From b48ccb8d1f8923ecd9795852de124ec1e7337090 Mon Sep 17 00:00:00 2001 From: Victor Julien Date: Tue, 9 Feb 2021 20:22:54 +0100 Subject: [PATCH] detect/stream: don't run mpm on packet if stream is available --- src/detect-engine-payload.c | 10 +++------- 1 file changed, 3 insertions(+), 7 deletions(-) diff --git a/src/detect-engine-payload.c b/src/detect-engine-payload.c index abe1315c58..ede97ca68b 100644 --- a/src/detect-engine-payload.c +++ b/src/detect-engine-payload.c @@ -86,14 +86,10 @@ static void PrefilterPktStream(DetectEngineThreadCtx *det_ctx, false /* mpm doesn't use min inspect depth */); SCLogDebug("POST det_ctx->raw_stream_progress %"PRIu64, det_ctx->raw_stream_progress); - } else { - SCLogDebug("NOT p->flags & PKT_DETECT_HAS_STREAMDATA"); - } - /* packets that have not been added to the stream will be inspected - * as if they are stream chunks */ - if ((p->flags & (PKT_NOPAYLOAD_INSPECTION|PKT_STREAM_ADD)) == 0) - { + /* packets that have not been added to the stream will be inspected as if they are stream + * chunks */ + } else if ((p->flags & (PKT_NOPAYLOAD_INSPECTION | PKT_STREAM_ADD)) == 0) { if (p->payload_len >= mpm_ctx->minlen) { #ifdef DEBUG det_ctx->payload_mpm_cnt++; -- 2.47.2