aiden
/
suricata
mirror of https://github.com/OISF/suricata
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

decode: convert 'action' macros to inline funcs

Browse Source 
Make sure most common branch is handled first to assist branch
prediction.

Macros still play a small role to please our 'action' cocci check.
pull/6324/head
Victor Julien 7 years ago
parent 2d1580233e
commit 4c7eb64411
19 changed files with 148 additions and 138 deletions
Show Stats Download Patch File Download Diff File

6
src/alert-prelude.c
Unescape Escape View File

@ -230,10 +230,8 @@ static int EventToImpact(const PacketAlert *pa, const Packet *p, idmef_alert_t *
idmef_impact_set_severity(impact, severity); idmef_impact_set_severity(impact, severity);
if (PACKET_TEST_ACTION(p, ACTION_DROP) || if (PacketTestAction(p, ACTION_DROP) || PacketTestAction(p, ACTION_REJECT) ||
PACKET_TEST_ACTION(p, ACTION_REJECT) || PacketTestAction(p, ACTION_REJECT_DST) || PacketTestAction(p, ACTION_REJECT_BOTH)) {
PACKET_TEST_ACTION(p, ACTION_REJECT_DST) ||
PACKET_TEST_ACTION(p, ACTION_REJECT_BOTH) ) {
idmef_action_t *action; idmef_action_t *action;
ret = idmef_action_new(&action); ret = idmef_action_new(&action);

4
src/decode.c
Unescape Escape View File

@ -744,9 +744,9 @@ const char *PktSrcToString(enum PktSrcEnum pkt_src)
void CaptureStatsUpdate(ThreadVars *tv, CaptureStats *s, const Packet *p) void CaptureStatsUpdate(ThreadVars *tv, CaptureStats *s, const Packet *p)
{ {
if (unlikely(PACKET_TEST_ACTION(p, (ACTION_REJECT|ACTION_REJECT_DST|ACTION_REJECT_BOTH)))) { if (unlikely(PacketTestAction(p, (ACTION_REJECT | ACTION_REJECT_DST | ACTION_REJECT_BOTH)))) {
StatsIncr(tv, s->counter_ips_rejected); StatsIncr(tv, s->counter_ips_rejected);
} else if (unlikely(PACKET_TEST_ACTION(p, ACTION_DROP))) { } else if (unlikely(PacketTestAction(p, ACTION_DROP))) {
StatsIncr(tv, s->counter_ips_blocked); StatsIncr(tv, s->counter_ips_blocked);
} else if (unlikely(p->flags & PKT_STREAM_MODIFIED)) { } else if (unlikely(p->flags & PKT_STREAM_MODIFIED)) {
StatsIncr(tv, s->counter_ips_replaced); StatsIncr(tv, s->counter_ips_replaced);

43
src/decode.h
Unescape Escape View File

@ -864,11 +864,16 @@ void CaptureStatsSetup(ThreadVars *tv, CaptureStats *s);
* handle the case of a root packet * handle the case of a root packet
* for tunnels */ * for tunnels */
#define PACKET_SET_ACTION(p, a) do { \ #define PACKET_SET_ACTION(p, a) (p)->action = (a)
((p)->root ? \
((p)->root->action = a) : \ static inline void PacketSetAction(Packet *p, const uint8_t a)
((p)->action = a)); \ {
} while (0) if (likely(p->root == NULL)) {
PACKET_SET_ACTION(p, a);
} else {
PACKET_SET_ACTION(p->root, a);
}
}
#define PACKET_ALERT(p) PACKET_SET_ACTION(p, ACTION_ALERT) #define PACKET_ALERT(p) PACKET_SET_ACTION(p, ACTION_ALERT)
@ -884,16 +889,26 @@ void CaptureStatsSetup(ThreadVars *tv, CaptureStats *s);
#define PACKET_PASS(p) PACKET_SET_ACTION(p, ACTION_PASS) #define PACKET_PASS(p) PACKET_SET_ACTION(p, ACTION_PASS)
#define PACKET_TEST_ACTION(p, a) \ #define PACKET_TEST_ACTION(p, a) (p)->action &(a)
((p)->root ? \
((p)->root->action & a) : \ static inline uint8_t PacketTestAction(const Packet *p, const uint8_t a)
((p)->action & a)) {
if (likely(p->root == NULL)) {
return PACKET_TEST_ACTION(p, a);
} else {
return PACKET_TEST_ACTION(p->root, a);
}
}
#define PACKET_UPDATE_ACTION(p, a) do { \ #define PACKET_UPDATE_ACTION(p, a) (p)->action |= (a)
((p)->root ? \ static inline void PacketUpdateAction(Packet *p, const uint8_t a)
((p)->root->action |= a) : \ {
((p)->action |= a)); \ if (likely(p->root == NULL)) {
} while (0) PACKET_UPDATE_ACTION(p, a);
} else {
PACKET_UPDATE_ACTION(p->root, a);
}
}
#define TUNNEL_INCR_PKT_RTV_NOLOCK(p) do { \ #define TUNNEL_INCR_PKT_RTV_NOLOCK(p) do { \
((p)->root ? (p)->root->tunnel_rtv_cnt++ : (p)->tunnel_rtv_cnt++); \ ((p)->root ? (p)->root->tunnel_rtv_cnt++ : (p)->tunnel_rtv_cnt++); \

14
src/detect-detection-filter.c
Unescape Escape View File

@ -574,17 +574,17 @@ static int DetectDetectionFilterTestSig3(void)
SigMatchSignatures(&th_v, de_ctx, det_ctx, p); SigMatchSignatures(&th_v, de_ctx, det_ctx, p);
alerts = PacketAlertCheck(p, 10); alerts = PacketAlertCheck(p, 10);
drops += ((PACKET_TEST_ACTION(p, ACTION_DROP))?1:0); drops += ((PacketTestAction(p, ACTION_DROP)) ? 1 : 0);
p->action = 0; p->action = 0;
SigMatchSignatures(&th_v, de_ctx, det_ctx, p); SigMatchSignatures(&th_v, de_ctx, det_ctx, p);
alerts += PacketAlertCheck(p, 10); alerts += PacketAlertCheck(p, 10);
drops += ((PACKET_TEST_ACTION(p, ACTION_DROP))?1:0); drops += ((PacketTestAction(p, ACTION_DROP)) ? 1 : 0);
p->action = 0; p->action = 0;
SigMatchSignatures(&th_v, de_ctx, det_ctx, p); SigMatchSignatures(&th_v, de_ctx, det_ctx, p);
alerts += PacketAlertCheck(p, 10); alerts += PacketAlertCheck(p, 10);
drops += ((PACKET_TEST_ACTION(p, ACTION_DROP))?1:0); drops += ((PacketTestAction(p, ACTION_DROP)) ? 1 : 0);
p->action = 0; p->action = 0;
TimeSetIncrementTime(200); TimeSetIncrementTime(200);
@ -592,22 +592,22 @@ static int DetectDetectionFilterTestSig3(void)
SigMatchSignatures(&th_v, de_ctx, det_ctx, p); SigMatchSignatures(&th_v, de_ctx, det_ctx, p);
alerts += PacketAlertCheck(p, 10); alerts += PacketAlertCheck(p, 10);
drops += ((PACKET_TEST_ACTION(p, ACTION_DROP))?1:0); drops += ((PacketTestAction(p, ACTION_DROP)) ? 1 : 0);
p->action = 0; p->action = 0;
SigMatchSignatures(&th_v, de_ctx, det_ctx, p); SigMatchSignatures(&th_v, de_ctx, det_ctx, p);
alerts += PacketAlertCheck(p, 10); alerts += PacketAlertCheck(p, 10);
drops += ((PACKET_TEST_ACTION(p, ACTION_DROP))?1:0); drops += ((PacketTestAction(p, ACTION_DROP)) ? 1 : 0);
p->action = 0; p->action = 0;
SigMatchSignatures(&th_v, de_ctx, det_ctx, p); SigMatchSignatures(&th_v, de_ctx, det_ctx, p);
alerts += PacketAlertCheck(p, 10); alerts += PacketAlertCheck(p, 10);
drops += ((PACKET_TEST_ACTION(p, ACTION_DROP))?1:0); drops += ((PacketTestAction(p, ACTION_DROP)) ? 1 : 0);
p->action = 0; p->action = 0;
SigMatchSignatures(&th_v, de_ctx, det_ctx, p); SigMatchSignatures(&th_v, de_ctx, det_ctx, p);
alerts += PacketAlertCheck(p, 10); alerts += PacketAlertCheck(p, 10);
drops += ((PACKET_TEST_ACTION(p, ACTION_DROP))?1:0); drops += ((PacketTestAction(p, ACTION_DROP)) ? 1 : 0);
p->action = 0; p->action = 0;
if (alerts == 3 && drops == 3) if (alerts == 3 && drops == 3)

