Consider signatures with the flags keyword to be packet inspecting only, not stream.

14 years ago · 09b5dca343
parent 30d84ab20d
commit 09b5dca343
1 changed files with 9 additions and 2 deletions
--- a/src/detect-engine-mpm.c
+++ b/src/detect-engine-mpm.c
@ -135,12 +135,19 @@ int SignatureHasStreamContent(Signature *s) {
        SCReturnInt(0);
    }

-    SigMatch *sm = s->sm_lists[DETECT_SM_LIST_PMATCH];
+    SigMatch *sm = s->sm_lists[DETECT_SM_LIST_MATCH];
+    for ( ; sm != NULL; sm = sm->next) {
+        if (sm->type == DETECT_FLAGS) {
+            SCReturnInt(0);
+        }
+    }
+
+    sm = s->sm_lists[DETECT_SM_LIST_PMATCH];
    if (sm == NULL) {
        SCReturnInt(0);
    }

-    for ( ;sm != NULL; sm = sm->next) {
+    for ( ; sm != NULL; sm = sm->next) {
        if (sm->type == DETECT_CONTENT) {
            SCReturnInt(1);
        }