eve/verdict: clean up packet action checking

Get action from packet just once.
pull/14278/head
Victor Julien 3 weeks ago
parent b8411fcc8d
commit bccdb445ff

@ -541,19 +541,20 @@ void EveAddVerdict(SCJsonBuilder *jb, const Packet *p)
{
SCJbOpenObject(jb, "verdict");
const uint8_t packet_action = PacketGetAction(p);
/* add verdict info */
if (PacketCheckAction(p, ACTION_REJECT_ANY)) {
if (packet_action & ACTION_REJECT_ANY) {
// check rule to define type of reject packet sent
if (EngineModeIsIPS()) {
JB_SET_STRING(jb, "action", "drop");
} else {
JB_SET_STRING(jb, "action", "alert");
}
if (PacketCheckAction(p, ACTION_REJECT)) {
if (packet_action & ACTION_REJECT) {
JB_SET_STRING(jb, "reject-target", "to_client");
} else if (PacketCheckAction(p, ACTION_REJECT_DST)) {
} else if (packet_action & ACTION_REJECT_DST) {
JB_SET_STRING(jb, "reject-target", "to_server");
} else if (PacketCheckAction(p, ACTION_REJECT_BOTH)) {
} else if (packet_action & ACTION_REJECT_BOTH) {
JB_SET_STRING(jb, "reject-target", "both");
}
SCJbOpenArray(jb, "reject");
@ -569,9 +570,9 @@ void EveAddVerdict(SCJsonBuilder *jb, const Packet *p)
}
SCJbClose(jb);
} else if (PacketCheckAction(p, ACTION_DROP) && EngineModeIsIPS()) {
} else if ((packet_action & ACTION_DROP) && EngineModeIsIPS()) {
JB_SET_STRING(jb, "action", "drop");
} else if (PacketCheckAction(p, ACTION_ACCEPT)) {
} else if (packet_action & ACTION_ACCEPT) {
JB_SET_STRING(jb, "action", "accept");
} else if (p->alerts.alerts[p->alerts.cnt].action & ACTION_PASS) {
JB_SET_STRING(jb, "action", "pass");

@ -58,6 +58,15 @@ bool PacketCheckAction(const Packet *p, const uint8_t a)
}
}
uint8_t PacketGetAction(const Packet *p)
{
if (likely(p->root == NULL)) {
return p->action;
} else {
return p->action | p->root->action;
}
}
/**
* \brief Initialize a packet structure for use.
*/

@ -23,6 +23,7 @@
void PacketDrop(Packet *p, const uint8_t action, enum PacketDropReason r);
bool PacketCheckAction(const Packet *p, const uint8_t a);
uint8_t PacketGetAction(const Packet *p);
#ifdef UNITTESTS
static inline uint8_t PacketTestAction(const Packet *p, const uint8_t a)

Loading…
Cancel
Save