Start rule inspect with mask check

11 years ago · 18dd54dfa7
parent bfe49b60f7
commit 18dd54dfa7
1 changed files with 3 additions and 0 deletions
--- a/src/detect.c
+++ b/src/detect.c
@ -1514,6 +1514,9 @@ int SigMatchSignatures(ThreadVars *th_v, DetectEngineCtx *de_ctx, DetectEngineTh

        SCLogDebug("inspecting signature id %"PRIu32"", s->id);

+        if ((s->mask & mask) != s->mask)
+            goto next;
+
        /* if the sig has alproto and the session as well they should match */
        if (likely(sflags & SIG_FLAG_APPLAYER)) {
            if (s->alproto != ALPROTO_UNKNOWN && s->alproto != alproto) {