-mpm-wumanber.c
+++ b/src/util-mpm-wumanber.c
@@ -104,6 +104,111 @@ void MpmWuManberRegister (void) {
     }
 }
 
+/* WmAddPattern
+ *
+ * pat: ptr to the pattern
+ * patlen: length of the pattern
+ * nocase: nocase flag: 1 enabled, 0 disable
+ * pid: pattern id
+ * sid: signature id (internal id)
+ */
+int WmAddPattern(MpmCtx *mpm_ctx, uint8_t *pat, uint16_t patlen, uint16_t offset, uint16_t depth, char nocase, char scan, uint32_t pid, uint32_t sid, uint8_t nosearch) {
+    WmCtx *ctx = (WmCtx *)mpm_ctx->ctx;
+
+//    printf("WmAddPattern: ctx %p \"", mpm_ctx); prt(pat, patlen);
+//    printf("\" id %" PRIu32 ", nocase %s\n", id, nocase ? "true" : "false");
+
+    if (patlen == 0)
+        return 0;
+
+    /* get a memory piece */
+    WmPattern *p = WmInitHashLookup(ctx, pat, patlen, nocase);
+    if (p == NULL) {
+//        printf("WmAddPattern: allocing new pattern\n");
+        p = WmAllocPattern(mpm_ctx);
+        if (p == NULL)
+            goto error;
+
+        p->len = patlen;
+
+        if (nocase) p->flags |= WUMANBER_NOCASE;
+
+        /* setup the case insensitive part of the pattern */
+        p->ci = SCMalloc(patlen);
+        if (p->ci == NULL) goto error;
+        mpm_ctx->memory_cnt++;
+        mpm_ctx->memory_size += patlen;
+        memcpy_tolower(p->ci, pat, patlen);
+
+        /* setup the case sensitive part of the pattern */
+        if (p->flags & WUMANBER_NOCASE) {
+            /* nocase means no difference between cs and ci */
+            p->cs = p->ci;
+        } else {
+            if (memcmp(p->ci,pat,p->len) == 0) {
+                /* no diff between cs and ci: pat is lowercase */
+                p->cs = p->ci;
+            } else {
+                p->cs = SCMalloc(patlen);
+                if (p->cs == NULL) goto error;
+                mpm_ctx->memory_cnt++;
+                mpm_ctx->memory_size += patlen;
+                memcpy(p->cs, pat, patlen);
+            }
+        }
+
+        if (p->len > 1) {
+            p->prefix_cs = (uint16_t)(*(p->cs)+*(p->cs+1));
+            p->prefix_ci = (uint16_t)(*(p->ci)+*(p->ci+1));
+        }
+
+        //printf("WmAddPattern: ci \""); prt(p->ci,p->len);
+        //printf("\" cs \""); prt(p->cs,p->len);
+        //printf("\" prefix_ci %" PRIu32 ", prefix_cs %" PRIu32 "\n", p->prefix_ci, p->prefix_cs);
+
+        /* put in the pattern hash */
+        WmInitHashAdd(ctx, p);
+
+        if (mpm_ctx->pattern_cnt == 65535) {
+            printf("Max search words reached\n");
+            exit(1);
+        }
+        mpm_ctx->pattern_cnt++;
+
+        if (scan) { /* SCAN */
+            if (mpm_ctx->scan_maxlen < patlen) mpm_ctx->scan_maxlen = patlen;
+            if (mpm_ctx->scan_minlen == 0) mpm_ctx->scan_minlen = patlen;
+            else if (mpm_ctx->scan_minlen > patlen) mpm_ctx->scan_minlen = patlen;
+            p->flags |= WUMANBER_SCAN;
+        } else { /* SEARCH */
+            if (mpm_ctx->search_maxlen < patlen) mpm_ctx->search_maxlen = patlen;
+            if (mpm_ctx->search_minlen == 0) mpm_ctx->search_minlen = patlen;
+            else if (mpm_ctx->search_minlen > patlen) mpm_ctx->search_minlen = patlen;
+        }
+    } else {
+        /* if we're reusing a pattern, check we need to check that it is a
+         * scan pattern if that is what we're adding. If so we set the pattern
+         * to be a scan pattern. */
+        if (scan) {
+            p->flags = WUMANBER_SCAN;
+            if (mpm_ctx->scan_maxlen < patlen) mpm_ctx->scan_maxlen = patlen;
+            if (mpm_ctx->scan_minlen == 0) mpm_ctx->scan_minlen = patlen;
+            else if (mpm_ctx->scan_minlen > patlen) mpm_ctx->scan_minlen = patlen;
+        }
+    }
+
+    /* we need a match */
+    WmEndMatchAppend(mpm_ctx, p, offset, depth, pid, sid, nosearch);
+
+    mpm_ctx->total_pattern_cnt++;
+    return 0;
+
+error:
+    WmFreePattern(mpm_ctx, p);
+    return -1;
+}
+
+
 void prt (uint8_t *buf, uint16_t buflen) {
     uint16_t i;
 
