|
|
|
@ -1686,7 +1686,6 @@ SigMatchData* SigMatchList2DataArray(SigMatch *head)
|
|
|
|
|
static int SigValidate(DetectEngineCtx *de_ctx, Signature *s)
|
|
|
|
|
{
|
|
|
|
|
uint32_t sig_flags = 0;
|
|
|
|
|
SigMatch *sm;
|
|
|
|
|
const int nlists = s->init_data->smlists_array_size;
|
|
|
|
|
|
|
|
|
|
SCEnter();
|
|
|
|
@ -1842,24 +1841,22 @@ static int SigValidate(DetectEngineCtx *de_ctx, Signature *s)
|
|
|
|
|
if (s->init_data->smlists[DETECT_SM_LIST_PMATCH]) {
|
|
|
|
|
if (!(s->flags & (SIG_FLAG_REQUIRE_PACKET | SIG_FLAG_REQUIRE_STREAM))) {
|
|
|
|
|
s->flags |= SIG_FLAG_REQUIRE_STREAM;
|
|
|
|
|
sm = s->init_data->smlists[DETECT_SM_LIST_PMATCH];
|
|
|
|
|
while (sm != NULL) {
|
|
|
|
|
for (SigMatch *sm = s->init_data->smlists[DETECT_SM_LIST_PMATCH]; sm != NULL;
|
|
|
|
|
sm = sm->next) {
|
|
|
|
|
if (sm->type == DETECT_CONTENT &&
|
|
|
|
|
(((DetectContentData *)(sm->ctx))->flags &
|
|
|
|
|
(DETECT_CONTENT_DEPTH | DETECT_CONTENT_OFFSET))) {
|
|
|
|
|
s->flags |= SIG_FLAG_REQUIRE_PACKET;
|
|
|
|
|
break;
|
|
|
|
|
}
|
|
|
|
|
sm = sm->next;
|
|
|
|
|
}
|
|
|
|
|
/* if stream_size is in use, also inspect packets */
|
|
|
|
|
sm = s->init_data->smlists[DETECT_SM_LIST_MATCH];
|
|
|
|
|
while (sm != NULL) {
|
|
|
|
|
for (SigMatch *sm = s->init_data->smlists[DETECT_SM_LIST_MATCH]; sm != NULL;
|
|
|
|
|
sm = sm->next) {
|
|
|
|
|
if (sm->type == DETECT_STREAM_SIZE) {
|
|
|
|
|
s->flags |= SIG_FLAG_REQUIRE_PACKET;
|
|
|
|
|
break;
|
|
|
|
|
}
|
|
|
|
|
sm = sm->next;
|
|
|
|
|
}
|
|
|
|
|
}
|
|
|
|
|
}
|
|
|
|
@ -1893,10 +1890,9 @@ static int SigValidate(DetectEngineCtx *de_ctx, Signature *s)
|
|
|
|
|
#endif
|
|
|
|
|
|
|
|
|
|
#ifdef DEBUG
|
|
|
|
|
int i;
|
|
|
|
|
for (i = 0; i < nlists; i++) {
|
|
|
|
|
for (int i = 0; i < nlists; i++) {
|
|
|
|
|
if (s->init_data->smlists[i] != NULL) {
|
|
|
|
|
for (sm = s->init_data->smlists[i]; sm != NULL; sm = sm->next) {
|
|
|
|
|
for (SigMatch *sm = s->init_data->smlists[i]; sm != NULL; sm = sm->next) {
|
|
|
|
|
BUG_ON(sm == sm->prev);
|
|
|
|
|
BUG_ON(sm == sm->next);
|
|
|
|
|
}
|
|
|
|
|