From 4f1befd217d7ba30424be91306b6563a34f79ba6 Mon Sep 17 00:00:00 2001 From: Victor Julien Date: Thu, 9 Aug 2018 17:35:32 +0200 Subject: [PATCH] detect/prefilter: fix prefilter when setting is 'mpm' When prefilter is not enabled globally, it is still possible to enable it per signature. This was broken however, as the setup code would never be called. This commit always call the setup code and lets that sort out which signatures (if any) to enable prefiltering for. --- src/detect-engine-prefilter.c | 13 ++++++------- 1 file changed, 6 insertions(+), 7 deletions(-) diff --git a/src/detect-engine-prefilter.c b/src/detect-engine-prefilter.c index f9075ba8d4..e0b04159b7 100644 --- a/src/detect-engine-prefilter.c +++ b/src/detect-engine-prefilter.c @@ -348,13 +348,12 @@ void PrefilterSetupRuleGroup(DetectEngineCtx *de_ctx, SigGroupHead *sgh) { BUG_ON(PatternMatchPrepareGroup(de_ctx, sgh) != 0); - if (de_ctx->prefilter_setting == DETECT_PREFILTER_AUTO) { - int i = 0; - for (i = 0; i < DETECT_TBLSIZE; i++) - { - if (sigmatch_table[i].SetupPrefilter != NULL) { - sigmatch_table[i].SetupPrefilter(de_ctx, sgh); - } + /* set up engines if needed - independent of 'detect.prefilter.default' + * setting as the prefilter keyword may have enabled individual sigs */ + for (int i = 0; i < DETECT_TBLSIZE; i++) + { + if (sigmatch_table[i].SetupPrefilter != NULL) { + sigmatch_table[i].SetupPrefilter(de_ctx, sgh); } }