frames: duplicate alerts when no flow direction provided
Seen with the PCAP from https://github.com/OISF/suricata-verify/pull/711.
A rule like:
alert sip any any -> any any (flow:to_client; frame:pdu; content:"REGISTER sip"; sid:1;)
will alert once as expected as the content
REGISTER sip is only seen once in the pcap in the
However the rule:
alert sip any any -> any any (frame:pdu; content:"REGISTER sip"; sid:1;)
will create 2 identical alerts, but should probably only create one alert.
This does not appear to be limited to SIP, as I'm seeing it in my work-in-progress DNS frame support.