From 34cf557abf80aa887a12e6cf31342b6f45a0bd26 Mon Sep 17 00:00:00 2001 From: Anoop Saldanha Date: Sat, 24 Dec 2011 14:42:02 +0530 Subject: [PATCH] fix indentation --- src/detect-engine-mpm.c | 1080 +++++++++++++++++++-------------------- 1 file changed, 540 insertions(+), 540 deletions(-) diff --git a/src/detect-engine-mpm.c b/src/detect-engine-mpm.c index 929f3db45b..bed343e5bd 100644 --- a/src/detect-engine-mpm.c +++ b/src/detect-engine-mpm.c @@ -732,596 +732,596 @@ static void PopulateMpmAddPatternToMpm(DetectEngineCtx *de_ctx, return; } - uint8_t flags = 0; - - DetectContentData *cd = NULL; - DetectContentData *ud = NULL; - DetectContentData *hcbd = NULL; - DetectContentData *hsbd = NULL; - DetectContentData *hhd = NULL; - DetectContentData *hrhd = NULL; - DetectContentData *hmd = NULL; - DetectContentData *hcd = NULL; - DetectContentData *hrud = NULL; - switch (mpm_sm->type) { - case DETECT_CONTENT: - { - cd = (DetectContentData *)mpm_sm->ctx; - if (cd->flags & DETECT_CONTENT_FAST_PATTERN_CHOP) { - /* add the content to the "packet" mpm */ - if (SignatureHasPacketContent(s)) { - if (cd->flags & DETECT_CONTENT_NOCASE) { - mpm_table[sgh->mpm_ctx->mpm_type]. - AddPatternNocase(sgh->mpm_ctx, - cd->content + cd->fp_chop_offset, - cd->fp_chop_len, - 0, 0, cd->id, s->num, flags); - } else { - mpm_table[sgh->mpm_ctx->mpm_type]. - AddPattern(sgh->mpm_ctx, - cd->content + cd->fp_chop_offset, - cd->fp_chop_len, - 0, 0, cd->id, s->num, flags); - } - /* tell matcher we are inspecting packet */ - s->flags |= SIG_FLAG_MPM_PACKET; - s->mpm_pattern_id_div_8 = cd->id / 8; - s->mpm_pattern_id_mod_8 = 1 << (cd->id % 8); - if (cd->flags & DETECT_CONTENT_NEGATED) { - SCLogDebug("flagging sig %"PRIu32" to be looking for negated mpm", s->id); - s->flags |= SIG_FLAG_MPM_PACKET_NEG; - } - } - if (SignatureHasStreamContent(s)) { - if (cd->flags & DETECT_CONTENT_NOCASE) { - mpm_table[sgh->mpm_stream_ctx->mpm_type]. - AddPatternNocase(sgh->mpm_stream_ctx, - cd->content + cd->fp_chop_offset, - cd->fp_chop_len, - 0, 0, cd->id, s->num, flags); - } else { - mpm_table[sgh->mpm_stream_ctx->mpm_type]. - AddPattern(sgh->mpm_stream_ctx, - cd->content + cd->fp_chop_offset, - cd->fp_chop_len, - 0, 0, cd->id, s->num, flags); - } - /* tell matcher we are inspecting stream */ - s->flags |= SIG_FLAG_MPM_STREAM; - s->mpm_pattern_id_div_8 = cd->id / 8; - s->mpm_pattern_id_mod_8 = 1 << (cd->id % 8); - if (cd->flags & DETECT_CONTENT_NEGATED) { - SCLogDebug("flagging sig %"PRIu32" to be looking for negated mpm", s->id); - s->flags |= SIG_FLAG_MPM_STREAM_NEG; - } - } - } else { - if (cd->flags & DETECT_CONTENT_FAST_PATTERN_ONLY) { - if (DETECT_CONTENT_IS_SINGLE(cd)) { - if (SignatureHasPacketContent(s)) - cd->flags |= DETECT_CONTENT_PACKET_MPM; - if (SignatureHasStreamContent(s)) - cd->flags |= DETECT_CONTENT_STREAM_MPM; - } - - /* see if we can bypass the match validation for this pattern */ + uint8_t flags = 0; + + DetectContentData *cd = NULL; + DetectContentData *ud = NULL; + DetectContentData *hcbd = NULL; + DetectContentData *hsbd = NULL; + DetectContentData *hhd = NULL; + DetectContentData *hrhd = NULL; + DetectContentData *hmd = NULL; + DetectContentData *hcd = NULL; + DetectContentData *hrud = NULL; + switch (mpm_sm->type) { + case DETECT_CONTENT: + { + cd = (DetectContentData *)mpm_sm->ctx; + if (cd->flags & DETECT_CONTENT_FAST_PATTERN_CHOP) { + /* add the content to the "packet" mpm */ + if (SignatureHasPacketContent(s)) { + if (cd->flags & DETECT_CONTENT_NOCASE) { + mpm_table[sgh->mpm_ctx->mpm_type]. + AddPatternNocase(sgh->mpm_ctx, + cd->content + cd->fp_chop_offset, + cd->fp_chop_len, + 0, 0, cd->id, s->num, flags); } else { - if (DETECT_CONTENT_IS_SINGLE(cd)) { - if (SignatureHasPacketContent(s)) - cd->flags |= DETECT_CONTENT_PACKET_MPM; - if (SignatureHasStreamContent(s)) - cd->flags |= DETECT_CONTENT_STREAM_MPM; - } - } /* else - if (co->flags & DETECT_CONTENT_FAST_PATTERN_ONLY) */ - - if (SignatureHasPacketContent(s)) { - /* add the content to the "packet" mpm */ - if (cd->flags & DETECT_CONTENT_NOCASE) { - mpm_table[sgh->mpm_ctx->mpm_type]. - AddPatternNocase(sgh->mpm_ctx, - cd->content, cd->content_len, - 0, 0, cd->id, s->num, flags); - } else { - mpm_table[sgh->mpm_ctx->mpm_type]. - AddPattern(sgh->mpm_ctx, - cd->content, cd->content_len, - 0, 0, cd->id, s->num, flags); - } - /* tell matcher we are inspecting packet */ - s->flags |= SIG_FLAG_MPM_PACKET; - s->mpm_pattern_id_div_8 = cd->id / 8; - s->mpm_pattern_id_mod_8 = 1 << (cd->id % 8); - if (cd->flags & DETECT_CONTENT_NEGATED) { - SCLogDebug("flagging sig %"PRIu32" to be looking for negated mpm", s->id); - s->flags |= SIG_FLAG_MPM_PACKET_NEG; - } + mpm_table[sgh->mpm_ctx->mpm_type]. + AddPattern(sgh->mpm_ctx, + cd->content + cd->fp_chop_offset, + cd->fp_chop_len, + 0, 0, cd->id, s->num, flags); } - if (SignatureHasStreamContent(s)) { - /* add the content to the "packet" mpm */ - if (cd->flags & DETECT_CONTENT_NOCASE) { - mpm_table[sgh->mpm_stream_ctx->mpm_type]. - AddPatternNocase(sgh->mpm_stream_ctx, - cd->content, cd->content_len, - 0, 0, cd->id, s->num, flags); - } else { - mpm_table[sgh->mpm_stream_ctx->mpm_type]. - AddPattern(sgh->mpm_stream_ctx, - cd->content, cd->content_len, - 0, 0, cd->id, s->num, flags); - } - /* tell matcher we are inspecting stream */ - s->flags |= SIG_FLAG_MPM_STREAM; - s->mpm_pattern_id_div_8 = cd->id / 8; - s->mpm_pattern_id_mod_8 = 1 << (cd->id % 8); - if (cd->flags & DETECT_CONTENT_NEGATED) { - SCLogDebug("flagging sig %"PRIu32" to be looking for negated mpm", s->id); - s->flags |= SIG_FLAG_MPM_STREAM_NEG; - } + /* tell matcher we are inspecting packet */ + s->flags |= SIG_FLAG_MPM_PACKET; + s->mpm_pattern_id_div_8 = cd->id / 8; + s->mpm_pattern_id_mod_8 = 1 << (cd->id % 8); + if (cd->flags & DETECT_CONTENT_NEGATED) { + SCLogDebug("flagging sig %"PRIu32" to be looking for negated mpm", s->id); + s->flags |= SIG_FLAG_MPM_PACKET_NEG; } } - if (SignatureHasPacketContent(s)) { - sgh->flags |= SIG_GROUP_HEAD_MPM_PACKET; - } if (SignatureHasStreamContent(s)) { - sgh->flags |= SIG_GROUP_HEAD_MPM_STREAM; - } - - break; - } /* case DETECT_CONTENT */ - - case DETECT_URICONTENT: - { - ud = (DetectContentData *)mpm_sm->ctx; - if (ud->flags & DETECT_CONTENT_FAST_PATTERN_CHOP) { - /* add the content to the "uri" mpm */ - if (ud->flags & DETECT_CONTENT_NOCASE) { - mpm_table[sgh->mpm_uri_ctx->mpm_type]. - AddPatternNocase(sgh->mpm_uri_ctx, - ud->content + ud->fp_chop_offset, - ud->fp_chop_len, - 0, 0, ud->id, s->num, flags); + if (cd->flags & DETECT_CONTENT_NOCASE) { + mpm_table[sgh->mpm_stream_ctx->mpm_type]. + AddPatternNocase(sgh->mpm_stream_ctx, + cd->content + cd->fp_chop_offset, + cd->fp_chop_len, + 0, 0, cd->id, s->num, flags); } else { - mpm_table[sgh->mpm_uri_ctx->mpm_type]. - AddPattern(sgh->mpm_uri_ctx, - ud->content + ud->fp_chop_offset, - ud->fp_chop_len, - 0, 0, ud->id, s->num, flags); + mpm_table[sgh->mpm_stream_ctx->mpm_type]. + AddPattern(sgh->mpm_stream_ctx, + cd->content + cd->fp_chop_offset, + cd->fp_chop_len, + 0, 0, cd->id, s->num, flags); } - } else { - if (ud->flags & DETECT_CONTENT_FAST_PATTERN_ONLY) { - if (DETECT_CONTENT_IS_SINGLE(ud)) { - ud->flags |= DETECT_CONTENT_URI_MPM; - } - - /* see if we can bypass the match validation for this pattern */ - } else { - if (DETECT_CONTENT_IS_SINGLE(ud)) { - ud->flags |= DETECT_CONTENT_URI_MPM; - } - } /* else - if (ud->flags & DETECT_CONTENT_FAST_PATTERN_ONLY) */ - - /* add the content to the "uri" mpm */ - if (ud->flags & DETECT_CONTENT_NOCASE) { - mpm_table[sgh->mpm_uri_ctx->mpm_type]. - AddPatternNocase(sgh->mpm_uri_ctx, - ud->content, ud->content_len, - 0, 0, ud->id, s->num, flags); - } else { - mpm_table[sgh->mpm_uri_ctx->mpm_type]. - AddPattern(sgh->mpm_uri_ctx, - ud->content, ud->content_len, - 0, 0, ud->id, s->num, flags); + /* tell matcher we are inspecting stream */ + s->flags |= SIG_FLAG_MPM_STREAM; + s->mpm_pattern_id_div_8 = cd->id / 8; + s->mpm_pattern_id_mod_8 = 1 << (cd->id % 8); + if (cd->flags & DETECT_CONTENT_NEGATED) { + SCLogDebug("flagging sig %"PRIu32" to be looking for negated mpm", s->id); + s->flags |= SIG_FLAG_MPM_STREAM_NEG; } } - /* tell matcher we are inspecting uri */ - s->flags |= SIG_FLAG_MPM_HTTP; - s->mpm_pattern_id_div_8 = ud->id / 8; - s->mpm_pattern_id_mod_8 = 1 << (ud->id % 8); - if (ud->flags & DETECT_CONTENT_NEGATED) - s->flags |= SIG_FLAG_MPM_HTTP_NEG; - - sgh->flags |= SIG_GROUP_HEAD_MPM_URI; - - break; - } /* case DETECT_URICONTENT */ - - case DETECT_AL_HTTP_CLIENT_BODY: - { - hcbd = (DetectContentData *)mpm_sm->ctx; - if (hcbd->flags & DETECT_CONTENT_FAST_PATTERN_CHOP) { - /* add the content to the "hcbd" mpm */ - if (hcbd->flags & DETECT_CONTENT_NOCASE) { - mpm_table[sgh->mpm_hcbd_ctx->mpm_type]. - AddPatternNocase(sgh->mpm_hcbd_ctx, - hcbd->content + hcbd->fp_chop_offset, - hcbd->fp_chop_len, - 0, 0, hcbd->id, s->num, flags); - } else { - mpm_table[sgh->mpm_hcbd_ctx->mpm_type]. - AddPattern(sgh->mpm_hcbd_ctx, - hcbd->content + hcbd->fp_chop_offset, - hcbd->fp_chop_len, - 0, 0, hcbd->id, s->num, flags); + } else { + if (cd->flags & DETECT_CONTENT_FAST_PATTERN_ONLY) { + if (DETECT_CONTENT_IS_SINGLE(cd)) { + if (SignatureHasPacketContent(s)) + cd->flags |= DETECT_CONTENT_PACKET_MPM; + if (SignatureHasStreamContent(s)) + cd->flags |= DETECT_CONTENT_STREAM_MPM; } - } else { - if (hcbd->flags & DETECT_CONTENT_FAST_PATTERN_ONLY) { - if (DETECT_CONTENT_IS_SINGLE(hcbd)) { - hcbd->flags |= DETECT_CONTENT_HCBD_MPM; - } - /* see if we can bypass the match validation for this pattern */ - } else { - if (DETECT_CONTENT_IS_SINGLE(hcbd)) { - hcbd->flags |= DETECT_CONTENT_HCBD_MPM; - } - } /* else - if (hcbd->flags & DETECT_CONTENT_FAST_PATTERN_ONLY) */ - - /* add the content to the "hcbd" mpm */ - if (hcbd->flags & DETECT_CONTENT_NOCASE) { - mpm_table[sgh->mpm_hcbd_ctx->mpm_type]. - AddPatternNocase(sgh->mpm_hcbd_ctx, - hcbd->content, hcbd->content_len, - 0, 0, hcbd->id, s->num, flags); - } else { - mpm_table[sgh->mpm_hcbd_ctx->mpm_type]. - AddPattern(sgh->mpm_hcbd_ctx, - hcbd->content, hcbd->content_len, - 0, 0, hcbd->id, s->num, flags); + /* see if we can bypass the match validation for this pattern */ + } else { + if (DETECT_CONTENT_IS_SINGLE(cd)) { + if (SignatureHasPacketContent(s)) + cd->flags |= DETECT_CONTENT_PACKET_MPM; + if (SignatureHasStreamContent(s)) + cd->flags |= DETECT_CONTENT_STREAM_MPM; } - } - /* tell matcher we are inspecting uri */ - s->flags |= SIG_FLAG_MPM_HTTP; - s->mpm_pattern_id_div_8 = hcbd->id / 8; - s->mpm_pattern_id_mod_8 = 1 << (hcbd->id % 8); - if (hcbd->flags & DETECT_CONTENT_NEGATED) - s->flags |= SIG_FLAG_MPM_HTTP_NEG; - - sgh->flags |= SIG_GROUP_HEAD_MPM_HCBD; + } /* else - if (co->flags & DETECT_CONTENT_FAST_PATTERN_ONLY) */ - break; - } /* case DETECT_AL_HTTP_CLIENT_BODY */ - - case DETECT_AL_HTTP_SERVER_BODY: - { - hsbd = (DetectContentData *)mpm_sm->ctx; - if (hsbd->flags & DETECT_CONTENT_FAST_PATTERN_CHOP) { - /* add the content to the "hcbd" mpm */ - if (hsbd->flags & DETECT_CONTENT_NOCASE) { - mpm_table[sgh->mpm_hsbd_ctx->mpm_type]. - AddPatternNocase(sgh->mpm_hsbd_ctx, - hsbd->content + hsbd->fp_chop_offset, - hsbd->fp_chop_len, - 0, 0, hsbd->id, s->num, flags); + if (SignatureHasPacketContent(s)) { + /* add the content to the "packet" mpm */ + if (cd->flags & DETECT_CONTENT_NOCASE) { + mpm_table[sgh->mpm_ctx->mpm_type]. + AddPatternNocase(sgh->mpm_ctx, + cd->content, cd->content_len, + 0, 0, cd->id, s->num, flags); } else { - mpm_table[sgh->mpm_hsbd_ctx->mpm_type]. - AddPattern(sgh->mpm_hsbd_ctx, - hsbd->content + hsbd->fp_chop_offset, - hsbd->fp_chop_len, - 0, 0, hsbd->id, s->num, flags); + mpm_table[sgh->mpm_ctx->mpm_type]. + AddPattern(sgh->mpm_ctx, + cd->content, cd->content_len, + 0, 0, cd->id, s->num, flags); } - } else { - if (hsbd->flags & DETECT_CONTENT_FAST_PATTERN_ONLY) { - if (DETECT_CONTENT_IS_SINGLE(hsbd)) { - hsbd->flags |= DETECT_CONTENT_HSBD_MPM; - } - - /* see if we can bypass the match validation for this pattern */ - } else { - if (DETECT_CONTENT_IS_SINGLE(hsbd)) { - hsbd->flags |= DETECT_CONTENT_HSBD_MPM; - } - } /* else - if (hcbd->flags & DETECT_CONTENT_FAST_PATTERN_ONLY) */ - - /* add the content to the "hsbd" mpm */ - if (hsbd->flags & DETECT_CONTENT_NOCASE) { - mpm_table[sgh->mpm_hsbd_ctx->mpm_type]. - AddPatternNocase(sgh->mpm_hsbd_ctx, - hsbd->content, hsbd->content_len, - 0, 0, hsbd->id, s->num, flags); - } else { - mpm_table[sgh->mpm_hsbd_ctx->mpm_type]. - AddPattern(sgh->mpm_hsbd_ctx, - hsbd->content, hsbd->content_len, - 0, 0, hsbd->id, s->num, flags); + /* tell matcher we are inspecting packet */ + s->flags |= SIG_FLAG_MPM_PACKET; + s->mpm_pattern_id_div_8 = cd->id / 8; + s->mpm_pattern_id_mod_8 = 1 << (cd->id % 8); + if (cd->flags & DETECT_CONTENT_NEGATED) { + SCLogDebug("flagging sig %"PRIu32" to be looking for negated mpm", s->id); + s->flags |= SIG_FLAG_MPM_PACKET_NEG; } } - /* tell matcher we are inspecting uri */ - s->flags |= SIG_FLAG_MPM_HTTP; - s->mpm_pattern_id_div_8 = hsbd->id / 8; - s->mpm_pattern_id_mod_8 = 1 << (hsbd->id % 8); - if (hsbd->flags & DETECT_CONTENT_NEGATED) - s->flags |= SIG_FLAG_MPM_HTTP_NEG; - - sgh->flags |= SIG_GROUP_HEAD_MPM_HSBD; - - break; - } /* case DETECT_AL_HTTP_CLIENT_BODY */ - - case DETECT_AL_HTTP_HEADER: - { - hhd = (DetectContentData *)mpm_sm->ctx; - if (hhd->flags & DETECT_CONTENT_FAST_PATTERN_CHOP) { - /* add the content to the "hhd" mpm */ - if (hhd->flags & DETECT_CONTENT_NOCASE) { - mpm_table[sgh->mpm_hhd_ctx->mpm_type]. - AddPatternNocase(sgh->mpm_hhd_ctx, - hhd->content + hhd->fp_chop_offset, - hhd->fp_chop_len, - 0, 0, hhd->id, s->num, flags); + if (SignatureHasStreamContent(s)) { + /* add