diff --git a/src/util-mpm-wumanber.h b/src/util-mpm-wumanber.h
index 660058f..29c0b9f 100644
--- a/src/util-mpm-wumanber.h
+++ b/src/util-mpm-wumanber.h
@@ -88,6 +88,9 @@ typedef struct WmThreadCtx_ {
 
 void MpmWuManberRegister(void);
 void WmFreePattern(MpmCtx *, WmPattern *);
+int WmAddPattern(MpmCtx *, uint8_t *, uint16_t, uint16_t,
+                 uint16_t, char, char, uint32_t,
+                 uint32_t, uint8_t);
 
 /** ---- Inline functions ---- */
 
@@ -230,110 +233,6 @@ static inline int WmCmpPattern(WmPattern *p, uint8_t *pat, uint16_t patlen, char
     return 1;
 }
 
-/* WmAddPattern
- *
- * pat: ptr to the pattern
- * patlen: length of the pattern
- * nocase: nocase flag: 1 enabled, 0 disable
- * pid: pattern id
- * sid: signature id (internal id)
- */
-static inline int WmAddPattern(MpmCtx *mpm_ctx, uint8_t *pat, uint16_t patlen, uint16_t offset, uint16_t depth, char nocase, char scan, uint32_t pid, uint32_t sid, uint8_t nosearch) {
-    WmCtx *ctx = (WmCtx *)mpm_ctx->ctx;
-
-//    printf("WmAddPattern: ctx %p \"", mpm_ctx); prt(pat, patlen);
-//    printf("\" id %" PRIu32 ", nocase %s\n", id, nocase ? "true" : "false");
-
-    if (patlen == 0)
-        return 0;
-
-    /* get a memory piece */
-    WmPattern *p = WmInitHashLookup(ctx, pat, patlen, nocase);
-    if (p == NULL) {
-//        printf("WmAddPattern: allocing new pattern\n");
-        p = WmAllocPattern(mpm_ctx);
-        if (p == NULL)
-            goto error;
-
-        p->len = patlen;
-
-        if (nocase) p->flags |= WUMANBER_NOCASE;
-
-        /* setup the case insensitive part of the pattern */
-        p->ci = SCMalloc(patlen);
-        if (p->ci == NULL) goto error;
-        mpm_ctx->memory_cnt++;
-        mpm_ctx->memory_size += patlen;
-        memcpy_tolower(p->ci, pat, patlen);
-
-        /* setup the case sensitive part of the pattern */
-        if (p->flags & WUMANBER_NOCASE) {
-            /* nocase means no difference between cs and ci */
-            p->cs = p->ci;
-        } else {
-            if (memcmp(p->ci,pat,p->len) == 0) {
-                /* no diff between cs and ci: pat is lowercase */
-                p->cs = p->ci;
-            } else {
-                p->cs = SCMalloc(patlen);
-                if (p->cs == NULL) goto error;
-                mpm_ctx->memory_cnt++;
-                mpm_ctx->memory_size += patlen;
-                memcpy(p->cs, pat, patlen);
