Suricata

When running the following ruleset on a pcap with a PDF transfer, we have an unexpected result with sid:2 and sid:3 alerting on the same packet even if they have opposed flowbits tests

alert http any any -> any any (msg:"Wget useragent";content:"wget"; nocase; http_user_agent; sid:1; rev:1; flowbits:set,wgetagent; noalert;)
alert http any any -> any any (msg:"PDF wget"; flowbits:isset,wgetagent; filemagic:"PDF"; flow:established,to_client; sid:2; rev:1;)
alert http any any -> any any (msg:"PDF not wget"; flowbits:isnotset,wgetagent; filemagic:"PDF"; flow:established,to_client; sid:3; rev:1;)

You can find suricata-verify test here: https://github.com/regit/suricata-verify/commits/filemagic

Suricata 3.2 was correct but Suricata 4.0.x was not. A git bisect on this range seems to show that the following patch is responsible of the issue:

commit 1bbf5553186c7d38b678f93db24773bd14ff84cf
Author: Victor Julien <victor@inliniac.net>
Date:   Tue Apr 11 15:24:49 2017 +0200

    detect: improve stateful detection