11
src/detect-engine-alert.c
Unescape Escape View File

@ -285,7 +285,7 @@ void PacketAlertFinalize(DetectEngineCtx *de_ctx, DetectEngineThreadCtx *det_ctx
/* set actions on packet */ /* set actions on packet */
DetectSignatureApplyActions(p, p->alerts.alerts[i].s, p->alerts.alerts[i].flags); DetectSignatureApplyActions(p, p->alerts.alerts[i].s, p->alerts.alerts[i].flags);
if (PACKET_TEST_ACTION(p, ACTION_PASS)) { if (PacketTestAction(p, ACTION_PASS)) {
/* Ok, reset the alert cnt to end in the previous of pass /* Ok, reset the alert cnt to end in the previous of pass
* so we ignore the rest with less prio */ * so we ignore the rest with less prio */
p->alerts.cnt = i; p->alerts.cnt = i;
@ -293,11 +293,10 @@ void PacketAlertFinalize(DetectEngineCtx *de_ctx, DetectEngineThreadCtx *det_ctx
/* if the signature wants to drop, check if the /* if the signature wants to drop, check if the
* PACKET_ALERT_FLAG_DROP_FLOW flag is set. */ * PACKET_ALERT_FLAG_DROP_FLOW flag is set. */
} else if ((PACKET_TEST_ACTION(p, ACTION_DROP)) && } else if ((PacketTestAction(p, ACTION_DROP)) &&
((p->alerts.alerts[i].flags & PACKET_ALERT_FLAG_DROP_FLOW) || ((p->alerts.alerts[i].flags & PACKET_ALERT_FLAG_DROP_FLOW) ||
(s->flags & SIG_FLAG_APPLAYER)) (s->flags & SIG_FLAG_APPLAYER)) &&
&& p->flow != NULL) p->flow != NULL) {
{
/* This will apply only on IPS mode (check StreamTcpPacket) */ /* This will apply only on IPS mode (check StreamTcpPacket) */
p->flow->flags |= FLOW_ACTION_DROP; // XXX API? p->flow->flags |= FLOW_ACTION_DROP; // XXX API?
} }

18
src/detect-iprep.c
Unescape Escape View File

@ -483,7 +483,7 @@ static int DetectIPRepTest01(void)
SigMatchSignatures(&th_v, de_ctx, det_ctx, p); SigMatchSignatures(&th_v, de_ctx, det_ctx, p);
FAIL_IF(p->alerts.cnt != 1); FAIL_IF(p->alerts.cnt != 1);
FAIL_IF(PACKET_TEST_ACTION(p, ACTION_DROP)); FAIL_IF(PacketTestAction(p, ACTION_DROP));
UTHFreePacket(p); UTHFreePacket(p);
@ -535,7 +535,7 @@ static int DetectIPRepTest02(void)
p->action = 0; p->action = 0;
SigMatchSignatures(&th_v, de_ctx, det_ctx, p); SigMatchSignatures(&th_v, de_ctx, det_ctx, p);
FAIL_IF(p->alerts.cnt != 1); FAIL_IF(p->alerts.cnt != 1);
FAIL_IF(PACKET_TEST_ACTION(p, ACTION_DROP)); FAIL_IF(PacketTestAction(p, ACTION_DROP));
UTHFreePacket(p); UTHFreePacket(p);
@ -587,7 +587,7 @@ static int DetectIPRepTest03(void)
p->action = 0; p->action = 0;
SigMatchSignatures(&th_v, de_ctx, det_ctx, p); SigMatchSignatures(&th_v, de_ctx, det_ctx, p);
FAIL_IF(p->alerts.cnt != 1); FAIL_IF(p->alerts.cnt != 1);
FAIL_IF(PACKET_TEST_ACTION(p, ACTION_DROP)); FAIL_IF(PacketTestAction(p, ACTION_DROP));
UTHFreePacket(p); UTHFreePacket(p);
@ -640,7 +640,7 @@ static int DetectIPRepTest04(void)
p->action = 0; p->action = 0;
SigMatchSignatures(&th_v, de_ctx, det_ctx, p); SigMatchSignatures(&th_v, de_ctx, det_ctx, p);
FAIL_IF(p->alerts.cnt != 1); FAIL_IF(p->alerts.cnt != 1);
FAIL_IF(PACKET_TEST_ACTION(p, ACTION_DROP)); FAIL_IF(PacketTestAction(p, ACTION_DROP));
UTHFreePacket(p); UTHFreePacket(p);
@ -692,7 +692,7 @@ static int DetectIPRepTest05(void)
p->action = 0; p->action = 0;
SigMatchSignatures(&th_v, de_ctx, det_ctx, p); SigMatchSignatures(&th_v, de_ctx, det_ctx, p);
FAIL_IF(p->alerts.cnt != 0); FAIL_IF(p->alerts.cnt != 0);
FAIL_IF(PACKET_TEST_ACTION(p, ACTION_DROP)); FAIL_IF(PacketTestAction(p, ACTION_DROP));
UTHFreePacket(p); UTHFreePacket(p);
@ -744,7 +744,7 @@ static int DetectIPRepTest06(void)
p->action = 0; p->action = 0;
SigMatchSignatures(&th_v, de_ctx, det_ctx, p); SigMatchSignatures(&th_v, de_ctx, det_ctx, p);
FAIL_IF(p->alerts.cnt != 1); FAIL_IF(p->alerts.cnt != 1);
FAIL_IF(PACKET_TEST_ACTION(p, ACTION_DROP)); FAIL_IF(PacketTestAction(p, ACTION_DROP));
UTHFreePacket(p); UTHFreePacket(p);
@ -796,7 +796,7 @@ static int DetectIPRepTest07(void)
p->action = 0; p->action = 0;
SigMatchSignatures(&th_v, de_ctx, det_ctx, p); SigMatchSignatures(&th_v, de_ctx, det_ctx, p);
FAIL_IF(p->alerts.cnt != 1); FAIL_IF(p->alerts.cnt != 1);
FAIL_IF(PACKET_TEST_ACTION(p, ACTION_DROP)); FAIL_IF(PacketTestAction(p, ACTION_DROP));
UTHFreePacket(p); UTHFreePacket(p);
@ -849,7 +849,7 @@ static int DetectIPRepTest08(void)
p->action = 0; p->action = 0;
SigMatchSignatures(&th_v, de_ctx, det_ctx, p); SigMatchSignatures(&th_v, de_ctx, det_ctx, p);
FAIL_IF(p->alerts.cnt != 0); FAIL_IF(p->alerts.cnt != 0);
FAIL_IF(PACKET_TEST_ACTION(p, ACTION_DROP)); FAIL_IF(PacketTestAction(p, ACTION_DROP));
UTHFreePacket(p); UTHFreePacket(p);
@ -902,7 +902,7 @@ static int DetectIPRepTest09(void)
p->action = 0; p->action = 0;
SigMatchSignatures(&th_v, de_ctx, det_ctx, p); SigMatchSignatures(&th_v, de_ctx, det_ctx, p);
FAIL_IF(p->alerts.cnt != 1); FAIL_IF(p->alerts.cnt != 1);
FAIL_IF(PACKET_TEST_ACTION(p, ACTION_DROP)); FAIL_IF(PacketTestAction(p, ACTION_DROP));
UTHFreePacket(p); UTHFreePacket(p);

