aiden
/
suricata
mirror of https://github.com/OISF/suricata
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

detect-engine: do a direct update of flag

Browse Source 
There is no reason not to update the flag directly. So do it
to avoid to crash the test.
pull/421/merge
Eric Leblond 13 years ago committed by Victor Julien
parent 9212ff7e59
commit 150cd39c6e
1 changed files with 42 additions and 45 deletions
Show Stats Download Patch File Download Diff File

87
src/detect-engine-mpm.c
Unescape Escape View File

@ -1442,116 +1442,115 @@ static void PopulateMpmAddPatternToMpm(DetectEngineCtx *de_ctx,
MpmCtx *mpm_ctx_ts = NULL; MpmCtx *mpm_ctx_ts = NULL;
MpmCtx *mpm_ctx_tc = NULL; MpmCtx *mpm_ctx_tc = NULL;
uint32_t sgh_flags = 0; uint32_t sgh_flags = 0;
uint32_t sig_flags = 0;
cd = (DetectContentData *)mpm_sm->ctx; cd = (DetectContentData *)mpm_sm->ctx;
if (sm_list == DETECT_SM_LIST_UMATCH) { if (sm_list == DETECT_SM_LIST_UMATCH) {
if (s->flags & SIG_FLAG_TOSERVER) if (s->flags & SIG_FLAG_TOSERVER)
mpm_ctx_ts = sgh->mpm_uri_ctx_ts; mpm_ctx_ts = sgh->mpm_uri_ctx_ts;
sgh_flags = SIG_GROUP_HEAD_MPM_URI; sgh->flags = SIG_GROUP_HEAD_MPM_URI;
sig_flags |= SIG_FLAG_MPM_APPLAYER; s->flags |= SIG_FLAG_MPM_APPLAYER;
if (cd->flags & DETECT_CONTENT_NEGATED) if (cd->flags & DETECT_CONTENT_NEGATED)
sig_flags |= SIG_FLAG_MPM_APPLAYER_NEG; s->flags |= SIG_FLAG_MPM_APPLAYER_NEG;
} else if (sm_list == DETECT_SM_LIST_HCBDMATCH) { } else if (sm_list == DETECT_SM_LIST_HCBDMATCH) {
if (s->flags & SIG_FLAG_TOSERVER) if (s->flags & SIG_FLAG_TOSERVER)
mpm_ctx_ts = sgh->mpm_hcbd_ctx_ts; mpm_ctx_ts = sgh->mpm_hcbd_ctx_ts;
sgh_flags = SIG_GROUP_HEAD_MPM_HCBD; sgh->flags = SIG_GROUP_HEAD_MPM_HCBD;
sig_flags |= SIG_FLAG_MPM_APPLAYER; s->flags |= SIG_FLAG_MPM_APPLAYER;
if (cd->flags & DETECT_CONTENT_NEGATED) if (cd->flags & DETECT_CONTENT_NEGATED)
sig_flags |= SIG_FLAG_MPM_APPLAYER_NEG; s->flags |= SIG_FLAG_MPM_APPLAYER_NEG;
} else if (sm_list == DETECT_SM_LIST_HSBDMATCH) { } else if (sm_list == DETECT_SM_LIST_HSBDMATCH) {
if (s->flags & SIG_FLAG_TOCLIENT) if (s->flags & SIG_FLAG_TOCLIENT)
mpm_ctx_tc = sgh->mpm_hsbd_ctx_tc; mpm_ctx_tc = sgh->mpm_hsbd_ctx_tc;
sgh_flags = SIG_GROUP_HEAD_MPM_HSBD; sgh->flags = SIG_GROUP_HEAD_MPM_HSBD;
sig_flags |= SIG_FLAG_MPM_APPLAYER; s->flags |= SIG_FLAG_MPM_APPLAYER;
if (cd->flags & DETECT_CONTENT_NEGATED) if (cd->flags & DETECT_CONTENT_NEGATED)
