diff --git a/src/action-globals.h b/src/action-globals.h index 5b2a0a527c..85726b6b38 100644 --- a/src/action-globals.h +++ b/src/action-globals.h @@ -2,13 +2,14 @@ #ifndef __ACTION_GLOBALS_H__ #define __ACTION_GLOBALS_H__ -typedef enum { - ACTION_ALERT, - ACTION_DROP, - ACTION_REJECT, - ACTION_REJECT_DST, - ACTION_REJECT_BOTH, - ACTION_PASS -} ActionType; +/* Changing them as flags, so later we can have alerts + * and drop simultaneously */ +#define ACTION_ALERT 0x01 +#define ACTION_DROP 0x02 +#define ACTION_REJECT 0x04 +#define ACTION_REJECT_DST 0x08 +#define ACTION_REJECT_BOTH 0x10 +#define ACTION_PASS 0x20 + #endif /* __ACTION_GLOBALS_H__ */ diff --git a/src/alert-unified2-alert.c b/src/alert-unified2-alert.c index cb0f543cf3..e9407d4d7c 100644 --- a/src/alert-unified2-alert.c +++ b/src/alert-unified2-alert.c @@ -331,7 +331,7 @@ int Unified2IPv6TypeAlert (ThreadVars *t, Packet *p, void *data, PacketQueue *pq phdr.dst_ip = *(struct in6_addr*)GET_IPV6_DST_ADDR(p); phdr.protocol = IPV6_GET_NH(p); - if(p->action == ACTION_DROP) + if(p->action & ACTION_DROP) phdr.packet_action = UNIFIED2_BLOCKED_FLAG; else phdr.packet_action = 0; @@ -442,7 +442,7 @@ int Unified2IPv4TypeAlert (ThreadVars *tv, Packet *p, void *data, PacketQueue *p phdr.dst_ip = p->ip4h->ip_dst.s_addr; phdr.protocol = IPV4_GET_RAW_IPPROTO(p->ip4h); - if(p->action == ACTION_DROP) + if(p->action & ACTION_DROP) phdr.packet_action = UNIFIED2_BLOCKED_FLAG; else phdr.packet_action = 0; diff --git a/src/decode.h b/src/decode.h index f46515ff3b..57227607d9 100644 --- a/src/decode.h +++ b/src/decode.h @@ -300,7 +300,7 @@ typedef struct Packet_ PacketAlerts alerts; /* IPS action to take */ - ActionType action; + uint8_t action; /* double linked list ptrs */ struct Packet_ *next; diff --git a/src/detect-engine-iponly.c b/src/detect-engine-iponly.c index 719217729a..8f3ff8fe64 100644 --- a/src/detect-engine-iponly.c +++ b/src/detect-engine-iponly.c @@ -380,7 +380,7 @@ void IPOnlyMatchPacket(DetectEngineCtx *de_ctx, DetectEngineIPOnlyCtx *io_ctx, if (!(s->flags & SIG_FLAG_NOALERT)) { PacketAlertHandle(de_ctx,s,p); /* set verdict on packet */ - p->action = s->action; + p->action |= s->action; } } } diff --git a/src/detect.c b/src/detect.c index 3ca3a19f7a..2834168eb0 100644 --- a/src/detect.c +++ b/src/detect.c @@ -686,7 +686,7 @@ int SigMatchSignatures(ThreadVars *th_v, DetectEngineCtx *de_ctx, DetectEngineTh if (!(s->flags & SIG_FLAG_NOALERT)) { PacketAlertHandle(de_ctx,s,p); /* set verdict on packet */ - p->action = s->action; + p->action |= s->action; } } else { /* reset pkt ptr and offset */ @@ -725,7 +725,7 @@ int SigMatchSignatures(ThreadVars *th_v, DetectEngineCtx *de_ctx, DetectEngineTh if (rmatch == 0) { PacketAlertHandle(de_ctx,s,p); /* set verdict on packet */ - p->action = s->action; + p->action |= s->action; } } rmatch = fmatch = 1; @@ -771,7 +771,7 @@ int SigMatchSignatures(ThreadVars *th_v, DetectEngineCtx *de_ctx, DetectEngineTh PacketAlertHandle(de_ctx,s,p); /* set verdict on packet */ - p->action = s->action; + p->action |= s->action; } } } else { diff --git a/src/respond-reject.c b/src/respond-reject.c index 71257c4411..50170bf888 100644 --- a/src/respond-reject.c +++ b/src/respond-reject.c @@ -41,8 +41,8 @@ TmEcode RespondRejectFunc(ThreadVars *tv, Packet *p, void *data, PacketQueue *pq int ret = 0; /* ACTION_REJECT defaults to rejecting the SRC */ - if (p->action != ACTION_REJECT && p->action != ACTION_REJECT_DST && - p->action != ACTION_REJECT_BOTH) { + if (!(p->action & ACTION_REJECT) && !(p->action & ACTION_REJECT_DST) && + (p->action & ACTION_REJECT_BOTH)) { return TM_ECODE_OK; } @@ -73,11 +73,11 @@ TmEcode RespondRejectFunc(ThreadVars *tv, Packet *p, void *data, PacketQueue *pq } int RejectSendIPv4TCP(ThreadVars *tv, Packet *p, void *data) { - if (p->action == ACTION_REJECT) { + if (p->action & ACTION_REJECT) { return RejectSendLibnet11L3IPv4TCP(tv, p, data, REJECT_DIR_SRC); - } else if (p->action == ACTION_REJECT_DST) { + } else if (p->action & ACTION_REJECT_DST) { return RejectSendLibnet11L3IPv4TCP(tv, p, data, REJECT_DIR_DST); - } else if(p->action == ACTION_REJECT_BOTH) { + } else if(p->action & ACTION_REJECT_BOTH) { if (RejectSendLibnet11L3IPv4TCP(tv, p, data, REJECT_DIR_SRC) == 0 && RejectSendLibnet11L3IPv4TCP(tv, p, data, REJECT_DIR_DST) == 0) { return 0; @@ -89,11 +89,11 @@ int RejectSendIPv4TCP(ThreadVars *tv, Packet *p, void *data) { } int RejectSendIPv4ICMP(ThreadVars *tv, Packet *p, void *data) { - if (p->action == ACTION_REJECT) { + if (p->action & ACTION_REJECT) { return RejectSendLibnet11L3IPv4ICMP(tv, p, data, REJECT_DIR_SRC); - } else if (p->action == ACTION_REJECT_DST) { + } else if (p->action & ACTION_REJECT_DST) { return RejectSendLibnet11L3IPv4ICMP(tv, p, data, REJECT_DIR_DST); - } else if(p->action == ACTION_REJECT_BOTH) { + } else if(p->action & ACTION_REJECT_BOTH) { if (RejectSendLibnet11L3IPv4ICMP(tv, p, data, REJECT_DIR_SRC) == 0 && RejectSendLibnet11L3IPv4ICMP(tv, p, data, REJECT_DIR_DST) == 0) { return 0; diff --git a/src/source-nfq.c b/src/source-nfq.c index fddfbe3bbf..501ac16add 100644 --- a/src/source-nfq.c +++ b/src/source-nfq.c @@ -407,23 +407,22 @@ void NFQSetVerdict(NFQThreadVars *t, Packet *p) { //printf("%p verdicting on queue %" PRIu32 "\n", t, t->queue_num); - switch (p->action) { - case ACTION_ALERT: - case ACTION_PASS: - verdict = NF_ACCEPT; + if (p->action & ACTION_REJECT || p->action & ACTION_REJECT_BOTH || + p->action & ACTION_REJECT_DST || p->action & ACTION_DROP) { + verdict = NF_DROP; #ifdef COUNTERS - t->accepted++; + t->dropped++; #endif /* COUNTERS */ - break; - case ACTION_REJECT: - case ACTION_REJECT_DST: - case ACTION_REJECT_BOTH: - case ACTION_DROP: - default: + } else if (p->action & ACTION_ALERT || p->action & ACTION_ALERT) { + verdict = NF_ACCEPT; +#ifdef COUNTERS + t->accepted++; +#endif /* COUNTERS */ + } else { /* a verdict we don't know about, drop to be sure */ - verdict = NF_DROP; + verdict = NF_DROP; #ifdef COUNTERS - t->dropped++; + t->dropped++; #endif /* COUNTERS */ }