aiden
/
suricata
mirror of https://github.com/OISF/suricata
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

decode: convert 'action' macros to inline funcs

Browse Source 
Make sure most common branch is handled first to assist branch
prediction.

Macros still play a small role to please our 'action' cocci check.
pull/6324/head
Victor Julien 6 years ago
parent 2d1580233e
commit 4c7eb64411
19 changed files with 148 additions and 138 deletions
Show Stats Download Patch File Download Diff File

6
src/alert-prelude.c
Unescape Escape View File

@ -230,10 +230,8 @@ static int EventToImpact(const PacketAlert *pa, const Packet *p, idmef_alert_t *
idmef_impact_set_severity(impact, severity);
if (PACKET_TEST_ACTION(p, ACTION_DROP) ||
PACKET_TEST_ACTION(p, ACTION_REJECT) ||
PACKET_TEST_ACTION(p, ACTION_REJECT_DST) ||
PACKET_TEST_ACTION(p, ACTION_REJECT_BOTH) ) {
if (PacketTestAction(p, ACTION_DROP) || PacketTestAction(p, ACTION_REJECT) ||
PacketTestAction(p, ACTION_REJECT_DST) || PacketTestAction(p, ACTION_REJECT_BOTH)) {
idmef_action_t *action;
ret = idmef_action_new(&action);

4
src/decode.c
Unescape Escape View File

@ -744,9 +744,9 @@ const char *PktSrcToString(enum PktSrcEnum pkt_src)
void CaptureStatsUpdate(ThreadVars *tv, CaptureStats *s, const Packet *p)
{
if (unlikely(PACKET_TEST_ACTION(p, (ACTION_REJECT|ACTION_REJECT_DST|ACTION_REJECT_BOTH)))) {
if (unlikely(PacketTestAction(p, (ACTION_REJECT | ACTION_REJECT_DST | ACTION_REJECT_BOTH)))) {
StatsIncr(tv, s->counter_ips_rejected);
} else if (unlikely(PACKET_TEST_ACTION(p, ACTION_DROP))) {
} else if (unlikely(PacketTestAction(p, ACTION_DROP))) {
StatsIncr(tv, s->counter_ips_blocked);
} else if (unlikely(p->flags & PKT_STREAM_MODIFIED)) {
StatsIncr(tv, s->counter_ips_replaced);

43
src/decode.h
Unescape Escape View File

@ -864,11 +864,16 @@ void CaptureStatsSetup(ThreadVars *tv, CaptureStats *s);
* handle the case of a root packet
* for tunnels */
#define PACKET_SET_ACTION(p, a) do { \
((p)->root ? \
((p)->root->action = a) : \
((p)->action = a)); \
} while (0)
#define PACKET_SET_ACTION(p, a) (p)->action = (a)
static inline void PacketSetAction(Packet *p, const uint8_t a)
{
if (likely(p->root == NULL)) {
PACKET_SET_ACTION(p, a);
} else {
PACKET_SET_ACTION(p->root, a);
}
}
#define PACKET_ALERT(p) PACKET_SET_ACTION(p, ACTION_ALERT)
@ -884,16 +889,26 @@ void CaptureStatsSetup(ThreadVars *tv, CaptureStats *s);
#define PACKET_PASS(p) PACKET_SET_ACTION(p, ACTION_PASS)
#define PACKET_TEST_ACTION(p, a) \
((p)->root ? \
((p)->root->action & a) : \
((p)->action & a))
#define PACKET_TEST_ACTION(p, a) (p)->action &(a)
static inline uint8_t PacketTestAction(const Packet *p, const uint8_t a)
{
if (likely(p->root == NULL)) {
return PACKET_TEST_ACTION(p, a);
} else {
return PACKET_TEST_ACTION(p->root, a);
}
}
#define PACKET_UPDATE_ACTION(p, a) do { \
((p)->root ? \
((p)->root->action |= a) : \
((p)->action |= a)); \
} while (0)
#define PACKET_UPDATE_ACTION(p, a) (p)->action |= (a)
static inline void PacketUpdateAction(Packet *p, const uint8_t a)
{
if (likely(p->root == NULL)) {
PACKET_UPDATE_ACTION(p, a);
} else {
PACKET_UPDATE_ACTION(p->root, a);
}
}
#define TUNNEL_INCR_PKT_RTV_NOLOCK(p) do { \
((p)->root ? (p)->root->tunnel_rtv_cnt++ : (p)->tunnel_rtv_cnt++); \

14
src/detect-detection-filter.c
Unescape Escape View File

@ -574,17 +574,17 @@ static int DetectDetectionFilterTestSig3(void)
SigMatchSignatures(&th_v, de_ctx, det_ctx, p);
alerts = PacketAlertCheck(p, 10);
drops += ((PACKET_TEST_ACTION(p, ACTION_DROP))?1:0);
drops += ((PacketTestAction(p, ACTION_DROP)) ? 1 : 0);
p->action = 0;
SigMatchSignatures(&th_v, de_ctx, det_ctx, p);
alerts += PacketAlertCheck(p, 10);
drops += ((PACKET_TEST_ACTION(p, ACTION_DROP))?1:0);
drops += ((PacketTestAction(p, ACTION_DROP)) ? 1 : 0);
p->action = 0;
SigMatchSignatures(&th_v, de_ctx, det_ctx, p);
alerts += PacketAlertCheck(p, 10);
drops += ((PACKET_TEST_ACTION(p, ACTION_DROP))?1:0);
drops += ((PacketTestAction(p, ACTION_DROP)) ? 1 : 0);
p->action = 0;
TimeSetIncrementTime(200);
@ -592,22 +592,22 @@ static int DetectDetectionFilterTestSig3(void)
SigMatchSignatures(&th_v, de_ctx, det_ctx, p);
alerts += PacketAlertCheck(p, 10);
drops += ((PACKET_TEST_ACTION(p, ACTION_DROP))?1:0);
drops += ((PacketTestAction(p, ACTION_DROP)) ? 1 : 0);
p->action = 0;
SigMatchSignatures(&th_v, de_ctx, det_ctx, p);
alerts += PacketAlertCheck(p, 10);
drops += ((PACKET_TEST_ACTION(p, ACTION_DROP))?1:0);
drops += ((PacketTestAction(p, ACTION_DROP)) ? 1 : 0);
p->action = 0;
SigMatchSignatures(&th_v, de_ctx, det_ctx, p);
alerts += PacketAlertCheck(p, 10);
drops += ((PACKET_TEST_ACTION(p, ACTION_DROP))?1:0);
drops += ((PacketTestAction(p, ACTION_DROP)) ? 1 : 0);
p->action = 0;
SigMatchSignatures(&th_v, de_ctx, det_ctx, p);
alerts += PacketAlertCheck(p, 10);
drops += ((PACKET_TEST_ACTION(p, ACTION_DROP))?1:0);
drops += ((PacketTestAction(p, ACTION_DROP)) ? 1 : 0);
p->action = 0;
if (alerts == 3 && drops == 3)

