Support #87 » 0001-Remember-the-IPOnlyMatch-action-veredict-at-flow-lev.patch
| src/detect.c | ||
|---|---|---|
|
IPOnlyMatchPacket(de_ctx, &de_ctx->io_ctx, &det_ctx->io_ctx, p);
|
||
|
/* save in the flow that we scanned this direction... locking is
|
||
|
* done in the FlowSetIPOnlyFlag function. */
|
||
|
if (p->flow != NULL)
|
||
|
if (p->flow != NULL) {
|
||
|
/* Remember the result of the first IPOnlyMatch() */
|
||
|
p->flow->iponly_action = p->action;
|
||
|
FlowSetIPOnlyFlag(p->flow, p->flowflags & FLOW_PKT_TOSERVER ? 1 : 0);
|
||
|
}
|
||
|
} else if (p->flow != NULL && p->flow->iponly_action) {
|
||
|
/* Get the result of the first IPOnlyMatch() */
|
||
|
p->action |= p->flow->iponly_action;
|
||
|
}
|
||
|
/* we assume we have an uri when we start inspection */
|
||
| src/flow-util.c | ||
|---|---|---|
|
f->hprev = NULL;
|
||
|
f->flowvar = NULL;
|
||
|
f->iponly_action = 0;
|
||
|
return f;
|
||
|
}
|
||
| src/flow.h | ||
|---|---|---|
|
/** how many pkts and stream msgs are using the flow *right now* */
|
||
|
uint16_t use_cnt;
|
||
|
uint8_t iponly_action;
|
||
|
SCMutex m;
|
||