aiden
/
suricata
mirror of https://github.com/OISF/suricata
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

detect: cleanup last tx logic

Browse Source 
Move into DetectTransaction.
pull/15486/head
Victor Julien 2 months ago
parent 3d00e73d91
commit e0b501a4b7
2 changed files with 46 additions and 47 deletions
Show Stats Download Patch File Download Diff File

1
src/detect-engine-prefilter.h
Unescape Escape View File

@ -42,6 +42,7 @@ typedef struct DetectTransaction_ {
const uint8_t tx_progress; const uint8_t tx_progress;
const uint8_t tx_end_state; const uint8_t tx_end_state;
bool is_last; /* is this the last tx? */
} DetectTransaction; } DetectTransaction;
typedef struct PrefilterStore_ { typedef struct PrefilterStore_ {

92
src/detect.c
Unescape Escape View File

@ -1505,7 +1505,7 @@ static int DetectRunTxInspectRule(ThreadVars *tv, DetectEngineCtx *de_ctx,
#define NO_TX \ #define NO_TX \
{ \ { \
NULL, 0, NULL, NULL, 0, 0, 0, 0, \ NULL, 0, NULL, NULL, 0, 0, 0, 0, false, \
} }
/** \internal /** \internal
@ -1559,6 +1559,7 @@ static DetectTransaction GetDetectTx(const uint8_t ipproto, const AppProto alpro
.detect_progress_orig = detect_progress, .detect_progress_orig = detect_progress,
.tx_progress = (uint8_t)tx_progress, .tx_progress = (uint8_t)tx_progress,
.tx_end_state = (uint8_t)tx_end_state, .tx_end_state = (uint8_t)tx_end_state,
.is_last = false,
}; };
return tx; return tx;
} }
@ -1684,7 +1685,7 @@ static inline void DetectRunAppendDefaultAppPolicyAlert(DetectEngineThreadCtx *d
static const struct DetectFirewallPolicy *DetectFirewallApplyDefaultAppPolicy( static const struct DetectFirewallPolicy *DetectFirewallApplyDefaultAppPolicy(
DetectEngineThreadCtx *det_ctx, const struct DetectFirewallAppPolicy *policies, DetectEngineThreadCtx *det_ctx, const struct DetectFirewallAppPolicy *policies,
const DetectTransaction *tx, Packet *p, const AppProto alproto, const uint8_t direction, const DetectTransaction *tx, Packet *p, const AppProto alproto, const uint8_t direction,
const uint8_t progress, const bool last_tx) const uint8_t progress)
{ {
const struct DetectFirewallPolicy *policy; const struct DetectFirewallPolicy *policy;
if (direction & STREAM_TOSERVER) { if (direction & STREAM_TOSERVER) {
@ -1725,10 +1726,10 @@ static const struct DetectFirewallPolicy *DetectFirewallApplyDefaultAppPolicy(
break; break;
case ACTION_SCOPE_TX: case ACTION_SCOPE_TX:
tx->tx_data_ptr->flags |= APP_LAYER_TX_ACCEPT; tx->tx_data_ptr->flags |= APP_LAYER_TX_ACCEPT;
apply_to_packet = last_tx; apply_to_packet = tx->is_last;
break; break;
case ACTION_SCOPE_HOOK: case ACTION_SCOPE_HOOK:
apply_to_packet = last_tx && last_hook; apply_to_packet = tx->is_last && last_hook;
break; break;
default: default:
/* should be unreachable */ /* should be unreachable */
@ -1768,25 +1769,26 @@ static const struct DetectFirewallPolicy *DetectFirewallApplyDefaultAppPolicy(
static enum DetectTxFirewallFlowControl DetectFirewallApplyDefaultPolicies( static enum DetectTxFirewallFlowControl DetectFirewallApplyDefaultPolicies(
DetectEngineThreadCtx *det_ctx, const struct DetectFirewallAppPolicy *policies, DetectEngineThreadCtx *det_ctx, const struct DetectFirewallAppPolicy *policies,
DetectTransaction *tx, Packet *p, const AppProto alproto, const uint8_t direction, DetectTransaction *tx, Packet *p, const AppProto alproto, const uint8_t direction,
const uint8_t start_hook, const uint8_t end_hook, const bool is_last) const uint8_t start_hook, const uint8_t end_hook)
{ {
DEBUG_VALIDATE_BUG_ON(start_hook > end_hook); DEBUG_VALIDATE_BUG_ON(start_hook > end_hook);
const bool need_verdict = const bool need_verdict =