11
src/detect-engine-alert.c
Unescape Escape View File

@ -285,7 +285,7 @@ void PacketAlertFinalize(DetectEngineCtx *de_ctx, DetectEngineThreadCtx *det_ctx
/* set actions on packet */
DetectSignatureApplyActions(p, p->alerts.alerts[i].s, p->alerts.alerts[i].flags);
if (PACKET_TEST_ACTION(p, ACTION_PASS)) {
if (PacketTestAction(p, ACTION_PASS)) {
/* Ok, reset the alert cnt to end in the previous of pass
* so we ignore the rest with less prio */
p->alerts.cnt = i;
@ -293,11 +293,10 @@ void PacketAlertFinalize(DetectEngineCtx *de_ctx, DetectEngineThreadCtx *det_ctx
/* if the signature wants to drop, check if the
* PACKET_ALERT_FLAG_DROP_FLOW flag is set. */
} else if ((PACKET_TEST_ACTION(p, ACTION_DROP)) &&
((p->alerts.alerts[i].flags & PACKET_ALERT_FLAG_DROP_FLOW) ||
(s->flags & SIG_FLAG_APPLAYER))
&& p->flow != NULL)
{
} else if ((PacketTestAction(p, ACTION_DROP)) &&
((p->alerts.alerts[i].flags & PACKET_ALERT_FLAG_DROP_FLOW) ||
(s->flags & SIG_FLAG_APPLAYER)) &&
p->flow != NULL) {
/* This will apply only on IPS mode (check StreamTcpPacket) */
p->flow->flags |= FLOW_ACTION_DROP; // XXX API?
}

18
src/detect-iprep.c
Unescape Escape View File

@ -483,7 +483,7 @@ static int DetectIPRepTest01(void)
SigMatchSignatures(&th_v, de_ctx, det_ctx, p);
FAIL_IF(p->alerts.cnt != 1);
FAIL_IF(PACKET_TEST_ACTION(p, ACTION_DROP));
FAIL_IF(PacketTestAction(p, ACTION_DROP));
UTHFreePacket(p);
@ -535,7 +535,7 @@ static int DetectIPRepTest02(void)
p->action = 0;
SigMatchSignatures(&th_v, de_ctx, det_ctx, p);
FAIL_IF(p->alerts.cnt != 1);
FAIL_IF(PACKET_TEST_ACTION(p, ACTION_DROP));
FAIL_IF(PacketTestAction(p, ACTION_DROP));
UTHFreePacket(p);
@ -587,7 +587,7 @@ static int DetectIPRepTest03(void)
p->action = 0;
SigMatchSignatures(&th_v, de_ctx, det_ctx, p);
FAIL_IF(p->alerts.cnt != 1);
FAIL_IF(PACKET_TEST_ACTION(p, ACTION_DROP));
FAIL_IF(PacketTestAction(p, ACTION_DROP));
UTHFreePacket(p);
@ -640,7 +640,7 @@ static int DetectIPRepTest04(void)
p->action = 0;
SigMatchSignatures(&th_v, de_ctx, det_ctx, p);
FAIL_IF(p->alerts.cnt != 1);
FAIL_IF(PACKET_TEST_ACTION(p, ACTION_DROP));
FAIL_IF(PacketTestAction(p, ACTION_DROP));
UTHFreePacket(p);
@ -692,7 +692,7 @@ static int DetectIPRepTest05(void)
p->action = 0;
SigMatchSignatures(&th_v, de_ctx, det_ctx, p);
FAIL_IF(p->alerts.cnt != 0);
FAIL_IF(PACKET_TEST_ACTION(p, ACTION_DROP));
FAIL_IF(PacketTestAction(p, ACTION_DROP));
UTHFreePacket(p);
@ -744,7 +744,7 @@ static int DetectIPRepTest06(void)
p->action = 0;
SigMatchSignatures(&th_v, de_ctx, det_ctx, p);
FAIL_IF(p->alerts.cnt != 1);
FAIL_IF(PACKET_TEST_ACTION(p, ACTION_DROP));
FAIL_IF(PacketTestAction(p, ACTION_DROP));
UTHFreePacket(p);
@ -796,7 +796,7 @@ static int DetectIPRepTest07(void)
p->action = 0;
SigMatchSignatures(&th_v, de_ctx, det_ctx, p);
FAIL_IF(p->alerts.cnt != 1);
FAIL_IF(PACKET_TEST_ACTION(p, ACTION_DROP));
FAIL_IF(PacketTestAction(p, ACTION_DROP));
UTHFreePacket(p);
@ -849,7 +849,7 @@ static int DetectIPRepTest08(void)
p->action = 0;
SigMatchSignatures(&th_v, de_ctx, det_ctx, p);
FAIL_IF(p->alerts.cnt != 0);
FAIL_IF(PACKET_TEST_ACTION(p, ACTION_DROP));
FAIL_IF(PacketTestAction(p, ACTION_DROP));
UTHFreePacket(p);
@ -902,7 +902,7 @@ static int DetectIPRepTest09(void)
p->action = 0;
SigMatchSignatures(&th_v, de_ctx, det_ctx, p);
FAIL_IF(p->alerts.cnt != 1);
FAIL_IF(PACKET_TEST_ACTION(p, ACTION_DROP));
FAIL_IF(PacketTestAction(p, ACTION_DROP));
UTHFreePacket(p);