-            }
-        }
-
-        if (p->len > 1) {
-            p->prefix_cs = (uint16_t)(*(p->cs)+*(p->cs+1));
-            p->prefix_ci = (uint16_t)(*(p->ci)+*(p->ci+1));
-        }
-
-        //printf("WmAddPattern: ci \""); prt(p->ci,p->len);
-        //printf("\" cs \""); prt(p->cs,p->len);
-        //printf("\" prefix_ci %" PRIu32 ", prefix_cs %" PRIu32 "\n", p->prefix_ci, p->prefix_cs);
-
-        /* put in the pattern hash */
-        WmInitHashAdd(ctx, p);
-
-        if (mpm_ctx->pattern_cnt == 65535) {
-            printf("Max search words reached\n");
-            exit(1);
-        }
-        mpm_ctx->pattern_cnt++;
-
-        if (scan) { /* SCAN */
-            if (mpm_ctx->scan_maxlen < patlen) mpm_ctx->scan_maxlen = patlen;
-            if (mpm_ctx->scan_minlen == 0) mpm_ctx->scan_minlen = patlen;
-            else if (mpm_ctx->scan_minlen > patlen) mpm_ctx->scan_minlen = patlen;
-            p->flags |= WUMANBER_SCAN;
-        } else { /* SEARCH */
-            if (mpm_ctx->search_maxlen < patlen) mpm_ctx->search_maxlen = patlen;
-            if (mpm_ctx->search_minlen == 0) mpm_ctx->search_minlen = patlen;
-            else if (mpm_ctx->search_minlen > patlen) mpm_ctx->search_minlen = patlen;
-        }
-    } else {
-        /* if we're reusing a pattern, check we need to check that it is a
-         * scan pattern if that is what we're adding. If so we set the pattern
-         * to be a scan pattern. */
-        if (scan) {
-            p->flags = WUMANBER_SCAN;
-            if (mpm_ctx->scan_maxlen < patlen) mpm_ctx->scan_maxlen = patlen;
-            if (mpm_ctx->scan_minlen == 0) mpm_ctx->scan_minlen = patlen;
-            else if (mpm_ctx->scan_minlen > patlen) mpm_ctx->scan_minlen = patlen;
-        }
-    }
-
-    /* we need a match */
-    WmEndMatchAppend(mpm_ctx, p, offset, depth, pid, sid, nosearch);
-
-    mpm_ctx->total_pattern_cnt++;
-    return 0;
-
-error:
-    WmFreePattern(mpm_ctx, p);
-    return -1;
-}
-
 static inline uint32_t WmScan(MpmCtx *mpm_ctx, MpmThreadCtx *mpm_thread_ctx, PatternMatcherQueue *pmq, uint8_t *buf, uint16_t buflen) {
     WmCtx *ctx = (WmCtx *)mpm_ctx->ctx;
     return ctx->Scan(mpm_ctx, mpm_thread_ctx, pmq, buf, buflen);
diff --git a/src/util-mpm.c b/src/util-mpm.c
index 1c82e8b..20b8f22 100644
--- a/src/util-mpm.c
+++ b/src/util-mpm.c
@@ -9,6 +9,92 @@
 #include "util-mpm-b3g.h"
 #include "util-hashlist.h"
 
