inliniac/suricata — pull request #247 by owlsec (2012-12-13 15:05:19+00:00)
Title: Adds support for the geoip keyword

Adds support for match-on conditions (src, dst, any, both)
Uses GEOIP_MEMORY_CACHE for performance reasons
Adds support for negation and multiple countries in the same rule
Bug fixes
Changed to take flow direction from rule, if present

Comments addressed. Unit tests added.