From: Shibin K V (shikv) Date: Thu, 1 Feb 2024 04:41:55 +0000 (+0000) Subject: Pull request #4169: appid: return false in is_appid_inspecting_session for quic if... X-Git-Tag: 3.1.79.0~1 X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=23ff32e69101e176163b55b6e4a363b369893f3f;p=thirdparty%2Fsnort3.git Pull request #4169: appid: return false in is_appid_inspecting_session for quic if not decrypting Merge in SNORT/snort3 from ~SHIKV/snort3:whitelist_quic to master Squashed commit of the following: commit 84ed4ba8e57ea4d2c0333af82e2ae1e9309d66f2 Author: shibin k v Date: Fri Jan 19 12:39:52 2024 +0000 appid: return false in is_appid_inspecting_session for quic if not decrypting --- diff --git a/src/network_inspectors/appid/appid_session_api.cc b/src/network_inspectors/appid/appid_session_api.cc index 8a9b3c2a1..1c9ff2555 100644 --- a/src/network_inspectors/appid/appid_session_api.cc +++ b/src/network_inspectors/appid/appid_session_api.cc @@ -239,6 +239,10 @@ bool AppIdSessionApi::is_appid_inspecting_session() const return false; } + if ( (get_service_app_id() == APP_ID_QUIC or get_service_app_id() == APP_ID_HTTP3) and + !asd->get_session_flags(APPID_SESSION_DECRYPTED) ) + return false; + if ( asd->service_disco_state != APPID_DISCO_STATE_FINISHED or !asd->is_tp_appid_done() or asd->get_session_flags(APPID_SESSION_HTTP_SESSION | APPID_SESSION_CONTINUE) or