72
src/detect-threshold.c
Unescape Escape View File

@ -1045,17 +1045,17 @@ static int DetectThresholdTestSig7(void)
TimeGet(&p->ts); TimeGet(&p->ts);
SigMatchSignatures(&th_v, de_ctx, det_ctx, p); SigMatchSignatures(&th_v, de_ctx, det_ctx, p);
alerts = PacketAlertCheck(p, 10); alerts = PacketAlertCheck(p, 10);
drops += ((PACKET_TEST_ACTION(p, ACTION_DROP))?1:0); drops += ((PacketTestAction(p, ACTION_DROP)) ? 1 : 0);
p->action = 0; p->action = 0;
SigMatchSignatures(&th_v, de_ctx, det_ctx, p); SigMatchSignatures(&th_v, de_ctx, det_ctx, p);
alerts += PacketAlertCheck(p, 10); alerts += PacketAlertCheck(p, 10);
drops += ((PACKET_TEST_ACTION(p, ACTION_DROP))?1:0); drops += ((PacketTestAction(p, ACTION_DROP)) ? 1 : 0);
p->action = 0; p->action = 0;
SigMatchSignatures(&th_v, de_ctx, det_ctx, p); SigMatchSignatures(&th_v, de_ctx, det_ctx, p);
alerts += PacketAlertCheck(p, 10); alerts += PacketAlertCheck(p, 10);
drops += ((PACKET_TEST_ACTION(p, ACTION_DROP))?1:0); drops += ((PacketTestAction(p, ACTION_DROP)) ? 1 : 0);
p->action = 0; p->action = 0;
TimeSetIncrementTime(200); TimeSetIncrementTime(200);
@ -1063,17 +1063,17 @@ static int DetectThresholdTestSig7(void)
SigMatchSignatures(&th_v, de_ctx, det_ctx, p); SigMatchSignatures(&th_v, de_ctx, det_ctx, p);
alerts += PacketAlertCheck(p, 10); alerts += PacketAlertCheck(p, 10);
drops += ((PACKET_TEST_ACTION(p, ACTION_DROP))?1:0); drops += ((PacketTestAction(p, ACTION_DROP)) ? 1 : 0);
p->action = 0; p->action = 0;
SigMatchSignatures(&th_v, de_ctx, det_ctx, p); SigMatchSignatures(&th_v, de_ctx, det_ctx, p);
alerts += PacketAlertCheck(p, 10); alerts += PacketAlertCheck(p, 10);
drops += ((PACKET_TEST_ACTION(p, ACTION_DROP))?1:0); drops += ((PacketTestAction(p, ACTION_DROP)) ? 1 : 0);
p->action = 0; p->action = 0;
SigMatchSignatures(&th_v, de_ctx, det_ctx, p); SigMatchSignatures(&th_v, de_ctx, det_ctx, p);
alerts += PacketAlertCheck(p, 10); alerts += PacketAlertCheck(p, 10);
drops += ((PACKET_TEST_ACTION(p, ACTION_DROP))?1:0); drops += ((PacketTestAction(p, ACTION_DROP)) ? 1 : 0);
p->action = 0; p->action = 0;
if (alerts == 1 && drops == 6) if (alerts == 1 && drops == 6)
@ -1139,17 +1139,17 @@ static int DetectThresholdTestSig8(void)
TimeGet(&p->ts); TimeGet(&p->ts);
SigMatchSignatures(&th_v, de_ctx, det_ctx, p); SigMatchSignatures(&th_v, de_ctx, det_ctx, p);
alerts = PacketAlertCheck(p, 10); alerts = PacketAlertCheck(p, 10);
drops += ((PACKET_TEST_ACTION(p, ACTION_DROP))?1:0); drops += ((PacketTestAction(p, ACTION_DROP)) ? 1 : 0);
p->action = 0; p->action = 0;
SigMatchSignatures(&th_v, de_ctx, det_ctx, p); SigMatchSignatures(&th_v, de_ctx, det_ctx, p);
alerts += PacketAlertCheck(p, 10); alerts += PacketAlertCheck(p, 10);
drops += ((PACKET_TEST_ACTION(p, ACTION_DROP))?1:0); drops += ((PacketTestAction(p, ACTION_DROP)) ? 1 : 0);
p->action = 0; p->action = 0;
SigMatchSignatures(&th_v, de_ctx, det_ctx, p); SigMatchSignatures(&th_v, de_ctx, det_ctx, p);
alerts += PacketAlertCheck(p, 10); alerts += PacketAlertCheck(p, 10);
drops += ((PACKET_TEST_ACTION(p, ACTION_DROP))?1:0); drops += ((PacketTestAction(p, ACTION_DROP)) ? 1 : 0);
p->action = 0; p->action = 0;
TimeSetIncrementTime(200); TimeSetIncrementTime(200);
@ -1157,17 +1157,17 @@ static int DetectThresholdTestSig8(void)
SigMatchSignatures(&th_v, de_ctx, det_ctx, p); SigMatchSignatures(&th_v, de_ctx, det_ctx, p);
alerts += PacketAlertCheck(p, 10); alerts += PacketAlertCheck(p, 10);
drops += ((PACKET_TEST_ACTION(p, ACTION_DROP))?1:0); drops += ((PacketTestAction(p, ACTION_DROP)) ? 1 : 0);
p->action = 0; p->action = 0;
SigMatchSignatures(&th_v, de_ctx, det_ctx, p); SigMatchSignatures(&th_v, de_ctx, det_ctx, p);
alerts += PacketAlertCheck(p, 10); alerts += PacketAlertCheck(p, 10);
drops += ((PACKET_TEST_ACTION(p, ACTION_DROP))?1:0); drops += ((PacketTestAction(p, ACTION_DROP)) ? 1 : 0);
p->action = 0; p->action = 0;
SigMatchSignatures(&th_v, de_ctx, det_ctx, p); SigMatchSignatures(&th_v, de_ctx, det_ctx, p);
alerts += PacketAlertCheck(p, 10); alerts += PacketAlertCheck(p, 10);
drops += ((PACKET_TEST_ACTION(p, ACTION_DROP))?1:0); drops += ((PacketTestAction(p, ACTION_DROP)) ? 1 : 0);
p->action = 0; p->action = 0;
if (alerts == 2 && drops == 6) if (alerts == 2 && drops == 6)
@ -1233,17 +1233,17 @@ static int DetectThresholdTestSig9(void)
TimeGet(&p->ts); TimeGet(&p->ts);
SigMatchSignatures(&th_v, de_ctx, det_ctx, p); SigMatchSignatures(&th_v, de_ctx, det_ctx, p);
alerts = PacketAlertCheck(p, 10); alerts = PacketAlertCheck(p, 10);
drops += ((PACKET_TEST_ACTION(p, ACTION_DROP))?1:0); drops += ((PacketTestAction(p, ACTION_DROP)) ? 1 : 0);
p->action = 0; p->action = 0;
SigMatchSignatures(&th_v, de_ctx, det_ctx, p); SigMatchSignatures(&th_v, de_ctx, det_ctx, p);
alerts += PacketAlertCheck(p, 10); alerts += PacketAlertCheck(p, 10);
drops += ((PACKET_TEST_ACTION(p, ACTION_DROP))?1:0); drops += ((PacketTestAction(p, ACTION_DROP)) ? 1 : 0);
p->action = 0; p->action = 0;
SigMatchSignatures(&th_v, de_ctx, det_ctx, p); SigMatchSignatures(&th_v, de_ctx, det_ctx, p);
alerts += PacketAlertCheck(p, 10); alerts += PacketAlertCheck(p, 10);
drops += ((PACKET_TEST_ACTION(p, ACTION_DROP))?1:0); drops += ((PacketTestAction(p, ACTION_DROP)) ? 1 : 0);
p->action = 0; p->action = 0;
TimeSetIncrementTime(200); TimeSetIncrementTime(200);
@ -1251,17 +1251,17 @@ static int DetectThresholdTestSig9(void)
SigMatchSignatures(&th_v, de_ctx, det_ctx, p); SigMatchSignatures(&th_v, de_ctx, det_ctx, p);
alerts += PacketAlertCheck(p, 10); alerts += PacketAlertCheck(p, 10);
drops += ((PACKET_TEST_ACTION(p, ACTION_DROP))?1:0); drops += ((PacketTestAction(p, ACTION_DROP)) ? 1 : 0);
p->action = 0; p->action = 0;
SigMatchSignatures(&th_v, de_ctx, det_ctx, p); SigMatchSignatures(&th_v, de_ctx, det_ctx, p);
alerts += PacketAlertCheck(p, 10); alerts += PacketAlertCheck(p, 10);
drops += ((PACKET_TEST_ACTION(p, ACTION_DROP))?1:0); drops += ((PacketTestAction(p, ACTION_DROP)) ? 1 : 0);
p->action = 0; p->action = 0;
SigMatchSignatures(&th_v, de_ctx, det_ctx, p); SigMatchSignatures(&th_v, de_ctx, det_ctx, p);
alerts += PacketAlertCheck(p, 10); alerts += PacketAlertCheck(p, 10);
drops += ((PACKET_TEST_ACTION(p, ACTION_DROP))?1:0); drops += ((PacketTestAction(p, ACTION_DROP)) ? 1 : 0);
p->action = 0; p->action = 0;
if (alerts == 2 && drops == 2) if (alerts == 2 && drops == 2)
