|
|
@ -1420,22 +1420,11 @@ Signature *SigInit(DetectEngineCtx *de_ctx, char *sigstr) {
|
|
|
|
sig->num = de_ctx->signum;
|
|
|
|
sig->num = de_ctx->signum;
|
|
|
|
de_ctx->signum++;
|
|
|
|
de_ctx->signum++;
|
|
|
|
|
|
|
|
|
|
|
|
/* see if need to set the SIG_FLAG_MPM flag */
|
|
|
|
|
|
|
|
SigMatch *sm;
|
|
|
|
SigMatch *sm;
|
|
|
|
for (sm = sig->sm_lists[DETECT_SM_LIST_PMATCH]; sm != NULL; sm = sm->next) {
|
|
|
|
|
|
|
|
if (sm->type == DETECT_CONTENT) {
|
|
|
|
|
|
|
|
DetectContentData *cd = (DetectContentData *)sm->ctx;
|
|
|
|
|
|
|
|
if (cd == NULL)
|
|
|
|
|
|
|
|
continue;
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
sig->flags |= SIG_FLAG_MPM;
|
|
|
|
|
|
|
|
}
|
|
|
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
/* set mpm_content_len */
|
|
|
|
/* set mpm_content_len */
|
|
|
|
|
|
|
|
|
|
|
|
/* determine the length of the longest pattern in the sig */
|
|
|
|
/* determine the length of the longest pattern in the sig */
|
|
|
|
if (sig->flags & SIG_FLAG_MPM) {
|
|
|
|
if (sig->sm_lists[DETECT_SM_LIST_PMATCH] != NULL) {
|
|
|
|
sig->mpm_content_maxlen = 0;
|
|
|
|
sig->mpm_content_maxlen = 0;
|
|
|
|
|
|
|
|
|
|
|
|
for (sm = sig->sm_lists[DETECT_SM_LIST_PMATCH]; sm != NULL; sm = sm->next) {
|
|
|
|
for (sm = sig->sm_lists[DETECT_SM_LIST_PMATCH]; sm != NULL; sm = sm->next) {
|
|
|
@ -1566,22 +1555,11 @@ Signature *SigInitReal(DetectEngineCtx *de_ctx, char *sigstr) {
|
|
|
|
sig->num = de_ctx->signum;
|
|
|
|
sig->num = de_ctx->signum;
|
|
|
|
de_ctx->signum++;
|
|
|
|
de_ctx->signum++;
|
|
|
|
|
|
|
|
|
|
|
|
/* see if need to set the SIG_FLAG_MPM flag */
|
|
|
|
|
|
|
|
SigMatch *sm;
|
|
|
|
SigMatch *sm;
|
|
|
|
for (sm = sig->sm_lists[DETECT_SM_LIST_PMATCH]; sm != NULL; sm = sm->next) {
|
|
|
|
|
|
|
|
if (sm->type == DETECT_CONTENT) {
|
|
|
|
|
|
|
|
DetectContentData *cd = (DetectContentData *)sm->ctx;
|
|
|
|
|
|
|
|
if (cd == NULL)
|
|
|
|
|
|
|
|
continue;
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
sig->flags |= SIG_FLAG_MPM;
|
|
|
|
|
|
|
|
}
|
|
|
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
/* set mpm_content_len */
|
|
|
|
/* set mpm_content_len */
|
|
|
|
|
|
|
|
|
|
|
|
/* determine the length of the longest pattern in the sig */
|
|
|
|
/* determine the length of the longest pattern in the sig */
|
|
|
|
if (sig->flags & SIG_FLAG_MPM) {
|
|
|
|
if (sig->sm_lists[DETECT_SM_LIST_PMATCH] != NULL) {
|
|
|
|
sig->mpm_content_maxlen = 0;
|
|
|
|
sig->mpm_content_maxlen = 0;
|
|
|
|
|
|
|
|
|
|
|
|
for (sm = sig->sm_lists[DETECT_SM_LIST_PMATCH]; sm != NULL; sm = sm->next) {
|
|
|
|
for (sm = sig->sm_lists[DETECT_SM_LIST_PMATCH]; sm != NULL; sm = sm->next) {
|
|
|
@ -1632,7 +1610,7 @@ Signature *SigInitReal(DetectEngineCtx *de_ctx, char *sigstr) {
|
|
|
|
/* set mpm_content_len */
|
|
|
|
/* set mpm_content_len */
|
|
|
|
|
|
|
|
|
|
|
|
/* determine the length of the longest pattern in the sig */
|
|
|
|
/* determine the length of the longest pattern in the sig */
|
|
|
|
if (sig->next->flags & SIG_FLAG_MPM) {
|
|
|
|
if (sig->next->sm_lists[DETECT_SM_LIST_PMATCH] != NULL) {
|
|
|
|
sig->next->mpm_content_maxlen = 0;
|
|
|
|
sig->next->mpm_content_maxlen = 0;
|
|
|
|
|
|
|
|
|
|
|
|
SigMatch *sm;
|
|
|
|
SigMatch *sm;
|
|
|
@ -3213,8 +3191,8 @@ int SigParseTestMpm01 (void) {
|
|
|
|
goto end;
|
|
|
|
goto end;
|
|
|
|
}
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
|
|
if (!(sig->flags & SIG_FLAG_MPM)) {
|
|
|
|
if (sig->sm_lists[DETECT_SM_LIST_PMATCH] == NULL) {
|
|
|
|
printf("sig doesn't have mpm flag set: ");
|
|
|
|
printf("sig doesn't have content list: ");
|
|
|
|
goto end;
|
|
|
|
goto end;
|
|
|
|
}
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
|
@ -3253,8 +3231,8 @@ int SigParseTestMpm02 (void) {
|
|
|
|
goto end;
|
|
|
|
goto end;
|
|
|
|
}
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
|
|
if (!(sig->flags & SIG_FLAG_MPM)) {
|
|
|
|
if (sig->sm_lists[DETECT_SM_LIST_PMATCH] == NULL) {
|
|
|
|
printf("sig doesn't have mpm flag set: ");
|
|
|
|
printf("sig doesn't have content list: ");
|
|
|
|
goto end;
|
|
|
|
goto end;
|
|
|
|
}
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
|
|