72
src/detect-threshold.c
Unescape Escape View File

@ -1045,17 +1045,17 @@ static int DetectThresholdTestSig7(void)
TimeGet(&p->ts);
SigMatchSignatures(&th_v, de_ctx, det_ctx, p);
alerts = PacketAlertCheck(p, 10);
drops += ((PACKET_TEST_ACTION(p, ACTION_DROP))?1:0);
drops += ((PacketTestAction(p, ACTION_DROP)) ? 1 : 0);
p->action = 0;
SigMatchSignatures(&th_v, de_ctx, det_ctx, p);
alerts += PacketAlertCheck(p, 10);
drops += ((PACKET_TEST_ACTION(p, ACTION_DROP))?1:0);
drops += ((PacketTestAction(p, ACTION_DROP)) ? 1 : 0);
p->action = 0;
SigMatchSignatures(&th_v, de_ctx, det_ctx, p);
alerts += PacketAlertCheck(p, 10);
drops += ((PACKET_TEST_ACTION(p, ACTION_DROP))?1:0);
drops += ((PacketTestAction(p, ACTION_DROP)) ? 1 : 0);
p->action = 0;
TimeSetIncrementTime(200);
@ -1063,17 +1063,17 @@ static int DetectThresholdTestSig7(void)
SigMatchSignatures(&th_v, de_ctx, det_ctx, p);
alerts += PacketAlertCheck(p, 10);
drops += ((PACKET_TEST_ACTION(p, ACTION_DROP))?1:0);
drops += ((PacketTestAction(p, ACTION_DROP)) ? 1 : 0);
p->action = 0;
SigMatchSignatures(&th_v, de_ctx, det_ctx, p);
alerts += PacketAlertCheck(p, 10);
drops += ((PACKET_TEST_ACTION(p, ACTION_DROP))?1:0);
drops += ((PacketTestAction(p, ACTION_DROP)) ? 1 : 0);
p->action = 0;
SigMatchSignatures(&th_v, de_ctx, det_ctx, p);
alerts += PacketAlertCheck(p, 10);
drops += ((PACKET_TEST_ACTION(p, ACTION_DROP))?1:0);
drops += ((PacketTestAction(p, ACTION_DROP)) ? 1 : 0);
p->action = 0;
if (alerts == 1 && drops == 6)
@ -1139,17 +1139,17 @@ static int DetectThresholdTestSig8(void)
TimeGet(&p->ts);
SigMatchSignatures(&th_v, de_ctx, det_ctx, p);
alerts = PacketAlertCheck(p, 10);
drops += ((PACKET_TEST_ACTION(p, ACTION_DROP))?1:0);
drops += ((PacketTestAction(p, ACTION_DROP)) ? 1 : 0);
p->action = 0;
SigMatchSignatures(&th_v, de_ctx, det_ctx, p);
alerts += PacketAlertCheck(p, 10);
drops += ((PACKET_TEST_ACTION(p, ACTION_DROP))?1:0);
drops += ((PacketTestAction(p, ACTION_DROP)) ? 1 : 0);
p->action = 0;
SigMatchSignatures(&th_v, de_ctx, det_ctx, p);
alerts += PacketAlertCheck(p, 10);
drops += ((PACKET_TEST_ACTION(p, ACTION_DROP))?1:0);
drops += ((PacketTestAction(p, ACTION_DROP)) ? 1 : 0);
p->action = 0;
TimeSetIncrementTime(200);
@ -1157,17 +1157,17 @@ static int DetectThresholdTestSig8(void)
SigMatchSignatures(&th_v, de_ctx, det_ctx, p);
alerts += PacketAlertCheck(p, 10);
drops += ((PACKET_TEST_ACTION(p, ACTION_DROP))?1:0);
drops += ((PacketTestAction(p, ACTION_DROP)) ? 1 : 0);
p->action = 0;
SigMatchSignatures(&th_v, de_ctx, det_ctx, p);
alerts += PacketAlertCheck(p, 10);
drops += ((PACKET_TEST_ACTION(p, ACTION_DROP))?1:0);
drops += ((PacketTestAction(p, ACTION_DROP)) ? 1 : 0);
p->action = 0;
SigMatchSignatures(&th_v, de_ctx, det_ctx, p);
alerts += PacketAlertCheck(p, 10);
drops += ((PACKET_TEST_ACTION(p, ACTION_DROP))?1:0);
drops += ((PacketTestAction(p, ACTION_DROP)) ? 1 : 0);
p->action = 0;
if (alerts == 2 && drops == 6)
@ -1233,17 +1233,17 @@ static int DetectThresholdTestSig9(void)
TimeGet(&p->ts);
SigMatchSignatures(&th_v, de_ctx, det_ctx, p);
alerts = PacketAlertCheck(p, 10);
drops += ((PACKET_TEST_ACTION(p, ACTION_DROP))?1:0);
drops += ((PacketTestAction(p, ACTION_DROP)) ? 1 : 0);
p->action = 0;
SigMatchSignatures(&th_v, de_ctx, det_ctx, p);
alerts += PacketAlertCheck(p, 10);
drops += ((PACKET_TEST_ACTION(p, ACTION_DROP))?1:0);
drops += ((PacketTestAction(p, ACTION_DROP)) ? 1 : 0);
p->action = 0;
SigMatchSignatures(&th_v, de_ctx, det_ctx, p);
alerts += PacketAlertCheck(p, 10);
drops += ((PACKET_TEST_ACTION(p, ACTION_DROP))?1:0);
drops += ((PacketTestAction(p, ACTION_DROP)) ? 1 : 0);
p->action = 0;
TimeSetIncrementTime(200);
@ -1251,17 +1251,17 @@ static int DetectThresholdTestSig9(void)
SigMatchSignatures(&th_v, de_ctx, det_ctx, p);
alerts += PacketAlertCheck(p, 10);
drops += ((PACKET_TEST_ACTION(p, ACTION_DROP))?1:0);
drops += ((PacketTestAction(p, ACTION_DROP)) ? 1 : 0);
p->action = 0;
SigMatchSignatures(&th_v, de_ctx, det_ctx, p);
alerts += PacketAlertCheck(p, 10);
drops += ((PACKET_TEST_ACTION(p, ACTION_DROP))?1:0);
drops += ((PacketTestAction(p, ACTION_DROP)) ? 1 : 0);
p->action = 0;
SigMatchSignatures(&th_v, de_ctx, det_ctx, p);
alerts += PacketAlertCheck(p, 10);
drops += ((PACKET_TEST_ACTION(p, ACTION_DROP))?1:0);
drops += ((PacketTestAction(p, ACTION_DROP)) ? 1 : 0);
p->action = 0;
