Add post-match list, move flowbits set, etc functions to it. Move flowint set, etc functions to it as well.

src/detect-flowbits.c

@@ -208,7 +208,7 @@ int DetectFlowbitSetup (DetectEngineCtx *de_ctx, Signature *s, char *rawstr)
         goto error;
     }
 
-    switch(fb_cmd)  {
+    switch (fb_cmd) {
         case DETECT_FLOWBITS_CMD_NOALERT:
             if(fb_name != NULL)
                 goto error;
@@ -249,7 +249,23 @@ int DetectFlowbitSetup (DetectEngineCtx *de_ctx, Signature *s, char *rawstr)
     sm->type = DETECT_FLOWBITS;
     sm->ctx = (void *)cd;
 
-    SigMatchAppendPacket(s, sm);
+    switch (fb_cmd) {
+        case DETECT_FLOWBITS_CMD_NOALERT:
+            /* nothing to do */
+            break;
+
+        case DETECT_FLOWBITS_CMD_ISNOTSET:
+        case DETECT_FLOWBITS_CMD_ISSET:
+            /* checks, so packet list */
+            SigMatchAppendPacket(s, sm);
+
+        case DETECT_FLOWBITS_CMD_SET:
+        case DETECT_FLOWBITS_CMD_UNSET:
+        case DETECT_FLOWBITS_CMD_TOGGLE:
+            /* modifiers, only run when entire sig has matched */
+            SigMatchAppendPostMatch(s, sm);
+            break;
+    }
 
     return 0;
 

src/detect-flowint.c

@@ -375,7 +375,24 @@ static int DetectFlowintSetup(DetectEngineCtx *de_ctx, Signature *s, char *rawst
     sm->type = DETECT_FLOWINT;
     sm->ctx = (void *)sfd;
 
-    SigMatchAppendPacket(s, sm);
+    switch (sfd->modifier) {
+        case FLOWINT_MODIFIER_SET:
+        case FLOWINT_MODIFIER_ADD:
+        case FLOWINT_MODIFIER_SUB:
+            SigMatchAppendPostMatch(s, sm);
+            break;
+
+        case FLOWINT_MODIFIER_LT:
+        case FLOWINT_MODIFIER_LE:
+        case FLOWINT_MODIFIER_NE:
+        case FLOWINT_MODIFIER_EQ:
+        case FLOWINT_MODIFIER_GE:
+        case FLOWINT_MODIFIER_GT:
+        case FLOWINT_MODIFIER_ISSET:
+        case FLOWINT_MODIFIER_NOTSET:
+            SigMatchAppendPacket(s, sm);
+            break;
+    }
 
     return 0;
 

src/detect-parse.c

@@ -327,6 +327,32 @@ void SigMatchAppendPacket(Signature *s, SigMatch *new) {
     s->sm_cnt++;
 }
 
+/** \brief Append a sig match to the signatures post-match list
+ *
+ *  \param s signature
+ *  \param new sigmatch to append
+ */
+void SigMatchAppendPostMatch(Signature *s, SigMatch *new) {
+    if (s->sm_lists[DETECT_SM_LIST_POSTMATCH] == NULL) {
+        s->sm_lists[DETECT_SM_LIST_POSTMATCH] = new;
+        s->sm_lists_tail[DETECT_SM_LIST_POSTMATCH] = new;
+        new->next = NULL;
+        new->prev = NULL;
+    } else {
+        SigMatch *cur = s->sm_lists[DETECT_SM_LIST_POSTMATCH];
+
+        for ( ; cur->next != NULL; cur = cur->next);
+
+        cur->next = new;
+        new->next = NULL;
+        new->prev = cur;
+        s->sm_lists_tail[DETECT_SM_LIST_POSTMATCH] = new;
+    }
+
+    new->idx = s->sm_cnt;
+    s->sm_cnt++;
+}
+
 /** \brief Pull a content 'old' from the pmatch list, append 'new' to amatch list.
   * Used for replacing contents that have http_cookie, etc modifiers.
   */

src/detect-parse.h

@@ -60,6 +60,7 @@ void SigMatchReplaceContentToUricontent(Signature *, SigMatch *, SigMatch *);
 void SigMatchAppendPayload(Signature *, SigMatch *);
 void SigMatchAppendDcePayload(Signature *, SigMatch *);
 void SigMatchAppendPacket(Signature *, SigMatch *);
+void SigMatchAppendPostMatch(Signature *, SigMatch *);
 void SigMatchAppendUricontent(Signature *, SigMatch *);
 void SigMatchAppendAppLayer(Signature *, SigMatch *);
 void SigMatchAppendTag(Signature *, SigMatch *);

src/detect.c

@@ -944,6 +944,28 @@ static void SigMatchSignaturesBuildMatchArray(DetectEngineThreadCtx *det_ctx,
 #endif
 }
 
+static int SigMatchSignaturesRunPostMatch(ThreadVars *tv,
+        DetectEngineCtx *de_ctx, DetectEngineThreadCtx *det_ctx, Packet *p,
+        Signature *s)
+{
+    /* run the packet match functions */
+    if (s->sm_lists[DETECT_SM_LIST_POSTMATCH] != NULL) {
+        SigMatch *sm = s->sm_lists[DETECT_SM_LIST_POSTMATCH];
+
+        SCLogDebug("running match functions, sm %p", sm);
+
+        for ( ; sm != NULL; sm = sm->next) {
+            (void)sigmatch_table[sm->type].Match(tv, det_ctx, p, s, sm);
+        }
+    }
+
+    DetectReplaceExecute(p, det_ctx->replist);
+    det_ctx->replist = NULL;
+    DetectFilestorePostMatch(tv, det_ctx,p);
+
+    return 1;
+}
+
 /**
  *  \brief Get the SigGroupHead for a packet.
  *
@@ -1638,9 +1660,8 @@ int SigMatchSignatures(ThreadVars *th_v, DetectEngineCtx *de_ctx, DetectEngineTh
 
         /* match! */
         fmatch = 1;
-        DetectReplaceExecute(p, det_ctx->replist);
-        det_ctx->replist = NULL;
-        DetectFilestorePostMatch(th_v, det_ctx,p);
+
+        SigMatchSignaturesRunPostMatch(th_v, de_ctx, det_ctx, p, s);
 
         if (!(s->flags & SIG_FLAG_NOALERT)) {
             PacketAlertAppend(det_ctx, s, p, alert_flags, alert_msg);

src/detect.h

@@ -102,6 +102,8 @@ enum {
     DETECT_SM_LIST_HRUDMATCH,
 
     DETECT_SM_LIST_FILEMATCH,
+
+    DETECT_SM_LIST_POSTMATCH,
     DETECT_SM_LIST_MAX,
 };