Pull request #4168: stream_tcp: persist disable_reassembly in Flow

Merge in SNORT/snort3 from ~RSHAFIQ/snort3:gcp_perf to master

Squashed commit of the following:

commit 1e3853009369678775c85dc30d7f3669a352dcc2
Author: rshafiq <rshafiq@cisco.com>
Date:   Wed Dec 13 17:23:28 2023 -0500

    stream_tcp: persist disable_reassembly in Flow

diff --git a/src/detection/ips_context.cc b/src/detection/ips_context.cc
index 95fa7c42b90dced6771b4c8b979835d5d5f7fa25..ac701cbf19855beb682b189bbf09b79c9533c3ee 100644 (file)
--- a/src/detection/ips_context.cc
+++ b/src/detection/ips_context.cc
@@ -107,6 +107,7 @@ void IpsContext::clear()
     if ( remove_gadget and packet->flow and !packet->is_rebuilt() )
     {
        Stream::disable_reassembly(packet->flow);
+       packet->flow->flags.disable_reassembly_by_ips = true;
 
        if ( packet->flow->gadget )
            packet->flow->clear_gadget();

diff --git a/src/flow/flow.h b/src/flow/flow.h
index 17550b1a16b90168e22a5e1d7c6c0ae72ba2e792..7246bbc61a94fb73fb90c7039265cdaad586f59b 100644 (file)
--- a/src/flow/flow.h
+++ b/src/flow/flow.h
@@ -501,6 +501,7 @@ public:  // FIXIT-M privatize if possible
         bool retry_queued : 1; // Set if a packet was queued for retry for this flow
         bool ha_flow : 1; // Set if this flow was created by an HA message
         bool ips_event_suppressed : 1; // Set if event filters have suppressed ips event
+        bool disable_reassembly_by_ips : 1; // Set if IPS has disabled reassembly for this flow
     } flags = {};
 
     FlowState flow_state = FlowState::SETUP;

diff --git a/src/stream/tcp/tcp_session.cc b/src/stream/tcp/tcp_session.cc
index 51a289690960b875f490852f6291874e8627d767..8ca8cf68d8958e3d1f64fc6a88a24e4af5a18a07 100644 (file)
--- a/src/stream/tcp/tcp_session.cc
+++ b/src/stream/tcp/tcp_session.cc
@@ -1090,7 +1090,8 @@ void TcpSession::init_tcp_packet_analysis(TcpSegmentDescriptor& tsd)
     if ( !splitter_init and tsd.is_data_segment() and
         (tcp_init or is_midstream_allowed(tsd)) )
     {
-        if ( !(tcp_config->flags & STREAM_CONFIG_NO_REASSEMBLY) )
+        if ( !(tcp_config->flags & STREAM_CONFIG_NO_REASSEMBLY) and
+                !(tsd.get_flow()->flags.disable_reassembly_by_ips) )
         {
             client.set_splitter(tsd.get_flow());
             server.set_splitter(tsd.get_flow());