aiden
/
suricata
mirror of https://github.com/OISF/suricata
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

Rename SIG_FLAG_AMATCH flag to SIG_FLAG_STATE_MATCH to better reflects its purpose.

Browse Source
remotes/origin/master-1.1.x
Victor Julien 16 years ago
parent d7b92d9bfe
commit 169aa5581a
3 changed files with 15 additions and 15 deletions
Show Stats Download Patch File Download Diff File

24
src/detect-parse.c
Unescape Escape View File

@ -1385,17 +1385,17 @@ Signature *SigInit(DetectEngineCtx *de_ctx, char *sigstr) {
}
if (sig->sm_lists[DETECT_SM_LIST_UMATCH])
sig->flags |= SIG_FLAG_AMATCH;
sig->flags |= SIG_FLAG_STATE_MATCH;
if (sig->sm_lists[DETECT_SM_LIST_DMATCH])
sig->flags |= SIG_FLAG_AMATCH;
sig->flags |= SIG_FLAG_STATE_MATCH;
if (sig->sm_lists[DETECT_SM_LIST_AMATCH])
sig->flags |= SIG_FLAG_AMATCH;
sig->flags |= SIG_FLAG_STATE_MATCH;
if (sig->sm_lists[DETECT_SM_LIST_HCBDMATCH])
sig->flags |= SIG_FLAG_AMATCH;
sig->flags |= SIG_FLAG_STATE_MATCH;
if (sig->sm_lists[DETECT_SM_LIST_HHDMATCH])
sig->flags |= SIG_FLAG_AMATCH;
sig->flags |= SIG_FLAG_STATE_MATCH;
if (sig->sm_lists[DETECT_SM_LIST_HRHDMATCH])
sig->flags |= SIG_FLAG_AMATCH;
sig->flags |= SIG_FLAG_STATE_MATCH;
SCLogDebug("sig %"PRIu32" SIG_FLAG_APPLAYER: %s, SIG_FLAG_PACKET: %s",
sig->id, sig->flags & SIG_FLAG_APPLAYER ? "set" : "not set",
@ -1583,17 +1583,17 @@ Signature *SigInitReal(DetectEngineCtx *de_ctx, char *sigstr) {
}
if (sig->sm_lists[DETECT_SM_LIST_UMATCH])
sig->flags |= SIG_FLAG_AMATCH;
sig->flags |= SIG_FLAG_STATE_MATCH;
if (sig->sm_lists[DETECT_SM_LIST_DMATCH])
sig->flags |= SIG_FLAG_AMATCH;
sig->flags |= SIG_FLAG_STATE_MATCH;
if (sig->sm_lists[DETECT_SM_LIST_AMATCH])
sig->flags |= SIG_FLAG_AMATCH;
sig->flags |= SIG_FLAG_STATE_MATCH;
if (sig->sm_lists[DETECT_SM_LIST_HCBDMATCH])
sig->flags |= SIG_FLAG_AMATCH;
sig->flags |= SIG_FLAG_STATE_MATCH;
if (sig->sm_lists[DETECT_SM_LIST_HHDMATCH])
sig->flags |= SIG_FLAG_AMATCH;
sig->flags |= SIG_FLAG_STATE_MATCH;
if (sig->sm_lists[DETECT_SM_LIST_HRHDMATCH])
sig->flags |= SIG_FLAG_AMATCH;
sig->flags |= SIG_FLAG_STATE_MATCH;
SigBuildAddressMatchArray(sig);

4
src/detect.c
Unescape Escape View File

@ -730,7 +730,7 @@ static void SigMatchSignaturesBuildMatchArray(DetectEngineCtx *de_ctx,
/* de_state check, filter out all signatures that already had a match before
* or just partially match */
if (s->flags & SIG_FLAG_AMATCH) {
if (s->flags & SIG_FLAG_STATE_MATCH) {
/* we run after DeStateDetectContinueDetection, so we might have
* state NEW here. In that case we'd want to continue detection
* for this sig. If we have NOSTATE, stateful detection didn't
@ -1259,7 +1259,7 @@ int SigMatchSignatures(ThreadVars *th_v, DetectEngineCtx *de_ctx, DetectEngineTh
s->sm_lists[DETECT_SM_LIST_AMATCH], s->sm_lists[DETECT_SM_LIST_UMATCH], s->sm_lists[DETECT_SM_LIST_DMATCH]);
/* consider stateful sig matches */
if (s->flags & SIG_FLAG_AMATCH) {
if (s->flags & SIG_FLAG_STATE_MATCH) {
if (alstate == NULL) {
SCLogDebug("state matches but no state, we can't match");
goto next;

2
src/detect.h
Unescape Escape View File

@ -231,7 +231,7 @@ typedef struct DetectPort_ {
#define SIG_FLAG_PACKET 0x00020000 /**< signature has matches against a packet (as opposed to app layer) */
// 0x00040000 unused
#define SIG_FLAG_AMATCH 0x00080000
#define SIG_FLAG_STATE_MATCH 0x00080000 /**< signature has matches that require stateful inspection */
// 0x00100000 unused
// 0x00200000 unused
// 0x00400000 unused

Write Preview
Loading…
Cancel
Save