@ -1327,17 +1327,17 @@ static int DetectThresholdTestSig10(void)
TimeGet(&p->ts); TimeGet(&p->ts);
SigMatchSignatures(&th_v, de_ctx, det_ctx, p); SigMatchSignatures(&th_v, de_ctx, det_ctx, p);
alerts = PacketAlertCheck(p, 10); alerts = PacketAlertCheck(p, 10);
drops += ((PACKET_TEST_ACTION(p, ACTION_DROP))?1:0); drops += ((PacketTestAction(p, ACTION_DROP)) ? 1 : 0);
p->action = 0; p->action = 0;
SigMatchSignatures(&th_v, de_ctx, det_ctx, p); SigMatchSignatures(&th_v, de_ctx, det_ctx, p);
alerts += PacketAlertCheck(p, 10); alerts += PacketAlertCheck(p, 10);
drops += ((PACKET_TEST_ACTION(p, ACTION_DROP))?1:0); drops += ((PacketTestAction(p, ACTION_DROP)) ? 1 : 0);
p->action = 0; p->action = 0;
SigMatchSignatures(&th_v, de_ctx, det_ctx, p); SigMatchSignatures(&th_v, de_ctx, det_ctx, p);
alerts += PacketAlertCheck(p, 10); alerts += PacketAlertCheck(p, 10);
drops += ((PACKET_TEST_ACTION(p, ACTION_DROP))?1:0); drops += ((PacketTestAction(p, ACTION_DROP)) ? 1 : 0);
p->action = 0; p->action = 0;
TimeSetIncrementTime(200); TimeSetIncrementTime(200);
@ -1345,17 +1345,17 @@ static int DetectThresholdTestSig10(void)
SigMatchSignatures(&th_v, de_ctx, det_ctx, p); SigMatchSignatures(&th_v, de_ctx, det_ctx, p);
alerts += PacketAlertCheck(p, 10); alerts += PacketAlertCheck(p, 10);
drops += ((PACKET_TEST_ACTION(p, ACTION_DROP))?1:0); drops += ((PacketTestAction(p, ACTION_DROP)) ? 1 : 0);
p->action = 0; p->action = 0;
SigMatchSignatures(&th_v, de_ctx, det_ctx, p); SigMatchSignatures(&th_v, de_ctx, det_ctx, p);
alerts += PacketAlertCheck(p, 10); alerts += PacketAlertCheck(p, 10);
drops += ((PACKET_TEST_ACTION(p, ACTION_DROP))?1:0); drops += ((PacketTestAction(p, ACTION_DROP)) ? 1 : 0);
p->action = 0; p->action = 0;
SigMatchSignatures(&th_v, de_ctx, det_ctx, p); SigMatchSignatures(&th_v, de_ctx, det_ctx, p);
alerts += PacketAlertCheck(p, 10); alerts += PacketAlertCheck(p, 10);
drops += ((PACKET_TEST_ACTION(p, ACTION_DROP))?1:0); drops += ((PacketTestAction(p, ACTION_DROP)) ? 1 : 0);
p->action = 0; p->action = 0;
if (alerts == 1 && drops == 1) if (alerts == 1 && drops == 1)
@ -1421,17 +1421,17 @@ static int DetectThresholdTestSig11(void)
TimeGet(&p->ts); TimeGet(&p->ts);
SigMatchSignatures(&th_v, de_ctx, det_ctx, p); SigMatchSignatures(&th_v, de_ctx, det_ctx, p);
alerts = PacketAlertCheck(p, 10); alerts = PacketAlertCheck(p, 10);
drops += ((PACKET_TEST_ACTION(p, ACTION_DROP))?1:0); drops += ((PacketTestAction(p, ACTION_DROP)) ? 1 : 0);
p->action = 0; p->action = 0;
SigMatchSignatures(&th_v, de_ctx, det_ctx, p); SigMatchSignatures(&th_v, de_ctx, det_ctx, p);
alerts += PacketAlertCheck(p, 10); alerts += PacketAlertCheck(p, 10);
drops += ((PACKET_TEST_ACTION(p, ACTION_DROP))?1:0); drops += ((PacketTestAction(p, ACTION_DROP)) ? 1 : 0);
p->action = 0; p->action = 0;
SigMatchSignatures(&th_v, de_ctx, det_ctx, p); SigMatchSignatures(&th_v, de_ctx, det_ctx, p);
alerts += PacketAlertCheck(p, 10); alerts += PacketAlertCheck(p, 10);
drops += ((PACKET_TEST_ACTION(p, ACTION_DROP))?1:0); drops += ((PacketTestAction(p, ACTION_DROP)) ? 1 : 0);
p->action = 0; p->action = 0;
TimeSetIncrementTime(200); TimeSetIncrementTime(200);
@ -1439,17 +1439,17 @@ static int DetectThresholdTestSig11(void)
SigMatchSignatures(&th_v, de_ctx, det_ctx, p); SigMatchSignatures(&th_v, de_ctx, det_ctx, p);
alerts += PacketAlertCheck(p, 10); alerts += PacketAlertCheck(p, 10);
drops += ((PACKET_TEST_ACTION(p, ACTION_DROP))?1:0); drops += ((PacketTestAction(p, ACTION_DROP)) ? 1 : 0);
p->action = 0; p->action = 0;
SigMatchSignatures(&th_v, de_ctx, det_ctx, p); SigMatchSignatures(&th_v, de_ctx, det_ctx, p);
alerts += PacketAlertCheck(p, 10); alerts += PacketAlertCheck(p, 10);
drops += ((PACKET_TEST_ACTION(p, ACTION_DROP))?1:0); drops += ((PacketTestAction(p, ACTION_DROP)) ? 1 : 0);
p->action = 0; p->action = 0;
SigMatchSignatures(&th_v, de_ctx, det_ctx, p); SigMatchSignatures(&th_v, de_ctx, det_ctx, p);
alerts += PacketAlertCheck(p, 10); alerts += PacketAlertCheck(p, 10);
drops += ((PACKET_TEST_ACTION(p, ACTION_DROP))?1:0); drops += ((PacketTestAction(p, ACTION_DROP)) ? 1 : 0);
p->action = 0; p->action = 0;
if (alerts == 1 && drops == 4) if (alerts == 1 && drops == 4)
@ -1515,17 +1515,17 @@ static int DetectThresholdTestSig12(void)
TimeGet(&p->ts); TimeGet(&p->ts);
SigMatchSignatures(&th_v, de_ctx, det_ctx, p); SigMatchSignatures(&th_v, de_ctx, det_ctx, p);
alerts = PacketAlertCheck(p, 10); alerts = PacketAlertCheck(p, 10);
drops += ((PACKET_TEST_ACTION(p, ACTION_DROP))?1:0); drops += ((PacketTestAction(p, ACTION_DROP)) ? 1 : 0);
p->action = 0; p->action = 0;
SigMatchSignatures(&th_v, de_ctx, det_ctx, p); SigMatchSignatures(&th_v, de_ctx, det_ctx, p);
alerts += PacketAlertCheck(p, 10); alerts += PacketAlertCheck(p, 10);
drops += ((PACKET_TEST_ACTION(p, ACTION_DROP))?1:0); drops += ((PacketTestAction(p, ACTION_DROP)) ? 1 : 0);
p->action = 0; p->action = 0;
SigMatchSignatures(&th_v, de_ctx, det_ctx, p); SigMatchSignatures(&th_v, de_ctx, det_ctx, p);
alerts += PacketAlertCheck(p, 10); alerts += PacketAlertCheck(p, 10);
drops += ((PACKET_TEST_ACTION(p, ACTION_DROP))?1:0); drops += ((PacketTestAction(p, ACTION_DROP)) ? 1 : 0);
p->action = 0; p->action = 0;
TimeSetIncrementTime(200); TimeSetIncrementTime(200);
@ -1533,17 +1533,17 @@ static int DetectThresholdTestSig12(void)
SigMatchSignatures(&th_v, de_ctx, det_ctx, p); SigMatchSignatures(&th_v, de_ctx, det_ctx, p);
alerts += PacketAlertCheck(p, 10); alerts += PacketAlertCheck(p, 10);
drops += ((PACKET_TEST_ACTION(p, ACTION_DROP))?1:0); drops += ((PacketTestAction(p, ACTION_DROP)) ? 1 : 0);
p->action = 0; p->action = 0;
SigMatchSignatures(&th_v, de_ctx, det_ctx, p); SigMatchSignatures(&th_v, de_ctx, det_ctx, p);
alerts += PacketAlertCheck(p, 10); alerts += PacketAlertCheck(p, 10);
drops += ((PACKET_TEST_ACTION(p, ACTION_DROP))?1:0); drops += ((PacketTestAction(p, ACTION_DROP)) ? 1 : 0);
p->action = 0; p->action = 0;
SigMatchSignatures(&th_v, de_ctx, det_ctx, p); SigMatchSignatures(&th_v, de_ctx, det_ctx, p);
alerts += PacketAlertCheck(p, 10); alerts += PacketAlertCheck(p, 10);
drops += ((PACKET_TEST_ACTION(p, ACTION_DROP))?1:0); drops += ((PacketTestAction(p, ACTION_DROP)) ? 1 : 0);
p->action = 0; p->action = 0;
if (alerts == 1 && drops == 2) if (alerts == 1 && drops == 2)

