diff --git a/src/detect-engine-payload.c b/src/detect-engine-payload.c index 757e249f82..23f2b81304 100644 --- a/src/detect-engine-payload.c +++ b/src/detect-engine-payload.c @@ -96,18 +96,16 @@ static int DoInspectPacketPayload(DetectEngineCtx *de_ctx, /* we might have already have this content matched by the mpm. * (if there is any other reason why we'd want to avoid checking * it here, please fill it in) */ - if (det_ctx->flags & DETECT_ENGINE_THREAD_CTX_INSPECTING_PACKET) { - if (cd->flags & DETECT_CONTENT_PACKET_MPM && !(cd->flags & DETECT_CONTENT_NEGATED)) { - /* we will remove this check in the end */ - if (!DETECT_CONTENT_IS_SINGLE(cd)) - abort(); - //goto match; - } - } else if (det_ctx->flags & DETECT_ENGINE_THREAD_CTX_INSPECTING_STREAM) { + //if (det_ctx->flags & DETECT_ENGINE_THREAD_CTX_INSPECTING_PACKET) { + // if (cd->flags & DETECT_CONTENT_PACKET_MPM && !(cd->flags & DETECT_CONTENT_NEGATED)) { + // /* we will remove this check in the end */ + // if (!DETECT_CONTENT_IS_SINGLE(cd)) + // abort(); + // //goto match; + // } + //} else if (det_ctx->flags & DETECT_ENGINE_THREAD_CTX_INSPECTING_STREAM) { + if (det_ctx->flags & DETECT_ENGINE_THREAD_CTX_INSPECTING_STREAM) { if (cd->flags & DETECT_CONTENT_STREAM_MPM && !(cd->flags & DETECT_CONTENT_NEGATED)) { - /* we will remove this check in the end */ - if (!DETECT_CONTENT_IS_SINGLE(cd)) - abort(); goto match; } } @@ -391,10 +389,10 @@ int DetectEngineInspectPacketPayload(DetectEngineCtx *de_ctx, det_ctx->payload_offset = 0; det_ctx->discontinue_matching = 0; det_ctx->inspection_recursion_counter = 0; - det_ctx->flags |= DETECT_ENGINE_THREAD_CTX_INSPECTING_PACKET; + //det_ctx->flags |= DETECT_ENGINE_THREAD_CTX_INSPECTING_PACKET; r = DoInspectPacketPayload(de_ctx, det_ctx, s, s->sm_lists[DETECT_SM_LIST_PMATCH], p, f, p->payload, p->payload_len); - det_ctx->flags &= ~DETECT_ENGINE_THREAD_CTX_INSPECTING_PACKET; + //det_ctx->flags &= ~DETECT_ENGINE_THREAD_CTX_INSPECTING_PACKET; if (r == 1) { SCReturnInt(1); } diff --git a/src/detect.c b/src/detect.c index cdf077d197..6c30133f7b 100644 --- a/src/detect.c +++ b/src/detect.c @@ -1132,12 +1132,34 @@ int SigMatchSignatures(ThreadVars *th_v, DetectEngineCtx *de_ctx, DetectEngineTh if (pmatch == 0) { SCLogDebug("no match in smsg, fall back to packet payload"); + if (sms_runflags & SMS_USED_PM) { + if (s->flags & SIG_FLAG_MPM_PACKET && !(s->flags & SIG_FLAG_MPM_PACKET_NEG) && + !(det_ctx->pmq.pattern_id_bitarray[(s->mpm_pattern_id_div_8)] & + s->mpm_pattern_id_mod_8)) { + goto next; + } + if (DetectEngineInspectPacketPayload(de_ctx, det_ctx, s, p->flow, flags, alstate, p) != 1) { + goto next; + } + } else { + if (DetectEngineInspectPacketPayload(de_ctx, det_ctx, s, p->flow, flags, alstate, p) != 1) + goto next; + } + } + } else { + if (sms_runflags & SMS_USED_PM) { + if (s->flags & SIG_FLAG_MPM_PACKET && !(s->flags & SIG_FLAG_MPM_PACKET_NEG) && + !(det_ctx->pmq.pattern_id_bitarray[(s->mpm_pattern_id_div_8)] & + s->mpm_pattern_id_mod_8)) { + goto next; + } + if (DetectEngineInspectPacketPayload(de_ctx, det_ctx, s, p->flow, flags, alstate, p) != 1) { + goto next; + } + } else { if (DetectEngineInspectPacketPayload(de_ctx, det_ctx, s, p->flow, flags, alstate, p) != 1) goto next; } - } else { - if (DetectEngineInspectPacketPayload(de_ctx, det_ctx, s, p->flow, flags, alstate, p) != 1) - goto next; } } @@ -1281,7 +1303,7 @@ end: /* cleanup pkt specific part of the patternmatcher */ //if (sms_runflags & SMS_USED_PM) { - PacketPatternCleanup(th_v, det_ctx); + PacketPatternCleanup(th_v, det_ctx); //} /* store the found sgh (or NULL) in the flow to save us from looking it