|
|
|
@ -5,6 +5,7 @@
|
|
|
|
|
#include "debug.h"
|
|
|
|
|
#include "detect.h"
|
|
|
|
|
#include "flow.h"
|
|
|
|
|
#include "flow-private.h"
|
|
|
|
|
|
|
|
|
|
#include "detect-parse.h"
|
|
|
|
|
#include "detect-engine.h"
|
|
|
|
@ -528,11 +529,12 @@ int SigMatchSignatures(ThreadVars *th_v, DetectEngineCtx *de_ctx, DetectEngineTh
|
|
|
|
|
if (p->flow != NULL) {
|
|
|
|
|
FlowSetIPOnlyFlag(p->flow, p->flowflags & FLOW_PKT_TOSERVER ? 1 : 0);
|
|
|
|
|
}
|
|
|
|
|
} else if (((p->flowflags & FLOW_PKT_TOSERVER && (p->flowflags & FLOW_PKT_TOSERVER_IPONLY_SET)) ||
|
|
|
|
|
(p->flowflags & FLOW_PKT_TOCLIENT && (p->flowflags & FLOW_PKT_TOCLIENT_IPONLY_SET))) &&
|
|
|
|
|
p->flow != NULL) {
|
|
|
|
|
} else if (p->flow != NULL && ((p->flowflags & FLOW_PKT_TOSERVER &&
|
|
|
|
|
(p->flow->flags & FLOW_TOSERVER_IPONLY_SET)) ||
|
|
|
|
|
(p->flowflags & FLOW_PKT_TOCLIENT &&
|
|
|
|
|
(p->flow->flags & FLOW_TOCLIENT_IPONLY_SET)))) {
|
|
|
|
|
/* Get the result of the first IPOnlyMatch() */
|
|
|
|
|
if (p->flow->flags & FLOW_ACTION_DROP) p->flow->flags |= ACTION_DROP;
|
|
|
|
|
if (p->flow->flags & FLOW_ACTION_DROP) p->action |= ACTION_DROP;
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
/* we assume we have an uri when we start inspection */
|
|
|
|
|