From: Anoop Saldanha <poonaatsoc@gmail.com>
Date: Fri, 6 Jul 2012 10:44:17 +0000 (+0530)
Subject: bug #496 - don't warn about offset/depth for packet sigs
X-Git-Tag: suricata-1.3.1~26
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=7833883a8f3c49902588509910733f94a2d94dff;p=thirdparty%2Fsuricata.git

bug #496 - don't warn about offset/depth for packet sigs
---

diff --git a/src/detect-engine-analyzer.c b/src/detect-engine-analyzer.c
index 3a9f343ae4..d802cbc6e4 100644
--- a/src/detect-engine-analyzer.c
+++ b/src/detect-engine-analyzer.c
@@ -514,7 +514,7 @@ void EngineAnalysisRules(Signature *s, char *line)
                                && (rule_pcre > 0 || rule_pcre_http > 0)*/) {
             fprintf(rule_engine_analysis_FD, "    Warning: Rule uses pcre with only a http_method content; possible performance issue.\n");
         }
-        if (rule_content_offset_depth > 0) {
+        if (rule_content_offset_depth > 0 && s->flags & SIG_FLAG_REQUIRE_STREAM) {
             fprintf(rule_engine_analysis_FD, "    Warning: Rule has depth"
                     "/offset with raw content keywords.  Please note the "
                     "offset/depth will be checked against both packet "