Load signatures with incompatible fast_pattern option (due to design differences for optimization)

remotes/origin/master-1.0.x
Pablo Rincon 16 years ago committed by Victor Julien
parent 50eb3cba6a
commit 693d4f54eb

@ -74,9 +74,13 @@ static int DetectFastPatternSetup(DetectEngineCtx *de_ctx, Signature *s, char *n
}
if (s->pmatch_tail == NULL) {
SCLogError(SC_ERR_INVALID_SIGNATURE, "fast_pattern found inside the "
"rule, without any preceding keywords");
return -1;
SCLogWarning(SC_WARN_COMPATIBILITY, " a fast_pattern found inside the "
"rule, is not preceding a keyword that support (currently)"
" this optimization. At least, the engine support "
"fast_pattern for content (not for uricontent yet). "
"The signature is being loaded anyway ==> %s",
s->sig_str);
return 0;
}
SigMatch *pm = DetectContentGetLastPattern(s->pmatch_tail);

@ -912,6 +912,7 @@ int SigParse(DetectEngineCtx *de_ctx, Signature *s, char *sigstr, uint8_t addrs_
SCEnter();
char **basics;
s->sig_str = sigstr;
int ret = SigParseBasics(s, sigstr, &basics, addrs_direction);
if (ret < 0) {
@ -944,6 +945,8 @@ int SigParse(DetectEngineCtx *de_ctx, Signature *s, char *sigstr, uint8_t addrs_
SCFree(basics);
}
s->sig_str = NULL;
SCReturnInt(ret);
}

@ -312,6 +312,10 @@ typedef struct Signature_ {
/** Reference */
Reference *references;
/* Be careful, this pointer is only valid while parsing the sig,
* to warn the user about any possible problem */
char *sig_str;
#ifdef PROFILING
uint16_t profiling_id;
#endif

@ -187,6 +187,7 @@ const char * SCErrorToString(SCError err)
CASE_CODE (SC_ERR_ERF_DAG_STREAM_SET_FAILED);
CASE_CODE (SC_ERR_ERF_DAG_STREAM_READ_FAILED);
CASE_CODE (SC_WARN_ERF_DAG_REC_LEN_CHANGED);
CASE_CODE (SC_WARN_COMPATIBILITY);
CASE_CODE (SC_ERR_DCERPC);
default:

@ -188,6 +188,7 @@ typedef enum {
SC_ERR_LIBCAP_NG_REQUIRED,
SC_ERR_LIBNET11_INCOMPATIBLE_WITH_LIBCAP_NG,
SC_WARN_FLOW_EMERGENCY,
SC_WARN_COMPATIBILITY,
SC_ERR_SVC,
SC_ERR_ERF_DAG_OPEN_FAILED,
SC_ERR_ERF_DAG_STREAM_OPEN_FAILED,

Loading…
Cancel
Save