sig_flags |= SIG_FLAG_MPM_APPLAYER_NEG; s->flags |= SIG_FLAG_MPM_APPLAYER_NEG;
} else if (sm_list == DETECT_SM_LIST_HHDMATCH) { } else if (sm_list == DETECT_SM_LIST_HHDMATCH) {
if (s->flags & SIG_FLAG_TOSERVER) if (s->flags & SIG_FLAG_TOSERVER)
mpm_ctx_ts = sgh->mpm_hhd_ctx_ts; mpm_ctx_ts = sgh->mpm_hhd_ctx_ts;
if (s->flags & SIG_FLAG_TOCLIENT) if (s->flags & SIG_FLAG_TOCLIENT)
mpm_ctx_tc = sgh->mpm_hhd_ctx_tc; mpm_ctx_tc = sgh->mpm_hhd_ctx_tc;
sgh_flags = SIG_GROUP_HEAD_MPM_HHD; sgh->flags = SIG_GROUP_HEAD_MPM_HHD;
sig_flags |= SIG_FLAG_MPM_APPLAYER; s->flags |= SIG_FLAG_MPM_APPLAYER;
if (cd->flags & DETECT_CONTENT_NEGATED) if (cd->flags & DETECT_CONTENT_NEGATED)
sig_flags |= SIG_FLAG_MPM_APPLAYER_NEG; s->flags |= SIG_FLAG_MPM_APPLAYER_NEG;
} else if (sm_list == DETECT_SM_LIST_HRHDMATCH) { } else if (sm_list == DETECT_SM_LIST_HRHDMATCH) {
if (s->flags & SIG_FLAG_TOSERVER) if (s->flags & SIG_FLAG_TOSERVER)
mpm_ctx_ts = sgh->mpm_hrhd_ctx_ts; mpm_ctx_ts = sgh->mpm_hrhd_ctx_ts;
if (s->flags & SIG_FLAG_TOCLIENT) if (s->flags & SIG_FLAG_TOCLIENT)
mpm_ctx_tc = sgh->mpm_hrhd_ctx_tc; mpm_ctx_tc = sgh->mpm_hrhd_ctx_tc;
sgh_flags = SIG_GROUP_HEAD_MPM_HRHD; sgh->flags = SIG_GROUP_HEAD_MPM_HRHD;
sig_flags |= SIG_FLAG_MPM_APPLAYER; s->flags |= SIG_FLAG_MPM_APPLAYER;
if (cd->flags & DETECT_CONTENT_NEGATED) if (cd->flags & DETECT_CONTENT_NEGATED)
sig_flags |= SIG_FLAG_MPM_APPLAYER_NEG; s->flags |= SIG_FLAG_MPM_APPLAYER_NEG;
} else if (sm_list == DETECT_SM_LIST_HMDMATCH) { } else if (sm_list == DETECT_SM_LIST_HMDMATCH) {
if (s->flags & SIG_FLAG_TOSERVER) if (s->flags & SIG_FLAG_TOSERVER)
mpm_ctx_ts = sgh->mpm_hmd_ctx_ts; mpm_ctx_ts = sgh->mpm_hmd_ctx_ts;
sgh_flags = SIG_GROUP_HEAD_MPM_HMD; sgh->flags = SIG_GROUP_HEAD_MPM_HMD;
sig_flags |= SIG_FLAG_MPM_APPLAYER; s->flags |= SIG_FLAG_MPM_APPLAYER;
if (cd->flags & DETECT_CONTENT_NEGATED) if (cd->flags & DETECT_CONTENT_NEGATED)
sig_flags |= SIG_FLAG_MPM_APPLAYER_NEG; s->flags |= SIG_FLAG_MPM_APPLAYER_NEG;
} else if (sm_list == DETECT_SM_LIST_HCDMATCH) { } else if (sm_list == DETECT_SM_LIST_HCDMATCH) {
if (s->flags & SIG_FLAG_TOSERVER) if (s->flags & SIG_FLAG_TOSERVER)
mpm_ctx_ts = sgh->mpm_hcd_ctx_ts; mpm_ctx_ts = sgh->mpm_hcd_ctx_ts;
if (s->flags & SIG_FLAG_TOCLIENT) if (s->flags & SIG_FLAG_TOCLIENT)
mpm_ctx_tc = sgh->mpm_hcd_ctx_tc; mpm_ctx_tc = sgh->mpm_hcd_ctx_tc;
