From 09b5dca3430ec2c2491de6184a20378d939a35c4 Mon Sep 17 00:00:00 2001
From: Victor Julien <victor@inliniac.net>
Date: Fri, 28 Oct 2011 10:30:06 +0200
Subject: [PATCH] Consider signatures with the flags keyword to be packet
 inspecting only, not stream.

---
 src/detect-engine-mpm.c | 11 +++++++++--
 1 file changed, 9 insertions(+), 2 deletions(-)

diff --git a/src/detect-engine-mpm.c b/src/detect-engine-mpm.c
index 8152700956..bae636e1a0 100644
--- a/src/detect-engine-mpm.c
+++ b/src/detect-engine-mpm.c
@@ -135,12 +135,19 @@ int SignatureHasStreamContent(Signature *s) {
         SCReturnInt(0);
     }
 
-    SigMatch *sm = s->sm_lists[DETECT_SM_LIST_PMATCH];
+    SigMatch *sm = s->sm_lists[DETECT_SM_LIST_MATCH];
+    for ( ; sm != NULL; sm = sm->next) {
+        if (sm->type == DETECT_FLAGS) {
+            SCReturnInt(0);
+        }
+    }
+
+    sm = s->sm_lists[DETECT_SM_LIST_PMATCH];
     if (sm == NULL) {
         SCReturnInt(0);
     }
 
-    for ( ;sm != NULL; sm = sm->next) {
+    for ( ; sm != NULL; sm = sm->next) {
         if (sm->type == DETECT_CONTENT) {
             SCReturnInt(1);
         }