if (alerts == 2 && drops == 2)
@ -1327,17 +1327,17 @@ static int DetectThresholdTestSig10(void)
TimeGet(&p->ts);
SigMatchSignatures(&th_v, de_ctx, det_ctx, p);
alerts = PacketAlertCheck(p, 10);
drops += ((PACKET_TEST_ACTION(p, ACTION_DROP))?1:0);
drops += ((PacketTestAction(p, ACTION_DROP)) ? 1 : 0);
p->action = 0;
SigMatchSignatures(&th_v, de_ctx, det_ctx, p);
alerts += PacketAlertCheck(p, 10);
drops += ((PACKET_TEST_ACTION(p, ACTION_DROP))?1:0);
drops += ((PacketTestAction(p, ACTION_DROP)) ? 1 : 0);
p->action = 0;
SigMatchSignatures(&th_v, de_ctx, det_ctx, p);
alerts += PacketAlertCheck(p, 10);
drops += ((PACKET_TEST_ACTION(p, ACTION_DROP))?1:0);
drops += ((PacketTestAction(p, ACTION_DROP)) ? 1 : 0);
p->action = 0;
TimeSetIncrementTime(200);
@ -1345,17 +1345,17 @@ static int DetectThresholdTestSig10(void)
SigMatchSignatures(&th_v, de_ctx, det_ctx, p);
alerts += PacketAlertCheck(p, 10);
drops += ((PACKET_TEST_ACTION(p, ACTION_DROP))?1:0);
drops += ((PacketTestAction(p, ACTION_DROP)) ? 1 : 0);
p->action = 0;
SigMatchSignatures(&th_v, de_ctx, det_ctx, p);
alerts += PacketAlertCheck(p, 10);
drops += ((PACKET_TEST_ACTION(p, ACTION_DROP))?1:0);
drops += ((PacketTestAction(p, ACTION_DROP)) ? 1 : 0);
p->action = 0;
SigMatchSignatures(&th_v, de_ctx, det_ctx, p);
alerts += PacketAlertCheck(p, 10);
drops += ((PACKET_TEST_ACTION(p, ACTION_DROP))?1:0);
drops += ((PacketTestAction(p, ACTION_DROP)) ? 1 : 0);
p->action = 0;
if (alerts == 1 && drops == 1)
@ -1421,17 +1421,17 @@ static int DetectThresholdTestSig11(void)
TimeGet(&p->ts);
SigMatchSignatures(&th_v, de_ctx, det_ctx, p);
alerts = PacketAlertCheck(p, 10);
drops += ((PACKET_TEST_ACTION(p, ACTION_DROP))?1:0);
drops += ((PacketTestAction(p, ACTION_DROP)) ? 1 : 0);
p->action = 0;
SigMatchSignatures(&th_v, de_ctx, det_ctx, p);
alerts += PacketAlertCheck(p, 10);
drops += ((PACKET_TEST_ACTION(p, ACTION_DROP))?1:0);
drops += ((PacketTestAction(p, ACTION_DROP)) ? 1 : 0);
p->action = 0;
SigMatchSignatures(&th_v, de_ctx, det_ctx, p);
alerts += PacketAlertCheck(p, 10);
drops += ((PACKET_TEST_ACTION(p, ACTION_DROP))?1:0);
drops += ((PacketTestAction(p, ACTION_DROP)) ? 1 : 0);
p->action = 0;
TimeSetIncrementTime(200);
@ -1439,17 +1439,17 @@ static int DetectThresholdTestSig11(void)
SigMatchSignatures(&th_v, de_ctx, det_ctx, p);
alerts += PacketAlertCheck(p, 10);
drops += ((PACKET_TEST_ACTION(p, ACTION_DROP))?1:0);
drops += ((PacketTestAction(p, ACTION_DROP)) ? 1 : 0);
p->action = 0;
SigMatchSignatures(&th_v, de_ctx, det_ctx, p);
alerts += PacketAlertCheck(p, 10);
drops += ((PACKET_TEST_ACTION(p, ACTION_DROP))?1:0);
drops += ((PacketTestAction(p, ACTION_DROP)) ? 1 : 0);
p->action = 0;
SigMatchSignatures(&th_v, de_ctx, det_ctx, p);
alerts += PacketAlertCheck(p, 10);
drops += ((PACKET_TEST_ACTION(p, ACTION_DROP))?1:0);
drops += ((PacketTestAction(p, ACTION_DROP)) ? 1 : 0);
p->action = 0;
if (alerts == 1 && drops == 4)
@ -1515,17 +1515,17 @@ static int DetectThresholdTestSig12(void)
TimeGet(&p->ts);
SigMatchSignatures(&th_v, de_ctx, det_ctx, p);
alerts = PacketAlertCheck(p, 10);
drops += ((PACKET_TEST_ACTION(p, ACTION_DROP))?1:0);
drops += ((PacketTestAction(p, ACTION_DROP)) ? 1 : 0);
p->action = 0;
SigMatchSignatures(&th_v, de_ctx, det_ctx, p);
alerts += PacketAlertCheck(p, 10);
drops += ((PACKET_TEST_ACTION(p, ACTION_DROP))?1:0);
drops += ((PacketTestAction(p, ACTION_DROP)) ? 1 : 0);
p->action = 0;
SigMatchSignatures(&th_v, de_ctx, det_ctx, p);
alerts += PacketAlertCheck(p, 10);
drops += ((PACKET_TEST_ACTION(p, ACTION_DROP))?1:0);
drops += ((PacketTestAction(p, ACTION_DROP)) ? 1 : 0);
p->action = 0;
TimeSetIncrementTime(200);
@ -1533,17 +1533,17 @@ static int DetectThresholdTestSig12(void)
SigMatchSignatures(&th_v, de_ctx, det_ctx, p);
alerts += PacketAlertCheck(p, 10);
drops += ((PACKET_TEST_ACTION(p, ACTION_DROP))?1:0);
drops += ((PacketTestAction(p, ACTION_DROP)) ? 1 : 0);
p->action = 0;
SigMatchSignatures(&th_v, de_ctx, det_ctx, p);
alerts += PacketAlertCheck(p, 10);
drops += ((PACKET_TEST_ACTION(p, ACTION_DROP))?1:0);
drops += ((PacketTestAction(p, ACTION_DROP)) ? 1 : 0);
p->action = 0;
SigMatchSignatures(&th_v, de_ctx, det_ctx, p);
alerts += PacketAlertCheck(p, 10);
drops += ((PACKET_TEST_ACTION(p, ACTION_DROP))?1:0);
drops += ((PacketTestAction(p, ACTION_DROP)) ? 1 : 0);
p->action = 0;
if (alerts == 1 && drops == 2)

