From df6b985f3cb6c2f30ae5c32a25888187be8332ca Mon Sep 17 00:00:00 2001 From: Victor Julien Date: Thu, 9 Aug 2018 17:35:32 +0200 Subject: [PATCH] detect/prefilter: fix prefilter when setting is 'mpm' When prefilter is not enabled globally, it is still possible to enable it per signature. This was broken however, as the setup code would never be called. This commit always call the setup code and lets that sort out which signatures (if any) to enable prefiltering for. --- src/detect-engine-prefilter.c | 13 ++++++------- 1 file changed, 6 insertions(+), 7 deletions(-) diff --git a/src/detect-engine-prefilter.c b/src/detect-engine-prefilter.c index 5478902cf4..b289bc1369 100644 --- a/src/detect-engine-prefilter.c +++ b/src/detect-engine-prefilter.c @@ -380,13 +380,12 @@ void PrefilterSetupRuleGroup(DetectEngineCtx *de_ctx, SigGroupHead *sgh) { BUG_ON(PatternMatchPrepareGroup(de_ctx, sgh) != 0); - if (de_ctx->prefilter_setting == DETECT_PREFILTER_AUTO) { - int i = 0; - for (i = 0; i < DETECT_TBLSIZE; i++) - { - if (sigmatch_table[i].SetupPrefilter != NULL) { - sigmatch_table[i].SetupPrefilter(sgh); - } + /* set up engines if needed - independent of 'detect.prefilter.default' + * setting as the prefilter keyword may have enabled individual sigs */ + for (int i = 0; i < DETECT_TBLSIZE; i++) + { + if (sigmatch_table[i].SetupPrefilter != NULL) { + sigmatch_table[i].SetupPrefilter(sgh); } }