From e1d1a7f2acc8642789bc51d0f8681cab361ef53e Mon Sep 17 00:00:00 2001
From: Victor Julien <victor@inliniac.net>
Date: Sun, 8 Oct 2017 15:27:00 +0200
Subject: [PATCH] detect: fix flow bypass flag handling

---
 src/detect.c | 11 ++++++-----
 1 file changed, 6 insertions(+), 5 deletions(-)

diff --git a/src/detect.c b/src/detect.c
index 50011d2e70..0d88be7fa0 100644
--- a/src/detect.c
+++ b/src/detect.c
@@ -1478,15 +1478,16 @@ static void DetectFlow(ThreadVars *tv,
         /* hack: if we are in pass the entire flow mode, we need to still
          * update the inspect_id forward. So test for the condition here,
          * and call the update code if necessary. */
-        int pass = ((p->flow->flags & FLOW_NOPACKET_INSPECTION));
-        uint8_t flags = FlowGetDisruptionFlags(p->flow, 0);
-        AppProto alproto = FlowGetAppProtocol(p->flow);
+        const int pass = ((p->flow->flags & FLOW_NOPACKET_INSPECTION));
+        const AppProto alproto = FlowGetAppProtocol(p->flow);
         if (pass && AppLayerParserProtocolSupportsTxs(p->proto, alproto)) {
+            uint8_t flags;
             if (p->flowflags & FLOW_PKT_TOSERVER) {
-                flags |= STREAM_TOSERVER;
+                flags = STREAM_TOSERVER;
             } else {
-                flags |= STREAM_TOCLIENT;
+                flags = STREAM_TOCLIENT;
             }
+            flags = FlowGetDisruptionFlags(p->flow, flags);
             DeStateUpdateInspectTransactionId(p->flow, flags);
         }
         return;