Merge pull request #2901 in SNORT/snort3 from ~DERAMADA/snort3:set_packet_context...

Squashed commit of the following:

commit 78dd1cbbc6e4f52c0616652f38855ecdc5054290
Author: Deepak Ramadass <deramada@cisco.com>
Date:   Fri May 21 11:06:39 2021 -0400

    stream_tcp: populate flow contents in context for non-wire packets

diff --git a/src/detection/detection_engine.cc b/src/detection/detection_engine.cc
index c0a848740022428fda4d87351e8c85f2f9e01008..46154430b037ca665f528c76c26ff07bf6e69beb 100644 (file)
--- a/src/detection/detection_engine.cc
+++ b/src/detection/detection_engine.cc
@@ -146,13 +146,16 @@ Packet* DetectionEngine::get_encode_packet()
 // we need to stay in the current context until rebuild is successful
 // any events while rebuilding will be logged against the current packet
 // however, rebuild is always in the next context, not current.
-Packet* DetectionEngine::set_next_packet(Packet* parent)
+Packet* DetectionEngine::set_next_packet(Packet* parent, Flow* flow)
 {
     static THREAD_LOCAL Active shutdown_active;
     static THREAD_LOCAL ActiveAction* shutdown_action = nullptr;
 
     wait_for_context();
     IpsContext* c = Analyzer::get_switcher()->get_next();
+
+    Packet* p = c->packet;
+
     if ( parent )
     {
         if ( parent->flow )
@@ -162,12 +165,12 @@ Packet* DetectionEngine::set_next_packet(Packet* parent)
     }
     else
     {
+        if ( flow )
+            p->context->snapshot_flow(flow);
         c->packet_number = get_packet_number();
         c->wire_packet = nullptr;
     }
 
-    Packet* p = c->packet;
-
     p->pkth = c->pkth;
     p->data = c->buf;
     p->pkt = c->buf;

diff --git a/src/detection/detection_engine.h b/src/detection/detection_engine.h
index 6e2063cfcebefc1ceddd891da4acc22bf5c5b0c9..3129f9395c05239d5ce6d35f8dfd8d653345e4d1 100644 (file)
--- a/src/detection/detection_engine.h
+++ b/src/detection/detection_engine.h
@@ -56,7 +56,7 @@ public:
 
     static Packet* get_current_packet();
     static Packet* get_current_wire_packet();
-    static Packet* set_next_packet(Packet* parent = nullptr);
+    static Packet* set_next_packet(Packet* parent = nullptr, Flow* flow = nullptr);
     static uint8_t* get_next_buffer(unsigned& max);
 
     static bool offload(Packet*);

diff --git a/src/flow/test/flow_test.cc b/src/flow/test/flow_test.cc
index f33049567494c6ffb364779d87a08c535fb0c369..a8e8bfb1a7c98943f808bd3da24ed0d010b89d4a 100644 (file)
--- a/src/flow/test/flow_test.cc
+++ b/src/flow/test/flow_test.cc
@@ -65,7 +65,7 @@ void FlowStash::reset() {}
 
 void DetectionEngine::onload(Flow*) {}
 
-Packet* DetectionEngine::set_next_packet(Packet*) { return nullptr; }
+Packet* DetectionEngine::set_next_packet(Packet*, Flow*) { return nullptr; }
 
 IpsContext* DetectionEngine::get_context() { return nullptr; }
 

diff --git a/src/stream/tcp/tcp_reassembler.cc b/src/stream/tcp/tcp_reassembler.cc
index 76b064c3274e69cdcc25d76266ff2bacbc889374..d31d17d047328a99a2ac6536ff11d242a83b9a66 100644 (file)
--- a/src/stream/tcp/tcp_reassembler.cc
+++ b/src/stream/tcp/tcp_reassembler.cc
@@ -717,7 +717,7 @@ void TcpReassembler::final_flush(TcpReassemblerState& trs, Packet* p, uint32_t d
 
 static Packet* get_packet(Flow* flow, uint32_t flags, bool c2s)
 {
-    Packet* p = DetectionEngine::set_next_packet();
+    Packet* p = DetectionEngine::set_next_packet(nullptr, flow);
 
     DAQ_PktHdr_t* ph = p->context->pkth;
     memset(ph, 0, sizeof(*ph));