Pull request #3627: Fix for IPS context generation ID.

Merge in SNORT/snort3 from ~OSHUMEIK/snort3:fix_context_num to master

Squashed commit of the following:

commit 38089067c06c360c60bf48d2d142e993c50813bd
Author: Oleksii Shumeiko <oshumeik@cisco.com>
Date:   Fri Oct 21 18:06:08 2022 +0300

    detection: check Pig run number in node state conditions

diff --git a/src/detection/detection_continuation.h b/src/detection/detection_continuation.h
index 24d30c50ddc086ba4e65b06cfafe6e7bdabc7581..ffac8ec57e45cc50c50fa42b3c715bf1d967c5e8 100644 (file)
--- a/src/detection/detection_continuation.h
+++ b/src/detection/detection_continuation.h
@@ -130,7 +130,8 @@ void Continuation::postpone(const Cursor& cursor,
 void Continuation::recall(dot_node_state_t& nst,
      const snort::Packet* p)
 {
-    if (nst.last_check.context_num != nst.conts_num)
+    if (nst.last_check.context_num != nst.context_num or
+        nst.last_check.run_num != nst.run_num)
         return;
 
     auto cnt = LState::erase_group((LState*&)nst.conts);
@@ -268,9 +269,11 @@ void Continuation::add(const Cursor& cursor,
     auto nst = node.state + snort::get_instance_id();
     assert(nst);
 
-    if (nst->last_check.context_num != nst->conts_num)
+    if (nst->last_check.context_num != nst->context_num or
+        nst->last_check.run_num != nst->run_num)
     {
-        nst->conts_num = nst->last_check.context_num;
+        nst->context_num = nst->last_check.context_num;
+        nst->run_num = nst->last_check.run_num;
         nst->conts = nullptr;
     }
 

diff --git a/src/detection/detection_options.h b/src/detection/detection_options.h
index 556fa2bd78559f13449e3b11c1c6ef4f56105a28..32323059e8c93951290df28a9ddd0b073805768e 100644 (file)
--- a/src/detection/detection_options.h
+++ b/src/detection/detection_options.h
@@ -63,7 +63,8 @@ struct dot_node_state_t
         char flowbit_failed;
     } last_check;
     void* conts;
-    uint64_t conts_num;
+    uint64_t context_num;
+    uint16_t run_num;
 
     // FIXIT-L perf profiler stuff should be factored of the node state struct
     hr_duration elapsed;