sgh_flags = SIG_GROUP_HEAD_MPM_HCD; sgh->flags = SIG_GROUP_HEAD_MPM_HCD;
sig_flags |= SIG_FLAG_MPM_APPLAYER; s->flags |= SIG_FLAG_MPM_APPLAYER;
if (cd->flags & DETECT_CONTENT_NEGATED) if (cd->flags & DETECT_CONTENT_NEGATED)
sig_flags |= SIG_FLAG_MPM_APPLAYER_NEG; s->flags |= SIG_FLAG_MPM_APPLAYER_NEG;
} else if (sm_list == DETECT_SM_LIST_HRUDMATCH) { } else if (sm_list == DETECT_SM_LIST_HRUDMATCH) {
if (s->flags & SIG_FLAG_TOSERVER) if (s->flags & SIG_FLAG_TOSERVER)
mpm_ctx_ts = sgh->mpm_hrud_ctx_ts; mpm_ctx_ts = sgh->mpm_hrud_ctx_ts;
sgh_flags = SIG_GROUP_HEAD_MPM_HRUD; sgh->flags = SIG_GROUP_HEAD_MPM_HRUD;
sig_flags |= SIG_FLAG_MPM_APPLAYER; s->flags |= SIG_FLAG_MPM_APPLAYER;
if (cd->flags & DETECT_CONTENT_NEGATED) if (cd->flags & DETECT_CONTENT_NEGATED)
sig_flags |= SIG_FLAG_MPM_APPLAYER_NEG; s->flags |= SIG_FLAG_MPM_APPLAYER_NEG;
} else if (sm_list == DETECT_SM_LIST_HSMDMATCH) { } else if (sm_list == DETECT_SM_LIST_HSMDMATCH) {
if (s->flags & SIG_FLAG_TOCLIENT) if (s->flags & SIG_FLAG_TOCLIENT)
mpm_ctx_tc = sgh->mpm_hsmd_ctx_tc; mpm_ctx_tc = sgh->mpm_hsmd_ctx_tc;
sgh_flags = SIG_GROUP_HEAD_MPM_HSMD; sgh->flags = SIG_GROUP_HEAD_MPM_HSMD;
sig_flags |= SIG_FLAG_MPM_APPLAYER; s->flags |= SIG_FLAG_MPM_APPLAYER;
if (cd->flags & DETECT_CONTENT_NEGATED) if (cd->flags & DETECT_CONTENT_NEGATED)
sig_flags |= SIG_FLAG_MPM_APPLAYER_NEG; s->flags |= SIG_FLAG_MPM_APPLAYER_NEG;
} else if (sm_list == DETECT_SM_LIST_HSCDMATCH) { } else if (sm_list == DETECT_SM_LIST_HSCDMATCH) {
if (s->flags & SIG_FLAG_TOCLIENT) if (s->flags & SIG_FLAG_TOCLIENT)
mpm_ctx_tc = sgh->mpm_hscd_ctx_tc; mpm_ctx_tc = sgh->mpm_hscd_ctx_tc;
sgh_flags = SIG_GROUP_HEAD_MPM_HSCD; sgh->flags = SIG_GROUP_HEAD_MPM_HSCD;
sig_flags |= SIG_FLAG_MPM_APPLAYER; s->flags |= SIG_FLAG_MPM_APPLAYER;
if (cd->flags & DETECT_CONTENT_NEGATED) if (cd->flags & DETECT_CONTENT_NEGATED)
sig_flags |= SIG_FLAG_MPM_APPLAYER_NEG; s->flags |= SIG_FLAG_MPM_APPLAYER_NEG;
} else if (sm_list == DETECT_SM_LIST_HUADMATCH) { } else if (sm_list == DETECT_SM_LIST_HUADMATCH) {
if (s->flags & SIG_FLAG_TOSERVER) if (s->flags & SIG_FLAG_TOSERVER)
mpm_ctx_ts = sgh->mpm_huad_ctx_ts; mpm_ctx_ts = sgh->mpm_huad_ctx_ts;
sgh_flags = SIG_GROUP_HEAD_MPM_HUAD; sgh->flags = SIG_GROUP_HEAD_MPM_HUAD;
sig_flags |= SIG_FLAG_MPM_APPLAYER; s->flags |= SIG_FLAG_MPM_APPLAYER;
if (cd->flags & DETECT_CONTENT_NEGATED) if (cd->flags & DETECT_CONTENT_NEGATED)
