Merge pull request #1657 in SNORT/snort3 from ~BRASTULT/snort3:fast_pattern_fix to...

Squashed commit of the following:

commit af403f7092a7a4f2d71a70b7a5d8d75cb23b80f3
Author: Brandon Stultz <brastult@cisco.com>
Date:   Tue Jun 25 11:42:42 2019 -0400

    detection: on PDUs change search order to set check_ports correctly

diff --git a/src/detection/fp_detect.cc b/src/detection/fp_detect.cc
index 2020dc336cbcd762561c75401b1a0f6d4b145bd7..c34695709b63badf1d11f6d5af73b608737f49c4 100644 (file)
--- a/src/detection/fp_detect.cc
+++ b/src/detection/fp_detect.cc
@@ -1312,9 +1312,6 @@ static void fpEvalPacket(Packet* p, FPTask task)
         break;
 
     case PktType::PDU:
-        if ( SnortConfig::get_conf()->sopgTable->user_mode )
-            fpEvalHeaderSvc(p, omd, SNORT_PROTO_USER, task);
-
         if ( p->proto_bits & PROTO_BIT__TCP )
         {
             if ( p->get_snort_protocol_id() == UNKNOWN_PROTOCOL_ID or !fpEvalHeaderSvc(p, omd, SNORT_PROTO_TCP, task) )
@@ -1325,6 +1322,10 @@ static void fpEvalPacket(Packet* p, FPTask task)
             if ( p->get_snort_protocol_id() == UNKNOWN_PROTOCOL_ID or !fpEvalHeaderSvc(p, omd, SNORT_PROTO_UDP, task) )
                 fpEvalHeaderUdp(p, omd, task);
         }
+
+        if ( SnortConfig::get_conf()->sopgTable->user_mode )
+            fpEvalHeaderSvc(p, omd, SNORT_PROTO_USER, task);
+
         break;
 
     case PktType::FILE: