diff --git a/src/detect.c b/src/detect.c index f30b3908ab..bbe5d6066e 100644 --- a/src/detect.c +++ b/src/detect.c @@ -1228,31 +1228,45 @@ static inline void DetectMpmPrefilter(DetectEngineCtx *de_ctx, /* all http based mpms */ if (alproto == ALPROTO_HTTP && alstate != NULL) { if (det_ctx->sgh->flags & SIG_GROUP_HEAD_MPM_URI) { + PACKET_PROFILING_DETECT_START(p, PROF_DETECT_MPM_URI); cnt = DetectUricontentInspectMpm(det_ctx, p->flow, alstate); + PACKET_PROFILING_DETECT_END(p, PROF_DETECT_MPM_URI); SCLogDebug("uri search: cnt %" PRIu32, cnt); } if (det_ctx->sgh->flags & SIG_GROUP_HEAD_MPM_HCBD) { + PACKET_PROFILING_DETECT_START(p, PROF_DETECT_MPM_HCBD); cnt = DetectEngineRunHttpClientBodyMpm(de_ctx, det_ctx, p->flow, alstate); + PACKET_PROFILING_DETECT_END(p, PROF_DETECT_MPM_HCBD); SCLogDebug("hcbd search: cnt %" PRIu32, cnt); } if (det_ctx->sgh->flags & SIG_GROUP_HEAD_MPM_HHD) { + PACKET_PROFILING_DETECT_START(p, PROF_DETECT_MPM_HHD); cnt = DetectEngineRunHttpHeaderMpm(det_ctx, p->flow, alstate); + PACKET_PROFILING_DETECT_END(p, PROF_DETECT_MPM_HHD); SCLogDebug("hhd search: cnt %" PRIu32, cnt); } if (det_ctx->sgh->flags & SIG_GROUP_HEAD_MPM_HRHD) { + PACKET_PROFILING_DETECT_START(p, PROF_DETECT_MPM_HRHD); cnt = DetectEngineRunHttpRawHeaderMpm(det_ctx, p->flow, alstate); + PACKET_PROFILING_DETECT_END(p, PROF_DETECT_MPM_HRHD); SCLogDebug("hrhd search: cnt %" PRIu32, cnt); } if (det_ctx->sgh->flags & SIG_GROUP_HEAD_MPM_HMD) { + PACKET_PROFILING_DETECT_START(p, PROF_DETECT_MPM_HMD); cnt = DetectEngineRunHttpMethodMpm(det_ctx, p->flow, alstate); + PACKET_PROFILING_DETECT_END(p, PROF_DETECT_MPM_HMD); SCLogDebug("hmd search: cnt %" PRIu32, cnt); } if (det_ctx->sgh->flags & SIG_GROUP_HEAD_MPM_HCD) { + PACKET_PROFILING_DETECT_START(p, PROF_DETECT_MPM_HCD); cnt = DetectEngineRunHttpCookieMpm(det_ctx, p->flow, alstate); + PACKET_PROFILING_DETECT_END(p, PROF_DETECT_MPM_HCD); SCLogDebug("hcd search: cnt %" PRIu32, cnt); } if (det_ctx->sgh->flags & SIG_GROUP_HEAD_MPM_HRUD) { + PACKET_PROFILING_DETECT_START(p, PROF_DETECT_MPM_HRUD); cnt = DetectEngineRunHttpRawUriMpm(det_ctx, p->flow, alstate); + PACKET_PROFILING_DETECT_END(p, PROF_DETECT_MPM_HRUD); SCLogDebug("hrud search: cnt %" PRIu32, cnt); } } diff --git a/src/suricata-common.h b/src/suricata-common.h index f2421a5164..5b046c12fb 100644 --- a/src/suricata-common.h +++ b/src/suricata-common.h @@ -164,6 +164,13 @@ typedef enum PacketProfileDetectId_ { PROF_DETECT_MPM, PROF_DETECT_MPM_PACKET, PROF_DETECT_MPM_STREAM, + PROF_DETECT_MPM_URI, + PROF_DETECT_MPM_HCBD, + PROF_DETECT_MPM_HHD, + PROF_DETECT_MPM_HRHD, + PROF_DETECT_MPM_HMD, + PROF_DETECT_MPM_HCD, + PROF_DETECT_MPM_HRUD, PROF_DETECT_IPONLY, PROF_DETECT_RULES, PROF_DETECT_STATEFUL, diff --git a/src/util-profiling.c b/src/util-profiling.c index 89bbe61970..c36ccd2a30 100644 --- a/src/util-profiling.c +++ b/src/util-profiling.c @@ -1123,6 +1123,13 @@ const char * PacketProfileDetectIdToString(PacketProfileDetectId id) CASE_CODE (PROF_DETECT_MPM); CASE_CODE (PROF_DETECT_MPM_PACKET); CASE_CODE (PROF_DETECT_MPM_STREAM); + CASE_CODE (PROF_DETECT_MPM_URI); + CASE_CODE (PROF_DETECT_MPM_HCBD); + CASE_CODE (PROF_DETECT_MPM_HHD); + CASE_CODE (PROF_DETECT_MPM_HRHD); + CASE_CODE (PROF_DETECT_MPM_HMD); + CASE_CODE (PROF_DETECT_MPM_HCD); + CASE_CODE (PROF_DETECT_MPM_HRUD); CASE_CODE (PROF_DETECT_IPONLY); CASE_CODE (PROF_DETECT_RULES); CASE_CODE (PROF_DETECT_PREFILTER);