the content to the "packet" mpm */ + if (cd->flags & DETECT_CONTENT_NOCASE) { + mpm_table[sgh->mpm_stream_ctx->mpm_type]. + AddPatternNocase(sgh->mpm_stream_ctx, + cd->content, cd->content_len, + 0, 0, cd->id, s->num, flags); } else { - mpm_table[sgh->mpm_hhd_ctx->mpm_type]. - AddPattern(sgh->mpm_hhd_ctx, - hhd->content + hhd->fp_chop_offset, - hhd->fp_chop_len, - 0, 0, hhd->id, s->num, flags); + mpm_table[sgh->mpm_stream_ctx->mpm_type]. + AddPattern(sgh->mpm_stream_ctx, + cd->content, cd->content_len, + 0, 0, cd->id, s->num, flags); } - } else { - if (hhd->flags & DETECT_CONTENT_FAST_PATTERN_ONLY) { - if (DETECT_CONTENT_IS_SINGLE(hhd)) { - hhd->flags |= DETECT_CONTENT_HHD_MPM; - } - - /* see if we can bypass the match validation for this pattern */ - } else { - if (DETECT_CONTENT_IS_SINGLE(hhd)) { - hhd->flags |= DETECT_CONTENT_HHD_MPM; - } - } /* else - if (hhd->flags & DETECT_CONTENT_FAST_PATTERN_ONLY) */ - - /* add the content to the "hhd" mpm */ - if (hhd->flags & DETECT_CONTENT_NOCASE) { - mpm_table[sgh->mpm_hhd_ctx->mpm_type]. - AddPatternNocase(sgh->mpm_hhd_ctx, - hhd->content, hhd->content_len, - 0, 0, hhd->id, s->num, flags); - } else { - mpm_table[sgh->mpm_hhd_ctx->mpm_type]. - AddPattern(sgh->mpm_hhd_ctx, - hhd->content, hhd->content_len, - 0, 0, hhd->id, s->num, flags); + /* tell matcher we are inspecting stream */ + s->flags |= SIG_FLAG_MPM_STREAM; + s->mpm_pattern_id_div_8 = cd->id / 8; + s->mpm_pattern_id_mod_8 = 1 << (cd->id % 8); + if (cd->flags & DETECT_CONTENT_NEGATED) { + SCLogDebug("flagging sig %"PRIu32" to be looking for negated mpm", s->id); + s->flags |= SIG_FLAG_MPM_STREAM_NEG; } } - /* tell matcher we are inspecting uri */ - s->flags |= SIG_FLAG_MPM_HTTP; - s->mpm_pattern_id_div_8 = hhd->id / 8; - s->mpm_pattern_id_mod_8 = 1 << (hhd->id % 8); - if (hhd->flags & DETECT_CONTENT_NEGATED) - s->flags |= SIG_FLAG_MPM_HTTP_NEG; + } + if (SignatureHasPacketContent(s)) { + sgh->flags |= SIG_GROUP_HEAD_MPM_PACKET; + } + if (SignatureHasStreamContent(s)) { + sgh->flags |= SIG_GROUP_HEAD_MPM_STREAM; + } - sgh->flags |= SIG_GROUP_HEAD_MPM_HHD; + break; + } /* case DETECT_CONTENT */ + + case DETECT_URICONTENT: + { + ud = (DetectContentData *)mpm_sm->ctx; + if (ud->flags & DETECT_CONTENT_FAST_PATTERN_CHOP) { + /* add the content to the "uri" mpm */ + if (ud->flags & DETECT_CONTENT_NOCASE) { + mpm_table[sgh->mpm_uri_ctx->mpm_type]. + AddPatternNocase(sgh->mpm_uri_ctx, + ud->content + ud->fp_chop_offset, + ud->fp_chop_len, + 0, 0, ud->id, s->num, flags); + } else { + mpm_table[sgh->mpm_uri_ctx->mpm_type]. + AddPattern(sgh->mpm_uri_ctx, + ud->content + ud->fp_chop_offset, + ud->fp_chop_len, + 0, 0, ud->id, s->num, flags); + } + } else { + if (ud->flags & DETECT_CONTENT_FAST_PATTERN_ONLY) { + if (DETECT_CONTENT_IS_SINGLE(ud)) { + ud->flags |= DETECT_CONTENT_URI_MPM; + } - break; - } /* case DETECT_AL_HTTP_HEADER */ - - case DETECT_AL_HTTP_RAW_HEADER: - { - hrhd = (DetectContentData *)mpm_sm->ctx; - if (hrhd->flags & DETECT_CONTENT_FAST_PATTERN_CHOP) { - /* add the content to the "hrhd" mpm */ - if (hrhd->flags & DETECT_CONTENT_NOCASE) { - mpm_table[sgh->mpm_hrhd_ctx->mpm_type]. - AddPatternNocase(sgh->mpm_hrhd_ctx, - hrhd->content + hrhd->fp_chop_offset, - hrhd->fp_chop_len, - 0, 0, hrhd->id, s->num, flags); - } else { - mpm_table[sgh->mpm_hrhd_ctx->mpm_type]. - AddPattern(sgh->mpm_hrhd_ctx, - hrhd->content + hrhd->fp_chop_offset, - hrhd->fp_chop_len, - 0, 0, hrhd->id, s->num, flags); + /* see if we can bypass the match validation for this pattern */ + } else { + if (DETECT_CONTENT_IS_SINGLE(ud)) { + ud->flags |= DETECT_CONTENT_URI_MPM; } + } /* else - if (ud->flags & DETECT_CONTENT_FAST_PATTERN_ONLY) */ + + /* add the content to the "uri" mpm */ + if (ud->flags & DETECT_CONTENT_NOCASE) { + mpm_table[sgh->mpm_uri_ctx->mpm_type]. + AddPatternNocase(sgh->mpm_uri_ctx, + ud->content, ud->content_len, + 0, 0, ud->id, s->num, flags); } else { - if (hrhd->flags & DETECT_CONTENT_FAST_PATTERN_ONLY) { - if (DETECT_CONTENT_IS_SINGLE(hrhd)) { - hrhd->flags |= DETECT_CONTENT_HRHD_MPM; - } + mpm_table[sgh->mpm_uri_ctx->mpm_type]. + AddPattern(sgh->mpm_uri_ctx, + ud->content, ud->content_len, + 0, 0, ud->id, s->num, flags); + } + } + /* tell matcher we are inspecting uri */ + s->flags |= SIG_FLAG_MPM_HTTP; + s->mpm_pattern_id_div_8 = ud->id / 8; + s->mpm_pattern_id_mod_8 = 1 << (ud->id % 8); + if (ud->flags & DETECT_CONTENT_NEGATED) + s->flags |= SIG_FLAG_MPM_HTTP_NEG; + + sgh->flags |= SIG_GROUP_HEAD_MPM_URI; + + break; + } /* case DETECT_URICONTENT */ + + case DETECT_AL_HTTP_CLIENT_BODY: + { + hcbd = (DetectContentData *)mpm_sm->ctx; + if (hcbd->flags & DETECT_CONTENT_FAST_PATTERN_CHOP) { + /* add the content to the "hcbd" mpm */ + if (hcbd->flags & DETECT_CONTENT_NOCASE) { + mpm_table[sgh->mpm_hcbd_ctx->mpm_type]. + AddPatternNocase(sgh->mpm_hcbd_ctx, + hcbd->content + hcbd->fp_chop_offset, + hcbd->fp_chop_len, + 0, 0, hcbd->id, s->num, flags); + } else { + mpm_table[sgh->mpm_hcbd_ctx->mpm_type]. + AddPattern(sgh->mpm_hcbd_ctx, + hcbd->content + hcbd->fp_chop_offset, + hcbd->fp_chop_len, + 0, 0, hcbd->id, s->num, flags); + } + } else { + if (hcbd->flags & DETECT_CONTENT_FAST_PATTERN_ONLY) { + if (DETECT_CONTENT_IS_SINGLE(hcbd)) { + hcbd->flags |= DETECT_CONTENT_HCBD_MPM; + } - /* see if we can bypass the match validation for this pattern */ - } else { - if (DETECT_CONTENT_IS_SINGLE(hrhd)) { - hrhd->flags |= DETECT_CONTENT_HRHD_MPM; - } - } /* else - if (hrhd->flags & DETECT_CONTENT_FAST_PATTERN_ONLY) */ - - /* add the content to the "hrhd" mpm */ - if (hrhd->flags & DETECT_CONTENT_NOCASE) { - mpm_table[sgh->mpm_hrhd_ctx->mpm_type]. - AddPatternNocase(sgh->mpm_hrhd_ctx, - hrhd->content, hrhd->content_len, - 0, 0, hrhd->id, s->num, flags); - } else { - mpm_table[sgh->mpm_hrhd_ctx->mpm_type]. - AddPattern(sgh->mpm_hrhd_ctx, - hrhd->content, hrhd->content_len, - 0, 0, hrhd->id, s->num, flags); + /* see if we can bypass the match validation for this pattern */ + } else { + if (DETECT_CONTENT_IS_SINGLE(hcbd)) { + hcbd->flags |= DETECT_CONTENT_HCBD_MPM; } + } /* else - if (hcbd->flags & DETECT_CONTENT_FAST_PATTERN_ONLY) */ + + /* add the content to the "hcbd" mpm */ + if (hcbd->flags & DETECT_CONTENT_NOCASE) { + mpm_table[sgh->mpm_hcbd_ctx->mpm_type]. + AddPatternNocase(sgh->mpm_hcbd_ctx, + hcbd->content, hcbd->content_len, + 0, 0, hcbd->id, s->num, flags); + } else { + mpm_table[sgh->mpm_hcbd_ctx->mpm_type]. + AddPattern(sgh->mpm_hcbd_ctx, + hcbd->content, hcbd->content_len, + 0, 0, hcbd->id, s->num, flags); } - /* tell matcher we are inspecting uri */ - s->flags |= SIG_FLAG_MPM_HTTP; - s->mpm_pattern_id_div_8 = hrhd->id / 8; - s->mpm_pattern_id_mod_8 = 1 << (hrhd->id % 8); - if (hrhd->flags & DETECT_CONTENT_NEGATED) - s->flags |= SIG_FLAG_MPM_HTTP_NEG; - - sgh->flags |= SIG_GROUP_HEAD_MPM_HRHD; + } + /* tell matcher we are inspecting uri */ + s->flags |= SIG_FLAG_MPM_HTTP; + s->mpm_pattern_id_div_8 = hcbd->id / 8; + s->mpm_pattern_id_mod_8 = 1 << (hcbd->id % 8); + if (hcbd->flags & DETECT_CONTENT_NEGATED) + s->flags |= SIG_FLAG_MPM_HTTP_NEG; + + sgh->flags |= SIG_GROUP_HEAD_MPM_HCBD; + + break; + } /* case DETECT_AL_HTTP_CLIENT_BODY */ + + case DETECT_AL_HTTP_SERVER_BODY: + { + hsbd = (DetectContentData *)mpm_sm->ctx; + if (hsbd->flags & DETECT_CONTENT_FAST_PATTERN_CHOP) { + /* add the content to the "hcbd" mpm */ + if (hsbd->flags & DETECT_CONTENT_NOCASE) { + mpm_table[sgh->mpm_hsbd_ctx->mpm_type]. + AddPatternNocase(sgh->mpm_hsbd_ctx, + hsbd->content + hsbd->fp_chop_offset, + hsbd->fp_chop_len, + 0, 0, hsbd->id, s->num, flags); + } else { + mpm_table[sgh->mpm_hsbd_ctx->mpm_type]. + AddPattern(sgh->mpm_hsbd_ctx, + hsbd->content + hsbd->fp_chop_offset, + hsbd->fp_chop_len, + 0, 0, hsbd->id, s->num, flags); + } + } else { + if (hsbd->flags & DETECT_CONTENT_FAST_PATTERN_ONLY) { + if (DETECT_CONTENT_IS_SINGLE(hsbd)) { + hsbd->flags |= DETECT_CONTENT_HSBD_MPM; + } - break; - } /* case DETECT_AL_HTTP_RAW_HEADER */ - - case DETECT_AL_HTTP_METHOD: - { - hmd = (DetectContentData *)mpm_sm->ctx; - if (hmd->flags & DETECT_CONTENT_FAST_PATTERN_CHOP) { - /* add the content to the "hmd" mpm */ - if (hmd->flags & DETECT_CONTENT_NOCASE) { - mpm_table[sgh->mpm_hmd_ctx->mpm_type]. - AddPatternNocase(sgh->mpm_hmd_ctx, - hmd->content + hmd->fp_chop_offset, - hmd->fp_chop_len, - 0, 0, hmd->id, s->num, flags); - } else { - mpm_table[sgh->mpm_hmd_ctx->mpm_type]. - AddPattern(sgh->mpm_hmd_ctx, - hmd->content + hmd->fp_chop_offset, - hmd->fp_chop_len, - 0, 0, hmd->id, s->num, flags); + /* see if we can bypass the match validation for this pattern */ + } else { + if (DETECT_CONTENT_IS_SINGLE(hsbd)) { + hsbd->flags |= DETECT_CONTENT_HSBD_MPM; } + } /* else - if (hcbd->flags & DETECT_CONTENT_FAST_PATTERN_ONLY) */ + + /* add the content to the "hsbd" mpm */ + if (hsbd->flags & DETECT_CONTENT_NOCASE) { + mpm_table[sgh->mpm_hsbd_ctx->mpm_type]. + AddPatternNocase(sgh->mpm_hsbd_ctx, + hsbd->content, hsbd->content_len, + 0, 0, hsbd->id, s->num, flags); } else { - if (hmd->flags & DETECT_CONTENT_FAST_PATTERN_ONLY) { - if (DETECT_CONTENT_IS_SINGLE(hmd)) { - hmd->flags |= DETECT_CONTENT_HMD_MPM; - } + mpm_table[sgh->mpm_hsbd_ctx->mpm_type]. + AddPattern(sgh->mpm_hsbd_ctx, + hsbd->content, hsbd->content_len, + 0, 0, hsbd->id, s->num, flags); + } + } + /* tell matcher we are inspecting uri */ + s->flags |= SIG_FLAG_MPM_HTTP; + s->mpm_pattern_id_div_8 = hsbd->id / 8; + s->mpm_pattern_id_mod_8 = 1 << (hsbd->id % 8); + if (hsbd->flags & DETECT_CONTENT_NEGATED) + s->flags |= SIG_FLAG_MPM_HTTP_NEG; + + sgh->flags |= SIG_GROUP_HEAD_MPM_HSBD; + + break; + } /* case DETECT_AL_HTTP_CLIENT_BODY */ + + case DETECT_AL_HTTP_HEADER: + { + hhd = (DetectContentData *)mpm_sm->ctx; + if (hhd->flags & DETECT_CONTENT_FAST_PATTERN_CHOP) { + /* add the content to the "hhd" mpm */ + if (hhd->flags & DETECT_CONTENT_NOCASE) { + mpm_table[sgh->mpm_hhd_ctx->mpm_type]. + AddPatternNocase(sgh->mpm_hhd_ctx, + hhd->content + hhd->fp_chop_offset, + hhd->fp_chop_len, + 0, 0, hhd->id, s->num, flags); + } else { + mpm_table[sgh->mpm_hhd_ctx->mpm_type]. + AddPattern(sgh->mpm_hhd_ctx, + hhd->content + hhd->fp_chop_offset, + hhd->fp_chop_len, + 0, 0, hhd->id, s->num, flags); + } + } else { + if (hhd->flags & DETECT_CONTENT_FAST_PATTERN_ONLY) { + if (DETECT_CONTENT_IS_SINGLE(hhd)) { + hhd->flags |= DETECT_CONTENT_HHD_MPM; + } - /* see if we can bypass the match validation for this pattern */ - } else { - if (DETECT_CONTENT_IS_SINGLE(hmd)) { - hmd->flags |= DETECT_CONTENT_HMD_MPM; - } - } /* else - if (hmd->flags & DETECT_CONTENT_FAST_PATTERN_ONLY) */ - - /* add the content to the "hmd" mpm */ - if (hmd->flags & DETECT_CONTENT_NOCASE) { - mpm_table[sgh->mpm_hmd_ctx->mpm_type]. - AddPatternNocase(sgh->mpm_hmd_ctx, - hmd->content, hmd->content_len, - 0, 0, hmd->id, s->num, flags); - } else { - mpm_table[sgh->mpm_hmd_ctx->mpm_type]. - AddPattern(sgh->mpm_hmd_ctx, - hmd->content, hmd->content_len, - 0, 0, hmd->id, s->num, flags); + /* see if we can bypass the match validation for this pattern */ + } else { + if (DETECT_CONTENT_IS_SINGLE(hhd)) { + hhd->flags |= DETECT_CONTENT_HHD_MPM; } + } /* else - if (hhd->flags & DETECT_CONTENT_FAST_PATTERN_ONLY) */ + + /* add the content to the "hhd" mpm */ + if (hhd->flags & DETECT_CONTENT_NOCASE) { + mpm_table[sgh->mpm_hhd_ctx->mpm_type]. + AddPatternNocase(sgh->mpm_hhd_ctx, + hhd->content, hhd->content_len, + 0, 0, hhd->id, s->num, flags); + } else { + mpm_table[sgh->mpm_hhd_ctx->mpm_type]. + AddPattern(sgh->mpm_hhd_ctx, + hhd->content, hhd->content_len, + 0, 0, hhd->id, s->num, flags); } - /* tell matcher we are inspecting method */ - s->flags |= SIG_FLAG_MPM_HTTP; - s->mpm_pattern_id_div_8 = hmd->id / 8; - s->mpm_pattern_id_mod_8 = 1 << (hmd->id % 8); - if (hmd->flags & DETECT_CONTENT_NEGATED) - s->flags |= SIG_FLAG_MPM_HTTP_NEG; - - sgh->flags |= SIG_GROUP_HEAD_MPM_HMD; + } + /* tell matcher we are inspecting uri */ + s->flags |= SIG_FLAG_MPM_HTTP; + s->mpm_pattern_id_div_8 = hhd->id / 8; + s->mpm_pattern_id_mod_8 = 1 << (hhd->id % 8); + if (hhd->flags & DETECT_CONTENT_NEGATED) + s->flags |= SIG_FLAG_MPM_HTTP_NEG; + + sgh->flags |= SIG_GROUP_HEAD_MPM_HHD; + + break; + } /* case DETECT_AL_HTTP_HEADER */ + + case DETECT_AL_HTTP_RAW_HEADER: + { + hrhd = (DetectContentData *)mpm_sm->ctx; + if (hrhd->flags & DETECT_CONTENT_FAST_PATTERN_CHOP) { + /* add the content to the "hrhd" mpm */ + if (hrhd->flags & DETECT_CONTENT_NOCASE) { + mpm_table[sgh->mpm_hrhd_ctx->mpm_type]. + AddPatternNocase(sgh->mpm_hrhd_ctx, + hrhd->content + hrhd->fp_chop_offset, + hrhd->fp_chop_len, + 0, 0, hrhd->id, s->num, flags); + } else { + mpm_table[sgh->mpm_hrhd_ctx->mpm_type]. + AddPattern(sgh->mpm_hrhd_ctx, + hrhd->content + hrhd->fp_chop_offset, + hrhd->fp_chop_len, + 0, 0, hrhd->id, s->num, flags); + } + } else { + if (hrhd->flags & DETECT_CONTENT_FAST_PATTERN_ONLY) { + if (DETECT_CONTENT_IS_SINGLE(hrhd)) { + hrhd->flags |= DETECT_CONTENT_HRHD_MPM; + } - break; - } /* case DETECT_AL_HTTP_METHOD */ - - case DETECT_AL_HTTP_COOKIE: - { - hcd = (DetectContentData *)mpm_sm->ctx; - if (hcd->flags & DETECT_CONTENT_FAST_PATTERN_CHOP) { - /* add the content to the "hcd" mpm */ - if (hcd->flags & DETECT_CONTENT_NOCASE) { - mpm_table[sgh->mpm_hcd_ctx->mpm_type]. - AddPatternNocase(sgh->mpm_hcd_ctx, - hcd->content + hcd->fp_chop_offset, - hcd->fp_chop_len, - 0, 0, hcd->id, s->num, flags); - } else { - mpm_table[sgh->mpm_hcd_ctx->mpm_type]. - AddPattern(sgh->mpm_hcd_ctx, - hcd->content + hcd->fp_chop_offset, - hcd->fp_chop_len, - 0, 0, hcd->id, s->num, flags); + /* see if we can bypass the match validation for this pattern */ + } else { + if (DETECT_CONTENT_IS_SINGLE(hrhd)) { + hrhd->flags |= DETECT_CONTENT_HRHD_MPM; } + } /* else - if (hrhd->flags & DETECT_CONTENT_FAST_PATTERN_ONLY) */ + + /* add the content to the "hrhd" mpm */ + if (hrhd->flags & DETECT_CONTENT_NOCASE) { + mpm_table[sgh->mpm_hrhd_ctx->mpm_type]. + AddPatternNocase(sgh->mpm_hrhd_ctx, + hrhd->content, hrhd->content_len, + 0, 0, hrhd->id, s->num, flags); } else { - if (hcd->flags & DETECT_CONTENT_FAST_PATTERN_ONLY) { - if (DETECT_CONTENT_IS_SINGLE(hcd)) { - hcd->flags |= DETECT_CONTENT_HCD_MPM; - } + mpm_table[sgh->mpm_hrhd_ctx->mpm_type]. + AddPattern(sgh->mpm_hrhd_ctx, + hrhd->content, hrhd->content_len, + 0, 0, hrhd->id, s->num, flags); + } + } + /* tell matcher we are inspecting uri */ + s->flags |= SIG_FLAG_MPM_HTTP; + s->mpm_pattern_id_div_8 = hrhd->id / 8; + s->mpm_pattern_id_mod_8 = 1 << (hrhd->id % 8); + if (hrhd->flags & DETECT_CONTENT_NEGATED) + s->flags |= SIG_FLAG_MPM_HTTP_NEG; + + sgh->flags |= SIG_GROUP_HEAD_MPM_HRHD; + + break; + } /* case DETECT_AL_HTTP_RAW_HEADER */ + + case DETECT_AL_HTTP_METHOD: + { + hmd = (DetectContentData *)mpm_sm->ctx; + if (hmd->flags & DETECT_CONTENT_FAST_PATTERN_CHOP) { + /* add the content to the "hmd" mpm */ + if (hmd->flags & DETECT_CONTENT_NOCASE) { + mpm_table[sgh->mpm_hmd_ctx->mpm_type]. + AddPatternNocase(sgh->mpm_hmd_ctx, + hmd->content + hmd->fp_chop_offset, + hmd->fp_chop_len, + 0, 0, hmd->id, s->num, flags); + } else { + mpm_table[sgh->mpm_hmd_ctx->mpm_type]. + AddPattern(sgh->mpm_hmd_ctx, + hmd->content + hmd->fp_chop_offset, + hmd->fp_chop_len, + 0, 0, hmd->id, s->num, flags); + } + } else { + if (hmd->flags & DETECT_CONTENT_FAST_PATTERN_ONLY) { + if (DETECT_CONTENT_IS_SINGLE(hmd)) { + hmd->flags |= DETECT_CONTENT_HMD_MPM; + } - /* see if we can bypass the match validation for this pattern */ - } else { - if (DETECT_CONTENT_IS_SINGLE(hcd)) { - hcd->flags |= DETECT_CONTENT_HCD_MPM; - } - } /* else - if (hcd->flags & DETECT_CONTENT_FAST_PATTERN_ONLY) */ - - /* add the content to the "hcd" mpm */ - if (hcd->flags & DETECT_CONTENT_NOCASE) { - mpm_table[sgh->mpm_hcd_ctx->mpm_type]. - AddPatternNocase(sgh->mpm_hcd_ctx, - hcd->content, hcd->content_len, - 0, 0, hcd->id, s->num, flags); - } else { - mpm_table[sgh->mpm_hcd_ctx->mpm_type]. - AddPattern(sgh->mpm_hcd_ctx, - hcd->content, hcd->content_len, - 0, 0, hcd->id, s->num, flags); + /* see if we can bypass the match validation for this pattern */ + } else { + if (DETECT_CONTENT_IS_SINGLE(hmd)) { + hmd->flags |= DETECT_CONTENT_HMD_MPM; } + } /* else - if (hmd->flags & DETECT_CONTENT_FAST_PATTERN_ONLY) */ + + /* add the content to the "hmd" mpm */ + if (hmd->flags & DETECT_CONTENT_NOCASE) { + mpm_table[sgh->mpm_hmd_ctx->mpm_type]. + AddPatternNocase(sgh->mpm_hmd_ctx, + hmd->content, hmd->content_len, + 0, 0, hmd->id, s->num, flags); + } else { + mpm_table[sgh->mpm_hmd_ctx->mpm_type]. + AddPattern(sgh->mpm_hmd_ctx, + hmd->content, hmd->content_len, + 0, 0, hmd->id, s->num, flags); } - /* tell matcher we are inspecting cookie */ - s->flags |= SIG_FLAG_MPM_HTTP; - s->mpm_pattern_id_div_8 = hcd->id / 8; - s->mpm_pattern_id_mod_8 = 1 << (hcd->id % 8); - if (hcd->flags & DETECT_CONTENT_NEGATED) - s->flags |= SIG_FLAG_MPM_HTTP_NEG; - - sgh->flags |= SIG_GROUP_HEAD_MPM_HCD; + } + /* tell matcher we are inspecting method */ + s->flags |= SIG_FLAG_MPM_HTTP; + s->mpm_pattern_id_div_8 = hmd->id / 8; + s->mpm_pattern_id_mod_8 = 1 << (hmd->id % 8); + if (hmd->flags & DETECT_CONTENT_NEGATED) + s->flags |= SIG_FLAG_MPM_HTTP_NEG; + + sgh->flags |= SIG_GROUP_HEAD_MPM_HMD; + + break; + } /* case DETECT_AL_HTTP_METHOD */ + + case DETECT_AL_HTTP_COOKIE: + { + hcd = (DetectContentData *)mpm_sm->ctx; + if (hcd->flags & DETECT_CONTENT_FAST_PATTERN_CHOP) { + /* add the content to the "hcd" mpm */ + if (hcd->flags & DETECT_CONTENT_NOCASE) { + mpm_table[sgh->mpm_hcd_ctx->mpm_type]. + AddPatternNocase(sgh->mpm_hcd_ctx, + hcd->content + hcd->fp_chop_offset, + hcd->fp_chop_len, + 0, 0, hcd->id, s->num, flags); + } else { + mpm_table[sgh->mpm_hcd_ctx->mpm_type]. + AddPattern(sgh->mpm_hcd_ctx, + hcd->content + hcd->fp_chop_offset, + hcd->fp_chop_len, + 0, 0, hcd->id, s->num, flags); + } + } else { + if (hcd->flags & DETECT_CONTENT_FAST_PATTERN_ONLY) { + if (DETECT_CONTENT_IS_SINGLE(hcd)) { + hcd->flags |= DETECT_CONTENT_HCD_MPM; + } - break; - } /* case DETECT_AL_HTTP_COOKIE */ - - case DETECT_AL_HTTP_RAW_URI: - { - hrud = (DetectContentData *)mpm_sm->ctx; - if (hrud->flags & DETECT_CONTENT_FAST_PATTERN_CHOP) { - /* add the content to the "hrud" mpm */ - if (hrud->flags & DETECT_CONTENT_NOCASE) { - mpm_table[sgh->mpm_hrud_ctx->mpm_type]. - AddPatternNocase(sgh->mpm_hrud_ctx, - hrud->content + hrud->fp_chop_offset, - hrud->fp_chop_len, - 0, 0, hrud->id, s->num, flags); - } else { - mpm_table[sgh->mpm_hrud_ctx->mpm_type]. - AddPattern(sgh->mpm_hrud_ctx, - hrud->content + hrud->fp_chop_offset, - hrud->fp_chop_len, - 0, 0, hrud->id, s->num, flags); + /* see if we can bypass the match validation for this pattern */ + } else { + if (DETECT_CONTENT_IS_SINGLE(hcd)) { + hcd->flags |= DETECT_CONTENT_HCD_MPM; } + } /* else - if (hcd->flags & DETECT_CONTENT_FAST_PATTERN_ONLY) */ + + /* add the content to the "hcd" mpm */ + if (hcd->flags & DETECT_CONTENT_NOCASE) { + mpm_table[sgh->mpm_hcd_ctx->mpm_type]. + AddPatternNocase(sgh->mpm_hcd_ctx, + hcd->content, hcd->content_len, + 0, 0, hcd->id, s->num, flags); } else { - if (hrud->flags & DETECT_CONTENT_FAST_PATTERN_ONLY) { - if (DETECT_CONTENT_IS_SINGLE(hrud)) { - hrud->flags |= DETECT_CONTENT_HRUD_MPM; - } + mpm_table[sgh->mpm_hcd_ctx->mpm_type]. + AddPattern(sgh->mpm_hcd_ctx, + hcd->content, hcd->content_len, + 0, 0, hcd->id, s->num, flags); + } + } + /* tell matcher we are inspecting cookie */ + s->flags |= SIG_FLAG_MPM_HTTP; + s->mpm_pattern_id_div_8 = hcd->id / 8; + s->mpm_pattern_id_mod_8 = 1 << (hcd->id % 8); + if (hcd->flags & DETECT_CONTENT_NEGATED) + s->flags |= SIG_FLAG_MPM_HTTP_NEG; + + sgh->flags |= SIG_GROUP_HEAD_MPM_HCD; + + break; + } /* case DETECT_AL_HTTP_COOKIE */ + + case DETECT_AL_HTTP_RAW_URI: + { + hrud = (DetectContentData *)mpm_sm->ctx; + if (hrud->flags & DETECT_CONTENT_FAST_PATTERN_CHOP) { + /* add the content to the "hrud" mpm */ + if (hrud->flags & DETECT_CONTENT_NOCASE) { + mpm_table[sgh->mpm_hrud_ctx->mpm_type]. + AddPatternNocase(sgh->mpm_hrud_ctx, + hrud->content + hrud->fp_chop_offset, + hrud->fp_chop_len, + 0, 0, hrud->id, s->num, flags); + } else { + mpm_table[sgh->mpm_hrud_ctx->mpm_type]. + AddPattern(sgh->mpm_hrud_ctx, + hrud->content + hrud->fp_chop_offset, + hrud->fp_chop_len, + 0, 0, hrud->id, s->num, flags); + } + } else { + if (hrud->flags & DETECT_CONTENT_FAST_PATTERN_ONLY) { + if (DETECT_CONTENT_IS_SINGLE(hrud)) { + hrud->flags |= DETECT_CONTENT_HRUD_MPM; + } - /* see if we can bypass the match validation for this pattern */ - } else { - if (DETECT_CONTENT_IS_SINGLE(hrud)) { - hrud->flags |= DETECT_CONTENT_HRUD_MPM; - } - } /* else - if (hrud->flags & DETECT_CONTENT_FAST_PATTERN_ONLY) */ - - /* add the content to the "hrud" mpm */ - if (hrud->flags & DETECT_CONTENT_NOCASE) { - mpm_table[sgh->mpm_hrud_ctx->mpm_type]. - AddPatternNocase(sgh->mpm_hrud_ctx, - hrud->content, hrud->content_len, - 0, 0, hrud->id, s->num, flags); - } else { - mpm_table[sgh->mpm_hrud_ctx->mpm_type]. - AddPattern(sgh->mpm_hrud_ctx, - hrud->content, hrud->content_len, - 0, 0, hrud->id, s->num, flags); + /* see if we can bypass the match validation for this pattern */ + } else { + if (DETECT_CONTENT_IS_SINGLE(hrud)) { + hrud->flags |= DETECT_CONTENT_HRUD_MPM; } + } /* else - if (hrud->flags & DETECT_CONTENT_FAST_PATTERN_ONLY) */ + + /* add the content to the "hrud" mpm */ + if (hrud->flags & DETECT_CONTENT_NOCASE) { + mpm_table[sgh->mpm_hrud_ctx->mpm_type]. + AddPatternNocase(sgh->mpm_hrud_ctx, + hrud->content, hrud->content_len, + 0, 0, hrud->id, s->num, flags); + } else { + mpm_table[sgh->mpm_hrud_ctx->mpm_type]. + AddPattern(sgh->mpm_hrud_ctx, + hrud->content, hrud->content_len, + 0, 0, hrud->id, s->num, flags); } - /* tell matcher we are inspecting raw uri */ - s->flags |= SIG_FLAG_MPM_HTTP; - s->mpm_pattern_id_div_8 = hrud->id / 8; - s->mpm_pattern_id_mod_8 = 1 << (hrud->id % 8); - if (hrud->flags & DETECT_CONTENT_NEGATED) - s->flags |= SIG_FLAG_MPM_HTTP_NEG; + } + /* tell matcher we are inspecting raw uri */ + s->flags |= SIG_FLAG_MPM_HTTP; + s->mpm_pattern_id_div_8 = hrud->id / 8; + s->mpm_pattern_id_mod_8 = 1 << (hrud->id % 8); + if (hrud->flags & DETECT_CONTENT_NEGATED) + s->flags |= SIG_FLAG_MPM_HTTP_NEG; - sgh->flags |= SIG_GROUP_HEAD_MPM_HRUD; + sgh->flags |= SIG_GROUP_HEAD_MPM_HRUD; - break; - } /* case DETECT_AL_HTTP_RAW_URI */ + break; + } /* case DETECT_AL_HTTP_RAW_URI */ - } /* switch (mpm_sm->type) */ + } /* switch (mpm_sm->type) */ - SCLogDebug("%"PRIu32" adding cd->id %"PRIu32" to the mpm phase " - "(s->num %"PRIu32")", s->id, - ((DetectContentData *)mpm_sm->ctx)->id, s->num); + SCLogDebug("%"PRIu32" adding cd->id %"PRIu32" to the mpm phase " + "(s->num %"PRIu32")", s->id, + ((DetectContentData *)mpm_sm->ctx)->id, s->num); return; }