diff --git a/src/detect-engine.c b/src/detect-engine.c index 591cf855f9..437408cc35 100644 --- a/src/detect-engine.c +++ b/src/detect-engine.c @@ -742,6 +742,11 @@ static void AppendAppInspectEngine(DetectEngineCtx *de_ctx, if (!(AppProtoEqualsStrict(s->alproto, t->alproto))) { return; } + + /* skip engines not for us */ + if (s->init_data->hook.t.app.sub_state != t->sub_state) { + return; + } } else { /* other rules use the more relax AppProtoEquals logic */ if (!AppProtoEquals(s->alproto, t->alproto)) { diff --git a/src/detect-parse.c b/src/detect-parse.c index e8225c98cf..e6a2fcedc1 100644 --- a/src/detect-parse.c +++ b/src/detect-parse.c @@ -2869,6 +2869,8 @@ static int SigValidateCheckBuffers( if (!(AppProtoEqualsStrict(s->alproto, app->alproto))) { continue; } + if (app->sub_state != s->init_data->hook.t.app.sub_state) + continue; } else { if (!(AppProtoEquals(s->alproto, app->alproto) || s->alproto == 0)) { continue;