is_last && (end_hook == tx->tx_end_state || end_hook == tx->tx_progress); tx->is_last && (end_hook == tx->tx_end_state || end_hook == tx->tx_progress);
SCLogDebug("need_verdict:%s is_last:%s end_hook:%u tx->tx_end_state:%u tx->progress: %u", SCLogDebug("need_verdict:%s is_last:%s end_hook:%u tx->tx_end_state:%u tx->progress: %u",
BOOL2STR(need_verdict), BOOL2STR(is_last), end_hook, tx->tx_end_state, tx->tx_progress); BOOL2STR(need_verdict), BOOL2STR(tx->is_last), end_hook, tx->tx_end_state,
tx->tx_progress);
for (uint8_t hook = start_hook; hook <= end_hook; hook++) { for (uint8_t hook = start_hook; hook <= end_hook; hook++) {
const bool apply_to_packet = const bool apply_to_packet =
is_last && (hook == tx->tx_end_state || hook == tx->tx_progress); tx->is_last && (hook == tx->tx_end_state || hook == tx->tx_progress);
SCLogDebug("%" PRIu64 ": %s default policy for hook %u, apply_to_packet %s", SCLogDebug("%" PRIu64 ": %s default policy for hook %u, apply_to_packet %s",
PcapPacketCntGet(p), direction & STREAM_TOSERVER ? "toserver" : "toclient", hook, PcapPacketCntGet(p), direction & STREAM_TOSERVER ? "toserver" : "toclient", hook,
BOOL2STR(apply_to_packet)); BOOL2STR(apply_to_packet));
const struct DetectFirewallPolicy *policy = DetectFirewallApplyDefaultAppPolicy(det_ctx, const struct DetectFirewallPolicy *policy = DetectFirewallApplyDefaultAppPolicy(
det_ctx->de_ctx->fw_policies->app, tx, p, alproto, direction, hook, is_last); det_ctx, det_ctx->de_ctx->fw_policies->app, tx, p, alproto, direction, hook);
SCLogDebug("fw: hook:%u policy:%02x apply_to_packet:%s", hook, policy->action, SCLogDebug("fw: hook:%u policy:%02x apply_to_packet:%s", hook, policy->action,
BOOL2STR(apply_to_packet)); BOOL2STR(apply_to_packet));
if (policy->action & ACTION_DROP) { if (policy->action & ACTION_DROP) {
@ -1845,8 +1847,7 @@ static enum DetectTxFirewallFlowControl DetectFirewallApplyDefaultPolicies(
*/ */
static enum DetectTxFirewallFlowControl DetectRunTxPreCheckFirewallPolicy( static enum DetectTxFirewallFlowControl DetectRunTxPreCheckFirewallPolicy(
DetectEngineThreadCtx *det_ctx, Packet *p, DetectTransaction *tx, const uint8_t direction, DetectEngineThreadCtx *det_ctx, Packet *p, DetectTransaction *tx, const uint8_t direction,
const Signature *s, const uint32_t can_idx, struct DetectFirewallAppTxState *fw_state, const Signature *s, const uint32_t can_idx, struct DetectFirewallAppTxState *fw_state)
const bool last_tx)
{ {
SCLogDebug("packet %" PRIu64 ": running pre-checks before sid %u", PcapPacketCntGet(p), s->id); SCLogDebug("packet %" PRIu64 ": running pre-checks before sid %u", PcapPacketCntGet(p), s->id);
@ -1875,7 +1876,7 @@ static enum DetectTxFirewallFlowControl DetectRunTxPreCheckFirewallPolicy(
/* append a blank accept:packet action for the APP_LAYER_TX_ACCEPT, /* append a blank accept:packet action for the APP_LAYER_TX_ACCEPT,
* if this is the last tx */ * if this is the last tx */
fw_state->fw_skip_app_filter = true; fw_state->fw_skip_app_filter = true;
const bool accept_tx_applies_to_packet = last_tx; const bool accept_tx_applies_to_packet = tx->is_last;
if (accept_tx_applies_to_packet) { if (accept_tx_applies_to_packet) {
SCLogDebug("accept:tx: should be applied to the packet"); SCLogDebug("accept:tx: should be applied to the packet");
DetectRunAppendDefaultAccept(det_ctx, p); DetectRunAppendDefaultAccept(det_ctx, p);
@ -1904,7 +1905,7 @@ static enum DetectTxFirewallFlowControl DetectRunTxPreCheckFirewallPolicy(
* no rules for that state. Invoke the default policies. */ * no rules for that state. Invoke the default policies. */
enum DetectTxFirewallFlowControl r = DetectFirewallApplyDefaultPolicies(det_ctx, enum DetectTxFirewallFlowControl r = DetectFirewallApplyDefaultPolicies(det_ctx,
