From: Philippe Antoine <contact@catenacyber.fr>
Date: Mon, 17 Jan 2022 13:47:48 +0000 (+0100)
Subject: detect: only apply ConfigApplyTx with app-layers
X-Git-Tag: suricata-7.0.0-beta1~831
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=c3a220647;p=thirdparty%2Fsuricata.git

detect: only apply ConfigApplyTx with app-layers

Ticket: 4972

Otherwise, it makes no sense to look for a tx...
---

diff --git a/src/detect-config.c b/src/detect-config.c
index 0a81ba8eef..0f06b9a66b 100644
--- a/src/detect-config.c
+++ b/src/detect-config.c
@@ -288,6 +288,10 @@ static int DetectConfigSetup (DetectEngineCtx *de_ctx, Signature *s, const char
         fd->scope = CONFIG_SCOPE_TX;
     }
 
+    if (fd->scope == CONFIG_SCOPE_TX) {
+        s->flags |= SIG_FLAG_APPLAYER;
+    }
+
     sm->ctx = (SigMatchCtx*)fd;
     SigMatchAppendSMToList(s, sm, DETECT_SM_LIST_POSTMATCH);
 
diff --git a/src/detect-engine-build.c b/src/detect-engine-build.c
index 108514c962..1be5192962 100644
--- a/src/detect-engine-build.c
+++ b/src/detect-engine-build.c
@@ -33,6 +33,7 @@
 #include "detect-dsize.h"
 #include "detect-tcp-flags.h"
 #include "detect-flow.h"
+#include "detect-config.h"
 #include "detect-flowbits.h"
 
 #include "util-profiling.h"
@@ -560,6 +561,13 @@ static int SignatureCreateMask(Signature *s)
             case DETECT_ENGINE_EVENT:
                 s->mask |= SIG_MASK_REQUIRE_ENGINE_EVENT;
                 break;
+            case DETECT_CONFIG: {
+                DetectConfigData *fd = (DetectConfigData *)sm->ctx;
+                if (fd->scope == CONFIG_SCOPE_FLOW) {
+                    s->mask |= SIG_MASK_REQUIRE_FLOW;
+                }
+                break;
+            }
         }
     }