aiden
/
suricata
mirror of https://github.com/OISF/suricata
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

app-layer: flag flow for next packet in other dir

Browse Source 
Add new flags to trigger FLOW_TS_APP_UPDATED/FLOW_TC_APP_UPDATED flags
to be set for the next packet in the relevant direction.

This allows for app relevant work to be done in the next packet in our
direction.
pull/11236/head
Victor Julien 2 years ago committed by Victor Julien
parent 683363b42d
commit 866c128c43
2 changed files with 17 additions and 5 deletions
Show Stats Download Patch File Download Diff File

16
src/flow-worker.c
Unescape Escape View File

@ -523,19 +523,19 @@ static void PacketAppUpdate2FlowFlags(Packet *p)
break;
case UPDATE_DIR_BOTH:
if (PKT_IS_TOSERVER(p)) {
p->flow->flags |= FLOW_TS_APP_UPDATED;
p->flow->flags |= FLOW_TS_APP_UPDATED | FLOW_TC_APP_UPDATE_NEXT;
SCLogDebug("pcap_cnt %" PRIu64 ", FLOW_TS_APP_UPDATED set", p->pcap_cnt);
} else {
p->flow->flags |= FLOW_TC_APP_UPDATED;
p->flow->flags |= FLOW_TC_APP_UPDATED | FLOW_TS_APP_UPDATE_NEXT;
SCLogDebug("pcap_cnt %" PRIu64 ", FLOW_TC_APP_UPDATED set", p->pcap_cnt);
}
/* fall through */
case UPDATE_DIR_OPPOSING:
if (PKT_IS_TOSERVER(p)) {
p->flow->flags |= FLOW_TC_APP_UPDATED;
p->flow->flags |= FLOW_TC_APP_UPDATED | FLOW_TS_APP_UPDATE_NEXT;
SCLogDebug("pcap_cnt %" PRIu64 ", FLOW_TC_APP_UPDATED set", p->pcap_cnt);
} else {
p->flow->flags |= FLOW_TS_APP_UPDATED;
p->flow->flags |= FLOW_TS_APP_UPDATED | FLOW_TC_APP_UPDATE_NEXT;
SCLogDebug("pcap_cnt %" PRIu64 ", FLOW_TS_APP_UPDATED set", p->pcap_cnt);
}
break;
@ -583,6 +583,14 @@ static TmEcode FlowWorker(ThreadVars *tv, Packet *p, void *data)
/* handle TCP and app layer */
if (p->flow) {
if (PKT_IS_TOSERVER(p) && (p->flow->flags & FLOW_TS_APP_UPDATE_NEXT)) {
p->flow->flags |= FLOW_TS_APP_UPDATED;
p->flow->flags &= ~FLOW_TS_APP_UPDATE_NEXT;
} else if (PKT_IS_TOCLIENT(p) && (p->flow->flags & FLOW_TC_APP_UPDATE_NEXT)) {
p->flow->flags |= FLOW_TC_APP_UPDATED;
p->flow->flags &= ~FLOW_TC_APP_UPDATE_NEXT;
}
if (PacketIsTCP(p)) {
SCLogDebug("packet %" PRIu64 " is TCP. Direction %s", p->pcap_cnt,
PKT_IS_TOSERVER(p) ? "TOSERVER" : "TOCLIENT");

6
src/flow.h
Unescape Escape View File

@ -52,7 +52,8 @@ typedef struct AppLayerParserState_ AppLayerParserState;
/** At least one packet from the destination address was seen */
#define FLOW_TO_DST_SEEN BIT_U32(1)
// vacancy
/** next packet in toclient direction will act on updated app-layer state */
#define FLOW_TC_APP_UPDATE_NEXT BIT_U32(2)
/** Flow was inspected against IP-Only sigs in the toserver direction */
#define FLOW_TOSERVER_IPONLY_SET BIT_U32(3)
@ -117,6 +118,9 @@ typedef struct AppLayerParserState_ AppLayerParserState;
#define FLOW_TS_APP_UPDATED BIT_U32(29)
#define FLOW_TC_APP_UPDATED BIT_U32(30)
/** next packet in toserver direction will act on updated app-layer state */
#define FLOW_TS_APP_UPDATE_NEXT BIT_U32(31)
/* File flags */
#define FLOWFILE_INIT 0

Write Preview
Loading…
Cancel
Save