From: Russ Combs (rucombs) <rucombs@cisco.com>
Date: Fri, 28 Jun 2019 03:44:43 +0000 (-0400)
Subject: Merge pull request #1657 in SNORT/snort3 from ~BRASTULT/snort3:fast_pattern_fix to... 
X-Git-Tag: 3.0.0-258~16
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=9785e613f9b91aa807fb4efa9947c2e6c108618f;p=thirdparty%2Fsnort3.git

Merge pull request #1657 in SNORT/snort3 from ~BRASTULT/snort3:fast_pattern_fix to master

Squashed commit of the following:

commit af403f7092a7a4f2d71a70b7a5d8d75cb23b80f3
Author: Brandon Stultz <brastult@cisco.com>
Date:   Tue Jun 25 11:42:42 2019 -0400

    detection: on PDUs change search order to set check_ports correctly
---

diff --git a/src/detection/fp_detect.cc b/src/detection/fp_detect.cc
index 2020dc336..c34695709 100644
--- a/src/detection/fp_detect.cc
+++ b/src/detection/fp_detect.cc
@@ -1312,9 +1312,6 @@ static void fpEvalPacket(Packet* p, FPTask task)
         break;
 
     case PktType::PDU:
-        if ( SnortConfig::get_conf()->sopgTable->user_mode )
-            fpEvalHeaderSvc(p, omd, SNORT_PROTO_USER, task);
-
         if ( p->proto_bits & PROTO_BIT__TCP )
         {
             if ( p->get_snort_protocol_id() == UNKNOWN_PROTOCOL_ID or !fpEvalHeaderSvc(p, omd, SNORT_PROTO_TCP, task) )
@@ -1325,6 +1322,10 @@ static void fpEvalPacket(Packet* p, FPTask task)
             if ( p->get_snort_protocol_id() == UNKNOWN_PROTOCOL_ID or !fpEvalHeaderSvc(p, omd, SNORT_PROTO_UDP, task) )
                 fpEvalHeaderUdp(p, omd, task);
         }
+
+        if ( SnortConfig::get_conf()->sopgTable->user_mode )
+            fpEvalHeaderSvc(p, omd, SNORT_PROTO_USER, task);
+
         break;
 
     case PktType::FILE: