Merge pull request #1604 in SNORT/snort3 from ~KATHARVE/snort3:disable_inspection_in_...

Squashed commit of the following:

commit 991d611b02b5bb0ad494b29e6914ac649cca581c
Author: Katura Harvey <katharve@cisco.com>
Date:   Tue May 7 18:53:02 2019 -0400

    stream: disable inspection of flow on reset

diff --git a/src/file_api/file_lib.cc b/src/file_api/file_lib.cc
index 1d53a85566c82b6b1b3cc5f19b14350b4d1fa697..6dac8279d777cc4c04b2e98aa50648e4b38e6855 100644 (file)
--- a/src/file_api/file_lib.cc
+++ b/src/file_api/file_lib.cc
@@ -351,8 +351,6 @@ void FileContext::finish_signature_lookup(Packet* p, bool final_lookup, FilePoli
             log_file_event(flow, policy);
             config_file_signature(false);
             file_stats->signatures_processed[get_file_type()][get_file_direction()]++;
-            if ( verdict == FILE_VERDICT_REJECT or verdict == FILE_VERDICT_BLOCK)
-                flow->disable_inspection();
         }
         else
         {

diff --git a/src/stream/stream.cc b/src/stream/stream.cc
index b76ac0fe2bd4675f367216f367bfb1fee95deb5d..91968f5acfa6f4b17483ac4b1ec7202db3ad3797 100644 (file)
--- a/src/stream/stream.cc
+++ b/src/stream/stream.cc
@@ -324,6 +324,8 @@ void Stream::drop_flow(const Packet* p)
     flow->session->clear();
     flow->set_state(Flow::FlowState::BLOCK);
 
+    flow->disable_inspection();
+
     if ( !(p->packet_flags & PKT_STATELESS) )
         drop_traffic(p, SSN_DIR_BOTH);
 }