sig_flags |= SIG_FLAG_MPM_APPLAYER_NEG; s->flags |= SIG_FLAG_MPM_APPLAYER_NEG;
} else if (sm_list == DETECT_SM_LIST_HHHDMATCH) { } else if (sm_list == DETECT_SM_LIST_HHHDMATCH) {
if (s->flags & SIG_FLAG_TOSERVER) if (s->flags & SIG_FLAG_TOSERVER)
mpm_ctx_ts = sgh->mpm_hhhd_ctx_ts; mpm_ctx_ts = sgh->mpm_hhhd_ctx_ts;
sgh_flags = SIG_GROUP_HEAD_MPM_HHHD; sgh->flags = SIG_GROUP_HEAD_MPM_HHHD;
sig_flags |= SIG_FLAG_MPM_APPLAYER; s->flags |= SIG_FLAG_MPM_APPLAYER;
if (cd->flags & DETECT_CONTENT_NEGATED) if (cd->flags & DETECT_CONTENT_NEGATED)
sig_flags |= SIG_FLAG_MPM_APPLAYER_NEG; s->flags |= SIG_FLAG_MPM_APPLAYER_NEG;
} else if (sm_list == DETECT_SM_LIST_HRHHDMATCH) { } else if (sm_list == DETECT_SM_LIST_HRHHDMATCH) {
if (s->flags & SIG_FLAG_TOSERVER) if (s->flags & SIG_FLAG_TOSERVER)
mpm_ctx_ts = sgh->mpm_hrhhd_ctx_ts; mpm_ctx_ts = sgh->mpm_hrhhd_ctx_ts;
sgh_flags = SIG_GROUP_HEAD_MPM_HRHHD; sgh->flags = SIG_GROUP_HEAD_MPM_HRHHD;
sig_flags |= SIG_FLAG_MPM_APPLAYER; s->flags |= SIG_FLAG_MPM_APPLAYER;
if (cd->flags & DETECT_CONTENT_NEGATED) if (cd->flags & DETECT_CONTENT_NEGATED)
sig_flags |= SIG_FLAG_MPM_APPLAYER_NEG; s->flags |= SIG_FLAG_MPM_APPLAYER_NEG;
} else if (sm_list == DETECT_SM_LIST_DNSQUERY_MATCH) { } else if (sm_list == DETECT_SM_LIST_DNSQUERY_MATCH) {
if (s->flags & SIG_FLAG_TOSERVER) if (s->flags & SIG_FLAG_TOSERVER)
mpm_ctx_ts = sgh->mpm_dnsquery_ctx_ts; mpm_ctx_ts = sgh->mpm_dnsquery_ctx_ts;
if (s->flags & SIG_FLAG_TOCLIENT) if (s->flags & SIG_FLAG_TOCLIENT)
mpm_ctx_tc = NULL; mpm_ctx_tc = NULL;
sgh_flags = SIG_GROUP_HEAD_MPM_DNSQUERY; sgh->flags = SIG_GROUP_HEAD_MPM_DNSQUERY;
sig_flags |= SIG_FLAG_MPM_APPLAYER; s->flags |= SIG_FLAG_MPM_APPLAYER;
if (cd->flags & DETECT_CONTENT_NEGATED) if (cd->flags & DETECT_CONTENT_NEGATED)
sig_flags |= SIG_FLAG_MPM_APPLAYER_NEG; s->flags |= SIG_FLAG_MPM_APPLAYER_NEG;
} }
if (cd->flags & DETECT_CONTENT_FAST_PATTERN_CHOP) { if (cd->flags & DETECT_CONTENT_FAST_PATTERN_CHOP) {
@ -1631,10 +1630,8 @@ static void PopulateMpmAddPatternToMpm(DetectEngineCtx *de_ctx,
} }
} }
/* tell matcher we are inspecting uri */ /* tell matcher we are inspecting uri */
s->flags |= sig_flags;
s->mpm_pattern_id_div_8 = cd->id / 8; s->mpm_pattern_id_div_8 = cd->id / 8;
s->mpm_pattern_id_mod_8 = 1 << (cd->id % 8); s->mpm_pattern_id_mod_8 = 1 << (cd->id % 8);
sgh->flags |= sgh_flags;
break; break;
} }

Write Preview
Loading…
Cancel
Save