From d5ed28b065ec61d00205310f1be0c51bda5092ef Mon Sep 17 00:00:00 2001 From: Victor Julien Date: Tue, 13 Dec 2011 11:58:46 +0100 Subject: [PATCH] Remove SIG_FLAG_MPM flag. --- src/detect-engine-mpm.c | 4 ++-- src/detect-engine-siggroup.c | 10 +--------- src/detect-parse.c | 36 +++++++----------------------------- src/detect.h | 3 +-- 4 files changed, 11 insertions(+), 42 deletions(-) diff --git a/src/detect-engine-mpm.c b/src/detect-engine-mpm.c index 132d6ea777..8b20d6eafe 100644 --- a/src/detect-engine-mpm.c +++ b/src/detect-engine-mpm.c @@ -84,7 +84,7 @@ int SignatureHasPacketContent(Signature *s) { SCReturnInt(0); } - if (!(s->flags & SIG_FLAG_MPM)) { + if (s->sm_lists[DETECT_SM_LIST_PMATCH] == NULL) { SCLogDebug("no mpm"); SCReturnInt(0); } @@ -117,7 +117,7 @@ int SignatureHasStreamContent(Signature *s) { SCReturnInt(0); } - if (!(s->flags & SIG_FLAG_MPM)) { + if (s->sm_lists[DETECT_SM_LIST_PMATCH] == NULL) { SCLogDebug("no mpm"); SCReturnInt(0); } diff --git a/src/detect-engine-siggroup.c b/src/detect-engine-siggroup.c index 31f425d4fc..10f3128c56 100644 --- a/src/detect-engine-siggroup.c +++ b/src/detect-engine-siggroup.c @@ -1023,7 +1023,7 @@ int SigGroupHeadAppendSig(DetectEngineCtx *de_ctx, SigGroupHead **sgh, (*sgh)->init->sig_array[s->num / 8] |= 1 << (s->num % 8); /* update maxlen for mpm */ - if (s->flags & SIG_FLAG_MPM) { + if (s->sm_lists[DETECT_SM_LIST_PMATCH] != NULL) { /* check with the precalculated values from the sig */ if (s->mpm_content_maxlen > 0) { if ((*sgh)->mpm_content_maxlen == 0) @@ -1317,9 +1317,6 @@ int SigGroupHeadLoadContent(DetectEngineCtx *de_ctx, SigGroupHead *sgh) if (s == NULL) continue; - if (!(s->flags & SIG_FLAG_MPM)) - continue; - if (s->alproto != ALPROTO_UNKNOWN) continue; @@ -1493,11 +1490,6 @@ int SigGroupHeadLoadStreamContent(DetectEngineCtx *de_ctx, SigGroupHead *sgh) continue; } - if (!(s->flags & SIG_FLAG_MPM)) { - SCLogDebug("no mpm"); - continue; - } - sm = s->sm_lists[DETECT_SM_LIST_PMATCH]; if (sm == NULL) continue; diff --git a/src/detect-parse.c b/src/detect-parse.c index ff6c1f54e4..d0d42b1bae 100644 --- a/src/detect-parse.c +++ b/src/detect-parse.c @@ -1420,22 +1420,11 @@ Signature *SigInit(DetectEngineCtx *de_ctx, char *sigstr) { sig->num = de_ctx->signum; de_ctx->signum++; - /* see if need to set the SIG_FLAG_MPM flag */ SigMatch *sm; - for (sm = sig->sm_lists[DETECT_SM_LIST_PMATCH]; sm != NULL; sm = sm->next) { - if (sm->type == DETECT_CONTENT) { - DetectContentData *cd = (DetectContentData *)sm->ctx; - if (cd == NULL) - continue; - - sig->flags |= SIG_FLAG_MPM; - } - } - /* set mpm_content_len */ /* determine the length of the longest pattern in the sig */ - if (sig->flags & SIG_FLAG_MPM) { + if (sig->sm_lists[DETECT_SM_LIST_PMATCH] != NULL) { sig->mpm_content_maxlen = 0; for (sm = sig->sm_lists[DETECT_SM_LIST_PMATCH]; sm != NULL; sm = sm->next) { @@ -1566,22 +1555,11 @@ Signature *SigInitReal(DetectEngineCtx *de_ctx, char *sigstr) { sig->num = de_ctx->signum; de_ctx->signum++; - /* see if need to set the SIG_FLAG_MPM flag */ SigMatch *sm; - for (sm = sig->sm_lists[DETECT_SM_LIST_PMATCH]; sm != NULL; sm = sm->next) { - if (sm->type == DETECT_CONTENT) { - DetectContentData *cd = (DetectContentData *)sm->ctx; - if (cd == NULL) - continue; - - sig->flags |= SIG_FLAG_MPM; - } - } - /* set mpm_content_len */ /* determine the length of the longest pattern in the sig */ - if (sig->flags & SIG_FLAG_MPM) { + if (sig->sm_lists[DETECT_SM_LIST_PMATCH] != NULL) { sig->mpm_content_maxlen = 0; for (sm = sig->sm_lists[DETECT_SM_LIST_PMATCH]; sm != NULL; sm = sm->next) { @@ -1632,7 +1610,7 @@ Signature *SigInitReal(DetectEngineCtx *de_ctx, char *sigstr) { /* set mpm_content_len */ /* determine the length of the longest pattern in the sig */ - if (sig->next->flags & SIG_FLAG_MPM) { + if (sig->next->sm_lists[DETECT_SM_LIST_PMATCH] != NULL) { sig->next->mpm_content_maxlen = 0; SigMatch *sm; @@ -3213,8 +3191,8 @@ int SigParseTestMpm01 (void) { goto end; } - if (!(sig->flags & SIG_FLAG_MPM)) { - printf("sig doesn't have mpm flag set: "); + if (sig->sm_lists[DETECT_SM_LIST_PMATCH] == NULL) { + printf("sig doesn't have content list: "); goto end; } @@ -3253,8 +3231,8 @@ int SigParseTestMpm02 (void) { goto end; } - if (!(sig->flags & SIG_FLAG_MPM)) { - printf("sig doesn't have mpm flag set: "); + if (sig->sm_lists[DETECT_SM_LIST_PMATCH] == NULL) { + printf("sig doesn't have content list: "); goto end; } diff --git a/src/detect.h b/src/detect.h index 8930c4232d..063393a95d 100644 --- a/src/detect.h +++ b/src/detect.h @@ -227,8 +227,7 @@ typedef struct DetectPort_ { #define SIG_FLAG_DP_ANY (((uint64_t)1)<<4) /**< destination port is any */ #define SIG_FLAG_NOALERT (((uint64_t)1)<<5) /**< no alert flag is set */ - -#define SIG_FLAG_MPM (((uint64_t)1)<<6) /**< sig has mpm portion (content) */ +// reserved // reserved #define SIG_FLAG_DSIZE (((uint64_t)1)<<8) /**< signature has a dsize setting */