6
src/detect.c
Unescape Escape View File

@ -1540,7 +1540,7 @@ next:
void DetectSignatureApplyActions(Packet *p,
const Signature *s, const uint8_t alert_flags)
{
PACKET_UPDATE_ACTION(p, s->action);
PacketUpdateAction(p, s->action);
if (s->action & ACTION_DROP) {
if (p->alerts.drop.action == 0) {
@ -1601,9 +1601,7 @@ static void DetectNoFlow(ThreadVars *tv,
Packet *p)
{
/* No need to perform any detection on this packet, if the the given flag is set.*/
if ((p->flags & PKT_NOPACKET_INSPECTION) ||
(PACKET_TEST_ACTION(p, ACTION_DROP)))
{
if ((p->flags & PKT_NOPACKET_INSPECTION) || (PacketTestAction(p, ACTION_DROP))) {
return;
}

4
src/output-json-alert.c
Unescape Escape View File

@ -344,8 +344,8 @@ void AlertJsonHeader(void *ctx, const Packet *p, const PacketAlert *pa,
const char *action = "allowed";
/* use packet action if rate_filter modified the action */
if (unlikely(pa->flags & PACKET_ALERT_RATE_FILTER_MODIFIED)) {
if (PACKET_TEST_ACTION(p, (ACTION_DROP|ACTION_REJECT|
ACTION_REJECT_DST|ACTION_REJECT_BOTH))) {
if (PacketTestAction(
p, (ACTION_DROP | ACTION_REJECT | ACTION_REJECT_DST | ACTION_REJECT_BOTH))) {
action = "blocked";
}
} else {

2
src/output-json-drop.c
Unescape Escape View File

@ -351,7 +351,7 @@ static int JsonDropLogCondition(ThreadVars *tv, const Packet *p)
ret = TRUE;
return ret;
} else if (PACKET_TEST_ACTION(p, ACTION_DROP)) {
} else if (PacketTestAction(p, ACTION_DROP)) {
return TRUE;
}

26
src/respond-reject.c
Unescape Escape View File

@ -64,7 +64,7 @@ static TmEcode RespondRejectThreadDeinit(ThreadVars *tv, void *data)
static TmEcode RespondRejectFunc(ThreadVars *tv, Packet *p, void *data)
{
/* ACTION_REJECT defaults to rejecting the SRC */
if (likely(PACKET_TEST_ACTION(p, ACTION_REJECT_ANY) == 0)) {
if (likely(PacketTestAction(p, ACTION_REJECT_ANY) == 0)) {
return TM_ECODE_OK;
}
@ -92,13 +92,13 @@ static TmEcode RespondRejectFunc(ThreadVars *tv, Packet *p, void *data)
int RejectSendIPv4TCP(ThreadVars *tv, Packet *p, void *data)
{
SCEnter();
if (PACKET_TEST_ACTION(p, ACTION_REJECT)) {
if (PacketTestAction(p, ACTION_REJECT)) {
int r = RejectSendLibnet11IPv4TCP(tv, p, data, REJECT_DIR_SRC);
SCReturnInt(r);
} else if (PACKET_TEST_ACTION(p, ACTION_REJECT_DST)) {
} else if (PacketTestAction(p, ACTION_REJECT_DST)) {
int r = RejectSendLibnet11IPv4TCP(tv, p, data, REJECT_DIR_DST);
SCReturnInt(r);
} else if(PACKET_TEST_ACTION(p, ACTION_REJECT_BOTH)) {
} else if (PacketTestAction(p, ACTION_REJECT_BOTH)) {
int r = RejectSendLibnet11IPv4TCP(tv, p, data, REJECT_DIR_SRC);
r |= RejectSendLibnet11IPv4TCP(tv, p, data, REJECT_DIR_DST);
SCReturnInt(r);
@ -109,13 +109,13 @@ int RejectSendIPv4TCP(ThreadVars *tv, Packet *p, void *data)
int RejectSendIPv4ICMP(ThreadVars *tv, Packet *p, void *data)
{
SCEnter();
if (PACKET_TEST_ACTION(p, ACTION_REJECT)) {
if (PacketTestAction(p, ACTION_REJECT)) {
int r = RejectSendLibnet11IPv4ICMP(tv, p, data, REJECT_DIR_SRC);
SCReturnInt(r);
} else if (PACKET_TEST_ACTION(p, ACTION_REJECT_DST)) {
} else if (PacketTestAction(p, ACTION_REJECT_DST)) {
int r = RejectSendLibnet11IPv4ICMP(tv, p, data, REJECT_DIR_DST);
SCReturnInt(r);
} else if(PACKET_TEST_ACTION(p, ACTION_REJECT_BOTH)) {
} else if (PacketTestAction(p, ACTION_REJECT_BOTH)) {
int r = RejectSendLibnet11IPv4ICMP(tv, p, data, REJECT_DIR_SRC);
r |= RejectSendLibnet11IPv4ICMP(tv, p, data, REJECT_DIR_DST);
SCReturnInt(r);
@ -126,13 +126,13 @@ int RejectSendIPv4ICMP(ThreadVars *tv, Packet *p, void *data)
int RejectSendIPv6TCP(ThreadVars *tv, Packet *p, void *data)
{
SCEnter();
if (PACKET_TEST_ACTION(p, ACTION_REJECT)) {
if (PacketTestAction(p, ACTION_REJECT)) {
int r = RejectSendLibnet11IPv6TCP(tv, p, data, REJECT_DIR_SRC);
SCReturnInt(r);
} else if (PACKET_TEST_ACTION(p, ACTION_REJECT_DST)) {
} else if (PacketTestAction(p, ACTION_REJECT_DST)) {
int r = RejectSendLibnet11IPv6TCP(tv, p, data, REJECT_DIR_DST);
SCReturnInt(r);
} else if(PACKET_TEST_ACTION(p, ACTION_REJECT_BOTH)) {
} else if (PacketTestAction(p, ACTION_REJECT_BOTH)) {
int r = RejectSendLibnet11IPv6TCP(tv, p, data, REJECT_DIR_SRC);
r |= RejectSendLibnet11IPv6TCP(tv, p, data, REJECT_DIR_DST);
SCReturnInt(r);
@ -143,13 +143,13 @@ int RejectSendIPv6TCP(ThreadVars *tv, Packet *p, void *data)
int RejectSendIPv6ICMP(ThreadVars *tv, Packet *p, void *data)
{
SCEnter();
if (PACKET_TEST_ACTION(p, ACTION_REJECT)) {
if (PacketTestAction(p, ACTION_REJECT)) {
int r = RejectSendLibnet11IPv6ICMP(tv, p, data, REJECT_DIR_SRC);
SCReturnInt(r);
} else if (PACKET_TEST_ACTION(p, ACTION_REJECT_DST)) {
} else if (PacketTestAction(p, ACTION_REJECT_DST)) {
int r = RejectSendLibnet11IPv6ICMP(tv, p, data, REJECT_DIR_DST);
SCReturnInt(r);
} else if(PACKET_TEST_ACTION(p, ACTION_REJECT_BOTH)) {
} else if (PacketTestAction(p, ACTION_REJECT_BOTH)) {
int r = RejectSendLibnet11IPv6ICMP(tv, p, data, REJECT_DIR_SRC);
r |= RejectSendLibnet11IPv6ICMP(tv, p, data, REJECT_DIR_DST);
SCReturnInt(r);

