From bb6dc93789aff6120ca5c8a0278ae46eaa90fe15 Mon Sep 17 00:00:00 2001 From: Victor Julien Date: Thu, 28 May 2026 15:59:29 +0200 Subject: [PATCH] detect/firewall: clean up per rule run check --- src/detect.c | 27 ++++++++------------------- 1 file changed, 8 insertions(+), 19 deletions(-) diff --git a/src/detect.c b/src/detect.c index 1642b06a9f..9a92242a88 100644 --- a/src/detect.c +++ b/src/detect.c @@ -1916,34 +1916,22 @@ static enum DetectTxFirewallFlowControl DetectRunTxPreCheckFirewallPolicy( * \internal * \brief Check and update firewall rules state. * - * \param skip_fw_hook bool to indicate firewall rules skips - * For state `skip_before_progress` should be skipped. - * - * \param skip_before_progress progress value to skip rules before.* Only used if `skip_fw_hook` is - * set. - * - * \param fw_last_for_progress[out] set to true if this is firewall rule for a progress - * value - * - * \param fw_next_progress_missing[out] set to true if the next fw rule does not target the next - * progress value, or there is no fw rule for that value. + * \param fw_state pointer to flow control state * * \retval DETECT_TX_FW_FC_OK no action needed * \retval DETECT_TX_FW_FC_BREAK rest of rules shouldn't inspected * \retval DETECT_TX_FW_FC_SKIP skip this rule */ -static enum DetectTxFirewallFlowControl DetectRunTxCheckFirewallPolicy( - DetectEngineThreadCtx *det_ctx, Packet *p, Flow *f, DetectTransaction *tx, - const Signature *s, const uint32_t can_idx, const uint32_t can_size, - struct DetectFirewallAppTxState *fw_state) +static enum DetectTxFirewallFlowControl DetectRunTxCheckRuleState(DetectEngineThreadCtx *det_ctx, + Packet *p, Flow *f, DetectTransaction *tx, const Signature *s, const uint32_t can_idx, + const uint32_t can_size, struct DetectFirewallAppTxState *fw_state) { if (s->flags & SIG_FLAG_FIREWALL) { /* check if the next sig is on the same progress hook. If not, we need to apply our * default policy in case the current sig doesn't apply one. If the next sig has a * progress beyond our progress + 1, it means the next progress has no rules and needs * the default policy applied. But only after we evaluate the current rule first, as - * that may override it. - * TODO should we do this after dedup below? */ + * that may override it. */ if (can_idx + 1 < can_size) { const Signature *next_s = det_ctx->tx_candidates[can_idx + 1].s; @@ -2415,8 +2403,9 @@ static void DetectRunTx(ThreadVars *tv, } if (have_fw_rules) { - const enum DetectTxFirewallFlowControl fw_r = DetectRunTxCheckFirewallPolicy( - det_ctx, p, f, &tx, s, i, array_idx, &fw_state); + /* check if we should run this rule and update the firewall flow state */ + const enum DetectTxFirewallFlowControl fw_r = + DetectRunTxCheckRuleState(det_ctx, p, f, &tx, s, i, array_idx, &fw_state); SCLogDebug("fw fw_skip_app_filter:%s skip_fw_hook:%s " "skip_before_progress:%u fw_last_for_progress:%s " "fw_next_progress_missing:%s",