From 75cddabd8a802c3578d00bf91bc6dd6160c56110 Mon Sep 17 00:00:00 2001 From: Victor Julien Date: Thu, 4 Oct 2012 11:48:42 +0200 Subject: [PATCH] fast_pattern: don't consider http_method, http_stat_code and http_stat_msg when automatically giving preference to a HTTP pattern over a stream pattern. --- src/detect-engine-mpm.c | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-) diff --git a/src/detect-engine-mpm.c b/src/detect-engine-mpm.c index d921de34ee..595dd21256 100644 --- a/src/detect-engine-mpm.c +++ b/src/detect-engine-mpm.c @@ -1720,7 +1720,12 @@ static int PatternMatchPreparePopulateMpm(DetectEngineCtx *de_ctx, DetectContentData *cd = (DetectContentData *)sm->ctx; if (!(cd->flags & DETECT_CONTENT_NEGATED) && - list_id != DETECT_SM_LIST_PMATCH) { + list_id != DETECT_SM_LIST_PMATCH && + /* don't consider http_method, http_stat_msg, http_stat_code + * to automatically override longest stream match */ + list_id != DETECT_SM_LIST_HMDMATCH && + list_id != DETECT_SM_LIST_HSMDMATCH && + list_id != DETECT_SM_LIST_HSCDMATCH) { has_non_negated_non_stream_pattern[sig] = 1; }