fixed fast_pattern only auto set

diff --git a/ChangeLog b/ChangeLog
index 341ddd3801b2f20410de6633261e33f236221c23..0850cc328de32dbf4832e090c231fa103a62c71f 100644 (file)
--- a/ChangeLog
+++ b/ChangeLog
@@ -4,6 +4,8 @@
 -- added IpsOption CursorActionType
 -- finally eliminated doe_ptr and friends ... yay!
 -- merged ips_option_base64_{data,decode}.cc
+-- fast_pattern_only (previously fast_pattern:only) is gone
+   (delete the option, Snort will figure it out)
 
 90
 -- added InspectApi.buffers and Inspector::getbuf()

diff --git a/src/ips_options/ips_content.cc b/src/ips_options/ips_content.cc
index 3de373531a02c73eb7a675b8d73a484c4953a544..3066ef516ef8f139693887a94fb1f6769e8f7ba9 100644 (file)
--- a/src/ips_options/ips_content.cc
+++ b/src/ips_options/ips_content.cc
@@ -50,7 +50,6 @@
 #include "detection/detection_util.h"
 
 #define MAX_PATTERN_SIZE 2048
-#define PM_FP_ONLY  "only"
 
 #ifdef PERF_PROFILING
 static THREAD_LOCAL PreprocStats contentPerfStats;
@@ -291,7 +290,8 @@ static void validate_content(
     {
         // this is provisional; will be disabled later if there
         // is a relative rule option following this one
-        pmd->fp_only = false; // true;  FIXIT integrate this with parse_rule.cc::ValidateFastPattern()
+        // see parse_rule.cc::ValidateFastPattern()
+        pmd->fp_only = 1;
     }
 }
 
@@ -399,6 +399,14 @@ bool is_fast_pattern_only(OptFpList* ofl)
     return pmd->fp_only != 0;
 }
 
+void clear_fast_pattern_only(OptFpList* ofl)
+{
+    PatternMatchData* pmd = get_pmd(ofl);
+
+    if ( pmd )
+        pmd->fp_only = 0;
+}
+
 bool is_unbounded(void* pv)
 {
     ContentOption* opt = (ContentOption*)pv;

diff --git a/src/ips_options/ips_content.h b/src/ips_options/ips_content.h
index dde58750c52c26b5d8531d840d202ea8c54224a2..f4b886bdc22227f513bb247ac462b7efa30c7025 100644 (file)
--- a/src/ips_options/ips_content.h
+++ b/src/ips_options/ips_content.h
@@ -93,6 +93,7 @@ int PatternMatchAdjustRelativeOffsets(
 // so PMD isn't exposed
 PatternMatchData* get_pmd(OptFpList*);
 bool is_fast_pattern_only(OptFpList*);
+void clear_fast_pattern_only(OptFpList*);
 bool is_unbounded(void*);
 
 #endif

diff --git a/src/parser/parse_rule.cc b/src/parser/parse_rule.cc
index 084cdc9a5de99f2ae750e457bfbb13ffb4210be0..909c58130f6ba4ff7aace36429e470cf7e69bbc6 100644 (file)
--- a/src/parser/parse_rule.cc
+++ b/src/parser/parse_rule.cc
@@ -1253,7 +1253,7 @@ static int mergeDuplicateOtn(
 
 static void ValidateFastPattern(OptTreeNode *otn)
 {
-    OptFpList* fpl;
+    OptFpList* fpl, * fp = nullptr;
     bool relative_is_bad_mkay = false;
 
     for(fpl = otn->opt_func; fpl != NULL; fpl = fpl->next)
@@ -1262,21 +1262,26 @@ static void ValidateFastPattern(OptTreeNode *otn)
         if ( relative_is_bad_mkay )
         {
             if (fpl->isRelative)
-                ParseWarning("relative rule option used after "
-                    "fast_pattern:only");
+            {
+                assert(fp);
+                clear_fast_pattern_only(fp);
+            }
         }
 
         // reset the check if one of these are present.
-        if ( fpl->context && (fpl->type != RULE_OPTION_TYPE_CONTENT) )
+        if ( fpl->type != RULE_OPTION_TYPE_CONTENT )
         {
-            if ( IpsOption::get_cat(fpl->context) > CAT_NONE )
+            if ( fpl->context && IpsOption::get_cat(fpl->context) > CAT_NONE )
                 relative_is_bad_mkay = false;
         }
         // set/unset the check on content options.
         else
         {
             if ( is_fast_pattern_only(fpl) )
+            {
+                fp = fpl;
                 relative_is_bad_mkay = true;
+            }
             else
                 relative_is_bad_mkay = false;
         }