// A flow has been determined to be bidirectional
#define STREAM_ICMP_BIDIRECTIONAL_EVENT "stream.icmp_bidirectional"
-#define STREAM_IP_BIDIRECTIONAL_EVENT "stream.ip.bidirectional"
-#define STREAM_UDP_BIDIRECTIONAL_EVENT "stream.udp.bidirectional"
+#define STREAM_IP_BIDIRECTIONAL_EVENT "stream.ip.bidirectional"
+#define STREAM_UDP_BIDIRECTIONAL_EVENT "stream.udp.bidirectional"
// A TCP flow has the flag; a midstream flow may not publish other events
#define STREAM_TCP_SYN_EVENT "stream.tcp_syn"
State(bool openlibs = true);
~State();
- State(State&) = delete;
- State& operator=(State&) = delete;
+ State(State&) = delete;
+ State& operator=(State&) = delete;
// Enable move constructor
State(State&&) noexcept;
- State& operator=(State&&);
+ State& operator=(State&&);
lua_State* get_ptr()
{ return state; }
decision = get_reputation(config, result, &p->iplist_id, ingressZone, egressZone);
if (decision == BLACKLISTED)
- *decision_final = BLACKLISTED_SRC;
+ *decision_final = BLACKLISTED_SRC;
else if (decision == MONITORED)
*decision_final = MONITORED_SRC;
else if (decision == WHITELISTED_TRUST)
- *decision_final = WHITELISTED_TRUST_SRC;
- else
+ *decision_final = WHITELISTED_TRUST_SRC;
+ else
*decision_final = decision;
if ( config->priority == decision)
decision = get_reputation(config, result, &p->iplist_id, ingressZone, egressZone);
if (decision == BLACKLISTED)
- *decision_final = BLACKLISTED_DST;
+ *decision_final = BLACKLISTED_DST;
else if (decision == MONITORED)
*decision_final = MONITORED_DST;
else if (decision == WHITELISTED_TRUST)
- *decision_final = WHITELISTED_TRUST_DST;
+ *decision_final = WHITELISTED_TRUST_DST;
else
- *decision_final = decision;
+ *decision_final = decision;
if ( config->priority == decision)
return true;
else if (BLACKLISTED_SRC == decision or BLACKLISTED_DST == decision)
{
- unsigned blacklist_event = (BLACKLISTED_SRC == decision) ?
+ unsigned blacklist_event = (BLACKLISTED_SRC == decision) ?
REPUTATION_EVENT_BLACKLIST_SRC : REPUTATION_EVENT_BLACKLIST_DST;
DetectionEngine::queue_event(GID_REPUTATION, blacklist_event);
else if (MONITORED_SRC == decision or MONITORED_DST == decision)
{
- unsigned monitor_event = (MONITORED_SRC == decision) ?
+ unsigned monitor_event = (MONITORED_SRC == decision) ?
REPUTATION_EVENT_MONITOR_SRC : REPUTATION_EVENT_MONITOR_DST;
p->packet_flags |= PKT_REP_MONITORED;
else if (WHITELISTED_TRUST_SRC == decision or WHITELISTED_TRUST_DST == decision)
{
- unsigned whitelist_event = (WHITELISTED_TRUST_SRC == decision) ?
+ unsigned whitelist_event = (WHITELISTED_TRUST_SRC == decision) ?
REPUTATION_EVENT_WHITELIST_SRC : REPUTATION_EVENT_WHITELIST_DST;
DetectionEngine::queue_event(GID_REPUTATION, whitelist_event);
#define PKT_IGNORE 0x00800000 /* this packet should be ignored, based on port */
#define PKT_RETRANSMIT 0x01000000 // packet is a re-transmitted pkt.
#define PKT_RETRY 0x02000000 /* this packet is being re-evaluated from the internal retry queue */
-#define PKT_REP_MONITORED 0x04000000 /* this packet is monitored by reputation */
+#define PKT_REP_MONITORED 0x04000000 /* this packet is monitored by reputation */
#define PKT_UNUSED_FLAGS 0xf8000000
#define PKT_TS_OFFLOADED 0x01
bool is_offloaded() const
{ return (ts_packet_flags & PKT_TS_OFFLOADED) != 0; }
-
+
void set_offloaded()
{ ts_packet_flags |= PKT_TS_OFFLOADED; }