]> git.ipfire.org Git - thirdparty/suricata.git/commit
detect: enforce isdataat:!1,relative earlier 2681/head
authorVictor Julien <victor@inliniac.net>
Mon, 6 Mar 2017 15:41:05 +0000 (16:41 +0100)
committerVictor Julien <victor@inliniac.net>
Mon, 1 May 2017 09:59:03 +0000 (11:59 +0200)
commit842dfbc3f86cee39d19ae394d39f87be2e1eea94
treea942f373db96cc723d1570d186cb734e680495c2
parentc0275c2b29d405e60782da7c1cc975d854a4be64
detect: enforce isdataat:!1,relative earlier

The expression 'isdataat:!1,relative' is used to make sure a match
is at the end of a buffer quite often. This patch optimizes this case
for 'content' followed by the expression. It enforces it by setting
and 'ends with' flag on the content and then taking that flag into
account while doing the pattern match.
src/detect-content.h
src/detect-engine-content-inspection.c
src/detect-isdataat.c
src/tests/detect-engine-content-inspection.c