From: Victor Julien <victor@inliniac.net>
Date: Tue, 9 Feb 2021 19:22:54 +0000 (+0100)
Subject: detect/stream: don't run mpm on packet if stream is available
X-Git-Tag: suricata-7.0.0-beta1~1504
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=b48ccb8d1f8923ecd9795852de124ec1e7337090;p=thirdparty%2Fsuricata.git

detect/stream: don't run mpm on packet if stream is available
---

diff --git a/src/detect-engine-payload.c b/src/detect-engine-payload.c
index abe1315c58..ede97ca68b 100644
--- a/src/detect-engine-payload.c
+++ b/src/detect-engine-payload.c
@@ -86,14 +86,10 @@ static void PrefilterPktStream(DetectEngineThreadCtx *det_ctx,
                 false /* mpm doesn't use min inspect depth */);
         SCLogDebug("POST det_ctx->raw_stream_progress %"PRIu64,
                 det_ctx->raw_stream_progress);
-    } else {
-        SCLogDebug("NOT p->flags & PKT_DETECT_HAS_STREAMDATA");
-    }
 
-    /* packets that have not been added to the stream will be inspected
-     * as if they are stream chunks */
-    if ((p->flags & (PKT_NOPAYLOAD_INSPECTION|PKT_STREAM_ADD)) == 0)
-    {
+        /* packets that have not been added to the stream will be inspected as if they are stream
+         * chunks */
+    } else if ((p->flags & (PKT_NOPAYLOAD_INSPECTION | PKT_STREAM_ADD)) == 0) {
         if (p->payload_len >= mpm_ctx->minlen) {
 #ifdef DEBUG
             det_ctx->payload_mpm_cnt++;