det_ctx->de_ctx->fw_policies->app, tx, p, s->alproto, direction, det_ctx->de_ctx->fw_policies->app, tx, p, s->alproto, direction,
tx->detect_progress_orig, s->app_progress_hook - 1, last_tx); tx->detect_progress_orig, s->app_progress_hook - 1);
if (r != DETECT_TX_FW_FC_OK) { if (r != DETECT_TX_FW_FC_OK) {
/* both SKIP and BREAK mean: no more fw rules to inspect. /* both SKIP and BREAK mean: no more fw rules to inspect.
* SKIP applies to just this TX. * SKIP applies to just this TX.
@ -2007,8 +2008,7 @@ static void DetectRunAppendDefaultAccept(DetectEngineThreadCtx *det_ctx, Packet
/** \internal /** \internal
* \brief see if the accept rule needs to apply to the packet * \brief see if the accept rule needs to apply to the packet
*/ */
static inline bool ApplyAcceptToPacket( static inline bool ApplyAcceptToPacket(const DetectTransaction *tx, const Signature *s)
const bool last_tx, const DetectTransaction *tx, const Signature *s)
{ {
if ((s->flags & SIG_FLAG_FIREWALL) == 0) { if ((s->flags & SIG_FLAG_FIREWALL) == 0) {
return false; return false;
@ -2021,7 +2021,7 @@ static inline bool ApplyAcceptToPacket(
* - packet will only be accepted if this is set on the last tx * - packet will only be accepted if this is set on the last tx
*/ */
if (s->action_scope == ACTION_SCOPE_TX) { if (s->action_scope == ACTION_SCOPE_TX) {
if (last_tx) { if (tx->is_last) {
return true; return true;
} }
} }
@ -2029,7 +2029,7 @@ static inline bool ApplyAcceptToPacket(
* - packet will only be accepted if this is set on the last tx * - packet will only be accepted if this is set on the last tx
* - the hook accepted should be the last progress available. */ * - the hook accepted should be the last progress available. */
if (s->action_scope == ACTION_SCOPE_HOOK) { if (s->action_scope == ACTION_SCOPE_HOOK) {
if (last_tx && (s->app_progress_hook == tx->tx_progress)) { if (tx->is_last && (s->app_progress_hook == tx->tx_progress)) {
return true; return true;
} }
} }
@ -2043,7 +2043,7 @@ static inline bool ApplyAcceptToPacket(
* *
* */ * */
static void DetectRunTxFirewallApplyAccept(DetectEngineThreadCtx *det_ctx, Packet *p, static void DetectRunTxFirewallApplyAccept(DetectEngineThreadCtx *det_ctx, Packet *p,
const uint8_t direction, const Signature *s, DetectTransaction *tx, const bool is_last, const uint8_t direction, const Signature *s, DetectTransaction *tx,
struct DetectFirewallAppTxState *fw_state) struct DetectFirewallAppTxState *fw_state)
{ {
const enum ActionScope as = s->action_scope; const enum ActionScope as = s->action_scope;
@ -2065,9 +2065,9 @@ static void DetectRunTxFirewallApplyAccept(DetectEngineThreadCtx *det_ctx, Packe
const uint8_t last_hook = fw_state->last_fw_rule const uint8_t last_hook = fw_state->last_fw_rule
? tx->tx_end_state ? tx->tx_end_state
: MIN(tx->tx_end_state, s->app_progress_hook + 1); : MIN(tx->tx_end_state, s->app_progress_hook + 1);
enum DetectTxFirewallFlowControl r = DetectFirewallApplyDefaultPolicies(det_ctx, enum DetectTxFirewallFlowControl r =
det_ctx->de_ctx->fw_policies->app, tx, p, s->alproto, direction, DetectFirewallApplyDefaultPolicies(det_ctx, det_ctx->de_ctx->fw_policies->app,
s->app_progress_hook + 1, last_hook, is_last); tx, p, s->alproto, direction, s->app_progress_hook + 1, last_hook);
if (r == DETECT_TX_FW_FC_BREAK) { if (r == DETECT_TX_FW_FC_BREAK) {
fw_state->fw_skip_app_filter = true; fw_state->fw_skip_app_filter = true;
return; return;
@ -2097,8 +2097,7 @@ static void DetectRunTxFirewallApplyAccept(DetectEngineThreadCtx *det_ctx, Packe
* \retval 0 ok, continue as normal. No policies applied. * \retval 0 ok, continue as normal. No policies applied.
