Merge pull request #2681 in SNORT/snort3 from ~PRBHALER/snort3:fw_ha to master

Squashed commit of the following:

commit 8947b45af8169786b9b46a8f6139e3532abcde20
Author: Pranav Bhalerao <prbhaler@cisco.com>
Date:   Mon Jan 18 10:17:47 2021 -0500

    flow: updating direction and interface info in HA flow.

diff --git a/src/flow/flow.cc b/src/flow/flow.cc
index 1cd14a7a3432572a651701502d6626ab9eb6dd81..2553a7acd40638edf484877ede734a7cf8ff37ca 100644 (file)
--- a/src/flow/flow.cc
+++ b/src/flow/flow.cc
@@ -31,6 +31,7 @@
 #include "ips_options/ips_flowbits.h"
 #include "memory/memory_cap.h"
 #include "protocols/packet.h"
+#include "protocols/tcp.h"
 #include "sfip/sf_ip.h"
 #include "utils/stats.h"
 #include "utils/util.h"
@@ -377,6 +378,22 @@ void Flow::markup_packet_flags(Packet* p)
     }
 }
 
+void Flow::set_client_initiate(Packet* p)
+{
+    if (p->pkth->flags & DAQ_PKT_FLAG_REV_FLOW)
+        flags.client_initiated = p->is_from_server();
+    // If we are tracking on syn, client initiated follows from client
+    else if (p->context->conf->track_on_syn())
+        flags.client_initiated = p->is_from_client();
+    // If not tracking on SYN and the packet is a SYN-ACK, assume the SYN did not create a
+    // session and client initiated follows from server
+    else if (p->is_tcp() and p->ptrs.tcph->is_syn_ack())
+        flags.client_initiated = p->is_from_server();
+    // Otherwise, client initiated follows from client
+    else
+        flags.client_initiated = p->is_from_client();
+}
+
 void Flow::set_direction(Packet* p)
 {
     ip::IpApi* ip_api = &p->ptrs.ip_api;

diff --git a/src/flow/flow.h b/src/flow/flow.h
index e90ee0686875594b9ee94f7363c63aca7ca9cdb7..e12f1809924fe0acc90f181f2ac143fc2a3c437a 100644 (file)
--- a/src/flow/flow.h
+++ b/src/flow/flow.h
@@ -186,6 +186,7 @@ public:
 
     void call_handlers(Packet* p, bool eof = false);
     void markup_packet_flags(Packet*);
+    void set_client_initiate(Packet*);
     void set_direction(Packet*);
     void set_expire(const Packet*, uint32_t timeout);
     bool expired(const Packet*);

diff --git a/src/flow/flow_control.cc b/src/flow/flow_control.cc
index 53bd553150a6bbad1b22a4432886a462f71da06e..07882b002cd21e54c670e35c477533fc4855fa19 100644 (file)
--- a/src/flow/flow_control.cc
+++ b/src/flow/flow_control.cc
@@ -469,19 +469,7 @@ unsigned FlowControl::process(Flow* flow, Packet* p)
 
         ++news;
         flow->flowstats.start_time = p->pkth->ts;
-        // If DAQ specifies reverse flow, client initiated follows from server
-        if (p->pkth->flags & DAQ_PKT_FLAG_REV_FLOW)
-            flow->flags.client_initiated = p->is_from_server();
-        // If we are tracking on syn, client initiated follows from client
-        else if (p->context->conf->track_on_syn())
-            flow->flags.client_initiated = p->is_from_client();
-        // If not tracking on SYN and the packet is a SYN-ACK, assume the SYN did not create a
-        // session and client initiated follows from server
-        else if (p->is_tcp() && p->ptrs.tcph->is_syn_ack())
-            flow->flags.client_initiated = p->is_from_server();
-        // Otherwise, client initiated follows from client
-        else
-            flow->flags.client_initiated = p->is_from_client();
+        flow->set_client_initiate(p);
     }
 
     // This requires the packet direction to be set

diff --git a/src/flow/ha.cc b/src/flow/ha.cc
index ab0712b980ffec1d617b485628f217934aa11c8e..701360e2cbc2a31553ccfac53b887b8cfae79b1f 100644 (file)
--- a/src/flow/ha.cc
+++ b/src/flow/ha.cc
@@ -445,6 +445,23 @@ static Flow* consume_ha_update_message(HAMessage& msg, const FlowKey& key, Packe
     if( p && no_flow_found && flow && flow->session )
     {
         flow->session->setup(p);
+        flow->set_direction(p);
+        flow->set_client_initiate(p);
+
+        if (p->is_from_client())
+        {
+            flow->client_intf = p->pkth->ingress_index;
+            flow->server_intf = p->pkth->egress_index;
+            flow->client_group = p->pkth->ingress_group;
+            flow->server_group = p->pkth->egress_group;
+        }
+        else
+        {
+            flow->client_intf = p->pkth->egress_index;
+            flow->server_intf = p->pkth->ingress_index;
+            flow->client_group = p->pkth->egress_group;
+            flow->server_group = p->pkth->ingress_group;
+        }
     }
 
     return flow;

diff --git a/src/flow/test/flow_cache_test.cc b/src/flow/test/flow_cache_test.cc
index ce16061bea97574b23fcae4ce6db6fdedc6ae666..1fb570f99c050e3d1f3f001ad339a6d7cbca86ca 100644 (file)
--- a/src/flow/test/flow_cache_test.cc
+++ b/src/flow/test/flow_cache_test.cc
@@ -79,6 +79,7 @@ void set_network_policy(const SnortConfig*, unsigned) { }
 void DataBus::publish(const char*, const uint8_t*, unsigned, Flow*) { }
 void DataBus::publish(const char*, Packet*, Flow*) { }
 const SnortConfig* SnortConfig::get_conf() { return nullptr; }
+void Flow::set_client_initiate(Packet*) { }
 void Flow::set_direction(Packet*) { }
 void set_inspection_policy(const SnortConfig*, unsigned) { }
 void set_ips_policy(const SnortConfig*, unsigned) { }

diff --git a/src/flow/test/flow_control_test.cc b/src/flow/test/flow_control_test.cc
index 5c4ac306f63b1583106f50de252f4d4aa85bb34e..b49bee6e0ee7abcebb79267d682f7be300085588 100644 (file)
--- a/src/flow/test/flow_control_test.cc
+++ b/src/flow/test/flow_control_test.cc
@@ -85,6 +85,7 @@ void DataBus::publish(const char*, const uint8_t*, unsigned, Flow*) { }
 void DataBus::publish(const char*, Packet*, Flow*) { }
 const SnortConfig* SnortConfig::get_conf() { return nullptr; }
 void FlowCache::unlink_uni(Flow*) { }
+void Flow::set_client_initiate(Packet*) { }
 void Flow::set_direction(Packet*) { }
 void set_inspection_policy(const SnortConfig*, unsigned) { }
 void set_ips_policy(const SnortConfig*, unsigned) { }

diff --git a/src/flow/test/ha_test.cc b/src/flow/test/ha_test.cc
index 470286724771dd0e946dea3d12b13edf388b3d5b..6572303b31628e9ebf8714b1bed49ae66db26b50 100644 (file)
--- a/src/flow/test/ha_test.cc
+++ b/src/flow/test/ha_test.cc
@@ -222,6 +222,9 @@ Flow::~Flow() { delete key; delete ha_state; }
 
 FlowStash::~FlowStash() { }
 
+void Flow::set_client_initiate(Packet*) { }
+void Flow::set_direction(Packet*) { }
+
 SideChannel* SideChannelManager::get_side_channel(SCPort)
 { return &s_side_channel; }