detect/flow: don't overwrite hook direction

diff --git a/src/detect-flow.c b/src/detect-flow.c
index 28c0cddf484bbbcff7c4fd7f95a5bd4df86037ee..1e5fdb0ca4d6509d62117865d1543782d6838c71 100644 (file)
--- a/src/detect-flow.c
+++ b/src/detect-flow.c
@@ -414,8 +414,11 @@ int DetectFlowSetup (DetectEngineCtx *de_ctx, Signature *s, const char *flowstr)
         }
         s->flags |= SIG_FLAG_TOCLIENT;
     } else {
-        s->flags |= SIG_FLAG_TOSERVER;
-        s->flags |= SIG_FLAG_TOCLIENT;
+        /* if direction wasn't already set, e.g. by rule hook, assume both */
+        if ((s->flags & (SIG_FLAG_TOSERVER | SIG_FLAG_TOCLIENT)) == 0) {
+            s->flags |= SIG_FLAG_TOSERVER;
+            s->flags |= SIG_FLAG_TOCLIENT;
+        }
     }
     if (fd->flags == 0 || fd->flags == DETECT_FLOW_FLAG_TOSERVER ||
             fd->flags == DETECT_FLOW_FLAG_TOCLIENT) {