*/ */
static int DetectTxFirewallNoRulesApplyPolicies(DetectEngineThreadCtx *det_ctx, Packet *p, Flow *f, static int DetectTxFirewallNoRulesApplyPolicies(DetectEngineThreadCtx *det_ctx, Packet *p, Flow *f,
DetectTransaction *tx, const AppProto alproto, const uint8_t flow_flags, const int rule_cnt, DetectTransaction *tx, const AppProto alproto, const uint8_t flow_flags, const int rule_cnt)
const bool last_tx)
{ {
/* if there are no rules / rule candidates, handling invoking the default /* if there are no rules / rule candidates, handling invoking the default
* policy. */ * policy. */
@ -2112,7 +2111,7 @@ static int DetectTxFirewallNoRulesApplyPolicies(DetectEngineThreadCtx *det_ctx,
} }
if (tx->tx_data_ptr->flags & APP_LAYER_TX_ACCEPT) { if (tx->tx_data_ptr->flags & APP_LAYER_TX_ACCEPT) {
/* current tx is the last we have, append a blank accept:packet */ /* current tx is the last we have, append a blank accept:packet */
if (last_tx) { if (tx->is_last) {
SCLogDebug("default accept:tx: no rules"); SCLogDebug("default accept:tx: no rules");
DetectRunAppendDefaultAccept(det_ctx, p); DetectRunAppendDefaultAccept(det_ctx, p);
return 1; return 1;
@ -2132,7 +2131,7 @@ static int DetectTxFirewallNoRulesApplyPolicies(DetectEngineThreadCtx *det_ctx,
enum DetectTxFirewallFlowControl r = enum DetectTxFirewallFlowControl r =
DetectFirewallApplyDefaultPolicies(det_ctx, det_ctx->de_ctx->fw_policies->app, DetectFirewallApplyDefaultPolicies(det_ctx, det_ctx->de_ctx->fw_policies->app,
tx, p, alproto, flow_flags & (STREAM_TOSERVER | STREAM_TOCLIENT), tx, p, alproto, flow_flags & (STREAM_TOSERVER | STREAM_TOCLIENT),
tx->detect_progress_orig, tx->tx_progress, last_tx); tx->detect_progress_orig, tx->tx_progress);
SCLogDebug("r %u", r); SCLogDebug("r %u", r);
if (r == DETECT_TX_FW_FC_BREAK) if (r == DETECT_TX_FW_FC_BREAK)
return 1; return 1;
@ -2155,14 +2154,14 @@ static int DetectTxFirewallNoRulesApplyPolicies(DetectEngineThreadCtx *det_ctx,
*/ */
static void DetectRunTxFirewallRuleFullMatch(DetectEngineThreadCtx *det_ctx, const Signature *s, static void DetectRunTxFirewallRuleFullMatch(DetectEngineThreadCtx *det_ctx, const Signature *s,
DetectTransaction *tx, struct DetectFirewallAppTxState *fw_state, Flow *f, Packet *p, DetectTransaction *tx, struct DetectFirewallAppTxState *fw_state, Flow *f, Packet *p,
const uint8_t flow_flags, const bool last_tx) const uint8_t flow_flags)
{ {
uint8_t alert_flags = (PACKET_ALERT_FLAG_STATE_MATCH | PACKET_ALERT_FLAG_TX); uint8_t alert_flags = (PACKET_ALERT_FLAG_STATE_MATCH | PACKET_ALERT_FLAG_TX);
if (s->action & ACTION_ACCEPT) { if (s->action & ACTION_ACCEPT) {
/* see if we need to apply tx/hook accept to the packet. This can be needed /* see if we need to apply tx/hook accept to the packet. This can be needed
* when we've completed the inspection so far for an incomplete tx, and an * when we've completed the inspection so far for an incomplete tx, and an
