mirror of https://github.com/OISF/suricata
detect/geoip: do not require packet
Ticket: 8333 Allows to pass on pseudo packets So, that a ruleset like pass ssh any any -> any any (geoip:any,US,IN; sid: 1;) drop ip any any -> any any (flow:established, to_server; sid:2;) Does not lead to a drop on the pseudo-packet when we flush because ssh traffic gets encryptedpull/15091/head
parent
bc4a055e73
commit
d4c036718a
Loading…
Reference in New Issue