fix for #562.

disable inspection bypass for stream mpm patterns.

diff --git a/src/detect-engine-content-inspection.c b/src/detect-engine-content-inspection.c
index f887b1414050bf5b162e0be5d8813b84c3183d91..9746ad72197682e7f6f3c2044e8de4be2da890b0 100644 (file)
--- a/src/detect-engine-content-inspection.c
+++ b/src/detect-engine-content-inspection.c
@@ -112,15 +112,6 @@ int DetectEngineContentInspection(DetectEngineCtx *de_ctx, DetectEngineThreadCtx
         DetectContentData *cd = (DetectContentData *)sm->ctx;
         SCLogDebug("inspecting content %"PRIu32" buffer_len %"PRIu32, cd->id, buffer_len);
 
-        /* we might have already have this content matched by the mpm.
-         * (if there is any other reason why we'd want to avoid checking
-         *  it here, please fill it in) */
-        if (inspection_mode == DETECT_ENGINE_CONTENT_INSPECTION_MODE_STREAM) {
-            if (cd->flags & DETECT_CONTENT_STREAM_MPM && !(cd->flags & DETECT_CONTENT_NEGATED)) {
-                goto match;
-            }
-        }
-
         /* rule parsers should take care of this */
 #ifdef DEBUG
         BUG_ON(cd->depth != 0 && cd->depth <= cd->offset);