detect/parse: try to set flow direction for sigs w/o explict app proto as well

7 years ago · a68eec630f
parent 4c1173ffcd
commit a68eec630f
1 changed files with 1 additions and 1 deletions
--- a/src/detect-parse.c
+++ b/src/detect-parse.c
@ -1564,7 +1564,7 @@ static int SigValidate(DetectEngineCtx *de_ctx, Signature *s)
        if (s->init_data->smlists[x]) {
            const DetectEngineAppInspectionEngine *app = de_ctx->app_inspect_engines;
            for ( ; app != NULL; app = app->next) {
-                if (app->sm_list == x && s->alproto == app->alproto) {
+                if (app->sm_list == x && ((s->alproto == app->alproto) || s->alproto == 0)) {
                    SCLogDebug("engine %s dir %d alproto %d",
                            DetectBufferTypeGetNameById(de_ctx, app->sm_list),
                            app->dir, app->alproto);