From 9c76480ac35291da38f5a4f11dab8a6ce5a5142b Mon Sep 17 00:00:00 2001 From: Victor Julien Date: Thu, 28 May 2026 20:50:19 +0200 Subject: [PATCH] detect/firewall: further simplify flow control For the last for progress case we can just break on a firewall drop. For the accept:flow and accept:tx cases the next sig (if any) will check the flow/tx flag and manage flow control from there. --- src/detect.c | 15 ++++----------- 1 file changed, 4 insertions(+), 11 deletions(-) diff --git a/src/detect.c b/src/detect.c index 9a92242a88..8087cf0732 100644 --- a/src/detect.c +++ b/src/detect.c @@ -2488,22 +2488,15 @@ static void DetectRunTx(ThreadVars *tv, flow_flags & STREAM_TOSERVER ? "toserver" : "toclient", s->app_progress_hook); /* if this rule was the last for our progress state, and it didn't match, - * we have to invoke the default policy. We only check the current rule hook. */ + * we have to invoke the default policy. We only check the current rule hook. + * DROP is immediate, flow control for various accept options is handled by + * the DetectRunTxPreCheckFirewallPolicy function for the next rule. */ const struct DetectFirewallPolicy *policy = DetectFirewallApplyDefaultAppPolicy( det_ctx, det_ctx->de_ctx->fw_policies->app, &tx, p, s->alproto, flow_flags, s->app_progress_hook, last_tx); SCLogDebug("fw_last_for_progress policy %02x", policy->action); if (policy->action & ACTION_DROP) { - fw_state.fw_skip_app_filter = true; - SCLogDebug("packet %02x", p->action); - } else if (policy->action & ACTION_ACCEPT) { - SCLogDebug("accept hook(s)? current hook %u (tx.detect_progress %u) max %u", - s->app_progress_hook, tx.detect_progress, tx.tx_progress); - - /* accepting flow, so skip rest of the fw rules */ - if (policy->action_scope == ACTION_SCOPE_FLOW) { - fw_state.fw_skip_app_filter = true; - } + return; } } DetectVarProcessList(det_ctx, p->flow, p);