From: Philippe Antoine <contact@catenacyber.fr>
Date: Mon, 17 Jan 2022 13:47:48 +0000 (+0100)
Subject: detect: only apply ConfigApplyTx with app-layers
X-Git-Tag: suricata-6.0.5~14
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=272f082b85307f73c2fff5fb9e27260178b1a6bb;p=thirdparty%2Fsuricata.git

detect: only apply ConfigApplyTx with app-layers

Ticket: 4972

Otherwise, it makes no sense to look for a tx...

(cherry picked from commit c3a220647b31b453b0fc14ecfb028defad2778dc)
---

diff --git a/src/detect-config.c b/src/detect-config.c
index f5bea5b922..c7d63a6641 100644
--- a/src/detect-config.c
+++ b/src/detect-config.c
@@ -283,6 +283,10 @@ static int DetectConfigSetup (DetectEngineCtx *de_ctx, Signature *s, const char
         fd->scope = CONFIG_SCOPE_TX;
     }
 
+    if (fd->scope == CONFIG_SCOPE_TX) {
+        s->flags |= SIG_FLAG_APPLAYER;
+    }
+
     sm->ctx = (SigMatchCtx*)fd;
     SigMatchAppendSMToList(s, sm, DETECT_SM_LIST_POSTMATCH);
 
diff --git a/src/detect-engine-build.c b/src/detect-engine-build.c
index 238f844956..9d8f05c98e 100644
--- a/src/detect-engine-build.c
+++ b/src/detect-engine-build.c
@@ -33,6 +33,7 @@
 #include "detect-dsize.h"
 #include "detect-tcp-flags.h"
 #include "detect-flow.h"
+#include "detect-config.h"
 #include "detect-flowbits.h"
 
 #include "util-profiling.h"
@@ -562,6 +563,13 @@ static int SignatureCreateMask(Signature *s)
             case DETECT_ENGINE_EVENT:
                 s->mask |= SIG_MASK_REQUIRE_ENGINE_EVENT;
                 break;
+            case DETECT_CONFIG: {
+                DetectConfigData *fd = (DetectConfigData *)sm->ctx;
+                if (fd->scope == CONFIG_SCOPE_FLOW) {
+                    s->mask |= SIG_MASK_REQUIRE_FLOW;
+                }
+                break;
+            }
         }
     }