From f1b9669ed5c509e63d3185ce4b2d60805aebc2ee Mon Sep 17 00:00:00 2001
From: Giuseppe Longo <giuseppe@glongo.it>
Date: Mon, 22 Dec 2025 23:18:31 +0100
Subject: [PATCH] flow: swap MACs when flow direction is swapped

When FlowSwap() reverses the direction of a flow, the MAC address sets
stored in the flow also need to be swapped to maintain consistency with
the new direction. Previously, MAC addresses were not swapped along with
other flow properties like packet/byte counters.

Ticket #8172
---
 src/flow.c        |  7 +++++++
 src/util-macset.c | 23 +++++++++++++++++++++++
 src/util-macset.h |  1 +
 3 files changed, 31 insertions(+)

diff --git a/src/flow.c b/src/flow.c
index f84df956bf..dd44a9083b 100644
--- a/src/flow.c
+++ b/src/flow.c
@@ -269,6 +269,13 @@ void FlowSwap(Flow *f)
 
     SWAP_VARS(uint32_t, f->todstpktcnt, f->tosrcpktcnt);
     SWAP_VARS(uint64_t, f->todstbytecnt, f->tosrcbytecnt);
+
+    if (MacSetFlowStorageEnabled()) {
+        MacSet *ms = FlowGetStorageById(f, MacSetGetFlowStorageID());
+        if (ms != NULL) {
+            MacSetSwap(ms);
+        }
+    }
 }
 
 /**
diff --git a/src/util-macset.c b/src/util-macset.c
index 69a2468a69..0c97708b65 100644
--- a/src/util-macset.c
+++ b/src/util-macset.c
@@ -292,6 +292,29 @@ void MacSetFree(MacSet *ms)
     (void)SC_ATOMIC_SUB(flow_memuse, total_free);
 }
 
+void MacSetSwap(MacSet *ms)
+{
+    if (ms == NULL)
+        return;
+
+    MacAddr tmp_single;
+    memcpy(tmp_single, ms->singles[0], sizeof(MacAddr));
+    memcpy(ms->singles[0], ms->singles[1], sizeof(MacAddr));
+    memcpy(ms->singles[1], tmp_single, sizeof(MacAddr));
+
+    MacSetState tmp_state = ms->state[0];
+    ms->state[0] = ms->state[1];
+    ms->state[1] = tmp_state;
+
+    MacAddr *tmp_buf = ms->buf[0];
+    ms->buf[0] = ms->buf[1];
+    ms->buf[1] = tmp_buf;
+
+    int tmp_last = ms->last[0];
+    ms->last[0] = ms->last[1];
+    ms->last[1] = tmp_last;
+}
+
 #ifdef UNITTESTS
 
 static int CheckTest1Membership(uint8_t *addr, MacSetSide side, void *data)
diff --git a/src/util-macset.h b/src/util-macset.h
index 7526677ebb..5b6fa265ee 100644
--- a/src/util-macset.h
+++ b/src/util-macset.h
@@ -41,6 +41,7 @@ void MacSetFree(MacSet *);
 void MacSetRegisterFlowStorage(void);
 FlowStorageId MacSetGetFlowStorageID(void);
 bool MacSetFlowStorageEnabled(void);
+void MacSetSwap(MacSet *);
 void MacSetRegisterTests(void);
 
 #endif /* SURICATA_UTIL_MACSET_H */