From 32ce3d29beb0b1c8871f87b3948a78b356cf8565 Mon Sep 17 00:00:00 2001
From: Philippe Antoine <pantoine@oisf.net>
Date: Wed, 19 Nov 2025 22:02:05 +0100
Subject: [PATCH] detect/krb: use flag u32 for krb5_msg_type

---
 rust/src/krb/detect.rs | 7 ++++---
 1 file changed, 4 insertions(+), 3 deletions(-)

diff --git a/rust/src/krb/detect.rs b/rust/src/krb/detect.rs
index ca4504f637..3f4ffe5cf6 100644
--- a/rust/src/krb/detect.rs
+++ b/rust/src/krb/detect.rs
@@ -29,7 +29,7 @@ use crate::core::{STREAM_TOCLIENT, STREAM_TOSERVER};
 use crate::detect::uint::{
     detect_parse_uint_enum, DetectUintData, SCDetectU32Free, SCDetectU32Match,
 };
-use crate::detect::{SIGMATCH_INFO_ENUM_UINT, SIGMATCH_INFO_MULTI_UINT};
+use crate::detect::{SIGMATCH_INFO_ENUM_UINT, SIGMATCH_INFO_MULTI_UINT, SIGMATCH_INFO_UINT32};
 use kerberos_parser::krb5::EncryptionType;
 
 use nom8::branch::alt;
@@ -193,7 +193,8 @@ pub fn detect_parse_encryption_item(i: &str) -> IResult<&str, EncryptionType> {
     let (i, _) = opt(is_a(" ")).parse(i)?;
     let (i, e) = map_res(take_while1(is_alphanumeric_or_dash), |s: &str| {
         EncryptionType::from_str(s)
-    }).parse(i)?;
+    })
+    .parse(i)?;
     let (i, _) = opt(is_a(" ")).parse(i)?;
     let (i, _) = opt(char(',')).parse(i)?;
     return Ok((i, e));
@@ -436,7 +437,7 @@ pub unsafe extern "C" fn SCDetectKrb5MsgTypeRegister() {
         AppLayerTxMatch: Some(krb5_msg_type_match),
         Setup: Some(krb5_msg_type_setup),
         Free: Some(krb5_msg_type_free),
-        flags: SIGMATCH_INFO_MULTI_UINT | SIGMATCH_INFO_ENUM_UINT,
+        flags: SIGMATCH_INFO_MULTI_UINT | SIGMATCH_INFO_ENUM_UINT | SIGMATCH_INFO_UINT32,
     };
     G_KRB5_MSG_TYPE_KW_ID = SCDetectHelperKeywordRegister(&kw);
     G_KRB5_MSG_TYPE_BUFFER_ID = SCDetectHelperBufferRegister(