#include "util-validate.h"
#include "util-detect.h"
+static void SigMatchSignaturesCleanup(DetectEngineThreadCtx *det_ctx,
+ Packet *p, Flow *pflow, const bool use_flow_sgh);
+
int SigMatchSignaturesRunPostMatch(ThreadVars *tv,
DetectEngineCtx *de_ctx, DetectEngineThreadCtx *det_ctx, Packet *p,
const Signature *s)
}
PACKET_PROFILING_DETECT_END(p, PROF_DETECT_ALERT);
+ SigMatchSignaturesCleanup(det_ctx, p, pflow, use_flow_sgh);
+ SCReturn;
+}
+
+/* TODO move use_flow_sgh into det_ctx */
+static void SigMatchSignaturesCleanup(DetectEngineThreadCtx *det_ctx,
+ Packet *p, Flow * const pflow, const bool use_flow_sgh)
+{
PACKET_PROFILING_DETECT_START(p, PROF_DETECT_CLEANUP);
/* cleanup pkt specific part of the patternmatcher */
PacketPatternCleanup(det_ctx);
/* store the found sgh (or NULL) in the flow to save us from looking it
* up again for the next packet. Also return any stream chunk we processed
* to the pool. */
- if (p->flags & PKT_HAS_FLOW) {
+ if (pflow != NULL) {
/* HACK: prevent the wrong sgh (or NULL) from being stored in the
* flow's sgh pointers */
if (PKT_IS_ICMPV4(p) && ICMPV4_DEST_UNREACH_IS_VALID(p)) {