From: Philippe Antoine <pantoine@oisf.net>
Date: Wed, 29 Mar 2023 13:17:46 +0000 (+0200)
Subject: detect: use http.connection to client
X-Git-Tag: suricata-7.0.0-rc2~319
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=59734d16a18708c182a03d5d46c7356c678a44b5;p=thirdparty%2Fsuricata.git

detect: use http.connection to client

Ticket: #5746
---

diff --git a/doc/userguide/rules/http-keywords.rst b/doc/userguide/rules/http-keywords.rst
index 5dda6dcb0a..4063165739 100644
--- a/doc/userguide/rules/http-keywords.rst
+++ b/doc/userguide/rules/http-keywords.rst
@@ -42,7 +42,7 @@ http.accept                    http_accept (*)          Request
 http.accept_lang               http_accept_lang (*)     Request
 http.accept_enc                http_accept_enc (*)      Request
 http.referer                   http_referer (*)         Request
-http.connection                http_connection (*)      Request
+http.connection                http_connection (*)      Both
 file.data                      file_data (*)            Both
 http.content_type              http_content_type (*)    Both
 http.content_len               http_content_len (*)     Both
diff --git a/src/detect-http-connection.c b/src/detect-http-connection.c
index 2995898df7..2db4512367 100644
--- a/src/detect-http-connection.c
+++ b/src/detect-http-connection.c
@@ -38,6 +38,7 @@
 #define HEADER_NAME "Connection"
 #define KEYWORD_ID DETECT_AL_HTTP_HEADER_CONNECTION
 #define KEYWORD_TOSERVER 1
+#define KEYWORD_TOCLIENT    1
 
 #include "detect-http-headers-stub.h"
 #include "detect-http-connection.h"