+/** \brief append a match to a bucket
+ *
+ * used at search runtime */
+int
+MpmMatchAppend(MpmThreadCtx *thread_ctx, PatternMatcherQueue *pmq, MpmEndMatch *em, MpmMatchBucket *mb, uint16_t offset, uint16_t patlen)
+{
+    /* don't bother looking at sigs that didn't match
+     * when we scanned. There's no matching anyway. */
+    if (pmq != NULL && pmq->mode == PMQ_MODE_SEARCH) {
+        if (!(pmq->sig_bitarray[(em->sig_id / 8)] & (1<<(em->sig_id % 8))))
+            return 0;
+    }
+
+    /* if our endmatch is set to a single match being enough,
+       we're not going to add more if we already have one */
+    if (em->flags & MPM_ENDMATCH_SINGLE && mb->len)
+        return 0;
+
+    /* check offset */
+    if (offset < em->offset)
+        return 0;
+
+    /* check depth */
+    if (em->depth && (offset+patlen) > em->depth)
+        return 0;
+
+    /* ok all checks passed, now append the match */
+    MpmMatch *m;
+    /* pull a match from the spare list */
+    if (thread_ctx->sparelist != NULL) {
+        m = thread_ctx->sparelist;
+        thread_ctx->sparelist = m->qnext;
+    } else {
+        m = MpmMatchAlloc(thread_ctx);
+        if (m == NULL)
+            return 0;
+    }
+
+    m->offset = offset;
+    m->mb = mb;
+    m->next = NULL;
+    m->qnext = NULL;
+
+    /* append to the mb list */
+    if (mb->bot == NULL) { /* empty list */
+        mb->top = m;
+        mb->bot = m;
+    } else { /* more items in list */
+        mb->bot->next = m;
+        mb->bot = m;
+    }
+
+    mb->len++;
+
+    /* put in the queue list */
+    if (thread_ctx->qlist == NULL) { /* empty list */
+        thread_ctx->qlist = m;
+    } else { /* more items in list */
+        m->qnext = thread_ctx->qlist;
+        thread_ctx->qlist = m;
+    }
+
+    BUG_ON(m == m->qnext);
+
+    if (pmq != NULL) {
+        /* make sure we only append a sig with a matching pattern once,
+         * so we won't inspect it more than once. For this we keep a
+         * bitarray of sig internal id's and flag each sig that matched */
+        if (!(pmq->sig_bitarray[(em->sig_id / 8)] & (1<<(em->sig_id % 8)))) {
+            /* flag this sig_id as being added now */
+            pmq->sig_bitarray[(em->sig_id / 8)] |= (1<<(em->sig_id % 8));
+            /* append the sig_id to the array with matches */
+            pmq->sig_id_array[pmq->sig_id_array_cnt] = em->sig_id;
+            pmq->sig_id_array_cnt++;
+        }
+
+        /* nosearch flag */
+        if (pmq->mode == PMQ_MODE_SCAN && !(em->flags & MPM_ENDMATCH_NOSEARCH)) {
+            pmq->searchable++;
+        }
+    }
+
+    SCLogDebug("len %" PRIu32 " (offset %" PRIu32 ")", mb->len, m->offset);
+    return 1;
+}
+
 /** \brief Setup a pmq
   * \param pmq Pattern matcher queue to be initialized
   * \param maxid Max id to be matched on
diff --git a/src/util-mpm.h b/src/util-mpm.h
index 952ee66..9548b89 100644
--- a/src/util-mpm.h
+++ b/src/util-mpm.h
@@ -162,10 +162,13 @@ void MpmInitThreadCtx(MpmThreadCtx *mpm_thread_ctx, uint16_t, uint32_t);
 uint32_t MpmGetHashSize(const char *);
 uint32_t MpmGetBloomSize(const char *);
 
+int
+MpmMatchAppend(MpmThreadCtx *, PatternMatcherQueue *, MpmEndMatch *,
+               MpmMatchBucket *, uint16_t, uint16_t);
+
 /** ------ Inline functions ------- */
 
 static inline MpmMatch *MpmMatchAlloc(MpmThreadCtx *);
-static inline int MpmMatchAppend(MpmThreadCtx *, PatternMatcherQueue *, MpmEndMatch *, MpmMatchBucket *, uint16_t, uint16_t);
 