6
src/detect.c
Unescape Escape View File

@ -1540,7 +1540,7 @@ next:
void DetectSignatureApplyActions(Packet *p, void DetectSignatureApplyActions(Packet *p,
const Signature *s, const uint8_t alert_flags) const Signature *s, const uint8_t alert_flags)
{ {
PACKET_UPDATE_ACTION(p, s->action); PacketUpdateAction(p, s->action);
if (s->action & ACTION_DROP) { if (s->action & ACTION_DROP) {
if (p->alerts.drop.action == 0) { if (p->alerts.drop.action == 0) {
@ -1601,9 +1601,7 @@ static void DetectNoFlow(ThreadVars *tv,
Packet *p) Packet *p)
{ {
/* No need to perform any detection on this packet, if the the given flag is set.*/ /* No need to perform any detection on this packet, if the the given flag is set.*/
if ((p->flags & PKT_NOPACKET_INSPECTION) || if ((p->flags & PKT_NOPACKET_INSPECTION) || (PacketTestAction(p, ACTION_DROP))) {
(PACKET_TEST_ACTION(p, ACTION_DROP)))
{
return; return;
} }

4
src/output-json-alert.c
Unescape Escape View File

@ -344,8 +344,8 @@ void AlertJsonHeader(void *ctx, const Packet *p, const PacketAlert *pa,
const char *action = "allowed"; const char *action = "allowed";
/* use packet action if rate_filter modified the action */ /* use packet action if rate_filter modified the action */
if (unlikely(pa->flags & PACKET_ALERT_RATE_FILTER_MODIFIED)) { if (unlikely(pa->flags & PACKET_ALERT_RATE_FILTER_MODIFIED)) {
if (PACKET_TEST_ACTION(p, (ACTION_DROP|ACTION_REJECT| if (PacketTestAction(
ACTION_REJECT_DST|ACTION_REJECT_BOTH))) { p, (ACTION_DROP | ACTION_REJECT | ACTION_REJECT_DST | ACTION_REJECT_BOTH))) {
action = "blocked"; action = "blocked";
} }
} else { } else {

2
src/output-json-drop.c
Unescape Escape View File

@ -351,7 +351,7 @@ static int JsonDropLogCondition(ThreadVars *tv, const Packet *p)
ret = TRUE; ret = TRUE;
return ret; return ret;
} else if (PACKET_TEST_ACTION(p, ACTION_DROP)) { } else if (PacketTestAction(p, ACTION_DROP)) {
return TRUE; return TRUE;
} }

26
src/respond-reject.c
Unescape Escape View File

@ -64,7 +64,7 @@ static TmEcode RespondRejectThreadDeinit(ThreadVars *tv, void *data)
static TmEcode RespondRejectFunc(ThreadVars *tv, Packet *p, void *data) static TmEcode RespondRejectFunc(ThreadVars *tv, Packet *p, void *data)
{ {
/* ACTION_REJECT defaults to rejecting the SRC */ /* ACTION_REJECT defaults to rejecting the SRC */
if (likely(PACKET_TEST_ACTION(p, ACTION_REJECT_ANY) == 0)) { if (likely(PacketTestAction(p, ACTION_REJECT_ANY) == 0)) {
return TM_ECODE_OK; return TM_ECODE_OK;
} }
@ -92,13 +92,13 @@ static TmEcode RespondRejectFunc(ThreadVars *tv, Packet *p, void *data)
int RejectSendIPv4TCP(ThreadVars *tv, Packet *p, void *data) int RejectSendIPv4TCP(ThreadVars *tv, Packet *p, void *data)
{ {
SCEnter(); SCEnter();
if (PACKET_TEST_ACTION(p, ACTION_REJECT)) { if (PacketTestAction(p, ACTION_REJECT)) {
int r = RejectSendLibnet11IPv4TCP(tv, p, data, REJECT_DIR_SRC); int r = RejectSendLibnet11IPv4TCP(tv, p, data, REJECT_DIR_SRC);
SCReturnInt(r); SCReturnInt(r);
} else if (PACKET_TEST_ACTION(p, ACTION_REJECT_DST)) { } else if (PacketTestAction(p, ACTION_REJECT_DST)) {
int r = RejectSendLibnet11IPv4TCP(tv, p, data, REJECT_DIR_DST); int r = RejectSendLibnet11IPv4TCP(tv, p, data, REJECT_DIR_DST);
SCReturnInt(r); SCReturnInt(r);
} else if(PACKET_TEST_ACTION(p, ACTION_REJECT_BOTH)) { } else if (PacketTestAction(p, ACTION_REJECT_BOTH)) {
int r = RejectSendLibnet11IPv4TCP(tv, p, data, REJECT_DIR_SRC); int r = RejectSendLibnet11IPv4TCP(tv, p, data, REJECT_DIR_SRC);
r |= RejectSendLibnet11IPv4TCP(tv, p, data, REJECT_DIR_DST); r |= RejectSendLibnet11IPv4TCP(tv, p, data, REJECT_DIR_DST);
SCReturnInt(r); SCReturnInt(r);
@ -109,13 +109,13 @@ int RejectSendIPv4TCP(ThreadVars *tv, Packet *p, void *data)
int RejectSendIPv4ICMP(ThreadVars *tv, Packet *p, void *data) int RejectSendIPv4ICMP(ThreadVars *tv, Packet *p, void *data)
{ {
SCEnter(); SCEnter();
if (PACKET_TEST_ACTION(p, ACTION_REJECT)) { if (PacketTestAction(p, ACTION_REJECT)) {
int r = RejectSendLibnet11IPv4ICMP(tv, p, data, REJECT_DIR_SRC); int r = RejectSendLibnet11IPv4ICMP(tv, p, data, REJECT_DIR_SRC);
SCReturnInt(r); SCReturnInt(r);
} else if (PACKET_TEST_ACTION(p, ACTION_REJECT_DST)) { } else if (PacketTestAction(p, ACTION_REJECT_DST)) {
int r = RejectSendLibnet11IPv4ICMP(tv, p, data, REJECT_DIR_DST); int r = RejectSendLibnet11IPv4ICMP(tv, p, data, REJECT_DIR_DST);
SCReturnInt(r); SCReturnInt(r);
} else if(PACKET_TEST_ACTION(p, ACTION_REJECT_BOTH)) { } else if (PacketTestAction(p, ACTION_REJECT_BOTH)) {
int r = RejectSendLibnet11IPv4ICMP(tv, p, data, REJECT_DIR_SRC); int r = RejectSendLibnet11IPv4ICMP(tv, p, data, REJECT_DIR_SRC);
r |= RejectSendLibnet11IPv4ICMP(tv, p, data, REJECT_DIR_DST); r |= RejectSendLibnet11IPv4ICMP(tv, p, data, REJECT_DIR_DST);
SCReturnInt(r); SCReturnInt(r);
@ -126,13 +126,13 @@ int RejectSendIPv4ICMP(ThreadVars *tv, Packet *p, void *data)
int RejectSendIPv6TCP(ThreadVars *tv, Packet *p, void *data) int RejectSendIPv6TCP(ThreadVars *tv, Packet *p, void *data)
{ {
SCEnter(); SCEnter();
if (PACKET_TEST_ACTION(p, ACTION_REJECT)) { if (PacketTestAction(p, ACTION_REJECT)) {
int r = RejectSendLibnet11IPv6TCP(tv, p, data, REJECT_DIR_SRC); int r = RejectSendLibnet11IPv6TCP(tv, p, data, REJECT_DIR_SRC);
SCReturnInt(r); SCReturnInt(r);
} else if (PACKET_TEST_ACTION(p, ACTION_REJECT_DST)) { } else if (PacketTestAction(p, ACTION_REJECT_DST)) {
int r = RejectSendLibnet11IPv6TCP(tv, p, data, REJECT_DIR_DST); int r = RejectSendLibnet11IPv6TCP(tv, p, data, REJECT_DIR_DST);
SCReturnInt(r); SCReturnInt(r);
} else if(PACKET_TEST_ACTION(p, ACTION_REJECT_BOTH)) { } else if (PacketTestAction(p, ACTION_REJECT_BOTH)) {
int r = RejectSendLibnet11IPv6TCP(tv, p, data, REJECT_DIR_SRC); int r = RejectSendLibnet11IPv6TCP(tv, p, data, REJECT_DIR_SRC);
r |= RejectSendLibnet11IPv6TCP(tv, p, data, REJECT_DIR_DST); r |= RejectSendLibnet11IPv6TCP(tv, p, data, REJECT_DIR_DST);
SCReturnInt(r); SCReturnInt(r);
@ -143,13 +143,13 @@ int RejectSendIPv6TCP(ThreadVars *tv, Packet *p, void *data)
int RejectSendIPv6ICMP(ThreadVars *tv, Packet *p, void *data) int RejectSendIPv6ICMP(ThreadVars *tv, Packet *p, void *data)
{ {
SCEnter(); SCEnter();
if (PACKET_TEST_ACTION(p, ACTION_REJECT)) { if (PacketTestAction(p, ACTION_REJECT)) {
int r = RejectSendLibnet11IPv6ICMP(tv, p, data, REJECT_DIR_SRC); int r = RejectSendLibnet11IPv6ICMP(tv, p, data, REJECT_DIR_SRC);
SCReturnInt(r); SCReturnInt(r);
} else if (PACKET_TEST_ACTION(p, ACTION_REJECT_DST)) { } else if (PacketTestAction(p, ACTION_REJECT_DST)) {
int r = RejectSendLibnet11IPv6ICMP(tv, p, data, REJECT_DIR_DST); int r = RejectSendLibnet11IPv6ICMP(tv, p, data, REJECT_DIR_DST);
SCReturnInt(r); SCReturnInt(r);
} else if(PACKET_TEST_ACTION(p, ACTION_REJECT_BOTH)) { } else if (PacketTestAction(p, ACTION_REJECT_BOTH)) {
int r = RejectSendLibnet11IPv6ICMP(tv, p, data, REJECT_DIR_SRC); int r = RejectSendLibnet11IPv6ICMP(tv, p, data, REJECT_DIR_SRC);
r |= RejectSendLibnet11IPv6ICMP(tv, p, data, REJECT_DIR_DST); r |= RejectSendLibnet11IPv6ICMP(tv, p, data, REJECT_DIR_DST);
SCReturnInt(r); SCReturnInt(r);

