From: Victor Julien <vjulien@oisf.net>
Date: Wed, 31 May 2023 13:52:14 +0000 (+0200)
Subject: app-layer: don't update UDP applayer for dropped packets
X-Git-Tag: suricata-6.0.13~41
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=416cc8455fe17a1f0444bbb7f069f76748d47896;p=thirdparty%2Fsuricata.git

app-layer: don't update UDP applayer for dropped packets

(cherry picked from commit 77f49661fd78df420c4542e230def0682a886c60)
---

diff --git a/src/flow-worker.c b/src/flow-worker.c
index ab8a41c586..ab2a2a6385 100644
--- a/src/flow-worker.c
+++ b/src/flow-worker.c
@@ -34,6 +34,7 @@
 #include "suricata-common.h"
 #include "suricata.h"
 
+#include "action-globals.h"
 #include "decode.h"
 #include "detect.h"
 #include "stream-tcp.h"
@@ -538,9 +539,11 @@ static TmEcode FlowWorker(ThreadVars *tv, Packet *p, void *data)
 
         /* handle the app layer part of the UDP packet payload */
     } else if (p->flow && p->proto == IPPROTO_UDP) {
-        FLOWWORKER_PROFILING_START(p, PROFILE_FLOWWORKER_APPLAYERUDP);
-        AppLayerHandleUdp(tv, fw->stream_thread->ra_ctx->app_tctx, p, p->flow);
-        FLOWWORKER_PROFILING_END(p, PROFILE_FLOWWORKER_APPLAYERUDP);
+        if (!PACKET_TEST_ACTION(p, ACTION_DROP)) {
+            FLOWWORKER_PROFILING_START(p, PROFILE_FLOWWORKER_APPLAYERUDP);
+            AppLayerHandleUdp(tv, fw->stream_thread->ra_ctx->app_tctx, p, p->flow);
+            FLOWWORKER_PROFILING_END(p, PROFILE_FLOWWORKER_APPLAYERUDP);
+        }
     }
 
     PacketUpdateEngineEventCounters(tv, fw->dtv, p);