mirror of https://github.com/OISF/suricata
detect/geoip: do not require packet
Ticket: 8333
Allows to pass on pseudo packets
So, that a ruleset like
pass ssh any any -> any any (geoip:any,US,IN; sid: 1;)
drop ip any any -> any any (flow:established, to_server; sid:2;)
Does not lead to a drop on the pseudo-packet when we flush
because ssh traffic gets encrypted
(cherry picked from commit d4c036718a)
pull/15105/head
parent
fe1cb9d24b
commit
a4aa865f52
Loading…
Reference in New Issue