Flow/Stream: set psuedopacket iface/vlan from flow

This fixes redmine bug #2057 by setting pseudopacket iface and vlan from
flow values, solving the problem of missing vlan/iface when psuedopacket
gets logged/alerted on.
pull/3815/head
Bendik Hagen 7 years ago committed by Victor Julien
parent b7b40393dc
commit f558ef2c55

@ -88,6 +88,10 @@ static inline Packet *FlowForceReassemblyPseudoPacketSetup(Packet *p,
p->flags |= PKT_STREAM_EOF; p->flags |= PKT_STREAM_EOF;
p->flags |= PKT_HAS_FLOW; p->flags |= PKT_HAS_FLOW;
p->flags |= PKT_PSEUDO_STREAM_END; p->flags |= PKT_PSEUDO_STREAM_END;
p->vlan_id[0] = f->vlan_id[0];
p->vlan_id[1] = f->vlan_id[1];
p->vlan_idx = f->vlan_idx;
p->livedev = (struct LiveDevice_ *)f->livedev;
if (f->flags & FLOW_NOPACKET_INSPECTION) { if (f->flags & FLOW_NOPACKET_INSPECTION) {
DecodeSetNoPacketInspectionFlag(p); DecodeSetNoPacketInspectionFlag(p);
@ -469,4 +473,3 @@ void FlowForceReassembly(void)
FlowForceReassemblyForHash(); FlowForceReassemblyForHash();
return; return;
} }

@ -6042,6 +6042,10 @@ static void StreamTcpPseudoPacketCreateDetectLogFlush(ThreadVars *tv,
np->flags |= PKT_HAS_FLOW; np->flags |= PKT_HAS_FLOW;
np->flags |= PKT_IGNORE_CHECKSUM; np->flags |= PKT_IGNORE_CHECKSUM;
np->flags |= PKT_PSEUDO_DETECTLOG_FLUSH; np->flags |= PKT_PSEUDO_DETECTLOG_FLUSH;
np->vlan_id[0] = f->vlan_id[0];
np->vlan_id[1] = f->vlan_id[1];
np->vlan_idx = f->vlan_idx;
np->livedev = (struct LiveDevice_ *)f->livedev;
if (f->flags & FLOW_NOPACKET_INSPECTION) { if (f->flags & FLOW_NOPACKET_INSPECTION) {
DecodeSetNoPacketInspectionFlag(np); DecodeSetNoPacketInspectionFlag(np);
@ -10835,4 +10839,3 @@ void StreamTcpRegisterTests (void)
StreamTcpSackRegisterTests (); StreamTcpSackRegisterTests ();
#endif /* UNITTESTS */ #endif /* UNITTESTS */
} }

Loading…
Cancel
Save