 /** \brief allocate a match
  *
@@ -186,90 +189,5 @@ MpmMatchAlloc(MpmThreadCtx *thread_ctx) {
     return m;
 }
 
-/** \brief append a match to a bucket
- *
- * used at search runtime */
-static inline int
-MpmMatchAppend(MpmThreadCtx *thread_ctx, PatternMatcherQueue *pmq, MpmEndMatch *em, MpmMatchBucket *mb, uint16_t offset, uint16_t patlen)
-{
-    /* don't bother looking at sigs that didn't match
-     * when we scanned. There's no matching anyway. */
-    if (pmq != NULL && pmq->mode == PMQ_MODE_SEARCH) {
-        if (!(pmq->sig_bitarray[(em->sig_id / 8)] & (1<<(em->sig_id % 8))))
-            return 0;
-    }
-
-    /* if our endmatch is set to a single match being enough,
-       we're not going to add more if we already have one */
-    if (em->flags & MPM_ENDMATCH_SINGLE && mb->len)
-        return 0;
-
-    /* check offset */
-    if (offset < em->offset)
-        return 0;
-
-    /* check depth */
-    if (em->depth && (offset+patlen) > em->depth)
-        return 0;
-
-    /* ok all checks passed, now append the match */
-    MpmMatch *m;
-    /* pull a match from the spare list */
-    if (thread_ctx->sparelist != NULL) {
-        m = thread_ctx->sparelist;
-        thread_ctx->sparelist = m->qnext;
-    } else {
-        m = MpmMatchAlloc(thread_ctx);
-        if (m == NULL)
-            return 0;
-    }
-
-    m->offset = offset;
-    m->mb = mb;
-    m->next = NULL;
-    m->qnext = NULL;
-
-    /* append to the mb list */
-    if (mb->bot == NULL) { /* empty list */
-        mb->top = m;
-        mb->bot = m;
-    } else { /* more items in list */
-        mb->bot->next = m;
-        mb->bot = m;
-    }
-
-    mb->len++;
-
-    /* put in the queue list */
-    if (thread_ctx->qlist == NULL) { /* empty list */
-        thread_ctx->qlist = m;
-    } else { /* more items in list */
-        m->qnext = thread_ctx->qlist;
-        thread_ctx->qlist = m;
-    }
-
-    BUG_ON(m == m->qnext);
-
-    if (pmq != NULL) {
-        /* make sure we only append a sig with a matching pattern once,
-         * so we won't inspect it more than once. For this we keep a
-         * bitarray of sig internal id's and flag each sig that matched */
-        if (!(pmq->sig_bitarray[(em->sig_id / 8)] & (1<<(em->sig_id % 8)))) {
-            /* flag this sig_id as being added now */
-            pmq->sig_bitarray[(em->sig_id / 8)] |= (1<<(em->sig_id % 8));
-            /* append the sig_id to the array with matches */
-            pmq->sig_id_array[pmq->sig_id_array_cnt] = em->sig_id;
-            pmq->sig_id_array_cnt++;
-        }
-
-        /* nosearch flag */
-        if (pmq->mode == PMQ_MODE_SCAN && !(em->flags & MPM_ENDMATCH_NOSEARCH)) {
-            pmq->searchable++;
-        }
-    }
-
-    SCLogDebug("len %" PRIu32 " (offset %" PRIu32 ")", mb->len, m->offset);
-    return 1;
-}
 #endif /* __UTIL_MPM_H__ */
 
diff --git a/src/util-radix-tree.c b/src/util-radix-tree.c
index 53313b0..e69638b 100644
--- a/src/util-radix-tree.c
+++ b/src/util-radix-tree.c
@@ -107,6 +107,22 @@ void SCRadixChopIPAddressAgainstNetmask(uint8_t *stream, uint8_t netmask,
 }
 
