diff --git a/src/detect.c b/src/detect.c index 367d80980e..db2015ef4f 100644 --- a/src/detect.c +++ b/src/detect.c @@ -462,6 +462,11 @@ inline SigGroupHead *SigMatchSignaturesGetSgh(ThreadVars *th_v, DetectEngineCtx SCReturnPtr(sgh, "SigGroupHead"); } +/** \brief Signature match function + * + * \retval 1 one or more signatures matched + * \retval 0 no matches were found + */ int SigMatchSignatures(ThreadVars *th_v, DetectEngineCtx *de_ctx, DetectEngineThreadCtx *det_ctx, Packet *p) { int match = 0, fmatch = 0; @@ -523,8 +528,10 @@ int SigMatchSignatures(ThreadVars *th_v, DetectEngineCtx *de_ctx, DetectEngineTh goto end; } - if (p->payload_len > 0 && det_ctx->sgh->mpm_ctx != NULL && !(p->flags & PKT_NOPAYLOAD_INSPECTION)) { - /* run the pattern matcher against the packet */ + if (p->payload_len > 0 && det_ctx->sgh->mpm_ctx != NULL && + !(p->flags & PKT_NOPAYLOAD_INSPECTION)) + { + /* run the multi packet matcher against the payload of the packet */ if (det_ctx->sgh->mpm_content_maxlen > p->payload_len) { SCLogDebug("not mpm-inspecting as pkt payload is smaller than " "the largest content length we need to match");