From 3c46e3693025b2ffac8594e91c1ee212edbd0e16 Mon Sep 17 00:00:00 2001 From: Juliana Fajardini Date: Fri, 10 Apr 2026 16:33:54 -0300 Subject: [PATCH] detect/tcp: opt-in tcp.flags for firewall mode The firewall enabling flag for tcp.flags was being overwritten by another line of code. Related to Ticket #8387 --- src/detect-tcp-flags.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/src/detect-tcp-flags.c b/src/detect-tcp-flags.c index 1a3c208842..76e34aa6f9 100644 --- a/src/detect-tcp-flags.c +++ b/src/detect-tcp-flags.c @@ -66,14 +66,14 @@ void DetectFlagsRegister (void) sigmatch_table[DETECT_FLAGS].url = "/rules/header-keywords.html#tcp-flags"; sigmatch_table[DETECT_FLAGS].Match = DetectFlagsMatch; sigmatch_table[DETECT_FLAGS].Setup = DetectFlagsSetup; - sigmatch_table[DETECT_FLAGS].Free = DetectFlagsFree; - sigmatch_table[DETECT_FLAGS].flags = SIGMATCH_SUPPORT_FIREWALL; + sigmatch_table[DETECT_FLAGS].Free = DetectFlagsFree; #ifdef UNITTESTS sigmatch_table[DETECT_FLAGS].RegisterTests = FlagsRegisterTests; #endif sigmatch_table[DETECT_FLAGS].SupportsPrefilter = PrefilterTcpFlagsIsPrefilterable; sigmatch_table[DETECT_FLAGS].SetupPrefilter = PrefilterSetupTcpFlags; - sigmatch_table[DETECT_FLAGS].flags = SIGMATCH_INFO_UINT8 | SIGMATCH_INFO_BITFLAGS_UINT; + sigmatch_table[DETECT_FLAGS].flags = + SIGMATCH_INFO_UINT8 | SIGMATCH_INFO_BITFLAGS_UINT | SIGMATCH_SUPPORT_FIREWALL; } /**