alert ipv4 and alert ipv6 specified proto rules should be treated and PROTO_ANY just like how we treat alert ip rules.

13 years ago · 6eb8f66f0a
parent f592c481dc
commit 6eb8f66f0a
1 changed files with 2 additions and 0 deletions
--- a/src/detect-engine-proto.c
+++ b/src/detect-engine-proto.c
@ -118,11 +118,13 @@ int DetectProtoParse(DetectProto *dp, char *str)
    } else if (strcasecmp(str,"ipv4") == 0 ||
               strcasecmp(str,"ip4") == 0 ) {
        dp->flags |= DETECT_PROTO_IPV4;
+        dp->flags |= DETECT_PROTO_ANY;
        memset(dp->proto, 0xff, sizeof(dp->proto));
        SCLogDebug("IPv4 protocol detected");
    } else if (strcasecmp(str,"ipv6") == 0 ||
               strcasecmp(str,"ip6") == 0 ) {
        dp->flags |= DETECT_PROTO_IPV6;
+        dp->flags |= DETECT_PROTO_ANY;
        memset(dp->proto, 0xff, sizeof(dp->proto));
        SCLogDebug("IPv6 protocol detected");
    } else if (strcasecmp(str,"ip") == 0 ||