2
src/source-af-packet.c
Unescape Escape View File

@ -726,7 +726,7 @@ static TmEcode AFPWritePacket(Packet *p, int version)
uint16_t vlan_tci = 0; uint16_t vlan_tci = 0;
if (p->afp_v.copy_mode == AFP_COPY_MODE_IPS) { if (p->afp_v.copy_mode == AFP_COPY_MODE_IPS) {
if (PACKET_TEST_ACTION(p, ACTION_DROP)) { if (PacketTestAction(p, ACTION_DROP)) {
return TM_ECODE_OK; return TM_ECODE_OK;
} }
} }

2
src/source-ipfw.c
Unescape Escape View File

@ -533,7 +533,7 @@ TmEcode IPFWSetVerdict(ThreadVars *tv, IPFWThreadVars *ptv, Packet *p)
IPFWpoll.events = POLLWRNORM; IPFWpoll.events = POLLWRNORM;
#endif #endif
if (PACKET_TEST_ACTION(p, ACTION_DROP)) { if (PacketTestAction(p, ACTION_DROP)) {
verdict = IPFW_DROP; verdict = IPFW_DROP;
} else { } else {
verdict = IPFW_ACCEPT; verdict = IPFW_ACCEPT;

4
src/source-napatech.c
Unescape Escape View File

@ -581,7 +581,7 @@ static int ProgramFlow(Packet *p, int is_inline)
flow_match.gfi = 1; /* Generate FlowInfo records */ flow_match.gfi = 1; /* Generate FlowInfo records */
flow_match.tau = 1; /* tcp automatic unlearn */ flow_match.tau = 1; /* tcp automatic unlearn */
if (PACKET_TEST_ACTION(p, ACTION_DROP)) { if (PacketTestAction(p, ACTION_DROP)) {
flow_match.keySetId = NAPATECH_FLOWTYPE_DROP; flow_match.keySetId = NAPATECH_FLOWTYPE_DROP;
} else { } else {
if (is_inline) { if (is_inline) {
@ -680,7 +680,7 @@ static void NapatechReleasePacket(struct Packet_ *p)
* before releasing the Napatech buffer back to NTService. * before releasing the Napatech buffer back to NTService.
*/ */
#ifdef NAPATECH_ENABLE_BYPASS #ifdef NAPATECH_ENABLE_BYPASS
if (is_inline && PACKET_TEST_ACTION(p, ACTION_DROP)) { if (is_inline && PacketTestAction(p, ACTION_DROP)) {
p->ntpv.dyn3->wireLength = 0; p->ntpv.dyn3->wireLength = 0;
} }

2
src/source-netmap.c
Unescape Escape View File

@ -515,7 +515,7 @@ error:
static TmEcode NetmapWritePacket(NetmapThreadVars *ntv, Packet *p) static TmEcode NetmapWritePacket(NetmapThreadVars *ntv, Packet *p)
{ {
if (ntv->copy_mode == NETMAP_COPY_MODE_IPS) { if (ntv->copy_mode == NETMAP_COPY_MODE_IPS) {
if (PACKET_TEST_ACTION(p, ACTION_DROP)) { if (PacketTestAction(p, ACTION_DROP)) {
return TM_ECODE_OK; return TM_ECODE_OK;
} }
} }

6
src/source-nfq.c
Unescape Escape View File

@ -475,7 +475,7 @@ static int NFQSetupPkt (Packet *p, struct nfq_q_handle *qh, void *data)
static void NFQReleasePacket(Packet *p) static void NFQReleasePacket(Packet *p)
{ {
if (unlikely(!p->nfq_v.verdicted)) { if (unlikely(!p->nfq_v.verdicted)) {
PACKET_UPDATE_ACTION(p, ACTION_DROP); PacketUpdateAction(p, ACTION_DROP);
NFQSetVerdict(p); NFQSetVerdict(p);
} }
PacketFreeOrRelease(p); PacketFreeOrRelease(p);
@ -1036,7 +1036,7 @@ static inline uint32_t GetVerdict(const Packet *p)
{ {
uint32_t verdict = NF_ACCEPT; uint32_t verdict = NF_ACCEPT;
if (PACKET_TEST_ACTION(p, ACTION_DROP)) { if (PacketTestAction(p, ACTION_DROP)) {
verdict = NF_DROP; verdict = NF_DROP;
} else { } else {
switch (nfq_config.mode) { switch (nfq_config.mode) {
@ -1058,7 +1058,7 @@ static inline uint32_t GetVerdict(const Packet *p)
#ifdef COUNTERS #ifdef COUNTERS
static inline void UpdateCounters(NFQQueueVars *t, const Packet *p) static inline void UpdateCounters(NFQQueueVars *t, const Packet *p)
{ {
if (PACKET_TEST_ACTION(p, ACTION_DROP)) { if (PacketTestAction(p, ACTION_DROP)) {
t->dropped++; t->dropped++;
} else { } else {
if (p->flags & PKT_STREAM_MODIFIED) { if (p->flags & PKT_STREAM_MODIFIED) {

2
src/source-windivert.c
Unescape Escape View File

@ -789,7 +789,7 @@ static TmEcode WinDivertVerdictHelper(ThreadVars *tv, Packet *p)
/* DROP simply means we do nothing; the WinDivert driver does the rest. /* DROP simply means we do nothing; the WinDivert driver does the rest.
*/ */
if (PACKET_TEST_ACTION(p, ACTION_DROP)) { if (PacketTestAction(p, ACTION_DROP)) {
#ifdef COUNTERS #ifdef COUNTERS
SCMutexLock(&wd_qv->counters_mutex); SCMutexLock(&wd_qv->counters_mutex);
wd_qv->dropped++; wd_qv->dropped++;

6
src/tests/detect.c
Unescape Escape View File

@ -4805,7 +4805,7 @@ static int SigTestDropFlow03(void)
goto end; goto end;
} }
if ( !(PACKET_TEST_ACTION(p2, ACTION_DROP))) { if (!(PacketTestAction(p2, ACTION_DROP))) {
printf("A \"drop\" action should be set from the flow to the packet: "); printf("A \"drop\" action should be set from the flow to the packet: ");
goto end; goto end;
} }
@ -4943,7 +4943,7 @@ static int SigTestDropFlow04(void)
goto end; goto end;
} }
if (!(PACKET_TEST_ACTION(p1, ACTION_DROP))) { if (!(PacketTestAction(p1, ACTION_DROP))) {
printf("A \"drop\" action was set from the flow to the packet " printf("A \"drop\" action was set from the flow to the packet "
"which is right, but setting the flag shouldn't disable " "which is right, but setting the flag shouldn't disable "
"inspection on the packet in IDS mode"); "inspection on the packet in IDS mode");
@ -4988,7 +4988,7 @@ static int SigTestDropFlow04(void)
goto end; goto end;
} }
if (!(PACKET_TEST_ACTION(p2, ACTION_DROP))) { if (!(PacketTestAction(p2, ACTION_DROP))) {
printf("A \"drop\" action was set from the flow to the packet " printf("A \"drop\" action was set from the flow to the packet "
"which is right, but setting the flag shouldn't disable " "which is right, but setting the flag shouldn't disable "
"inspection on the packet in IDS mode"); "inspection on the packet in IDS mode");

