From: Victor Julien <victor@inliniac.net>
Date: Thu, 4 Oct 2012 09:48:42 +0000 (+0200)
Subject: fast_pattern: don't consider http_method, http_stat_code and http_stat_msg when autom... 
X-Git-Tag: suricata-1.4beta2~7
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=75cddabd8a802c3578d00bf91bc6dd6160c56110;p=thirdparty%2Fsuricata.git

fast_pattern: don't consider http_method, http_stat_code and http_stat_msg when automatically giving preference to a HTTP pattern over a stream pattern.
---

diff --git a/src/detect-engine-mpm.c b/src/detect-engine-mpm.c
index d921de34ee..595dd21256 100644
--- a/src/detect-engine-mpm.c
+++ b/src/detect-engine-mpm.c
@@ -1720,7 +1720,12 @@ static int PatternMatchPreparePopulateMpm(DetectEngineCtx *de_ctx,
 
                 DetectContentData *cd = (DetectContentData *)sm->ctx;
                 if (!(cd->flags & DETECT_CONTENT_NEGATED) &&
-                    list_id != DETECT_SM_LIST_PMATCH) {
+                    list_id != DETECT_SM_LIST_PMATCH &&
+                    /* don't consider http_method, http_stat_msg, http_stat_code
+                     * to automatically override longest stream match */
+                    list_id != DETECT_SM_LIST_HMDMATCH &&
+                    list_id != DETECT_SM_LIST_HSMDMATCH &&
+                    list_id != DETECT_SM_LIST_HSCDMATCH) {
                     has_non_negated_non_stream_pattern[sig] = 1;
                 }