GH-554: don't init PIA endpoint matchers if there's only file-magic

The logic for initializing PIA endpoint matchers was previously
skipped if "there's no global rule matcher", and that's only true
when no signature files get loaded.

But when using `zeek -b`, some file-magic signatures still get loaded
by default, so the PIA endpoint matchers still get initialized even
though they don't need to be -- file-magic patterns play no part
in PIA.

For typical use-cases (not using the `-b` flag), this change won't
help any, but we do at least use `-b` often within the test suite.
This commit is contained in:
Jon Siwek 2019-08-27 16:32:30 -07:00
parent 8c9b3bd3ae
commit 316e8bb671
3 changed files with 26 additions and 0 deletions

View file

@ -286,6 +286,8 @@ public:
void AddRule(Rule* rule);
void SetParseError() { parse_error = true; }
bool HasNonFileMagicRule() const { return has_non_file_magic_rule; }
// Interface to for getting some statistics
struct Stats {
unsigned int matchers; // # distinct RE matchers
@ -356,6 +358,7 @@ private:
const AcceptingMatchSet& ams);
int RE_level;
bool has_non_file_magic_rule;
bool parse_error;
RuleHdrTest* root;
rule_list rules;