From 930eadddcbe8b471b3c29d54cb4f19e24e587d17 Mon Sep 17 00:00:00 2001 From: Philippe Antoine Date: Fri, 19 Apr 2024 09:57:04 +0200 Subject: [PATCH] detect: log relevant frames app-layer metadata Ticket: 6973 Completes commit 2b4e10224eaebb613352e9b82556b60035d032a1 (cherry picked from commit 9e01956e77e741ce9c1b9d6f64726de8054d37d9) --- src/detect.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) diff --git a/src/detect.c b/src/detect.c index 191c7a877e..ac1f13906e 100644 --- a/src/detect.c +++ b/src/detect.c @@ -1727,12 +1727,14 @@ static void DetectRunFrames(ThreadVars *tv, DetectEngineCtx *de_ctx, DetectEngin /* match */ DetectRunPostMatch(tv, det_ctx, p, s); - const uint8_t alert_flags = - (PACKET_ALERT_FLAG_STATE_MATCH | PACKET_ALERT_FLAG_FRAME); + uint8_t alert_flags = (PACKET_ALERT_FLAG_STATE_MATCH | PACKET_ALERT_FLAG_FRAME); det_ctx->flags |= DETECT_ENGINE_THREAD_CTX_FRAME_ID_SET; det_ctx->frame_id = frame->id; SCLogDebug( "%p/%" PRIi64 " sig %u (%u) matched", frame, frame->id, s->id, s->num); + if (frame->flags & FRAME_FLAG_TX_ID_SET) { + alert_flags |= PACKET_ALERT_FLAG_TX; + } AlertQueueAppend(det_ctx, s, p, frame->tx_id, alert_flags); } } -- 2.47.2