Merge pull request #1280 in SNORT/snort3 from reputation_default to master

Squashed commit of the following:

commit 6cd7800ea3c44ab9b8850dd002ea62675b4a9fbd
Author: huica <huica@cisco.com>
Date:   Wed Jun 20 13:56:44 2018 -0400

    Reputation: make sure reputation inspector is called in default policy

diff --git a/src/managers/inspector_manager.cc b/src/managers/inspector_manager.cc
index 1f2242625283f05cbc0ef3b50a4c9ce404e01792..fb13e026cd34b361fac767b81397a8f83b00f8c2 100644 (file)
--- a/src/managers/inspector_manager.cc
+++ b/src/managers/inspector_manager.cc
@@ -945,13 +945,6 @@ void InspectorManager::full_inspection(Packet* p)
     }
 }
 
-void InspectorManager::execute_control(Packet* p)
-{
-    SnortConfig* sc = SnortConfig::get_conf();
-    FrameworkPolicy* fp = snort::get_default_inspection_policy(sc)->framework_policy;
-    ::execute(p, fp->control.vec, fp->control.num);
-}
-
 // FIXIT-M leverage knowledge of flow creation so that reputation (possibly a
 // new it_xxx) is run just once per flow (and all non-flow packets).
 
@@ -979,14 +972,19 @@ void InspectorManager::execute(Packet* p)
     if ( p->disable_inspect )
        return;
 
+    SnortConfig* sc = SnortConfig::get_conf();
+    FrameworkPolicy* fp_dft = snort::get_default_inspection_policy(sc)->framework_policy;
+
     if ( !p->flow )
     {
+        if (fp_dft != fp)
+            ::execute(p, fp_dft->network.vec, fp_dft->network.num);
         ::execute(p, fp->network.vec, fp->network.num);
 
         if ( p->disable_inspect )
            return;
 
-        execute_control(p);
+        ::execute(p, fp_dft->control.vec, fp_dft->control.num);
     }
     else
     {
@@ -994,7 +992,11 @@ void InspectorManager::execute(Packet* p)
             p->flow->session->process(p);
 
         if ( !p->flow->service )
+        {
+            if (fp_dft != fp)
+                ::execute(p, fp_dft->network.vec, fp_dft->network.num);
             ::execute(p, fp->network.vec, fp->network.num);
+        }
 
         if ( p->disable_inspect )
            return;
@@ -1003,7 +1005,7 @@ void InspectorManager::execute(Packet* p)
             full_inspection(p);
 
         if ( !p->disable_inspect and !p->flow->is_inspection_disabled() )
-            execute_control(p);
+            ::execute(p, fp_dft->control.vec, fp_dft->control.num);
     }
 }
 

diff --git a/src/managers/inspector_manager.h b/src/managers/inspector_manager.h
index 6fe1fb26aad69be8e6299ccf0706bab78fef9a9d..1f6968a4c0c90062d02a7678d35455c33178d430 100644 (file)
--- a/src/managers/inspector_manager.h
+++ b/src/managers/inspector_manager.h
@@ -89,7 +89,6 @@ public:
 private:
     static void bumble(Packet*);
     static void full_inspection(Packet*);
-    static void execute_control(Packet*);
 };
 }
 #endif