Merge pull request #2466 in SNORT/snort3 from ~KAMURTHI/snort3:ultrasurf_thirdparty...

Squashed commit of the following:

commit 7bf244eaf487f78289c03b8fbfe16772cd872249
Author: kamurthi <kamurthi@cisco.com>
Date:   Tue Sep 8 09:24:44 2020 -0400

    appid: Use third party payload if available for HTTP tunneled.

diff --git a/src/network_inspectors/appid/appid_session.cc b/src/network_inspectors/appid/appid_session.cc
index 4af2d395292b42b4be62ba43bb20659985632f44..dad1981181e56fbd51cc48ad1e750884021faf2a 100644 (file)
--- a/src/network_inspectors/appid/appid_session.cc
+++ b/src/network_inspectors/appid/appid_session.cc
@@ -844,7 +844,12 @@ AppId AppIdSession::pick_ss_payload_app_id(AppId service_id) const
     if (!api.hsessions.empty())
         tmp_id = api.hsessions[0]->payload.get_id();
     if (tmp_id > APP_ID_NONE)
-        return tmp_id;
+    {
+        if (tmp_id == APP_ID_HTTP_TUNNEL and tp_payload_app_id > APP_ID_NONE)
+            return tp_payload_app_id;
+        else
+            return tmp_id;
+    }
 
     if (api.payload.get_id() > APP_ID_NONE)
         return api.payload.get_id();

diff --git a/src/network_inspectors/appid/lua_detector_api.cc b/src/network_inspectors/appid/lua_detector_api.cc
index 710916225c66fd096ee0febfac795450ce2357ca..5a1007e8f90b8d152a8f5f67f92b48674e754c3f 100644 (file)
--- a/src/network_inspectors/appid/lua_detector_api.cc
+++ b/src/network_inspectors/appid/lua_detector_api.cc
@@ -1172,6 +1172,9 @@ static int detector_add_host_port_dynamic(lua_State* L)
     // Verify detector user data and that we are in packet context
     ud->validate_lua_state(true);
 
+    if (!ud->get_odp_ctxt().is_host_port_app_cache_runtime)
+        return 0;
+
     SfIp ip_addr;
     int index = 1;