Changing the veredict actions to flags to allow simultaneous veredict

src/action-globals.h

@@ -2,13 +2,14 @@
 #ifndef __ACTION_GLOBALS_H__
 #define __ACTION_GLOBALS_H__
 
-typedef enum {
+/* Changing them as flags, so later we can have alerts
-    ACTION_ALERT,
+ * and drop simultaneously */
-    ACTION_DROP,
+#define    ACTION_ALERT         0x01
-    ACTION_REJECT,
+#define    ACTION_DROP          0x02
-    ACTION_REJECT_DST,
+#define    ACTION_REJECT        0x04
-    ACTION_REJECT_BOTH,
+#define    ACTION_REJECT_DST    0x08
-    ACTION_PASS
+#define    ACTION_REJECT_BOTH   0x10
-} ActionType;
+#define    ACTION_PASS          0x20
+
 
 #endif /* __ACTION_GLOBALS_H__ */

src/alert-unified2-alert.c

@@ -331,7 +331,7 @@ int Unified2IPv6TypeAlert (ThreadVars *t, Packet *p, void *data, PacketQueue *pq
     phdr.dst_ip = *(struct in6_addr*)GET_IPV6_DST_ADDR(p);
     phdr.protocol = IPV6_GET_NH(p);
 
-    if(p->action == ACTION_DROP)
+    if(p->action & ACTION_DROP)
         phdr.packet_action = UNIFIED2_BLOCKED_FLAG;
     else
         phdr.packet_action = 0;
@@ -442,7 +442,7 @@ int Unified2IPv4TypeAlert (ThreadVars *tv, Packet *p, void *data, PacketQueue *p
     phdr.dst_ip = p->ip4h->ip_dst.s_addr;
     phdr.protocol = IPV4_GET_RAW_IPPROTO(p->ip4h);
 
-    if(p->action == ACTION_DROP)
+    if(p->action & ACTION_DROP)
         phdr.packet_action = UNIFIED2_BLOCKED_FLAG;
     else
         phdr.packet_action = 0;

src/decode.h

@@ -300,7 +300,7 @@ typedef struct Packet_
     PacketAlerts alerts;
 
     /* IPS action to take */
-    ActionType action;
+    uint8_t action;
 
     /* double linked list ptrs */
     struct Packet_ *next;

src/detect-engine-iponly.c

@@ -380,7 +380,7 @@ void IPOnlyMatchPacket(DetectEngineCtx *de_ctx, DetectEngineIPOnlyCtx *io_ctx,
         if (!(s->flags & SIG_FLAG_NOALERT)) {
             PacketAlertHandle(de_ctx,s,p);
             /* set verdict on packet */
-            p->action = s->action;
+            p->action |= s->action;
         }
     }
 }

src/detect.c

@@ -686,7 +686,7 @@ int SigMatchSignatures(ThreadVars *th_v, DetectEngineCtx *de_ctx, DetectEngineTh
             if (!(s->flags & SIG_FLAG_NOALERT)) {
                 PacketAlertHandle(de_ctx,s,p);
                 /* set verdict on packet */
-                p->action = s->action;
+                p->action |= s->action;
             }
         } else {
             /* reset pkt ptr and offset */
@@ -725,7 +725,7 @@ int SigMatchSignatures(ThreadVars *th_v, DetectEngineCtx *de_ctx, DetectEngineTh
                                     if (rmatch == 0) {
                                         PacketAlertHandle(de_ctx,s,p);
                                         /* set verdict on packet */
-                                        p->action = s->action;
+                                        p->action |= s->action;
                                     }
                                 }
                                 rmatch = fmatch = 1;
@@ -771,7 +771,7 @@ int SigMatchSignatures(ThreadVars *th_v, DetectEngineCtx *de_ctx, DetectEngineTh
                                 PacketAlertHandle(de_ctx,s,p);
 
