diff --git a/src/detect-engine-siggroup.c b/src/detect-engine-siggroup.c index 5d0dca7063..31f425d4fc 100644 --- a/src/detect-engine-siggroup.c +++ b/src/detect-engine-siggroup.c @@ -1035,7 +1035,7 @@ int SigGroupHeadAppendSig(DetectEngineCtx *de_ctx, SigGroupHead **sgh, SCLogDebug("(%p)->mpm_content_maxlen %u", *sgh, (*sgh)->mpm_content_maxlen); } } - if (s->flags & SIG_FLAG_MPM_URI) { + if (s->sm_lists[DETECT_SM_LIST_UMATCH] != NULL) { if (s->mpm_uricontent_maxlen > 0) { if ((*sgh)->mpm_uricontent_maxlen == 0) (*sgh)->mpm_uricontent_maxlen = s->mpm_uricontent_maxlen; @@ -1401,9 +1401,6 @@ int SigGroupHeadLoadUricontent(DetectEngineCtx *de_ctx, SigGroupHead *sgh) if (s == NULL) continue; - if (!(s->flags & SIG_FLAG_MPM_URI)) - continue; - sm = s->sm_lists[DETECT_SM_LIST_UMATCH]; if (sm == NULL) continue; diff --git a/src/detect-parse.c b/src/detect-parse.c index b0edc2d64c..ff6c1f54e4 100644 --- a/src/detect-parse.c +++ b/src/detect-parse.c @@ -1306,7 +1306,7 @@ static int SigValidate(Signature *s) { SCEnter(); /* check for uricontent + from_server/to_client */ - if (s->flags & SIG_FLAG_MPM_URI) { + if (s->sm_lists[DETECT_SM_LIST_UMATCH] != NULL) { SigMatch *sm; for (sm = s->sm_lists[DETECT_SM_LIST_MATCH]; sm != NULL; sm = sm->next) { if (sm->type == DETECT_FLOW) { @@ -1431,15 +1431,6 @@ Signature *SigInit(DetectEngineCtx *de_ctx, char *sigstr) { sig->flags |= SIG_FLAG_MPM; } } - for (sm = sig->sm_lists[DETECT_SM_LIST_UMATCH]; sm != NULL; sm = sm->next) { - if (sm->type == DETECT_URICONTENT) { - DetectContentData *ud = (DetectContentData *)sm->ctx; - if (ud == NULL) - continue; - - sig->flags |= SIG_FLAG_MPM_URI; - } - } /* set mpm_content_len */ @@ -1460,7 +1451,7 @@ Signature *SigInit(DetectEngineCtx *de_ctx, char *sigstr) { } } } - if (sig->flags & SIG_FLAG_MPM_URI) { + if (sig->sm_lists[DETECT_SM_LIST_UMATCH] != NULL) { sig->mpm_uricontent_maxlen = 0; for (sm = sig->sm_lists[DETECT_SM_LIST_UMATCH]; sm != NULL; sm = sm->next) { @@ -1586,15 +1577,6 @@ Signature *SigInitReal(DetectEngineCtx *de_ctx, char *sigstr) { sig->flags |= SIG_FLAG_MPM; } } - for (sm = sig->sm_lists[DETECT_SM_LIST_UMATCH]; sm != NULL; sm = sm->next) { - if (sm->type == DETECT_URICONTENT) { - DetectContentData *ud = (DetectContentData *)sm->ctx; - if (ud == NULL) - continue; - - sig->flags |= SIG_FLAG_MPM_URI; - } - } /* set mpm_content_len */ @@ -1615,7 +1597,7 @@ Signature *SigInitReal(DetectEngineCtx *de_ctx, char *sigstr) { } } } - if (sig->flags & SIG_FLAG_MPM_URI) { + if (sig->sm_lists[DETECT_SM_LIST_UMATCH] != NULL) { sig->mpm_uricontent_maxlen = 0; for (sm = sig->sm_lists[DETECT_SM_LIST_UMATCH]; sm != NULL; sm = sm->next) { @@ -1667,7 +1649,7 @@ Signature *SigInitReal(DetectEngineCtx *de_ctx, char *sigstr) { } } } - if (sig->next->flags & SIG_FLAG_MPM_URI) { + if (sig->next->sm_lists[DETECT_SM_LIST_UMATCH] != NULL) { sig->next->mpm_uricontent_maxlen = 0; for (sm = sig->next->sm_lists[DETECT_SM_LIST_UMATCH]; sm != NULL; sm = sm->next) { diff --git a/src/detect.h b/src/detect.h index e71a6c8c10..9d964bd7a2 100644 --- a/src/detect.h +++ b/src/detect.h @@ -229,7 +229,7 @@ typedef struct DetectPort_ { #define SIG_FLAG_NOALERT (((uint64_t)1)<<5) /**< no alert flag is set */ #define SIG_FLAG_MPM (((uint64_t)1)<<6) /**< sig has mpm portion (content) */ -#define SIG_FLAG_MPM_URI (((uint64_t)1)<<7) /**< sig has mpm portion (uricontent) */ +// reserved #define SIG_FLAG_DSIZE (((uint64_t)1)<<8) /**< signature has a dsize setting */ #define SIG_FLAG_APPLAYER (((uint64_t)1)<<9) /**< signature applies to app layer instead of packets */