* accept:tx or accept:hook is the last match.*/ * accept:tx or accept:hook is the last match.*/
const bool fw_accept_to_packet = ApplyAcceptToPacket(last_tx, tx, s); const bool fw_accept_to_packet = ApplyAcceptToPacket(tx, s);
if (fw_accept_to_packet) { if (fw_accept_to_packet) {
SCLogDebug("packet %" PRIu64 ": apply accept to packet", PcapPacketCntGet(p)); SCLogDebug("packet %" PRIu64 ": apply accept to packet", PcapPacketCntGet(p));
SCLogDebug("accept:(tx|hook): should be applied to the packet"); SCLogDebug("accept:(tx|hook): should be applied to the packet");
@ -2174,7 +2173,7 @@ static void DetectRunTxFirewallRuleFullMatch(DetectEngineThreadCtx *det_ctx, con
* policy matches that could add alerts. */ * policy matches that could add alerts. */
AlertQueueAppend(det_ctx, s, p, tx->tx_id, alert_flags); AlertQueueAppend(det_ctx, s, p, tx->tx_id, alert_flags);
DetectRunTxFirewallApplyAccept(det_ctx, p, flow_flags, s, tx, last_tx, fw_state); DetectRunTxFirewallApplyAccept(det_ctx, p, flow_flags, s, tx, fw_state);
} else if (s->action & ACTION_DROP) { } else if (s->action & ACTION_DROP) {
SCLogDebug("drop packet because of rule with drop action"); SCLogDebug("drop packet because of rule with drop action");
PacketDrop(p, s->action, PKT_DROP_REASON_FW_RULES); PacketDrop(p, s->action, PKT_DROP_REASON_FW_RULES);
@ -2203,12 +2202,12 @@ static void DetectRunTxFirewallRuleFullMatch(DetectEngineThreadCtx *det_ctx, con
* \retval 0 ok, caller must continue as normal * \retval 0 ok, caller must continue as normal
*/ */
static int DetectRunTxFirewallRulePartialMatch( static int DetectRunTxFirewallRulePartialMatch(
DetectEngineThreadCtx *det_ctx, const Signature *s, Packet *p, const bool last_tx) DetectEngineThreadCtx *det_ctx, const Signature *s, const DetectTransaction *tx, Packet *p)
{ {
if ((s->flags & SIG_FLAG_FIREWALL) && (s->action & ACTION_ACCEPT)) { if ((s->flags & SIG_FLAG_FIREWALL) && (s->action & ACTION_ACCEPT)) {
/* partial match always uses ACTION_SCOPE_HOOK. Final action only on the full /* partial match always uses ACTION_SCOPE_HOOK. Final action only on the full
* match */ * match */
if (last_tx) { if (tx->is_last) {
SCLogDebug("need to apply accept to packet"); SCLogDebug("need to apply accept to packet");
DetectRunAppendDefaultAccept(det_ctx, p); DetectRunAppendDefaultAccept(det_ctx, p);
} }
@ -2234,7 +2233,7 @@ static int DetectRunTxFirewallRulePartialMatch(
*/ */
static int DetectRunTxFirewallRuleNoMatch(DetectEngineThreadCtx *det_ctx, const Signature *s, static int DetectRunTxFirewallRuleNoMatch(DetectEngineThreadCtx *det_ctx, const Signature *s,
DetectTransaction *tx, struct DetectFirewallAppTxState *fw_state, Packet *p, DetectTransaction *tx, struct DetectFirewallAppTxState *fw_state, Packet *p,
const uint8_t flow_flags, const bool last_tx) const uint8_t flow_flags)
{ {
if (fw_state->fw_last_for_progress && (s->flags & SIG_FLAG_FIREWALL)) { if (fw_state->fw_last_for_progress && (s->flags & SIG_FLAG_FIREWALL)) {
