Merge pull request #2892 in SNORT/snort3 from ~MMATIRKO/snort3:last_seen_fix to master

Squashed commit of the following:

commit a320cce2f258f3390fbddca2993c19ca108a6ff5
Author: Michael Matirko <mmatirko@cisco.com>
Date:   Tue Apr 20 11:38:37 2021 -0400

    rna: update last seen time on deleted host rediscovery

diff --git a/src/host_tracker/host_tracker.cc b/src/host_tracker/host_tracker.cc
index 758d873f27439fbea6d36adf6c995d858d3e68dd..a663cb2fa6775b240d56ecad6ea441369bda1f37 100644 (file)
--- a/src/host_tracker/host_tracker.cc
+++ b/src/host_tracker/host_tracker.cc
@@ -124,12 +124,16 @@ bool HostTracker::add_mac(const uint8_t* mac, uint8_t ttl, uint8_t primary)
             }
 
             hm_t.visibility = true;
+            hm_t.last_seen = last_seen;
             num_visible_macs++;
             return true;
         }
 
         if ( !invisible_swap_candidate and !hm_t.visibility )
+        {
             invisible_swap_candidate = &hm_t;
+            break;
+        }
     }
 
     if ( invisible_swap_candidate )
@@ -138,6 +142,7 @@ bool HostTracker::add_mac(const uint8_t* mac, uint8_t ttl, uint8_t primary)
         invisible_swap_candidate->ttl = ttl;
         invisible_swap_candidate->primary = primary;
         invisible_swap_candidate->visibility = true;
+        invisible_swap_candidate->last_seen = last_seen;
         num_visible_macs++;
         return true;
     }

diff --git a/src/network_inspectors/rna/rna_pnd.cc b/src/network_inspectors/rna/rna_pnd.cc
index 177a5115589df555fea6f5318ebb66779eda6b31..c1b89cc0837df370e06ffa196763d2aa41dd104f 100644 (file)
--- a/src/network_inspectors/rna/rna_pnd.cc
+++ b/src/network_inspectors/rna/rna_pnd.cc
@@ -77,7 +77,10 @@ HostCacheIp::Data RnaPnd::find_or_create_host_tracker(const SfIp& ip, bool& new_
     // Also if it was not new (we had it in the cache) and it went from
     // not visible to visible, then it's as good as new.
     if (!new_host and !ht->set_visibility(true))
+    {
+        ht->update_last_seen();
         new_host = true;
+    }
 
     return ht;
 }