 /**
+ * \brief Frees a Radix tree node
+ *
+ * \param node Pointer to a Radix tree node
+ * \param tree Pointer to the Radix tree to which this node belongs
+ */
+void SCRadixReleaseNode(SCRadixNode *node, SCRadixTree *tree)
+{
+    if (node != NULL) {
+        SCRadixReleasePrefix(node->prefix, tree);
+        SCFree(node);
+    }
+
+    return;
+}
+
+/**
  * \brief Allocates and returns a new instance of SCRadixUserData.
  *
  * \param netmask The netmask entry that has to be made in the new
diff --git a/src/util-radix-tree.h b/src/util-radix-tree.h
index 6cfed45..9b2ff5b 100644
--- a/src/util-radix-tree.h
+++ b/src/util-radix-tree.h
@@ -110,10 +110,11 @@ void SCRadixRegisterTests(void);
 
 void SCRadixReleasePrefix(SCRadixPrefix *, SCRadixTree *);
 int SCRadixPrefixContainNetmaskAndSetUserData(SCRadixPrefix *, uint16_t, int);
+void SCRadixReleaseNode(SCRadixNode *, SCRadixTree *);
+
 /** ----- Inline funcions ------ */
 
 static inline SCRadixNode *SCRadixCreateNode();
-static inline void SCRadixReleaseNode(SCRadixNode *, SCRadixTree *);
 static inline SCRadixNode *SCRadixFindKeyIPNetblock(SCRadixPrefix *, SCRadixNode *);
 
 /**
@@ -135,22 +136,6 @@ static inline SCRadixNode *SCRadixCreateNode()
 }
 
 /**
- * \brief Frees a Radix tree node
- *
- * \param node Pointer to a Radix tree node
- * \param tree Pointer to the Radix tree to which this node belongs
- */
-static inline void SCRadixReleaseNode(SCRadixNode *node, SCRadixTree *tree)
-{
-    if (node != NULL) {
-        SCRadixReleasePrefix(node->prefix, tree);
-        SCFree(node);
-    }
-
-    return;
-}
-
-/**
  * \brief Checks if an IP prefix falls under a netblock, in the path to the root
  *        of the tree, from the node.  Used internally by SCRadixFindKey()
  *
diff --git a/src/util-spm-bs.c b/src/util-spm-bs.c
index e0f1e3c..267a9f0 100644
--- a/src/util-spm-bs.c
+++ b/src/util-spm-bs.c
@@ -17,4 +17,47 @@
 #include <limits.h>
 #include <string.h>
 
+/**
+ * \brief Basic search improved. Limits are better handled, so
+ * it doesn't start searches that wont fit in the remaining buffer
+ *
+ * \param haystack pointer to the buffer to search in
+ * \param haystack_len length limit of the buffer
+ * \param neddle pointer to the pattern we ar searching for
+ * \param needle_len length limit of the needle
+ *
+ * \retval ptr to start of the match; NULL if no match
+ */
+uint8_t *BasicSearch(const uint8_t *haystack, uint32_t haystack_len, const uint8_t *needle, uint32_t needle_len) {
+    const uint8_t *h, *n;
+    const uint8_t *hmax = haystack + haystack_len;
+    const uint8_t *nmax = needle + needle_len;
+
+    if (needle_len == 0 || needle_len > haystack_len)
+        return NULL;
+
+    for (n = needle; nmax - n <= hmax - haystack; haystack++) {
+        if (*haystack != *n) {
+            continue;
+        }
+        /* one byte needles */
+        if (needle_len == 1)
+            return (uint8_t *)haystack;
+
+        for (h = haystack+1, n++; nmax - n <= hmax - haystack; h++, n++) {
+            if (*h != *n) {
+                break;
+            }
+            /* if we run out of needle we fully matched */
+            if (n == nmax - 1) {
+                return (uint8_t *)haystack;
+            }
+        }
+        n = needle;
+    }
+
+    return NULL;
+}
+
+
 /* Look at the .h, all the functions are Inlined */
diff --git a/src/util-spm-bs.h b/src/util-spm-bs.h
index 614f60f..fa9445f 100644
--- a/src/util-spm-bs.h
+++ b/src/util-spm-bs.h
@@ -3,54 +3,13 @@
 