56
src/util-threshold-config.c
Unescape Escape View File

@ -1636,15 +1636,15 @@ static int SCThresholdConfTest09(void)
p->alerts.cnt = 0; p->alerts.cnt = 0;
p->action = 0; p->action = 0;
SigMatchSignatures(&th_v, de_ctx, det_ctx, p); SigMatchSignatures(&th_v, de_ctx, det_ctx, p);
FAIL_IF(p->alerts.cnt != 1 || PACKET_TEST_ACTION(p, ACTION_DROP)); FAIL_IF(p->alerts.cnt != 1 || PacketTestAction(p, ACTION_DROP));
p->alerts.cnt = 0; p->alerts.cnt = 0;
p->action = 0; p->action = 0;
SigMatchSignatures(&th_v, de_ctx, det_ctx, p); SigMatchSignatures(&th_v, de_ctx, det_ctx, p);
FAIL_IF(p->alerts.cnt != 1 || PACKET_TEST_ACTION(p, ACTION_DROP)); FAIL_IF(p->alerts.cnt != 1 || PacketTestAction(p, ACTION_DROP));
p->alerts.cnt = 0; p->alerts.cnt = 0;
p->action = 0; p->action = 0;
SigMatchSignatures(&th_v, de_ctx, det_ctx, p); SigMatchSignatures(&th_v, de_ctx, det_ctx, p);
FAIL_IF(p->alerts.cnt != 1 || PACKET_TEST_ACTION(p, ACTION_DROP)); FAIL_IF(p->alerts.cnt != 1 || PacketTestAction(p, ACTION_DROP));
TimeSetIncrementTime(2); TimeSetIncrementTime(2);
TimeGet(&p->ts); TimeGet(&p->ts);
@ -1652,7 +1652,7 @@ static int SCThresholdConfTest09(void)
p->alerts.cnt = 0; p->alerts.cnt = 0;
p->action = 0; p->action = 0;
SigMatchSignatures(&th_v, de_ctx, det_ctx, p); SigMatchSignatures(&th_v, de_ctx, det_ctx, p);
FAIL_IF(p->alerts.cnt != 1 || !(PACKET_TEST_ACTION(p, ACTION_DROP))); FAIL_IF(p->alerts.cnt != 1 || !(PacketTestAction(p, ACTION_DROP)));
TimeSetIncrementTime(3); TimeSetIncrementTime(3);
TimeGet(&p->ts); TimeGet(&p->ts);
@ -1660,7 +1660,7 @@ static int SCThresholdConfTest09(void)
p->alerts.cnt = 0; p->alerts.cnt = 0;
p->action = 0; p->action = 0;
SigMatchSignatures(&th_v, de_ctx, det_ctx, p); SigMatchSignatures(&th_v, de_ctx, det_ctx, p);
FAIL_IF(p->alerts.cnt != 1 || !(PACKET_TEST_ACTION(p, ACTION_DROP))); FAIL_IF(p->alerts.cnt != 1 || !(PacketTestAction(p, ACTION_DROP)));
TimeSetIncrementTime(10); TimeSetIncrementTime(10);
TimeGet(&p->ts); TimeGet(&p->ts);
@ -1668,12 +1668,12 @@ static int SCThresholdConfTest09(void)
p->alerts.cnt = 0; p->alerts.cnt = 0;
p->action = 0; p->action = 0;
SigMatchSignatures(&th_v, de_ctx, det_ctx, p); SigMatchSignatures(&th_v, de_ctx, det_ctx, p);
FAIL_IF(p->alerts.cnt != 1 || PACKET_TEST_ACTION(p, ACTION_DROP)); FAIL_IF(p->alerts.cnt != 1 || PacketTestAction(p, ACTION_DROP));
p->alerts.cnt = 0; p->alerts.cnt = 0;
p->action = 0; p->action = 0;
SigMatchSignatures(&th_v, de_ctx, det_ctx, p); SigMatchSignatures(&th_v, de_ctx, det_ctx, p);
FAIL_IF(p->alerts.cnt != 1 || PACKET_TEST_ACTION(p, ACTION_DROP)); FAIL_IF(p->alerts.cnt != 1 || PacketTestAction(p, ACTION_DROP));
UTHFreePacket(p); UTHFreePacket(p);
DetectEngineThreadCtxDeinit(&th_v, (void *)det_ctx); DetectEngineThreadCtxDeinit(&th_v, (void *)det_ctx);
@ -1730,21 +1730,21 @@ static int SCThresholdConfTest10(void)
/* All should be alerted, none dropped */ /* All should be alerted, none dropped */
SigMatchSignatures(&th_v, de_ctx, det_ctx, p1); SigMatchSignatures(&th_v, de_ctx, det_ctx, p1);
FAIL_IF(PACKET_TEST_ACTION(p1, ACTION_DROP)); FAIL_IF(PacketTestAction(p1, ACTION_DROP));
FAIL_IF(PacketAlertCheck(p1, 10) != 1); FAIL_IF(PacketAlertCheck(p1, 10) != 1);
p1->action = 0; p1->action = 0;
SigMatchSignatures(&th_v, de_ctx, det_ctx, p2); SigMatchSignatures(&th_v, de_ctx, det_ctx, p2);
FAIL_IF(PACKET_TEST_ACTION(p2, ACTION_DROP)); FAIL_IF(PacketTestAction(p2, ACTION_DROP));
FAIL_IF(PacketAlertCheck(p2, 10) != 1); FAIL_IF(PacketAlertCheck(p2, 10) != 1);
p2->action = 0; p2->action = 0;
SigMatchSignatures(&th_v, de_ctx, det_ctx, p1); SigMatchSignatures(&th_v, de_ctx, det_ctx, p1);
FAIL_IF(PACKET_TEST_ACTION(p1, ACTION_DROP)); FAIL_IF(PacketTestAction(p1, ACTION_DROP));
FAIL_IF(PacketAlertCheck(p1, 10) != 1); FAIL_IF(PacketAlertCheck(p1, 10) != 1);
p1->action = 0; p1->action = 0;
/* Match #4 should be dropped*/ /* Match #4 should be dropped*/
SigMatchSignatures(&th_v, de_ctx, det_ctx, p2); SigMatchSignatures(&th_v, de_ctx, det_ctx, p2);
FAIL_IF_NOT(PACKET_TEST_ACTION(p2, ACTION_DROP)); FAIL_IF_NOT(PacketTestAction(p2, ACTION_DROP));
FAIL_IF(PacketAlertCheck(p2, 10) != 1); FAIL_IF(PacketAlertCheck(p2, 10) != 1);
p2->action = 0; p2->action = 0;
@ -1753,7 +1753,7 @@ static int SCThresholdConfTest10(void)
/* Still dropped because timeout not expired */ /* Still dropped because timeout not expired */
SigMatchSignatures(&th_v, de_ctx, det_ctx, p1); SigMatchSignatures(&th_v, de_ctx, det_ctx, p1);
FAIL_IF_NOT(PACKET_TEST_ACTION(p1, ACTION_DROP)); FAIL_IF_NOT(PacketTestAction(p1, ACTION_DROP));
FAIL_IF(PacketAlertCheck(p1, 10) != 1); FAIL_IF(PacketAlertCheck(p1, 10) != 1);
p1->action = 0; p1->action = 0;
@ -1762,7 +1762,7 @@ static int SCThresholdConfTest10(void)
/* Not dropped because timeout expired */ /* Not dropped because timeout expired */
SigMatchSignatures(&th_v, de_ctx, det_ctx, p1); SigMatchSignatures(&th_v, de_ctx, det_ctx, p1);
FAIL_IF(PACKET_TEST_ACTION(p1, ACTION_DROP)); FAIL_IF(PacketTestAction(p1, ACTION_DROP));
FAIL_IF(PacketAlertCheck(p1, 10) != 1); FAIL_IF(PacketAlertCheck(p1, 10) != 1);
/* Ensure that a Threshold entry was installed at the sig */ /* Ensure that a Threshold entry was installed at the sig */
@ -2135,7 +2135,7 @@ static int SCThresholdConfTest15(void)
/* 10000 shouldn't match */ /* 10000 shouldn't match */
FAIL_IF(PacketAlertCheck(p, 10000) != 0); FAIL_IF(PacketAlertCheck(p, 10000) != 0);
/* however, it should have set the drop flag */ /* however, it should have set the drop flag */
FAIL_IF(!(PACKET_TEST_ACTION(p, ACTION_DROP))); FAIL_IF(!(PacketTestAction(p, ACTION_DROP)));
UTHFreePacket(p); UTHFreePacket(p);
DetectEngineThreadCtxDeinit(&th_v, (void *)det_ctx); DetectEngineThreadCtxDeinit(&th_v, (void *)det_ctx);
