From: Eileen Donlon <emdonlo@gmail.com>
Date: Mon, 2 Apr 2012 13:17:31 +0000 (-0400)
Subject: allow only one content to use fast_pattern
X-Git-Tag: suricata-1.3beta2~90
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=195eb42d4eb0fa7f57bef282abc22da69c4c7594;p=thirdparty%2Fsuricata.git

allow only one content to use fast_pattern
---

diff --git a/src/detect-fast-pattern.c b/src/detect-fast-pattern.c
index 15e05acb5f..9ce673290b 100644
--- a/src/detect-fast-pattern.c
+++ b/src/detect-fast-pattern.c
@@ -202,7 +202,6 @@ void DetectFastPatternRegister(void)
  *
  * \param de_ctx   Pointer to the Detection Engine Context.
  * \param s        Pointer to the Signature to which the current keyword belongs.
- * \param m        Pointer to the SigMatch.
  * \param null_str Should hold an empty string always.
  *
  * \retval  0 On success.
@@ -274,6 +273,22 @@ static int DetectFastPatternSetup(DetectEngineCtx *de_ctx, Signature *s, char *a
                     "options for the same content");
             goto error;
         }
+        else { /*allow only one content to have fast_pattern modifier*/
+            int list_id = 0;
+            for (list_id = 0; list_id < DETECT_SM_LIST_MAX; list_id++) {
+                SigMatch *sm = NULL;
+                for (sm = s->sm_lists[list_id]; sm != NULL; sm = sm->next) {
+                    if (sm->type == DETECT_CONTENT) {
+                        cd = sm->ctx;
+                        if (cd->flags & DETECT_CONTENT_FAST_PATTERN) {
+                            SCLogError(SC_ERR_INVALID_SIGNATURE, "fast_pattern "
+                                        "can be used on only one content in a rule");
+                            goto error;
+                        }
+                    }
+                } /* for (sm = s->sm_lists[list_id]; sm != NULL; sm = sm->next) */
+            }
+        }
         cd->flags |= DETECT_CONTENT_FAST_PATTERN;
         return 0;
     }