 #include "suricata-common.h"
 #include "suricata.h"
+
 /** ----- Inline functions ------- */
-static inline uint8_t *BasicSearch(const uint8_t *, uint32_t, const uint8_t *, uint32_t);
+uint8_t *BasicSearch(const uint8_t *, uint32_t, const uint8_t *, uint32_t);
 static inline uint8_t *BasicSearchNocase(const uint8_t *, uint32_t, const uint8_t *, uint32_t);
 static inline void BasicSearchInit (void);
 
 /**
- * \brief Basic search improved. Limits are better handled, so
- * it doesn't start searches that wont fit in the remaining buffer
- *
- * \param haystack pointer to the buffer to search in
- * \param haystack_len length limit of the buffer
- * \param neddle pointer to the pattern we ar searching for
- * \param needle_len length limit of the needle
- *
- * \retval ptr to start of the match; NULL if no match
- */
-static inline uint8_t *BasicSearch(const uint8_t *haystack, uint32_t haystack_len, const uint8_t *needle, uint32_t needle_len) {
-    const uint8_t *h, *n;
-    const uint8_t *hmax = haystack + haystack_len;
-    const uint8_t *nmax = needle + needle_len;
-
-    if (needle_len == 0 || needle_len > haystack_len)
-        return NULL;
-
-    for (n = needle; nmax - n <= hmax - haystack; haystack++) {
-        if (*haystack != *n) {
-            continue;
-        }
-        /* one byte needles */
-        if (needle_len == 1)
-            return (uint8_t *)haystack;
-
-        for (h = haystack+1, n++; nmax - n <= hmax - haystack; h++, n++) {
-            if (*h != *n) {
-                break;
-            }
-            /* if we run out of needle we fully matched */
-            if (n == nmax - 1) {
-                return (uint8_t *)haystack;
-            }
-        }
-        n = needle;
-    }
-
-    return NULL;
-}
-
-/**
  * \brief Basic search case less
  *
  * \param haystack pointer to the buffer to search in
diff --git a/src/util-spm.c b/src/util-spm.c
index e9a6bfe..42645e3 100644
--- a/src/util-spm.c
+++ b/src/util-spm.c
@@ -40,6 +40,50 @@
 #include "util-spm-bm.h"
 #include "util-clock.h"
 
+/**
+ * \brief Search a pattern in the text using Boyer Moore algorithm
+ *        (build a bad character shifts array and good prefixes shift array)
+ *
+ * \param text Text to search in
+ * \param textlen length of the text
+ * \param needle pattern to search for
+ * \param needlelen length of the pattern
+ */
+uint8_t *BoyerMooreSearch(uint8_t *text, uint32_t textlen, uint8_t *needle, uint32_t needlelen) {
+    int32_t bmBc[ALPHABET_SIZE];
+    int32_t *bmGs = SCMalloc(sizeof(int32_t)*(needlelen + 1));
+
+    PreBmGs(needle, needlelen, bmGs);
+    PreBmBc(needle, needlelen, bmBc);
+
+    uint8_t *ret = BoyerMoore(needle, needlelen, text, textlen, bmGs, bmBc);
+    SCFree(bmGs);
+
+    return ret;
+}
+
+/**
+ * \brief Search a pattern in the text using Boyer Moore nocase algorithm
+ *        (build a bad character shifts array and good prefixes shift array)
+ *
+ * \param text Text to search in
+ * \param textlen length of the text
+ * \param needle pattern to search for
+ * \param needlelen length of the pattern
+ */
+uint8_t *BoyerMooreNocaseSearch(uint8_t *text, uint32_t textlen, uint8_t *needle, uint32_t needlelen) {
+    int32_t bmBc[ALPHABET_SIZE];
+    int32_t *bmGs = SCMalloc(sizeof(int32_t)*(needlelen + 1));
+
+    PreBmGsNocase(needle, needlelen, bmGs);
+    PreBmBcNocase(needle, needlelen, bmBc);
+
+    uint8_t *ret = BoyerMooreNocase(needle, needlelen, text, textlen, bmGs, bmBc);
+    SCFree(bmGs);
+
+    return ret;
+}
+
 
