From: Russ Combs <rucombs@cisco.com>
Date: Tue, 24 Jun 2014 04:45:04 +0000 (-0400)
Subject: fixed fast_pattern only auto set
X-Git-Tag: 3.0.0-233~1470
X-Git-Url: http://git.ipfire.org/gitweb.cgi?a=commitdiff_plain;h=a72d498c380b0d9e76e2dc8d1feda282ad50cf57;p=thirdparty%2Fsnort3.git

fixed fast_pattern only auto set
---

diff --git a/ChangeLog b/ChangeLog
index 341ddd380..0850cc328 100644
--- a/ChangeLog
+++ b/ChangeLog
@@ -4,6 +4,8 @@
 -- added IpsOption CursorActionType
 -- finally eliminated doe_ptr and friends ... yay!
 -- merged ips_option_base64_{data,decode}.cc
+-- fast_pattern_only (previously fast_pattern:only) is gone
+   (delete the option, Snort will figure it out)
 
 90
 -- added InspectApi.buffers and Inspector::getbuf()
diff --git a/src/ips_options/ips_content.cc b/src/ips_options/ips_content.cc
index 3de373531..3066ef516 100644
--- a/src/ips_options/ips_content.cc
+++ b/src/ips_options/ips_content.cc
@@ -50,7 +50,6 @@
 #include "detection/detection_util.h"
 
 #define MAX_PATTERN_SIZE 2048
-#define PM_FP_ONLY  "only"
 
 #ifdef PERF_PROFILING
 static THREAD_LOCAL PreprocStats contentPerfStats;
@@ -291,7 +290,8 @@ static void validate_content(
     {
         // this is provisional; will be disabled later if there
         // is a relative rule option following this one
-        pmd->fp_only = false; // true;  FIXIT integrate this with parse_rule.cc::ValidateFastPattern()
+        // see parse_rule.cc::ValidateFastPattern()
+        pmd->fp_only = 1;
     }
 }
 
@@ -399,6 +399,14 @@ bool is_fast_pattern_only(OptFpList* ofl)
     return pmd->fp_only != 0;
 }
 
+void clear_fast_pattern_only(OptFpList* ofl)
+{
+    PatternMatchData* pmd = get_pmd(ofl);
+
+    if ( pmd )
+        pmd->fp_only = 0;
+}
+
 bool is_unbounded(void* pv)
 {
     ContentOption* opt = (ContentOption*)pv;
diff --git a/src/ips_options/ips_content.h b/src/ips_options/ips_content.h
index dde58750c..f4b886bdc 100644
--- a/src/ips_options/ips_content.h
+++ b/src/ips_options/ips_content.h
@@ -93,6 +93,7 @@ int PatternMatchAdjustRelativeOffsets(
 // so PMD isn't exposed
 PatternMatchData* get_pmd(OptFpList*);
 bool is_fast_pattern_only(OptFpList*);
+void clear_fast_pattern_only(OptFpList*);
 bool is_unbounded(void*);
 
 #endif
diff --git a/src/parser/parse_rule.cc b/src/parser/parse_rule.cc
index 084cdc9a5..909c58130 100644
--- a/src/parser/parse_rule.cc
+++ b/src/parser/parse_rule.cc
@@ -1253,7 +1253,7 @@ static int mergeDuplicateOtn(
 
 static void ValidateFastPattern(OptTreeNode *otn)
 {
-    OptFpList* fpl;
+    OptFpList* fpl, * fp = nullptr;
     bool relative_is_bad_mkay = false;
 
     for(fpl = otn->opt_func; fpl != NULL; fpl = fpl->next)
@@ -1262,21 +1262,26 @@ static void ValidateFastPattern(OptTreeNode *otn)
         if ( relative_is_bad_mkay )
         {
             if (fpl->isRelative)
-                ParseWarning("relative rule option used after "
-                    "fast_pattern:only");
+            {
+                assert(fp);
+                clear_fast_pattern_only(fp);
+            }
         }
 
         // reset the check if one of these are present.
-        if ( fpl->context && (fpl->type != RULE_OPTION_TYPE_CONTENT) )
+        if ( fpl->type != RULE_OPTION_TYPE_CONTENT )
         {
-            if ( IpsOption::get_cat(fpl->context) > CAT_NONE )
+            if ( fpl->context && IpsOption::get_cat(fpl->context) > CAT_NONE )
                 relative_is_bad_mkay = false;
         }
         // set/unset the check on content options.
         else
         {
             if ( is_fast_pattern_only(fpl) )
+            {
+                fp = fpl;
                 relative_is_bad_mkay = true;
+            }
             else
                 relative_is_bad_mkay = false;
         }