Pull request #4169: appid: return false in is_appid_inspecting_session for quic if...

Merge in SNORT/snort3 from ~SHIKV/snort3:whitelist_quic to master

Squashed commit of the following:

commit 84ed4ba8e57ea4d2c0333af82e2ae1e9309d66f2
Author: shibin k v <shikv@cisco.com>
Date:   Fri Jan 19 12:39:52 2024 +0000

    appid: return false in is_appid_inspecting_session for quic if not decrypting

diff --git a/src/network_inspectors/appid/appid_session_api.cc b/src/network_inspectors/appid/appid_session_api.cc
index 8a9b3c2a18bf66d7439c973d1748c1cc97d5f365..1c9ff25559c713869835087daca7a9e240a91006 100644 (file)
--- a/src/network_inspectors/appid/appid_session_api.cc
+++ b/src/network_inspectors/appid/appid_session_api.cc
@@ -239,6 +239,10 @@ bool AppIdSessionApi::is_appid_inspecting_session() const
             return false;
     }
 
+    if ( (get_service_app_id() == APP_ID_QUIC or  get_service_app_id() == APP_ID_HTTP3) and
+         !asd->get_session_flags(APPID_SESSION_DECRYPTED) )
+        return false;
+
     if ( asd->service_disco_state != APPID_DISCO_STATE_FINISHED or
         !asd->is_tp_appid_done() or
         asd->get_session_flags(APPID_SESSION_HTTP_SESSION | APPID_SESSION_CONTINUE) or