SCLogDebug("%" PRIu64 ": %s default policy for progress %u", PcapPacketCntGet(p), SCLogDebug("%" PRIu64 ": %s default policy for progress %u", PcapPacketCntGet(p),
@ -2245,7 +2244,7 @@ static int DetectRunTxFirewallRuleNoMatch(DetectEngineThreadCtx *det_ctx, const
* the DetectRunTxPreCheckFirewallPolicy function for the next rule. */ * the DetectRunTxPreCheckFirewallPolicy function for the next rule. */
const struct DetectFirewallPolicy *policy = const struct DetectFirewallPolicy *policy =
DetectFirewallApplyDefaultAppPolicy(det_ctx, det_ctx->de_ctx->fw_policies->app, tx, DetectFirewallApplyDefaultAppPolicy(det_ctx, det_ctx->de_ctx->fw_policies->app, tx,
p, s->alproto, flow_flags, s->app_progress_hook, last_tx); p, s->alproto, flow_flags, s->app_progress_hook);
SCLogDebug("fw_last_for_progress policy %02x", policy->action); SCLogDebug("fw_last_for_progress policy %02x", policy->action);
if (policy->action & ACTION_DROP) { if (policy->action & ACTION_DROP) {
return 1; return 1;
@ -2262,14 +2261,14 @@ static int DetectRunTxFirewallRuleNoMatch(DetectEngineThreadCtx *det_ctx, const
*/ */
static void DetectRunTxFirewallRuleStatefulReApplyMatch(DetectEngineThreadCtx *det_ctx, static void DetectRunTxFirewallRuleStatefulReApplyMatch(DetectEngineThreadCtx *det_ctx,
const Signature *s, DetectTransaction *tx, struct DetectFirewallAppTxState *fw_state, const Signature *s, DetectTransaction *tx, struct DetectFirewallAppTxState *fw_state,
Packet *p, const uint8_t flow_flags, const bool last_tx) Packet *p, const uint8_t flow_flags)
{ {
/* if we're still in the same progress state as an earlier full /* if we're still in the same progress state as an earlier full
* match, we need to apply the same accept */ * match, we need to apply the same accept */
if ((s->flags & SIG_FLAG_FIREWALL) && (s->action & ACTION_ACCEPT) && if ((s->flags & SIG_FLAG_FIREWALL) && (s->action & ACTION_ACCEPT) &&
s->app_progress_hook == tx->tx_progress) { s->app_progress_hook == tx->tx_progress) {
const bool fw_accept_to_packet = ApplyAcceptToPacket(last_tx, tx, s); const bool fw_accept_to_packet = ApplyAcceptToPacket(tx, s);
DetectRunTxFirewallApplyAccept(det_ctx, p, flow_flags, s, tx, last_tx, fw_state); DetectRunTxFirewallApplyAccept(det_ctx, p, flow_flags, s, tx, fw_state);
if (fw_accept_to_packet) { if (fw_accept_to_packet) {
SCLogDebug("packet %" PRIu64 ": apply accept to packet", PcapPacketCntGet(p)); SCLogDebug("packet %" PRIu64 ": apply accept to packet", PcapPacketCntGet(p));
DetectRunAppendDefaultAccept(det_ctx, p); DetectRunAppendDefaultAccept(det_ctx, p);
@ -2319,9 +2318,9 @@ static void DetectRunTx(ThreadVars *tv,
tx_id_min++; // next (if any) run look for +1 tx_id_min++; // next (if any) run look for +1
goto next; goto next;
} }
tx.is_last = (total_txs == tx.tx_id + 1);
tx_id_min = tx.tx_id + 1; // next look for cur + 1 tx_id_min = tx.tx_id + 1; // next look for cur + 1
tx_inspected++; tx_inspected++;
const bool last_tx = (total_txs == tx.tx_id + 1);
