detect: reset signature groups when reversing flow

Ticket: 7552

When we use midstream, and the first packet we see of a flow is
a response from server, and we want to match on some signature
to client :
- we had first set sgh_toserver/FLOW_SGH_TOSERVER as we first
  thought this was a packet to server
- we then swap/reverse the flow, so sgh_toclient becomes sgh_toserver
  but it contains signatures to server and cannot match our
  to_client signature

The detect engine with DetectRunSetup will set again the
signatures group heads properly
pull/12730/head
Philippe Antoine 1 year ago committed by Victor Julien
parent 6477b31199
commit d74bc774b7

@ -460,6 +460,8 @@ static int TCPProtoDetect(ThreadVars *tv, TcpReassemblyThreadCtx *ra_ctx,
SCLogDebug("reversing flow after proto detect told us so");
PacketSwap(p);
FlowSwap(f);
// Will reset signature groups in DetectRunSetup
f->de_ctx_version = UINT32_MAX;
SWAP_FLAGS(flags, STREAM_TOSERVER, STREAM_TOCLIENT);
if (*stream == &ssn->client) {
*stream = &ssn->server;

Loading…
Cancel
Save