|
|
|
@ -10520,11 +10520,23 @@ static int SigTestDropFlow04(void)
|
|
|
|
goto end;
|
|
|
|
goto end;
|
|
|
|
}
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
if (PacketAlertCheck(p1, 2)) {
|
|
|
|
|
|
|
|
printf("sig 2 alerted on p1, but it should not: ");
|
|
|
|
|
|
|
|
goto end;
|
|
|
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
|
|
if ( !(p1->flow->flags & FLOW_ACTION_DROP)) {
|
|
|
|
if ( !(p1->flow->flags & FLOW_ACTION_DROP)) {
|
|
|
|
printf("sig 1 alerted but flow was not flagged correctly: ");
|
|
|
|
printf("sig 1 alerted but flow was not flagged correctly: ");
|
|
|
|
goto end;
|
|
|
|
goto end;
|
|
|
|
}
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
if (!(p1->action & ACTION_DROP)) {
|
|
|
|
|
|
|
|
printf("A \"drop\" action was set from the flow to the packet "
|
|
|
|
|
|
|
|
"which is right, but setting the flag shouldn't disable "
|
|
|
|
|
|
|
|
"inspection on the packet in IDS mode");
|
|
|
|
|
|
|
|
goto end;
|
|
|
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
|
|
/* Second part.. Let's feed with another packet */
|
|
|
|
/* Second part.. Let's feed with another packet */
|
|
|
|
if (StreamTcpCheckFlowDrops(p2) == 1) {
|
|
|
|
if (StreamTcpCheckFlowDrops(p2) == 1) {
|
|
|
|
FlowSetNoPacketInspectionFlag(p2->flow);
|
|
|
|
FlowSetNoPacketInspectionFlag(p2->flow);
|
|
|
|
@ -10550,7 +10562,7 @@ static int SigTestDropFlow04(void)
|
|
|
|
SigMatchSignatures(&tv, de_ctx, det_ctx, p2);
|
|
|
|
SigMatchSignatures(&tv, de_ctx, det_ctx, p2);
|
|
|
|
|
|
|
|
|
|
|
|
if (PacketAlertCheck(p2, 1)) {
|
|
|
|
if (PacketAlertCheck(p2, 1)) {
|
|
|
|
printf("sig 1 alerted, but it should not since the no pkt inspection should be set: ");
|
|
|
|
printf("sig 1 alerted, but it should not: ");
|
|
|
|
goto end;
|
|
|
|
goto end;
|
|
|
|
}
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
|
|
@ -10559,8 +10571,10 @@ static int SigTestDropFlow04(void)
|
|
|
|
goto end;
|
|
|
|
goto end;
|
|
|
|
}
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
|
|
if (p2->action & ACTION_DROP) {
|
|
|
|
if (!(p2->action & ACTION_DROP)) {
|
|
|
|
printf("A \"drop\" action was set from the flow to the packet, but on IDS mode it whould not (it should be inspected as usual: ");
|
|
|
|
printf("A \"drop\" action was set from the flow to the packet "
|
|
|
|
|
|
|
|
"which is right, but setting the flag shouldn't disable "
|
|
|
|
|
|
|
|
"inspection on the packet in IDS mode");
|
|
|
|
goto end;
|
|
|
|
goto end;
|
|
|
|
}
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
|
|
|