@ -2186,7 +2186,7 @@ static int SCThresholdConfTest16(void)
FAIL_IF(PacketAlertCheck(p, 1000) != 0); FAIL_IF(PacketAlertCheck(p, 1000) != 0);
/* however, it should have set the drop flag */ /* however, it should have set the drop flag */
FAIL_IF(!(PACKET_TEST_ACTION(p, ACTION_DROP))); FAIL_IF(!(PacketTestAction(p, ACTION_DROP)));
UTHFreePacket(p); UTHFreePacket(p);
DetectEngineThreadCtxDeinit(&th_v, (void *)det_ctx); DetectEngineThreadCtxDeinit(&th_v, (void *)det_ctx);
@ -2238,7 +2238,7 @@ static int SCThresholdConfTest17(void)
/* 10000 shouldn't match */ /* 10000 shouldn't match */
FAIL_IF(PacketAlertCheck(p, 10000) != 0); FAIL_IF(PacketAlertCheck(p, 10000) != 0);
/* however, it should have set the drop flag */ /* however, it should have set the drop flag */
FAIL_IF(!(PACKET_TEST_ACTION(p, ACTION_DROP))); FAIL_IF(!(PacketTestAction(p, ACTION_DROP)));
UTHFreePacket(p); UTHFreePacket(p);
DetectEngineThreadCtxDeinit(&th_v, (void *)det_ctx); DetectEngineThreadCtxDeinit(&th_v, (void *)det_ctx);
@ -2528,15 +2528,15 @@ static int SCThresholdConfTest22(void)
/* All should be alerted, none dropped */ /* All should be alerted, none dropped */
SigMatchSignatures(&th_v, de_ctx, det_ctx, p1); SigMatchSignatures(&th_v, de_ctx, det_ctx, p1);
FAIL_IF(PACKET_TEST_ACTION(p1, ACTION_DROP)); FAIL_IF(PacketTestAction(p1, ACTION_DROP));
FAIL_IF(PacketAlertCheck(p1, 10) != 1); FAIL_IF(PacketAlertCheck(p1, 10) != 1);
SigMatchSignatures(&th_v, de_ctx, det_ctx, p2); SigMatchSignatures(&th_v, de_ctx, det_ctx, p2);
FAIL_IF(PACKET_TEST_ACTION(p2, ACTION_DROP)); FAIL_IF(PacketTestAction(p2, ACTION_DROP));
FAIL_IF(PacketAlertCheck(p2, 10) != 1); FAIL_IF(PacketAlertCheck(p2, 10) != 1);
SigMatchSignatures(&th_v, de_ctx, det_ctx, p3); SigMatchSignatures(&th_v, de_ctx, det_ctx, p3);
FAIL_IF(PACKET_TEST_ACTION(p3, ACTION_DROP)); FAIL_IF(PacketTestAction(p3, ACTION_DROP));
FAIL_IF(PacketAlertCheck(p3, 10) != 1); FAIL_IF(PacketAlertCheck(p3, 10) != 1);
p1->action = p2->action = p3->action = 0; p1->action = p2->action = p3->action = 0;
@ -2547,7 +2547,7 @@ static int SCThresholdConfTest22(void)
/* p1 still shouldn't be dropped after 2nd alert */ /* p1 still shouldn't be dropped after 2nd alert */
SigMatchSignatures(&th_v, de_ctx, det_ctx, p1); SigMatchSignatures(&th_v, de_ctx, det_ctx, p1);
FAIL_IF(PACKET_TEST_ACTION(p1, ACTION_DROP)); FAIL_IF(PacketTestAction(p1, ACTION_DROP));
FAIL_IF(PacketAlertCheck(p1, 10) != 1); FAIL_IF(PacketAlertCheck(p1, 10) != 1);
p1->action = 0; p1->action = 0;
@ -2558,15 +2558,15 @@ static int SCThresholdConfTest22(void)
/* All should be alerted, only p1 must be dropped due to rate_filter*/ /* All should be alerted, only p1 must be dropped due to rate_filter*/
SigMatchSignatures(&th_v, de_ctx, det_ctx, p1); SigMatchSignatures(&th_v, de_ctx, det_ctx, p1);
FAIL_IF_NOT(PACKET_TEST_ACTION(p1, ACTION_DROP)); FAIL_IF_NOT(PacketTestAction(p1, ACTION_DROP));
FAIL_IF(PacketAlertCheck(p1, 10) != 1); FAIL_IF(PacketAlertCheck(p1, 10) != 1);
SigMatchSignatures(&th_v, de_ctx, det_ctx, p2); SigMatchSignatures(&th_v, de_ctx, det_ctx, p2);
FAIL_IF(PACKET_TEST_ACTION(p2, ACTION_DROP)); FAIL_IF(PacketTestAction(p2, ACTION_DROP));
FAIL_IF(PacketAlertCheck(p2, 10) != 1); FAIL_IF(PacketAlertCheck(p2, 10) != 1);
SigMatchSignatures(&th_v, de_ctx, det_ctx, p3); SigMatchSignatures(&th_v, de_ctx, det_ctx, p3);
FAIL_IF(PACKET_TEST_ACTION(p3, ACTION_DROP)); FAIL_IF(PacketTestAction(p3, ACTION_DROP));
FAIL_IF(PacketAlertCheck(p3, 10) != 1); FAIL_IF(PacketAlertCheck(p3, 10) != 1);
p1->action = p2->action = p3->action = 0; p1->action = p2->action = p3->action = 0;
@ -2577,15 +2577,15 @@ static int SCThresholdConfTest22(void)
/* All should be alerted, none dropped (because timeout expired) */ /* All should be alerted, none dropped (because timeout expired) */
SigMatchSignatures(&th_v, de_ctx, det_ctx, p1); SigMatchSignatures(&th_v, de_ctx, det_ctx, p1);
FAIL_IF(PACKET_TEST_ACTION(p1, ACTION_DROP)); FAIL_IF(PacketTestAction(p1, ACTION_DROP));
FAIL_IF(PacketAlertCheck(p1, 10) != 1); FAIL_IF(PacketAlertCheck(p1, 10) != 1);
SigMatchSignatures(&th_v, de_ctx, det_ctx, p2); SigMatchSignatures(&th_v, de_ctx, det_ctx, p2);
FAIL_IF(PACKET_TEST_ACTION(p2, ACTION_DROP)); FAIL_IF(PacketTestAction(p2, ACTION_DROP));
FAIL_IF(PacketAlertCheck(p2, 10) != 1); FAIL_IF(PacketAlertCheck(p2, 10) != 1);
SigMatchSignatures(&th_v, de_ctx, det_ctx, p3); SigMatchSignatures(&th_v, de_ctx, det_ctx, p3);
FAIL_IF(PACKET_TEST_ACTION(p3, ACTION_DROP)); FAIL_IF(PacketTestAction(p3, ACTION_DROP));
FAIL_IF(PacketAlertCheck(p3, 10) != 1); FAIL_IF(PacketAlertCheck(p3, 10) != 1);
UTHFreePacket(p3); UTHFreePacket(p3);
@ -2662,7 +2662,7 @@ static int SCThresholdConfTest23(void)
TimeGet(&p1->ts); TimeGet(&p1->ts);
SigMatchSignatures(&th_v, de_ctx, det_ctx, p1); SigMatchSignatures(&th_v, de_ctx, det_ctx, p1);
/* First packet should be alerted, not dropped */ /* First packet should be alerted, not dropped */
FAIL_IF(PACKET_TEST_ACTION(p1, ACTION_DROP)); FAIL_IF(PacketTestAction(p1, ACTION_DROP));
FAIL_IF(PacketAlertCheck(p1, 10) != 1); FAIL_IF(PacketAlertCheck(p1, 10) != 1);
TimeSetIncrementTime(2); TimeSetIncrementTime(2);
@ -2671,7 +2671,7 @@ static int SCThresholdConfTest23(void)
/* Second packet should be dropped because it considered as "the same pair" /* Second packet should be dropped because it considered as "the same pair"
and rate_filter count reached*/ and rate_filter count reached*/
FAIL_IF_NOT(PACKET_TEST_ACTION(p2, ACTION_DROP)); FAIL_IF_NOT(PacketTestAction(p2, ACTION_DROP));
FAIL_IF(PacketAlertCheck(p2, 10) != 1); FAIL_IF(PacketAlertCheck(p2, 10) != 1);
UTHFreePacket(p2); UTHFreePacket(p2);

Write Preview
Loading…
Cancel
Save