]> git.ipfire.org Git - thirdparty/suricata.git/commit
detect: introduce "like" ip-only signature type
authorJason Ish <jason.ish@oisf.net>
Wed, 11 May 2022 17:23:24 +0000 (11:23 -0600)
committerVictor Julien <vjulien@oisf.net>
Thu, 2 Jun 2022 05:33:19 +0000 (07:33 +0200)
commitc8a52070835c16612346ef14c2633412b6344a8c
tree9ce8d8d8bf237889861f8ab1787febc39a63f85a
parentd5abaf0b385990a7bc45a3e5a035d92625409f68
detect: introduce "like" ip-only signature type

Rules that look like they should be IP-only but contain a negated rule
address are now marked with an LIKE_IPONLY flag. This is so they are
treated like IPONLY rules with respect to flow action, but don't
interfere with other IPONLY processing like using the radix tree.

Ticket: #5361
src/detect-engine-alert.c
src/detect-engine-build.c
src/detect.h