|
|
|
|
@ -671,6 +671,42 @@ static void SetMpm(Signature *s, SigMatch *mpm_sm)
|
|
|
|
|
return;
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
static SigMatch *GetMpmForList(const Signature *s, const int list, SigMatch *mpm_sm,
|
|
|
|
|
uint16_t max_len, bool skip_negated_content)
|
|
|
|
|
{
|
|
|
|
|
for (SigMatch *sm = s->init_data->smlists[list]; sm != NULL; sm = sm->next) {
|
|
|
|
|
if (sm->type != DETECT_CONTENT)
|
|
|
|
|
continue;
|
|
|
|
|
|
|
|
|
|
const DetectContentData *cd = (DetectContentData *)sm->ctx;
|
|
|
|
|
/* skip_negated_content is only set if there's absolutely no
|
|
|
|
|
* non-negated content present in the sig */
|
|
|
|
|
if ((cd->flags & DETECT_CONTENT_NEGATED) && skip_negated_content)
|
|
|
|
|
continue;
|
|
|
|
|
if (cd->content_len != max_len)
|
|
|
|
|
continue;
|
|
|
|
|
|
|
|
|
|
if (mpm_sm == NULL) {
|
|
|
|
|
mpm_sm = sm;
|
|
|
|
|
} else {
|
|
|
|
|
DetectContentData *data1 = (DetectContentData *)sm->ctx;
|
|
|
|
|
DetectContentData *data2 = (DetectContentData *)mpm_sm->ctx;
|
|
|
|
|
uint32_t ls = PatternStrength(data1->content, data1->content_len);
|
|
|
|
|
uint32_t ss = PatternStrength(data2->content, data2->content_len);
|
|
|
|
|
if (ls > ss) {
|
|
|
|
|
mpm_sm = sm;
|
|
|
|
|
} else if (ls == ss) {
|
|
|
|
|
/* if 2 patterns are of equal strength, we pick the longest */
|
|
|
|
|
if (data1->content_len > data2->content_len)
|
|
|
|
|
mpm_sm = sm;
|
|
|
|
|
} else {
|
|
|
|
|
SCLogDebug("sticking with mpm_sm");
|
|
|
|
|
}
|
|
|
|
|
}
|
|
|
|
|
}
|
|
|
|
|
return mpm_sm;
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
void RetrieveFPForSig(const DetectEngineCtx *de_ctx, Signature *s)
|
|
|
|
|
{
|
|
|
|
|
if (s->init_data->mpm_sm != NULL)
|
|
|
|
|
@ -774,36 +810,7 @@ void RetrieveFPForSig(const DetectEngineCtx *de_ctx, Signature *s)
|
|
|
|
|
if (final_sm_list[i] >= (int)s->init_data->smlists_array_size)
|
|
|
|
|
continue;
|
|
|
|
|
|
|
|
|
|
for (sm = s->init_data->smlists[final_sm_list[i]]; sm != NULL; sm = sm->next) {
|
|
|
|
|
if (sm->type != DETECT_CONTENT)
|
|
|
|
|
continue;
|
|
|
|
|
|
|
|
|
|
const DetectContentData *cd = (DetectContentData *)sm->ctx;
|
|
|
|
|
/* skip_negated_content is only set if there's absolutely no
|
|
|
|
|
* non-negated content present in the sig */
|
|
|
|
|
if ((cd->flags & DETECT_CONTENT_NEGATED) && skip_negated_content)
|
|
|
|
|
continue;
|
|
|
|
|
if (cd->content_len != max_len)
|
|
|
|
|
continue;
|
|
|
|
|
|
|
|
|
|
if (mpm_sm == NULL) {
|
|
|
|
|
mpm_sm = sm;
|
|
|
|
|
} else {
|
|
|
|
|
DetectContentData *data1 = (DetectContentData *)sm->ctx;
|
|
|
|
|
DetectContentData *data2 = (DetectContentData *)mpm_sm->ctx;
|
|
|
|
|
uint32_t ls = PatternStrength(data1->content, data1->content_len);
|
|
|
|
|
uint32_t ss = PatternStrength(data2->content, data2->content_len);
|
|
|
|
|
if (ls > ss) {
|
|
|
|
|
mpm_sm = sm;
|
|
|
|
|
} else if (ls == ss) {
|
|
|
|
|
/* if 2 patterns are of equal strength, we pick the longest */
|
|
|
|
|
if (data1->content_len > data2->content_len)
|
|
|
|
|
mpm_sm = sm;
|
|
|
|
|
} else {
|
|
|
|
|
SCLogDebug("sticking with mpm_sm");
|
|
|
|
|
}
|
|
|
|
|
}
|
|
|
|
|
}
|
|
|
|
|
mpm_sm = GetMpmForList(s, final_sm_list[i], mpm_sm, max_len, skip_negated_content);
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
/* assign to signature */
|
|
|
|
|
|