From 538a941486434a7f2ed87f44ed6b376547e14579 Mon Sep 17 00:00:00 2001 From: Victor Julien Date: Mon, 10 Dec 2012 13:59:53 +0100 Subject: [PATCH] decoder events: fix bug causing some rules not to be inspected if the decoder completed with warnings --- src/detect.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) diff --git a/src/detect.c b/src/detect.c index c9224d678d..4aafca3427 100644 --- a/src/detect.c +++ b/src/detect.c @@ -3116,14 +3116,16 @@ int SigAddressPrepareStage2(DetectEngineCtx *de_ctx) { SCLogDebug("tmp_s->id %"PRIu32, tmp_s->id); if (tmp_s->flags & SIG_FLAG_IPONLY) { IPOnlyAddSignature(de_ctx, &de_ctx->io_ctx, tmp_s); - } else if (tmp_s->init_flags & SIG_FLAG_INIT_DEONLY) { - DetectEngineAddDecoderEventSig(de_ctx, tmp_s); } else { DetectEngineLookupFlowAddSig(de_ctx, tmp_s, AF_INET); DetectEngineLookupFlowAddSig(de_ctx, tmp_s, AF_INET6); DetectEngineLookupFlowAddSig(de_ctx, tmp_s, AF_UNSPEC); } + if (tmp_s->init_flags & SIG_FLAG_INIT_DEONLY) { + DetectEngineAddDecoderEventSig(de_ctx, tmp_s); + } + sigs++; }