detect-events: set SIG_MASK_REQUIRE_*_STATE for events

Set SIG_MASK_REQUIRE_*_STATE for event rules to earlier discard
them.
pull/1479/head
Victor Julien 12 years ago
parent 8d0b090150
commit 62e937672d

@ -2434,6 +2434,30 @@ static int SignatureCreateMask(Signature *s)
}
}
for (sm = s->sm_lists[DETECT_SM_LIST_APP_EVENT] ; sm != NULL; sm = sm->next) {
switch (sm->type) {
case DETECT_AL_APP_LAYER_EVENT:
{
DetectAppLayerEventData *aed = (DetectAppLayerEventData *)sm->ctx;
switch (aed->alproto) {
case ALPROTO_HTTP:
s->mask |= SIG_MASK_REQUIRE_HTTP_STATE;
SCLogDebug("sig %u requires http app state (http event)", s->id);
break;
case ALPROTO_SMTP:
s->mask |= SIG_MASK_REQUIRE_SMTP_STATE;
SCLogDebug("sig %u requires smtp app state (smtp event)", s->id);
break;
case ALPROTO_DNS:
s->mask |= SIG_MASK_REQUIRE_DNS_STATE;
SCLogDebug("sig %u requires dns app state (dns event)", s->id);
break;
}
break;
}
}
}
for (sm = s->sm_lists[DETECT_SM_LIST_MATCH] ; sm != NULL; sm = sm->next) {
switch(sm->type) {
case DETECT_FLOWBITS:

Loading…
Cancel
Save