From a492518e7a47d1a1b3b8c3b670bab4b831d8ef21 Mon Sep 17 00:00:00 2001 From: Victor Julien Date: Thu, 29 Jul 2010 11:19:00 +0200 Subject: [PATCH] Properly detect detect-event-only sigs. --- src/detect.c | 11 ++++++++--- 1 file changed, 8 insertions(+), 3 deletions(-) diff --git a/src/detect.c b/src/detect.c index 4b510c9020..0143482fe9 100644 --- a/src/detect.c +++ b/src/detect.c @@ -1335,14 +1335,19 @@ static int SignatureIsDEOnly(DetectEngineCtx *de_ctx, Signature *s) { } SigMatch *sm = s->match; - if (sm == NULL) - goto deonly; - + /* check for conflicting keywords */ for ( ;sm != NULL; sm = sm->next) { if ( !(sigmatch_table[sm->type].flags & SIGMATCH_DEONLY_COMPAT)) return 0; } + /* need at least one decode event keyword to be condered decode event. */ + for ( ;sm != NULL; sm = sm->next) { + if (sm->type == DETECT_DECODE_EVENT) + goto deonly; + } + return 0; + deonly: if (!(de_ctx->flags & DE_QUIET)) { SCLogDebug("DE-ONLY (%" PRIu32 "): source %s, dest %s", s->id,