detect/prefilter: fix alias for fast_pattern

If prefilter is used on a content keyword, it acts as a simple
fast_pattern statement. This was broken because the SIG_FLAG_PREFILTER
flag bypasses MPM for a sig. This commits fixes this by not setting
the flag when it should act as fast_pattern.
pull/3451/head
Victor Julien 7 years ago
parent 35c5ae3458
commit 0b5d8a1d75

@ -59,27 +59,23 @@ static int DetectPrefilterSetup (DetectEngineCtx *de_ctx, Signature *s, const ch
{ {
SCEnter(); SCEnter();
SigMatch *sm = NULL;
int ret = -1;
if (nullstr != NULL) { if (nullstr != NULL) {
SCLogError(SC_ERR_INVALID_VALUE, "prefilter has value"); SCLogError(SC_ERR_INVALID_VALUE, "prefilter has value");
goto end; SCReturnInt(-1);
} }
if (s->flags & SIG_FLAG_PREFILTER) { if (s->flags & SIG_FLAG_PREFILTER) {
SCLogError(SC_ERR_INVALID_SIGNATURE, "prefilter already set"); SCLogError(SC_ERR_INVALID_SIGNATURE, "prefilter already set");
goto end; SCReturnInt(-1);
} }
sm = DetectGetLastSM(s); SigMatch *sm = DetectGetLastSM(s);
if (sm == NULL) { if (sm == NULL) {
SCLogError(SC_ERR_INVALID_SIGNATURE, "prefilter needs preceding match"); SCLogError(SC_ERR_INVALID_SIGNATURE, "prefilter needs preceding match");
goto end; SCReturnInt(-1);
} }
s->init_data->prefilter_sm = sm; s->init_data->prefilter_sm = sm;
s->flags |= SIG_FLAG_PREFILTER;
/* if the sig match is content, prefilter should act like /* if the sig match is content, prefilter should act like
* 'fast_pattern' w/o options. */ * 'fast_pattern' w/o options. */
@ -93,12 +89,12 @@ static int DetectPrefilterSetup (DetectEngineCtx *de_ctx, Signature *s, const ch
{ {
SCLogError(SC_ERR_INVALID_SIGNATURE, "prefilter; cannot be " SCLogError(SC_ERR_INVALID_SIGNATURE, "prefilter; cannot be "
"used with negated content, along with relative modifiers"); "used with negated content, along with relative modifiers");
goto end; SCReturnInt(-1);
} }
cd->flags |= DETECT_CONTENT_FAST_PATTERN; cd->flags |= DETECT_CONTENT_FAST_PATTERN;
} else {
s->flags |= SIG_FLAG_PREFILTER;
} }
ret = 0; SCReturnInt(0);
end:
SCReturnInt(ret);
} }

Loading…
Cancel
Save