detect/flow: don't overwrite hook direction

7 months ago · 3fe9bd7cbb
parent 6ee32cba3b
commit 3fe9bd7cbb
1 changed files with 5 additions and 2 deletions
--- a/src/detect-flow.c
+++ b/src/detect-flow.c
@ -414,8 +414,11 @@ int DetectFlowSetup (DetectEngineCtx *de_ctx, Signature *s, const char *flowstr)
        }
        s->flags |= SIG_FLAG_TOCLIENT;
    } else {
-        s->flags |= SIG_FLAG_TOSERVER;
-        s->flags |= SIG_FLAG_TOCLIENT;
+        /* if direction wasn't already set, e.g. by rule hook, assume both */
+        if ((s->flags & (SIG_FLAG_TOSERVER | SIG_FLAG_TOCLIENT)) == 0) {
+            s->flags |= SIG_FLAG_TOSERVER;
+            s->flags |= SIG_FLAG_TOCLIENT;
+        }
    }
    if (fd->flags == 0 || fd->flags == DETECT_FLOW_FLAG_TOSERVER ||
            fd->flags == DETECT_FLOW_FLAG_TOCLIENT) {