 /* Look at the .h, all the functions are Inline */
 #ifdef UNITTESTS
diff --git a/src/util-spm.h b/src/util-spm.h
index 971cc44..f1bbb6c 100644
--- a/src/util-spm.h
+++ b/src/util-spm.h
@@ -10,8 +10,8 @@
 /** Default algorithm to use: Boyer Moore */
 static inline uint8_t *Bs2bmSearch(uint8_t *text, uint32_t textlen, uint8_t *needle, uint32_t needlelen);
 static inline uint8_t *Bs2bmNocaseSearch(uint8_t *text, uint32_t textlen, uint8_t *needle, uint32_t needlelen);
-static inline uint8_t *BoyerMooreSearch(uint8_t *text, uint32_t textlen, uint8_t *needle, uint32_t needlelen);
-static inline uint8_t *BoyerMooreNocaseSearch(uint8_t *text, uint32_t textlen, uint8_t *needle, uint32_t needlelen);
+uint8_t *BoyerMooreSearch(uint8_t *text, uint32_t textlen, uint8_t *needle, uint32_t needlelen);
+uint8_t *BoyerMooreNocaseSearch(uint8_t *text, uint32_t textlen, uint8_t *needle, uint32_t needlelen);
 
 /* Macros for automatic algorithm selection (use them only when you can't store the context) */
 #define SpmSearch(text, textlen, needle, needlelen) ({\
@@ -76,49 +76,5 @@ static inline uint8_t *Bs2bmNocaseSearch(uint8_t *text, uint32_t textlen, uint8_
     return Bs2BmNocase(text, textlen, needle, needlelen, badchars);
 }
 
-/**
- * \brief Search a pattern in the text using Boyer Moore algorithm
- *        (build a bad character shifts array and good prefixes shift array)
- *
- * \param text Text to search in
- * \param textlen length of the text
- * \param needle pattern to search for
- * \param needlelen length of the pattern
- */
-static inline uint8_t *BoyerMooreSearch(uint8_t *text, uint32_t textlen, uint8_t *needle, uint32_t needlelen) {
-    int32_t bmBc[ALPHABET_SIZE];
-    int32_t *bmGs = SCMalloc(sizeof(int32_t)*(needlelen + 1));
-
-    PreBmGs(needle, needlelen, bmGs);
-    PreBmBc(needle, needlelen, bmBc);
-
-    uint8_t *ret = BoyerMoore(needle, needlelen, text, textlen, bmGs, bmBc);
-    SCFree(bmGs);
-
-    return ret;
-}
-
-/**
- * \brief Search a pattern in the text using Boyer Moore nocase algorithm
- *        (build a bad character shifts array and good prefixes shift array)
- *
- * \param text Text to search in
- * \param textlen length of the text
- * \param needle pattern to search for
- * \param needlelen length of the pattern
- */
-static inline uint8_t *BoyerMooreNocaseSearch(uint8_t *text, uint32_t textlen, uint8_t *needle, uint32_t needlelen) {
-    int32_t bmBc[ALPHABET_SIZE];
-    int32_t *bmGs = SCMalloc(sizeof(int32_t)*(needlelen + 1));
-
-    PreBmGsNocase(needle, needlelen, bmGs);
-    PreBmBcNocase(needle, needlelen, bmBc);
-
-    uint8_t *ret = BoyerMooreNocase(needle, needlelen, text, textlen, bmGs, bmBc);
-    SCFree(bmGs);
-
-    return ret;
-}
-
 
 #endif /* __UTIL_SPM_H__ */
-- 
1.6.0.4

