]> git.ipfire.org Git - thirdparty/suricata.git/commit
detect/iponly: use flow first flags
authorVictor Julien <vjulien@oisf.net>
Thu, 23 Jan 2025 15:07:08 +0000 (16:07 +0100)
committerVictor Julien <victor@inliniac.net>
Tue, 28 Jan 2025 21:34:28 +0000 (22:34 +0100)
commit3f3964555e4e8f7292e8c704ddea6b824e4cd846
treeec9de53c0501bd4278e481228731fa7be1f79af2
parent8230cb5672e29c89a3feaf9670b5667e38a7149f
detect/iponly: use flow first flags

Instead of ip-only specific flags, reuse the FLOW_PKT_TOSERVER_FIRST and
FLOW_PKT_TOCLIENT_FIRST flags.

Fixes false positives on one sided streams that trigger a opposing flow
timeout packet at the flow's end. That pseudo packet would trigger a
match even though it shouldn't.

Ticket: #7521.
src/alert-debuglog.c
src/detect-engine-iponly.c
src/detect-flowbits.c
src/detect.c
src/flow.c
src/flow.h