inliniac/suricata — pull request #90 by poona (2012-09-25 06:58:05+00:00)
Title: alproto mpm prefilter fix

In our mpm engine, if the alproto is ALPROTO_HTTP, we should run both the
toserver mpms like uri, hcbd, and the toclient mpms like hsbd for any packet
direction we receive. This is because if we have a sig which has a uri fp
set, but the sig also has a hsbd keyword set, we won't end up inspecting the
hsbd data, since we never run the uri mpm while we receive a toclient packet.

Another solution is, if we have a alproto mpm set, and if the same sig has
the same alproto content in the other direction, we should set a mpm for
the other direction as well.