Pull request #4082: Ips option ack

Merge in SNORT/snort3 from ~OSHUMEIK/snort3:ips_option_ack to master

Squashed commit of the following:

commit 9001bca22553e7cd2a393a195ef0348b535bf5cc
Author: Oleksii Shumeiko <oshumeik@cisco.com>
Date:   Wed Nov 1 13:35:11 2023 +0200

    ips_options: fix ack option

    Packet header contains ACK in network representation.

diff --git a/src/ips_options/ips_ack.cc b/src/ips_options/ips_ack.cc
index 9f00fa10fe7a16bb3d3559f7df743c5076af47e9..02833413c84f4e533370613d6163e534e76560d8 100644 (file)
--- a/src/ips_options/ips_ack.cc
+++ b/src/ips_options/ips_ack.cc
@@ -82,10 +82,12 @@ IpsOption::EvalStatus TcpAckOption::eval(Cursor&, Packet* p)
     // cppcheck-suppress unreadVariable
     RuleProfile profile(tcpAckPerfStats);
 
-    if ( p->ptrs.tcph && config.eval(p->ptrs.tcph->th_ack) )
-        return MATCH;
+    if ( !p->ptrs.tcph )
+        return NO_MATCH;
 
-    return NO_MATCH;
+    auto ack = p->ptrs.tcph->ack();
+
+    return config.eval(ack) ? MATCH : NO_MATCH;
 }
 
 //-------------------------------------------------------------------------