if (p->flags & PKT_DETECT_HAS_STREAMDATA) {
pmatch = DetectEngineInspectStreamPayload(de_ctx, det_ctx, s, p->flow, p);
if (pmatch) {
- det_ctx->flags |= DETECT_ENGINE_THREAD_CTX_STREAM_CONTENT_MATCH;
*alert_flags |= PACKET_ALERT_FLAG_STREAM_MATCH;
}
}
DetectVarProcessList(det_ctx, pflow, p);
DetectReplaceFree(det_ctx);
RULE_PROFILING_END(det_ctx, s, smatch, p);
-
- det_ctx->flags = 0;
continue;
}
}
DetectRunPostMatch(tv, det_ctx, p, s);
uint8_t alert_flags = (PACKET_ALERT_FLAG_STATE_MATCH | PACKET_ALERT_FLAG_FRAME);
- det_ctx->flags |= DETECT_ENGINE_THREAD_CTX_FRAME_ID_SET;
det_ctx->frame_id = frame->id;
SCLogDebug(
"%p/%" PRIi64 " sig %u (%u) matched", frame, frame->id, s->id, s->num);
/* for now a uint8_t is enough */
#define SignatureMask uint8_t
-#define DETECT_ENGINE_THREAD_CTX_FRAME_ID_SET 0x0001
-#define DETECT_ENGINE_THREAD_CTX_STREAM_CONTENT_MATCH 0x0004
-
#define FILE_SIG_NEED_FILE 0x01
#define FILE_SIG_NEED_FILENAME 0x02
#define FILE_SIG_NEED_MAGIC 0x04 /**< need the start of the file */
uint32_t *to_clear_queue;
} multi_inspect;
- uint16_t flags; /**< DETECT_ENGINE_THREAD_CTX_* flags */
-
/* true if tx_id is set */
bool tx_id_set;
/** ID of the transaction currently being inspected. */