diff --git a/src/detect-dns-query.c b/src/detect-dns-query.c index 0994546f5a..a9e072999c 100644 --- a/src/detect-dns-query.c +++ b/src/detect-dns-query.c @@ -78,7 +78,7 @@ void DetectDnsQueryRegister (void) sigmatch_table[DETECT_AL_DNS_QUERY].flags |= SIGMATCH_PAYLOAD; DetectMpmAppLayerRegister("dns_query", SIG_FLAG_TOSERVER, - DETECT_SM_LIST_DNSQUERYNAME_MATCH, + DETECT_SM_LIST_DNSQUERYNAME_MATCH, 2, PrefilterTxDnsQueryRegister); } diff --git a/src/detect-engine-mpm.c b/src/detect-engine-mpm.c index 8f94aa4421..c1ee337d6e 100644 --- a/src/detect-engine-mpm.c +++ b/src/detect-engine-mpm.c @@ -92,7 +92,8 @@ const char *builtin_mpms[] = { static DetectMpmAppLayerRegistery *g_app_mpms_list = NULL; static int g_app_mpms_list_cnt = 0; -void DetectMpmAppLayerRegister(const char *name, int direction, int sm_list, +void DetectMpmAppLayerRegister(const char *name, + int direction, int sm_list, int priority, int (*PrefilterRegister)(SigGroupHead *sgh, MpmCtx *mpm_ctx)) { DetectMpmAppLayerRegistery *am = SCCalloc(1, sizeof(*am)); @@ -114,6 +115,8 @@ void DetectMpmAppLayerRegister(const char *name, int direction, int sm_list, am->id = t->id + 1; } g_app_mpms_list_cnt++; + + SupportFastPatternForSigMatchList(sm_list, priority); } void DetectMpmInitializeAppMpms(DetectEngineCtx *de_ctx) diff --git a/src/detect-engine-mpm.h b/src/detect-engine-mpm.h index 3d12506fd1..27de064d89 100644 --- a/src/detect-engine-mpm.h +++ b/src/detect-engine-mpm.h @@ -89,7 +89,8 @@ int DetectSetFastPatternAndItsId(DetectEngineCtx *de_ctx); * \note direction must be set to either toserver or toclient. * If both are needed, register the keyword twice. */ -void DetectMpmAppLayerRegister(const char *name, int direction, int sm_list, +void DetectMpmAppLayerRegister(const char *name, + int direction, int sm_list, int priority, int (*PrefilterRegister)(SigGroupHead *sgh, MpmCtx *mpm_ctx)); #endif /* __DETECT_ENGINE_MPM_H__ */ diff --git a/src/detect-fast-pattern.c b/src/detect-fast-pattern.c index 1180209bc8..dba0850f36 100644 --- a/src/detect-fast-pattern.c +++ b/src/detect-fast-pattern.c @@ -56,8 +56,22 @@ SCFPSupportSMList *sm_fp_support_smlist_list = NULL; * \param list_id SM list id. * \param priority Priority for this list. */ -static void SupportFastPatternForSigMatchList(int list_id, int priority) +void SupportFastPatternForSigMatchList(int list_id, int priority) { + SCFPSupportSMList *ip = NULL; + /* insertion point - ip */ + for (SCFPSupportSMList *tmp = sm_fp_support_smlist_list; tmp != NULL; tmp = tmp->next) { + if (list_id == tmp->list_id) { + SCLogDebug("SM list already registered."); + return; + } + + if (priority <= tmp->priority) + break; + + ip = tmp; + } + if (sm_fp_support_smlist_list == NULL) { SCFPSupportSMList *new = SCMalloc(sizeof(SCFPSupportSMList)); if (unlikely(new == NULL)) @@ -71,20 +85,6 @@ static void SupportFastPatternForSigMatchList(int list_id, int priority) return; } - /* insertion point - ip */ - SCFPSupportSMList *ip = NULL; - for (SCFPSupportSMList *tmp = sm_fp_support_smlist_list; tmp != NULL; tmp = tmp->next) { - if (list_id == tmp->list_id) { - SCLogError(SC_ERR_FATAL, "SM list already registered."); - exit(EXIT_FAILURE); - } - - if (priority <= tmp->priority) - break; - - ip = tmp; - } - SCFPSupportSMList *new = SCMalloc(sizeof(SCFPSupportSMList)); if (unlikely(new == NULL)) exit(EXIT_FAILURE); @@ -99,13 +99,6 @@ static void SupportFastPatternForSigMatchList(int list_id, int priority) ip->next = new; } - for (SCFPSupportSMList *tmp = new->next; tmp != NULL; tmp = tmp->next) { - if (list_id == tmp->list_id) { - SCLogError(SC_ERR_FATAL, "SM list already registered."); - exit(EXIT_FAILURE); - } - } - return; } @@ -114,31 +107,9 @@ static void SupportFastPatternForSigMatchList(int list_id, int priority) */ void SupportFastPatternForSigMatchTypes(void) { - SupportFastPatternForSigMatchList(DETECT_SM_LIST_HCBDMATCH, 2); - SupportFastPatternForSigMatchList(DETECT_SM_LIST_FILEDATA, 2); - - SupportFastPatternForSigMatchList(DETECT_SM_LIST_HHDMATCH, 2); - SupportFastPatternForSigMatchList(DETECT_SM_LIST_HRHDMATCH, 2); - - SupportFastPatternForSigMatchList(DETECT_SM_LIST_UMATCH, 2); - SupportFastPatternForSigMatchList(DETECT_SM_LIST_HRUDMATCH, 2); - - SupportFastPatternForSigMatchList(DETECT_SM_LIST_HHHDMATCH, 2); - SupportFastPatternForSigMatchList(DETECT_SM_LIST_HRHHDMATCH, 2); - - SupportFastPatternForSigMatchList(DETECT_SM_LIST_HCDMATCH, 2); - SupportFastPatternForSigMatchList(DETECT_SM_LIST_HUADMATCH, 2); - SupportFastPatternForSigMatchList(DETECT_SM_LIST_PMATCH, 3); - SupportFastPatternForSigMatchList(DETECT_SM_LIST_HMDMATCH, 3); - SupportFastPatternForSigMatchList(DETECT_SM_LIST_HSCDMATCH, 3); - SupportFastPatternForSigMatchList(DETECT_SM_LIST_HSMDMATCH, 3); - - SupportFastPatternForSigMatchList(DETECT_SM_LIST_DNSQUERYNAME_MATCH, 2); - SupportFastPatternForSigMatchList(DETECT_SM_LIST_TLSSNI_MATCH, 2); - SupportFastPatternForSigMatchList(DETECT_SM_LIST_TLSISSUER_MATCH, 2); - SupportFastPatternForSigMatchList(DETECT_SM_LIST_TLSSUBJECT_MATCH, 2); + /* other types are handled by DetectMpmAppLayerRegister() */ #if 0 SCFPSupportSMList *tmp = sm_fp_support_smlist_list; diff --git a/src/detect-fast-pattern.h b/src/detect-fast-pattern.h index 8298e7bbf9..ff8bc5cc37 100644 --- a/src/detect-fast-pattern.h +++ b/src/detect-fast-pattern.h @@ -59,6 +59,8 @@ static inline int FastPatternSupportEnabledForSigMatchList(int