From e36b9b89a1be5b45b6e071248a17208b617b0c71 Mon Sep 17 00:00:00 2001 From: Victor Julien Date: Fri, 10 Sep 2021 13:42:15 +0200 Subject: [PATCH] detect/tests: improve detection entry Lots of tests still use SigMatchSignatures as their main detection entry function, which bypassed some logic. Make it match main logic more closely. --- src/detect.c | 11 +++++++---- 1 file changed, 7 insertions(+), 4 deletions(-) diff --git a/src/detect.c b/src/detect.c index 89d37dcfa4..7fdfbeaf45 100644 --- a/src/detect.c +++ b/src/detect.c @@ -1639,11 +1639,14 @@ void DisableDetectFlowFileFlags(Flow *f) /** * \brief wrapper for old tests */ -void SigMatchSignatures(ThreadVars *th_v, - DetectEngineCtx *de_ctx, DetectEngineThreadCtx *det_ctx, - Packet *p) +void SigMatchSignatures( + ThreadVars *tv, DetectEngineCtx *de_ctx, DetectEngineThreadCtx *det_ctx, Packet *p) { - DetectRun(th_v, de_ctx, det_ctx, p); + if (p->flow) { + DetectFlow(tv, de_ctx, det_ctx, p); + } else { + DetectNoFlow(tv, de_ctx, det_ctx, p); + } } #endif