fixed white-/black-list enforcement

diff --git a/ChangeLog b/ChangeLog
index a7942cefde2fc1c1101d51a1fa13e51b0f20322b..c63ee3a248930d5b4462636529e6bccb4b0e45a1 100644 (file)
--- a/ChangeLog
+++ b/ChangeLog
@@ -16,6 +16,7 @@
 -- snort2lua updates from josh
 -- suppress repeated 129:20 on same session
 -- fixed legacy HI scanner events
+-- fixed whitelist / blacklist enforcement
 
 127
 -- REG_TEST out logging tcp options for rebuilt packets to match snort bug

diff --git a/src/flow/flow_control.cc b/src/flow/flow_control.cc
index c8b453b61c978c2fefde94eec28080c14a19a026..ca61dabdb66e95a9d56390683603acf53e6aa8cd 100644 (file)
--- a/src/flow/flow_control.cc
+++ b/src/flow/flow_control.cc
@@ -370,11 +370,14 @@ unsigned FlowControl::process(FlowCache* cache, Packet* p)
         break;
 
     case Flow::ALLOW:
+        p->ptrs.decode_flags |= DECODE_PKT_TRUST;
         stream.stop_inspection(flow, p, SSN_DIR_BOTH, -1, 0);
         break;
 
     case Flow::BLOCK:
+        // FIXIT-M should not repeatedly clear session
         stream.drop_packet(p);
+        Active_DropSession();
         break;
     }