Actions
Bug #7323
closedmqtt: wrong and missing direction for keywords
Affected Versions:
Effort:
Difficulty:
Label:
Description
As reported https://forum.suricata.io/t/question-about-mqtt-detection/4890/3
@Sascha Steinbiss do you want to fix this ?
diff --git a/rust/src/mqtt/detect.rs b/rust/src/mqtt/detect.rs
index c7dedc7ee8..b65d70686b 100644
--- a/rust/src/mqtt/detect.rs
+++ b/rust/src/mqtt/detect.rs
@@ -1127,7 +1127,7 @@ pub unsafe extern "C" fn ScDetectMqttRegister() {
G_MQTT_TYPE_BUFFER_ID = DetectHelperBufferRegister(
b"mqtt.type\0".as_ptr() as *const libc::c_char,
ALPROTO_MQTT,
- false, // only to server
+ true,
true,
);
@@ -1172,7 +1172,7 @@ pub unsafe extern "C" fn ScDetectMqttRegister() {
G_MQTT_REASON_CODE_BUFFER_ID = DetectHelperBufferRegister(
b"mqtt.reason_code\0".as_ptr() as *const libc::c_char,
ALPROTO_MQTT,
- false, // only to server
+ true, // only to client
true,
);
let kw = SCSigTableElmt {
allows to have more alerts for SV test about unsub
Also SUBACK case seems to be missing for reason code
Files
Actions