list_id) return 0; } +void SupportFastPatternForSigMatchList(int list_id, int priority); + void SupportFastPatternForSigMatchTypes(void); void DetectFastPatternRegister(void); diff --git a/src/detect-file-data.c b/src/detect-file-data.c index 12b54cbe00..981a2d5f10 100644 --- a/src/detect-file-data.c +++ b/src/detect-file-data.c @@ -64,10 +64,10 @@ void DetectFiledataRegister(void) sigmatch_table[DETECT_FILE_DATA].flags = SIGMATCH_NOOPT; DetectMpmAppLayerRegister("file_data", SIG_FLAG_TOSERVER, - DETECT_SM_LIST_FILEDATA, + DETECT_SM_LIST_FILEDATA, 2, PrefilterTxSmtpFiledataRegister); DetectMpmAppLayerRegister("file_data", SIG_FLAG_TOCLIENT, - DETECT_SM_LIST_FILEDATA, + DETECT_SM_LIST_FILEDATA, 2, PrefilterTxHttpResponseBodyRegister); } diff --git a/src/detect-http-client-body.c b/src/detect-http-client-body.c index 8b74276a9d..4437fafb27 100644 --- a/src/detect-http-client-body.c +++ b/src/detect-http-client-body.c @@ -80,7 +80,7 @@ void DetectHttpClientBodyRegister(void) sigmatch_table[DETECT_AL_HTTP_CLIENT_BODY].flags |= SIGMATCH_PAYLOAD ; DetectMpmAppLayerRegister("http_client_body", SIG_FLAG_TOSERVER, - DETECT_SM_LIST_HCBDMATCH, + DETECT_SM_LIST_HCBDMATCH, 2, PrefilterTxHttpRequestBodyRegister); } diff --git a/src/detect-http-cookie.c b/src/detect-http-cookie.c index 59fa1c1c07..bb57e139d1 100644 --- a/src/detect-http-cookie.c +++ b/src/detect-http-cookie.c @@ -83,10 +83,10 @@ void DetectHttpCookieRegister(void) sigmatch_table[DETECT_AL_HTTP_COOKIE].flags |= SIGMATCH_PAYLOAD; DetectMpmAppLayerRegister("http_cookie", SIG_FLAG_TOSERVER, - DETECT_SM_LIST_HCDMATCH, + DETECT_SM_LIST_HCDMATCH, 2, PrefilterTxRequestCookieRegister); DetectMpmAppLayerRegister("http_cookie", SIG_FLAG_TOCLIENT, - DETECT_SM_LIST_HCDMATCH, + DETECT_SM_LIST_HCDMATCH, 2, PrefilterTxResponseCookieRegister); } diff --git a/src/detect-http-header.c b/src/detect-http-header.c index e94c35e9d4..291be54899 100644 --- a/src/detect-http-header.c +++ b/src/detect-http-header.c @@ -81,9 +81,11 @@ void DetectHttpHeaderRegister(void) sigmatch_table[DETECT_AL_HTTP_HEADER].flags |= SIGMATCH_NOOPT ; sigmatch_table[DETECT_AL_HTTP_HEADER].flags |= SIGMATCH_PAYLOAD ; - DetectMpmAppLayerRegister("http_header", SIG_FLAG_TOSERVER, DETECT_SM_LIST_HHDMATCH, + DetectMpmAppLayerRegister("http_header", SIG_FLAG_TOSERVER, + DETECT_SM_LIST_HHDMATCH, 2, PrefilterTxHttpRequestHeadersRegister); - DetectMpmAppLayerRegister("http_header", SIG_FLAG_TOCLIENT, DETECT_SM_LIST_HHDMATCH, + DetectMpmAppLayerRegister("http_header", SIG_FLAG_TOCLIENT, + DETECT_SM_LIST_HHDMATCH, 2, PrefilterTxHttpResponseHeadersRegister); return; diff --git a/src/detect-http-hh.c b/src/detect-http-hh.c index c2c99055a8..85098c295b 100644 --- a/src/detect-http-hh.c +++ b/src/detect-http-hh.c @@ -80,7 +80,7 @@ void DetectHttpHHRegister(void) sigmatch_table[DETECT_AL_HTTP_HOST].flags |= SIGMATCH_PAYLOAD ; DetectMpmAppLayerRegister("http_host", SIG_FLAG_TOSERVER, - DETECT_SM_LIST_HHHDMATCH, + DETECT_SM_LIST_HHHDMATCH, 2, PrefilterTxHostnameRegister); return; } diff --git a/src/detect-http-hrh.c b/src/detect-http-hrh.c index c5bbaa7aa6..3ba72481fb 100644 --- a/src/detect-http-hrh.c +++ b/src/detect-http-hrh.c @@ -80,7 +80,7 @@ void DetectHttpHRHRegister(void) sigmatch_table[DETECT_AL_HTTP_RAW_HOST].flags |= SIGMATCH_PAYLOAD ; DetectMpmAppLayerRegister("http_raw_host", SIG_FLAG_TOSERVER, - DETECT_SM_LIST_HRHHDMATCH, + DETECT_SM_LIST_HRHHDMATCH, 2, PrefilterTxHostnameRawRegister); return; diff --git a/src/detect-http-method.c b/src/detect-http-method.c index ed8cbd9a65..5fa9e30c99 100644 --- a/src/detect-http-method.c +++ b/src/detect-http-method.c @@ -82,7 +82,7 @@ void DetectHttpMethodRegister(void) sigmatch_table[DETECT_AL_HTTP_METHOD].flags |= SIGMATCH_PAYLOAD; DetectMpmAppLayerRegister("http_method", SIG_FLAG_TOSERVER, - DETECT_SM_LIST_HMDMATCH, + DETECT_SM_LIST_HMDMATCH, 4, PrefilterTxMethodRegister); SCLogDebug("registering http_method rule option"); diff --git a/src/detect-http-raw-header.c b/src/detect-http-raw-header.c index fe670bfb2b..8729d26e7d 100644 --- a/src/detect-http-raw-header.c +++ b/src/detect-http-raw-header.c @@ -80,10 +80,10 @@ void DetectHttpRawHeaderRegister(void) sigmatch_table[DETECT_AL_HTTP_RAW_HEADER].flags |= SIGMATCH_PAYLOAD; DetectMpmAppLayerRegister("http_raw_header", SIG_FLAG_TOSERVER, - DETECT_SM_LIST_HRHDMATCH, + DETECT_SM_LIST_HRHDMATCH, 2, PrefilterTxRequestHeadersRawRegister); DetectMpmAppLayerRegister("http_raw_header", SIG_FLAG_TOCLIENT, - DETECT_SM_LIST_HRHDMATCH, + DETECT_SM_LIST_HRHDMATCH, 2, PrefilterTxResponseHeadersRawRegister); return; diff --git a/src/detect-http-raw-uri.c b/src/detect-http-raw-uri.c index 9eda2d600e..deb9b879e7 100644 --- a/src/detect-http-raw-uri.c +++ b/src/detect-http-raw-uri.c @@ -75,7 +75,7 @@ void DetectHttpRawUriRegister(void) sigmatch_table[DETECT_AL_HTTP_RAW_URI].flags |= SIGMATCH_PAYLOAD; DetectMpmAppLayerRegister("http_raw_uri", SIG_FLAG_TOSERVER, - DETECT_SM_LIST_HRUDMATCH, + DETECT_SM_LIST_HRUDMATCH, 2, PrefilterTxRawUriRegister); return; diff --git a/src/detect-http-stat-code.c b/src/detect-http-stat-code.c index 58e28fd465..b127dcc70b 100644 --- a/src/detect-http-stat-code.c +++ b/src/detect-http-stat-code.c @@ -88,7 +88,7 @@ void DetectHttpStatCodeRegister (void) sigmatch_table[DETECT_AL_HTTP_STAT_CODE].flags |= SIGMATCH_PAYLOAD; DetectMpmAppLayerRegister("http_stat_code", SIG_FLAG_TOCLIENT, - DETECT_SM_LIST_HSCDMATCH, + DETECT_SM_LIST_HSCDMATCH, 