aiden
/
suricata
mirror of https://github.com/OISF/suricata
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

detect state: fix indent

Browse Source 
AMATCH block was indented too far.
pull/906/head
Victor Julien 12 years ago
parent 6c8ca76942
commit a96446d39e
1 changed files with 18 additions and 18 deletions
Show Stats Download Patch File Download Diff File

36
src/detect-engine-state.c
Unescape Escape View File

@ -627,29 +627,29 @@ void DeStateDetectContinueDetection(ThreadVars *tv, DetectEngineCtx *de_ctx,
KEYWORD_PROFILING_SET_LIST(det_ctx, DETECT_SM_LIST_AMATCH); KEYWORD_PROFILING_SET_LIST(det_ctx, DETECT_SM_LIST_AMATCH);
for (sm = item->nm; sm != NULL; sm = sm->next) { for (sm = item->nm; sm != NULL; sm = sm->next) {
if (sigmatch_table[sm->type].AppLayerMatch != NULL) if (sigmatch_table[sm->type].AppLayerMatch != NULL)
{ {
if (alproto == ALPROTO_SMB || alproto == ALPROTO_SMB2) { if (alproto == ALPROTO_SMB || alproto == ALPROTO_SMB2) {
smb_state = (SMBState *)alstate; smb_state = (SMBState *)alstate;
if (smb_state->dcerpc_present) { if (smb_state->dcerpc_present) {
KEYWORD_PROFILING_START;
match = sigmatch_table[sm->type].
AppLayerMatch(tv, det_ctx, f, flags, &smb_state->dcerpc, s, sm);
KEYWORD_PROFILING_END(det_ctx, sm->type, (match > 0));
}
} else {
KEYWORD_PROFILING_START; KEYWORD_PROFILING_START;
match = sigmatch_table[sm->type]. match = sigmatch_table[sm->type].
AppLayerMatch(tv, det_ctx, f, flags, alstate, s, sm); AppLayerMatch(tv, det_ctx, f, flags, &smb_state->dcerpc, s, sm);
KEYWORD_PROFILING_END(det_ctx, sm->type, (match > 0)); KEYWORD_PROFILING_END(det_ctx, sm->type, (match > 0));
} }
} else {
if (match == 0) KEYWORD_PROFILING_START;
break; match = sigmatch_table[sm->type].
else if (match == 2) AppLayerMatch(tv, det_ctx, f, flags, alstate, s, sm);
inspect_flags |= DE_STATE_FLAG_SIG_CANT_MATCH; KEYWORD_PROFILING_END(det_ctx, sm->type, (match > 0));
else if (match == 1)
total_matches++;
} }
if (match == 0)
break;
else if (match == 2)
inspect_flags |= DE_STATE_FLAG_SIG_CANT_MATCH;
else if (match == 1)
total_matches++;
}
} }
RULE_PROFILING_END(det_ctx, s, match, p); RULE_PROFILING_END(det_ctx, s, match, p);

Write Preview
Loading…
Cancel
Save