From 28e74abcc56ff6b22837301bce4f7608d3449757 Mon Sep 17 00:00:00 2001 From: Victor Julien Date: Tue, 14 Aug 2018 11:12:37 +0200 Subject: [PATCH] detect/files: fix inspection issues with 'alert ip' Don't track the 'skipped' engines as matches. --- src/detect.c | 2 -- 1 file changed, 2 deletions(-) diff --git a/src/detect.c b/src/detect.c index 39b395728f..6aaa6996ad 100644 --- a/src/detect.c +++ b/src/detect.c @@ -1211,9 +1211,7 @@ static bool DetectRunTxInspectRule(ThreadVars *tv, /* special case: file_data on 'alert tcp' will have engines * in the list that are not for us. Bypass with assume match */ } else if (unlikely(engine->alproto != 0 && engine->alproto != f->alproto)) { - inspect_flags |= BIT_U32(engine->id); engine = engine->next; - total_matches++; continue; } else { KEYWORD_PROFILING_SET_LIST(det_ctx, engine->sm_list);