From: Anoop Saldanha <anoopsaldanha@gmail.com>
Date: Wed, 3 Oct 2012 03:59:13 +0000 (+0530)
Subject: fix for #562.
X-Git-Tag: suricata-1.3.2~3
X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=refs%2Fpull%2F114%2Fhead;p=thirdparty%2Fsuricata.git

fix for #562.

disable inspection bypass for stream mpm patterns.
---

diff --git a/src/detect-engine-content-inspection.c b/src/detect-engine-content-inspection.c
index f887b14140..9746ad7219 100644
--- a/src/detect-engine-content-inspection.c
+++ b/src/detect-engine-content-inspection.c
@@ -112,15 +112,6 @@ int DetectEngineContentInspection(DetectEngineCtx *de_ctx, DetectEngineThreadCtx
         DetectContentData *cd = (DetectContentData *)sm->ctx;
         SCLogDebug("inspecting content %"PRIu32" buffer_len %"PRIu32, cd->id, buffer_len);
 
-        /* we might have already have this content matched by the mpm.
-         * (if there is any other reason why we'd want to avoid checking
-         *  it here, please fill it in) */
-        if (inspection_mode == DETECT_ENGINE_CONTENT_INSPECTION_MODE_STREAM) {
-            if (cd->flags & DETECT_CONTENT_STREAM_MPM && !(cd->flags & DETECT_CONTENT_NEGATED)) {
-                goto match;
-            }
-        }
-
         /* rule parsers should take care of this */
 #ifdef DEBUG
         BUG_ON(cd->depth != 0 && cd->depth <= cd->offset);