4 Commits (4705314fd2741ac0b375b822706da7f34810e37c)

Author	SHA1	Message	Date
Victor Julien	6a5084ccf9	detect/parse: set the type of signature early ... This way we can know much sooner if the rule is ip-only or not.	6 years ago
Victor Julien	af51e0f5a1	detect: rewrite of the detect engine ... Use per tx detect_flags to track prefilter. Detect flags are used for 2 things: 1. marking tx as fully inspected 2. tracking already run prefilter (incl mpm) engines This supercedes the MpmIDs API for directionless tracking of the prefilter engines. When we have no SGH we have to flag the txs that are 'complete' as inspected as well. Special handling for the stream engine: If a rule mixes TX inspection and STREAM inspection, we can encounter the case where the rule is evaluated against multiple transactions during a single inspection run. As the stream data is exactly the same for each of those runs, it's wasteful to rerun inspection of the stream portion of the rule. This patch enables caching of the stream 'inspect engine' result in the local 'RuleMatchCandidateTx' array. This is valid only during the live of a single inspection run. Remove stateful inspection from 'mask' (SignatureMask). The mask wasn't used in most cases for those rules anyway, as there we rely on the prefilter. Add a alproto check to catch the remaining cases. When building the active non-mpm/non-prefilter list check not just the mask, but also the alproto. This especially helps stateful rules with negated mpm. Simplify AppLayerParserHasDecoderEvents usage in detection to only return true if protocol detection events are set. Other detection is done in inspect engines. Move rule group lookup and handling into it's own function. Handle 'post lookup' tasks immediately, instead of after the first detect run. The tasks were independent of the initial detection. Many cleanups and much refactoring.	7 years ago
Victor Julien	948dee9a98	app-layer: use bool for 'HasDecoderEvents'	7 years ago
Victor Julien	90569d5fd6	detect: move grouping/building code into own file ... Clean up main detect.c file by moving things related to rule grouping out.	7 years ago