4, PrefilterTxHttpStatCodeRegister); } diff --git a/src/detect-http-stat-msg.c b/src/detect-http-stat-msg.c index ed02a9c574..de60f71788 100644 --- a/src/detect-http-stat-msg.c +++ b/src/detect-http-stat-msg.c @@ -88,7 +88,7 @@ void DetectHttpStatMsgRegister (void) sigmatch_table[DETECT_AL_HTTP_STAT_MSG].flags |= SIGMATCH_PAYLOAD; DetectMpmAppLayerRegister("http_stat_msg", SIG_FLAG_TOCLIENT, - DETECT_SM_LIST_HSMDMATCH, + DETECT_SM_LIST_HSMDMATCH, 3, PrefilterTxHttpStatMsgRegister); } diff --git a/src/detect-http-ua.c b/src/detect-http-ua.c index 2042ee8d77..d018c11b7c 100644 --- a/src/detect-http-ua.c +++ b/src/detect-http-ua.c @@ -81,7 +81,7 @@ void DetectHttpUARegister(void) sigmatch_table[DETECT_AL_HTTP_USER_AGENT].flags |= SIGMATCH_PAYLOAD ; DetectMpmAppLayerRegister("http_user_agent", SIG_FLAG_TOSERVER, - DETECT_SM_LIST_HUADMATCH, + DETECT_SM_LIST_HUADMATCH, 2, PrefilterTxUARegister); return; diff --git a/src/detect-http-uri.c b/src/detect-http-uri.c index 328ce67cd4..113bde1246 100644 --- a/src/detect-http-uri.c +++ b/src/detect-http-uri.c @@ -77,7 +77,7 @@ void DetectHttpUriRegister (void) sigmatch_table[DETECT_AL_HTTP_URI].flags |= SIGMATCH_PAYLOAD; DetectMpmAppLayerRegister("http_uri", SIG_FLAG_TOSERVER, - DETECT_SM_LIST_UMATCH, + DETECT_SM_LIST_UMATCH, 2, PrefilterTxUriRegister); } diff --git a/src/detect-tls-cert-issuer.c b/src/detect-tls-cert-issuer.c index 7399e40bf9..fad6448222 100644 --- a/src/detect-tls-cert-issuer.c +++ b/src/detect-tls-cert-issuer.c @@ -73,7 +73,7 @@ void DetectTlsIssuerRegister(void) sigmatch_table[DETECT_AL_TLS_CERT_ISSUER].flags |= SIGMATCH_PAYLOAD; DetectMpmAppLayerRegister("tls_cert_issuer", SIG_FLAG_TOCLIENT, - DETECT_SM_LIST_TLSISSUER_MATCH, + DETECT_SM_LIST_TLSISSUER_MATCH, 2, PrefilterTxTlsIssuerRegister); } diff --git a/src/detect-tls-cert-subject.c b/src/detect-tls-cert-subject.c index 41706b1179..9a3d4b464f 100644 --- a/src/detect-tls-cert-subject.c +++ b/src/detect-tls-cert-subject.c @@ -73,7 +73,7 @@ void DetectTlsSubjectRegister(void) sigmatch_table[DETECT_AL_TLS_CERT_SUBJECT].flags |= SIGMATCH_PAYLOAD; DetectMpmAppLayerRegister("tls_cert_subject", SIG_FLAG_TOCLIENT, - DETECT_SM_LIST_TLSSUBJECT_MATCH, + DETECT_SM_LIST_TLSSUBJECT_MATCH, 2, PrefilterTxTlsSubjectRegister); } diff --git a/src/detect-tls-sni.c b/src/detect-tls-sni.c index 2d8b96e6e6..cdfb1e5087 100644 --- a/src/detect-tls-sni.c +++ b/src/detect-tls-sni.c @@ -73,7 +73,7 @@ void DetectTlsSniRegister(void) sigmatch_table[DETECT_AL_TLS_SNI].flags |= SIGMATCH_PAYLOAD; DetectMpmAppLayerRegister("tls_sni", SIG_FLAG_TOSERVER, - DETECT_SM_LIST_TLSSNI_MATCH, + DETECT_SM_LIST_TLSSNI_MATCH, 2, PrefilterTxTlsSniRegister); }