From b15ada81028a2df41bee6ef1101095e1cca3d95d Mon Sep 17 00:00:00 2001 From: Anoop Saldanha Date: Mon, 22 Nov 2010 12:56:38 +0530 Subject: [PATCH] set content_packet_mpm and content_stream_mpm flag for content to prevent double check inside inspection code --- src/detect-engine-mpm.c | 13 ++++++++++++- 1 file changed, 12 insertions(+), 1 deletion(-) diff --git a/src/detect-engine-mpm.c b/src/detect-engine-mpm.c index 73ee0ce6b4..3798ddb080 100644 --- a/src/detect-engine-mpm.c +++ b/src/detect-engine-mpm.c @@ -649,7 +649,18 @@ static void PopulateMpmAddPatternToMpm(DetectEngineCtx *de_ctx, cd->flags |= DETECT_CONTENT_STREAM_MPM; } } - } /* if (prev_sm != NULL) */ + } else { + if (SignatureHasPacketContent(s) && + (sgh->flags & SIG_GROUP_HAVECONTENT && + !(sgh->flags & SIG_GROUP_HEAD_MPM_COPY))) { + cd->flags |= DETECT_CONTENT_PACKET_MPM; + } + if (SignatureHasStreamContent(s) && + (sgh->flags & SIG_GROUP_HAVESTREAMCONTENT + && !(sgh->flags & SIG_GROUP_HEAD_MPM_STREAM_COPY))) { + cd->flags |= DETECT_CONTENT_STREAM_MPM; + } + } /* else - if (prev_sm != NULL) */ } } /* else - if (co->flags & DETECT_CONTENT_FAST_PATTERN_ONLY) */