                                 /* set verdict on packet */
-                                p->action = s->action;
+                                p->action |= s->action;
                             }
                         }
                     } else {

src/respond-reject.c

@@ -41,8 +41,8 @@ TmEcode RespondRejectFunc(ThreadVars *tv, Packet *p, void *data, PacketQueue *pq
 
     int ret = 0;
     /* ACTION_REJECT defaults to rejecting the SRC */
-    if (p->action != ACTION_REJECT && p->action != ACTION_REJECT_DST &&
+    if (!(p->action & ACTION_REJECT) && !(p->action & ACTION_REJECT_DST) &&
-        p->action != ACTION_REJECT_BOTH) {
+        (p->action & ACTION_REJECT_BOTH)) {
         return TM_ECODE_OK;
     }
 
@@ -73,11 +73,11 @@ TmEcode RespondRejectFunc(ThreadVars *tv, Packet *p, void *data, PacketQueue *pq
 }
 
 int RejectSendIPv4TCP(ThreadVars *tv, Packet *p, void *data) {
-    if (p->action == ACTION_REJECT) {
+    if (p->action & ACTION_REJECT) {
         return RejectSendLibnet11L3IPv4TCP(tv, p, data, REJECT_DIR_SRC);
-    } else if (p->action == ACTION_REJECT_DST) {
+    } else if (p->action & ACTION_REJECT_DST) {
         return RejectSendLibnet11L3IPv4TCP(tv, p, data, REJECT_DIR_DST);
-    } else if(p->action == ACTION_REJECT_BOTH) {
+    } else if(p->action & ACTION_REJECT_BOTH) {
         if (RejectSendLibnet11L3IPv4TCP(tv, p, data, REJECT_DIR_SRC) == 0 &&
             RejectSendLibnet11L3IPv4TCP(tv, p, data, REJECT_DIR_DST) == 0) {
             return 0;
@@ -89,11 +89,11 @@ int RejectSendIPv4TCP(ThreadVars *tv, Packet *p, void *data) {
 }
 
 int RejectSendIPv4ICMP(ThreadVars *tv, Packet *p, void *data) {
-    if (p->action == ACTION_REJECT) {
+    if (p->action & ACTION_REJECT) {
         return RejectSendLibnet11L3IPv4ICMP(tv, p, data, REJECT_DIR_SRC);
-    } else if (p->action == ACTION_REJECT_DST) {
+    } else if (p->action & ACTION_REJECT_DST) {
         return RejectSendLibnet11L3IPv4ICMP(tv, p, data, REJECT_DIR_DST);
-    } else if(p->action == ACTION_REJECT_BOTH) {
+    } else if(p->action & ACTION_REJECT_BOTH) {
         if (RejectSendLibnet11L3IPv4ICMP(tv, p, data, REJECT_DIR_SRC) == 0 &&
             RejectSendLibnet11L3IPv4ICMP(tv, p, data, REJECT_DIR_DST) == 0) {
             return 0;

src/source-nfq.c

@@ -407,23 +407,22 @@ void NFQSetVerdict(NFQThreadVars *t, Packet *p) {
 
     //printf("%p verdicting on queue %" PRIu32 "\n", t, t->queue_num);
 
-    switch (p->action) {
+    if (p->action & ACTION_REJECT || p->action & ACTION_REJECT_BOTH ||
-        case ACTION_ALERT:
+        p->action & ACTION_REJECT_DST || p->action & ACTION_DROP) {
-        case ACTION_PASS:
+        verdict = NF_DROP;
-            verdict = NF_ACCEPT;
 #ifdef COUNTERS
-            t->accepted++;
+        t->dropped++;
 #endif /* COUNTERS */
-            break;
+    } else if (p->action & ACTION_ALERT || p->action & ACTION_ALERT) {
-        case ACTION_REJECT:
+        verdict = NF_ACCEPT;
-        case ACTION_REJECT_DST:
+#ifdef COUNTERS
-        case ACTION_REJECT_BOTH:
+        t->accepted++;
-        case ACTION_DROP:
+#endif /* COUNTERS */
-        default:
+    } else {
             /* a verdict we don't know about, drop to be sure */
-            verdict = NF_DROP;
+        verdict = NF_DROP;
 #ifdef COUNTERS
-            t->dropped++;
+        t->dropped++;
 #endif /* COUNTERS */
     }