2
src/source-af-packet.c
Unescape Escape View File

@ -726,7 +726,7 @@ static TmEcode AFPWritePacket(Packet *p, int version)
uint16_t vlan_tci = 0;
if (p->afp_v.copy_mode == AFP_COPY_MODE_IPS) {
if (PACKET_TEST_ACTION(p, ACTION_DROP)) {
if (PacketTestAction(p, ACTION_DROP)) {
return TM_ECODE_OK;
}
}

2
src/source-ipfw.c
Unescape Escape View File

@ -533,7 +533,7 @@ TmEcode IPFWSetVerdict(ThreadVars *tv, IPFWThreadVars *ptv, Packet *p)
IPFWpoll.events = POLLWRNORM;
#endif
if (PACKET_TEST_ACTION(p, ACTION_DROP)) {
if (PacketTestAction(p, ACTION_DROP)) {
verdict = IPFW_DROP;
} else {
verdict = IPFW_ACCEPT;

4
src/source-napatech.c
Unescape Escape View File

@ -581,7 +581,7 @@ static int ProgramFlow(Packet *p, int is_inline)
flow_match.gfi = 1; /* Generate FlowInfo records */
flow_match.tau = 1; /* tcp automatic unlearn */
if (PACKET_TEST_ACTION(p, ACTION_DROP)) {
if (PacketTestAction(p, ACTION_DROP)) {
flow_match.keySetId = NAPATECH_FLOWTYPE_DROP;
} else {
if (is_inline) {
@ -680,7 +680,7 @@ static void NapatechReleasePacket(struct Packet_ *p)
* before releasing the Napatech buffer back to NTService.
*/
#ifdef NAPATECH_ENABLE_BYPASS
if (is_inline && PACKET_TEST_ACTION(p, ACTION_DROP)) {
if (is_inline && PacketTestAction(p, ACTION_DROP)) {
p->ntpv.dyn3->wireLength = 0;
}

2
src/source-netmap.c
Unescape Escape View File

@ -515,7 +515,7 @@ error:
static TmEcode NetmapWritePacket(NetmapThreadVars *ntv, Packet *p)
{
if (ntv->copy_mode == NETMAP_COPY_MODE_IPS) {
if (PACKET_TEST_ACTION(p, ACTION_DROP)) {
if (PacketTestAction(p, ACTION_DROP)) {
return TM_ECODE_OK;
}
}

6
src/source-nfq.c
Unescape Escape View File

@ -475,7 +475,7 @@ static int NFQSetupPkt (Packet *p, struct nfq_q_handle *qh, void *data)
static void NFQReleasePacket(Packet *p)
{
if (unlikely(!p->nfq_v.verdicted)) {
PACKET_UPDATE_ACTION(p, ACTION_DROP);
PacketUpdateAction(p, ACTION_DROP);
NFQSetVerdict(p);
}
PacketFreeOrRelease(p);
@ -1036,7 +1036,7 @@ static inline uint32_t GetVerdict(const Packet *p)
{
uint32_t verdict = NF_ACCEPT;
if (PACKET_TEST_ACTION(p, ACTION_DROP)) {
if (PacketTestAction(p, ACTION_DROP)) {
verdict = NF_DROP;
} else {
switch (nfq_config.mode) {
@ -1058,7 +1058,7 @@ static inline uint32_t GetVerdict(const Packet *p)
#ifdef COUNTERS
static inline void UpdateCounters(NFQQueueVars *t, const Packet *p)
{
if (PACKET_TEST_ACTION(p, ACTION_DROP)) {
if (PacketTestAction(p, ACTION_DROP)) {
t->dropped++;
} else {
if (p->flags & PKT_STREAM_MODIFIED) {

2
src/source-windivert.c
Unescape Escape View File

@ -789,7 +789,7 @@ static TmEcode WinDivertVerdictHelper(ThreadVars *tv, Packet *p)
/* DROP simply means we do nothing; the WinDivert driver does the rest.
*/
if (PACKET_TEST_ACTION(p, ACTION_DROP)) {
if (PacketTestAction(p, ACTION_DROP)) {
#ifdef COUNTERS
SCMutexLock(&wd_qv->counters_mutex);
wd_qv->dropped++;

6
src/tests/detect.c
Unescape Escape View File

@ -4805,7 +4805,7 @@ static int SigTestDropFlow03(void)
goto end;
}
if ( !(PACKET_TEST_ACTION(p2, ACTION_DROP))) {
if (!(PacketTestAction(p2, ACTION_DROP))) {
printf("A \"drop\" action should be set from the flow to the packet: ");
goto end;
}
@ -4943,7 +4943,7 @@ static int SigTestDropFlow04(void)
goto end;
}
if (!(PACKET_TEST_ACTION(p1, ACTION_DROP))) {
if (!(PacketTestAction(p1, ACTION_DROP))) {
printf("A \"drop\" action was set from the flow to the packet "
"which is right, but setting the flag shouldn't disable "
"inspection on the packet in IDS mode");
@ -4988,7 +4988,7 @@ static int SigTestDropFlow04(void)
goto end;
}
if (!(PACKET_TEST_ACTION(p2, ACTION_DROP))) {
if (!(PacketTestAction(p2, ACTION_DROP))) {
printf("A \"drop\" action was set from the flow to the packet "
"which is right, but setting the flag shouldn't disable "
"inspection on the packet in IDS mode");

