From 1ba514bbba8c769f5560ed9b515cd3b778fc9c7d Mon Sep 17 00:00:00 2001 From: Pablo Rincon Date: Wed, 10 Feb 2010 19:19:11 +0100 Subject: [PATCH 2/2] Ensure that the flow has the IPONLY flag (src or dst) --- src/detect.c | 4 +++- 1 files changed, 3 insertions(+), 1 deletions(-) diff --git a/src/detect.c b/src/detect.c index abbc972..d8c0c8f 100644 --- a/src/detect.c +++ b/src/detect.c @@ -558,7 +558,9 @@ int SigMatchSignatures(ThreadVars *th_v, DetectEngineCtx *de_ctx, DetectEngineTh p->flow->iponly_action = p->action; FlowSetIPOnlyFlag(p->flow, p->flowflags & FLOW_PKT_TOSERVER ? 1 : 0); } - } else if (p->flow != NULL && p->flow->iponly_action) { + } else if (((p->flowflags & FLOW_PKT_TOSERVER && (p->flowflags & FLOW_PKT_TOSERVER_IPONLY_SET)) || + (p->flowflags & FLOW_PKT_TOCLIENT && (p->flowflags & FLOW_PKT_TOCLIENT_IPONLY_SET))) && + p->flow != NULL && p->flow->iponly_action != 0) { /* Get the result of the first IPOnlyMatch() */ p->action |= p->flow->iponly_action; } -- 1.6.5