SCLogDebug("%p/%" PRIu64 " txd flags %02x", tx.tx_ptr, tx.tx_id, tx.tx_data_ptr->flags); SCLogDebug("%p/%" PRIu64 " txd flags %02x", tx.tx_ptr, tx.tx_id, tx.tx_data_ptr->flags);
@ -2449,7 +2448,7 @@ static void DetectRunTx(ThreadVars *tv,
/* if there are no firewall rules to consider, handle invoking the default /* if there are no firewall rules to consider, handle invoking the default
* policies. */ * policies. */
const int r = DetectTxFirewallNoRulesApplyPolicies( const int r = DetectTxFirewallNoRulesApplyPolicies(
det_ctx, p, f, &tx, alproto, flow_flags, array_idx, last_tx); det_ctx, p, f, &tx, alproto, flow_flags, array_idx);
if (r == 1) { if (r == 1) {
SCLogDebug("done"); SCLogDebug("done");
return; return;
@ -2469,9 +2468,9 @@ static void DetectRunTx(ThreadVars *tv,
tx.detect_progress, tx.detect_progress_orig, s->app_progress_hook); tx.detect_progress, tx.detect_progress_orig, s->app_progress_hook);
if (have_fw_rules) { if (have_fw_rules) {
const enum DetectTxFirewallFlowControl fw_r = DetectRunTxPreCheckFirewallPolicy( const enum DetectTxFirewallFlowControl fw_r =
det_ctx, p, &tx, flow_flags & (STREAM_TOSERVER | STREAM_TOCLIENT), s, i, DetectRunTxPreCheckFirewallPolicy(det_ctx, p, &tx,
&fw_state, last_tx); flow_flags & (STREAM_TOSERVER | STREAM_TOCLIENT), s, i, &fw_state);
SCLogDebug("fw fw_skip_app_filter:%s skip_fw_hook:%s " SCLogDebug("fw fw_skip_app_filter:%s skip_fw_hook:%s "
"skip_before_progress:%u fw_last_for_progress:%s " "skip_before_progress:%u fw_last_for_progress:%s "
"fw_next_progress_missing:%s", "fw_next_progress_missing:%s",
@ -2513,7 +2512,7 @@ static void DetectRunTx(ThreadVars *tv,
* match, we need to apply the same accept */ * match, we need to apply the same accept */
if (have_fw_rules) { if (have_fw_rules) {
DetectRunTxFirewallRuleStatefulReApplyMatch( DetectRunTxFirewallRuleStatefulReApplyMatch(
det_ctx, s, &tx, &fw_state, p, flow_flags, last_tx); det_ctx, s, &tx, &fw_state, p, flow_flags);
} }
continue; continue;
} }
@ -2563,17 +2562,16 @@ static void DetectRunTx(ThreadVars *tv,
AlertQueueAppend(det_ctx, s, p, tx.tx_id, AlertQueueAppend(det_ctx, s, p, tx.tx_id,
(PACKET_ALERT_FLAG_STATE_MATCH | PACKET_ALERT_FLAG_TX)); (PACKET_ALERT_FLAG_STATE_MATCH | PACKET_ALERT_FLAG_TX));
} else { } else {
DetectRunTxFirewallRuleFullMatch( DetectRunTxFirewallRuleFullMatch(det_ctx, s, &tx, &fw_state, f, p, flow_flags);
det_ctx, s, &tx, &fw_state, f, p, flow_flags, last_tx);
} }
} else if (r == 0) { } else if (r == 0) {
SCLogDebug("sid %u partial match", s->id); SCLogDebug("sid %u partial match", s->id);
if (DetectRunTxFirewallRulePartialMatch(det_ctx, s, p, last_tx) == 1) { if (DetectRunTxFirewallRulePartialMatch(det_ctx, s, &tx, p) == 1) {
break; break;
} }
} else { } else {
if (DetectRunTxFirewallRuleNoMatch( if (DetectRunTxFirewallRuleNoMatch(det_ctx, s, &tx, &fw_state, p, flow_flags) ==
det_ctx, s, &tx, &fw_state, p, flow_flags, last_tx) == 1) { 1) {
return; return;
} }
} }

Write Preview
Loading…
Cancel
Save