56
src/util-threshold-config.c
Unescape Escape View File

@ -1636,15 +1636,15 @@ static int SCThresholdConfTest09(void)
p->alerts.cnt = 0;
p->action = 0;
SigMatchSignatures(&th_v, de_ctx, det_ctx, p);
FAIL_IF(p->alerts.cnt != 1 || PACKET_TEST_ACTION(p, ACTION_DROP));
FAIL_IF(p->alerts.cnt != 1 || PacketTestAction(p, ACTION_DROP));
p->alerts.cnt = 0;
p->action = 0;
SigMatchSignatures(&th_v, de_ctx, det_ctx, p);
FAIL_IF(p->alerts.cnt != 1 || PACKET_TEST_ACTION(p, ACTION_DROP));
FAIL_IF(p->alerts.cnt != 1 || PacketTestAction(p, ACTION_DROP));
p->alerts.cnt = 0;
p->action = 0;
SigMatchSignatures(&th_v, de_ctx, det_ctx, p);
FAIL_IF(p->alerts.cnt != 1 || PACKET_TEST_ACTION(p, ACTION_DROP));
FAIL_IF(p->alerts.cnt != 1 || PacketTestAction(p, ACTION_DROP));
TimeSetIncrementTime(2);
TimeGet(&p->ts);
@ -1652,7 +1652,7 @@ static int SCThresholdConfTest09(void)
p->alerts.cnt = 0;
p->action = 0;
SigMatchSignatures(&th_v, de_ctx, det_ctx, p);
FAIL_IF(p->alerts.cnt != 1 || !(PACKET_TEST_ACTION(p, ACTION_DROP)));
FAIL_IF(p->alerts.cnt != 1 || !(PacketTestAction(p, ACTION_DROP)));
TimeSetIncrementTime(3);
TimeGet(&p->ts);
@ -1660,7 +1660,7 @@ static int SCThresholdConfTest09(void)
p->alerts.cnt = 0;
p->action = 0;
SigMatchSignatures(&th_v, de_ctx, det_ctx, p);
FAIL_IF(p->alerts.cnt != 1 || !(PACKET_TEST_ACTION(p, ACTION_DROP)));
FAIL_IF(p->alerts.cnt != 1 || !(PacketTestAction(p, ACTION_DROP)));
TimeSetIncrementTime(10);
TimeGet(&p->ts);
@ -1668,12 +1668,12 @@ static int SCThresholdConfTest09(void)
p->alerts.cnt = 0;
p->action = 0;
SigMatchSignatures(&th_v, de_ctx, det_ctx, p);
FAIL_IF(p->alerts.cnt != 1 || PACKET_TEST_ACTION(p, ACTION_DROP));
FAIL_IF(p->alerts.cnt != 1 || PacketTestAction(p, ACTION_DROP));
p->alerts.cnt = 0;
p->action = 0;
SigMatchSignatures(&th_v, de_ctx, det_ctx, p);
FAIL_IF(p->alerts.cnt != 1 || PACKET_TEST_ACTION(p, ACTION_DROP));
FAIL_IF(p->alerts.cnt != 1 || PacketTestAction(p, ACTION_DROP));
UTHFreePacket(p);
DetectEngineThreadCtxDeinit(&th_v, (void *)det_ctx);
@ -1730,21 +1730,21 @@ static int SCThresholdConfTest10(void)
/* All should be alerted, none dropped */
SigMatchSignatures(&th_v, de_ctx, det_ctx, p1);
FAIL_IF(PACKET_TEST_ACTION(p1, ACTION_DROP));
FAIL_IF(PacketTestAction(p1, ACTION_DROP));
FAIL_IF(PacketAlertCheck(p1, 10) != 1);
p1->action = 0;
SigMatchSignatures(&th_v, de_ctx, det_ctx, p2);
FAIL_IF(PACKET_TEST_ACTION(p2, ACTION_DROP));
FAIL_IF(PacketTestAction(p2, ACTION_DROP));
FAIL_IF(PacketAlertCheck(p2, 10) != 1);
p2->action = 0;
SigMatchSignatures(&th_v, de_ctx, det_ctx, p1);
FAIL_IF(PACKET_TEST_ACTION(p1, ACTION_DROP));
FAIL_IF(PacketTestAction(p1, ACTION_DROP));
FAIL_IF(PacketAlertCheck(p1, 10) != 1);
p1->action = 0;
/* Match #4 should be dropped*/
SigMatchSignatures(&th_v, de_ctx, det_ctx, p2);
FAIL_IF_NOT(PACKET_TEST_ACTION(p2, ACTION_DROP));
FAIL_IF_NOT(PacketTestAction(p2, ACTION_DROP));
FAIL_IF(PacketAlertCheck(p2, 10) != 1);
p2->action = 0;
@ -1753,7 +1753,7 @@ static int SCThresholdConfTest10(void)
/* Still dropped because timeout not expired */
SigMatchSignatures(&th_v, de_ctx, det_ctx, p1);
FAIL_IF_NOT(PACKET_TEST_ACTION(p1, ACTION_DROP));
FAIL_IF_NOT(PacketTestAction(p1, ACTION_DROP));
FAIL_IF(PacketAlertCheck(p1, 10) != 1);
p1->action = 0;
@ -1762,7 +1762,7 @@ static int SCThresholdConfTest10(void)
/* Not dropped because timeout expired */
SigMatchSignatures(&th_v, de_ctx, det_ctx, p1);
FAIL_IF(PACKET_TEST_ACTION(p1, ACTION_DROP));
FAIL_IF(PacketTestAction(p1, ACTION_DROP));
FAIL_IF(PacketAlertCheck(p1, 10) != 1);
/* Ensure that a Threshold entry was installed at the sig */
@ -2135,7 +2135,7 @@ static int SCThresholdConfTest15(void)
/* 10000 shouldn't match */
FAIL_IF(PacketAlertCheck(p, 10000) != 0);
/* however, it should have set the drop flag */
FAIL_IF(!(PACKET_TEST_ACTION(p, ACTION_DROP)));
FAIL_IF(!(PacketTestAction(p, ACTION_DROP)));
