mirror of https://github.com/OISF/suricata
detect: reset signature groups when reversing flow
Ticket: 7552 When we use midstream, and the first packet we see of a flow is a response from server, and we want to match on some signature to client : - we had first set sgh_toserver/FLOW_SGH_TOSERVER as we first thought this was a packet to server - we then swap/reverse the flow, so sgh_toclient becomes sgh_toserver but it contains signatures to server and cannot match our to_client signature The detect engine with DetectRunSetup will set again the signatures group heads properlypull/12730/head
parent
6477b31199
commit
d74bc774b7
Loading…
Reference in New Issue