Pull request #4772: binder, flow, framework: add a facility to block binding based...

Merge in SNORT/snort3 from ~ASHIKTHO/snort3:CSCwo40673_tot_1 to master

Squashed commit of the following:

commit 61177c5e2c7690f33dca5b67dc0bb29dbeece64a
Author: bjandhya <bjandhya@cisco.com>
Date:   Tue Mar 25 10:16:35 2025 -0400

    binder, flow, framework: add a facility to block binding based on a do_not_decrypt flow flag and inspector can_decrypt method

diff --git a/src/flow/flow.h b/src/flow/flow.h
index 87d3d1e17f49a8bfa68de3156cd5505d369cd804..7c21c45781e94200c0abff19a3012f5ca81abc60 100644 (file)
--- a/src/flow/flow.h
+++ b/src/flow/flow.h
@@ -538,6 +538,7 @@ public:  // FIXIT-M privatize if possible
         bool binder_action_block : 1;
         bool in_allowlist : 1; // Set if the flow is in the allowlist
         bool allowed_on_excess : 1; // Set if the flow is allowed on excess
+        bool do_not_decrypt :1; //set when decided to not to decrypt 
     } flags = {};
 
     int32_t client_intf = 0;

diff --git a/src/framework/inspector.h b/src/framework/inspector.h
index 090c02fa6e884e0d099257d974184bd50fb5a3dc..80dc95f045e10b9b10334f622427c0a5345a85de 100644 (file)
--- a/src/framework/inspector.h
+++ b/src/framework/inspector.h
@@ -188,6 +188,9 @@ public:
     virtual bool supports_no_ips() const
     { return false; }
 
+    virtual bool can_decrypt() const
+    { return false; }
+
     void allocate_thread_storage();
     void set_thread_specific_data(void*);
     void* get_thread_specific_data() const;

diff --git a/src/network_inspectors/binder/binding.cc b/src/network_inspectors/binder/binding.cc
index 58f7e0b530ba2befe499c0be37f2c2dc8bc8877f..b3354d97a8e09ec2b0202cc890013dd4cd97fc72 100644 (file)
--- a/src/network_inspectors/binder/binding.cc
+++ b/src/network_inspectors/binder/binding.cc
@@ -605,6 +605,11 @@ inline bool Binding::check_service() const
     return when.has_criteria(BindWhen::Criteria::BWC_SVC) ? false : true;
 }
 
+inline bool Binding::check_inspector(const Flow& flow) const
+{
+    return !(use.inspector and use.inspector->can_decrypt() and flow.flags.do_not_decrypt);
+}
+
 bool Binding::check_all(const Flow& flow, const char* service) const
 {
     // Do the service check first to optimize service change re-evaluations
@@ -655,6 +660,9 @@ bool Binding::check_all(const Flow& flow, const char* service) const
     if (!check_tenant(flow))
         return false;
 
+    if (!check_inspector(flow))
+        return false;
+
     return true;
 }
 

diff --git a/src/network_inspectors/binder/binding.h b/src/network_inspectors/binder/binding.h
index bd4895e47023189c78d83b0d63d06162ee39c9fa..e4c552ae2fdb63b41e321be5be5c5de15861d487 100644 (file)
--- a/src/network_inspectors/binder/binding.h
+++ b/src/network_inspectors/binder/binding.h
@@ -148,6 +148,7 @@ struct Binding
     bool check_service(const snort::Flow&) const;
     bool check_service(const char* service) const;
     bool check_service() const;
+    bool check_inspector(const snort::Flow&) const;
 };
 
 #endif