cooked verdicts do not apply to raw packets

diff --git a/src/main/snort.cc b/src/main/snort.cc
index 46a1682380441efcd44be78cf076fce74e99a978..eb934f70ed51dd6fbeb6ccbab010cd90ac22e24b 100644 (file)
--- a/src/main/snort.cc
+++ b/src/main/snort.cc
@@ -741,6 +741,9 @@ DAQ_Verdict Snort::process_packet(
     // process flow verdicts here
     if ( Active::session_was_blocked() )
     {
+        if ( !Active::can_block() )
+            return DAQ_VERDICT_PASS;
+
         if ( Active::get_tunnel_bypass() )
         {
             aux_counts.internal_blacklist++;
@@ -759,7 +762,7 @@ DAQ_Verdict Snort::process_packet(
 // process (wire-only) packet verdicts here
 static DAQ_Verdict update_verdict(DAQ_Verdict verdict, int& inject)
 {
-    if ( Active::packet_was_dropped() )
+    if ( Active::packet_was_dropped() and Active::can_block() )
     {
         if ( verdict == DAQ_VERDICT_PASS )
             verdict = DAQ_VERDICT_BLOCK;

diff --git a/src/packet_io/active.h b/src/packet_io/active.h
index b71710b564b5551dbee09cff451ae35eeb9a02ce..1088b7007c512596ae685ea916f269827a1a9003 100644 (file)
--- a/src/packet_io/active.h
+++ b/src/packet_io/active.h
@@ -83,6 +83,9 @@ public:
     static ActiveStatus get_status()
     { return active_status; }
 
+    static bool can_block()
+    { return active_status == AST_ALLOW or active_status == AST_FORCE; }
+
     static const char* get_action_string();
 
     static void drop_packet(const Packet*, bool force = false);