UTHFreePacket(p);
DetectEngineThreadCtxDeinit(&th_v, (void *)det_ctx);
@ -2186,7 +2186,7 @@ static int SCThresholdConfTest16(void)
FAIL_IF(PacketAlertCheck(p, 1000) != 0);
/* however, it should have set the drop flag */
FAIL_IF(!(PACKET_TEST_ACTION(p, ACTION_DROP)));
FAIL_IF(!(PacketTestAction(p, ACTION_DROP)));
UTHFreePacket(p);
DetectEngineThreadCtxDeinit(&th_v, (void *)det_ctx);
@ -2238,7 +2238,7 @@ static int SCThresholdConfTest17(void)
/* 10000 shouldn't match */
FAIL_IF(PacketAlertCheck(p, 10000) != 0);
/* however, it should have set the drop flag */
FAIL_IF(!(PACKET_TEST_ACTION(p, ACTION_DROP)));
FAIL_IF(!(PacketTestAction(p, ACTION_DROP)));
UTHFreePacket(p);
DetectEngineThreadCtxDeinit(&th_v, (void *)det_ctx);
@ -2528,15 +2528,15 @@ static int SCThresholdConfTest22(void)
/* All should be alerted, none dropped */
SigMatchSignatures(&th_v, de_ctx, det_ctx, p1);
FAIL_IF(PACKET_TEST_ACTION(p1, ACTION_DROP));
FAIL_IF(PacketTestAction(p1, ACTION_DROP));
FAIL_IF(PacketAlertCheck(p1, 10) != 1);
SigMatchSignatures(&th_v, de_ctx, det_ctx, p2);
FAIL_IF(PACKET_TEST_ACTION(p2, ACTION_DROP));
FAIL_IF(PacketTestAction(p2, ACTION_DROP));
FAIL_IF(PacketAlertCheck(p2, 10) != 1);
SigMatchSignatures(&th_v, de_ctx, det_ctx, p3);
FAIL_IF(PACKET_TEST_ACTION(p3, ACTION_DROP));
FAIL_IF(PacketTestAction(p3, ACTION_DROP));
FAIL_IF(PacketAlertCheck(p3, 10) != 1);
p1->action = p2->action = p3->action = 0;
@ -2547,7 +2547,7 @@ static int SCThresholdConfTest22(void)
/* p1 still shouldn't be dropped after 2nd alert */
SigMatchSignatures(&th_v, de_ctx, det_ctx, p1);
FAIL_IF(PACKET_TEST_ACTION(p1, ACTION_DROP));
FAIL_IF(PacketTestAction(p1, ACTION_DROP));
FAIL_IF(PacketAlertCheck(p1, 10) != 1);
p1->action = 0;
@ -2558,15 +2558,15 @@ static int SCThresholdConfTest22(void)
/* All should be alerted, only p1 must be dropped due to rate_filter*/
SigMatchSignatures(&th_v, de_ctx, det_ctx, p1);
FAIL_IF_NOT(PACKET_TEST_ACTION(p1, ACTION_DROP));
FAIL_IF_NOT(PacketTestAction(p1, ACTION_DROP));
FAIL_IF(PacketAlertCheck(p1, 10) != 1);
SigMatchSignatures(&th_v, de_ctx, det_ctx, p2);
FAIL_IF(PACKET_TEST_ACTION(p2, ACTION_DROP));
FAIL_IF(PacketTestAction(p2, ACTION_DROP));
FAIL_IF(PacketAlertCheck(p2, 10) != 1);
SigMatchSignatures(&th_v, de_ctx, det_ctx, p3);
FAIL_IF(PACKET_TEST_ACTION(p3, ACTION_DROP));
FAIL_IF(PacketTestAction(p3, ACTION_DROP));
FAIL_IF(PacketAlertCheck(p3, 10) != 1);
p1->action = p2->action = p3->action = 0;
@ -2577,15 +2577,15 @@ static int SCThresholdConfTest22(void)
/* All should be alerted, none dropped (because timeout expired) */
SigMatchSignatures(&th_v, de_ctx, det_ctx, p1);
FAIL_IF(PACKET_TEST_ACTION(p1, ACTION_DROP));
FAIL_IF(PacketTestAction(p1, ACTION_DROP));
FAIL_IF(PacketAlertCheck(p1, 10) != 1);
SigMatchSignatures(&th_v, de_ctx, det_ctx, p2);
FAIL_IF(PACKET_TEST_ACTION(p2, ACTION_DROP));
FAIL_IF(PacketTestAction(p2, ACTION_DROP));
FAIL_IF(PacketAlertCheck(p2, 10) != 1);
SigMatchSignatures(&th_v, de_ctx, det_ctx, p3);
FAIL_IF(PACKET_TEST_ACTION(p3, ACTION_DROP));
FAIL_IF(PacketTestAction(p3, ACTION_DROP));
FAIL_IF(PacketAlertCheck(p3, 10) != 1);
UTHFreePacket(p3);
@ -2662,7 +2662,7 @@ static int SCThresholdConfTest23(void)
TimeGet(&p1->ts);
SigMatchSignatures(&th_v, de_ctx, det_ctx, p1);
/* First packet should be alerted, not dropped */
FAIL_IF(PACKET_TEST_ACTION(p1, ACTION_DROP));
FAIL_IF(PacketTestAction(p1, ACTION_DROP));
FAIL_IF(PacketAlertCheck(p1, 10) != 1);
TimeSetIncrementTime(2);
@ -2671,7 +2671,7 @@ static int SCThresholdConfTest23(void)
/* Second packet should be dropped because it considered as "the same pair"
and rate_filter count reached*/
FAIL_IF_NOT(PACKET_TEST_ACTION(p2, ACTION_DROP));
FAIL_IF_NOT(PacketTestAction(p2, ACTION_DROP));
FAIL_IF(PacketAlertCheck(p2, 10) != 1);
UTHFreePacket(p2);

Write Preview
Loading…
Cancel
Save