From: Masud Hasan (mashasan) <mashasan@cisco.com>
Date: Thu, 20 May 2021 20:41:32 +0000 (+0000)
Subject: Merge pull request #2892 in SNORT/snort3 from ~MMATIRKO/snort3:last_seen_fix to master
X-Git-Tag: 3.1.6.0~49
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=6b8f101c8094677f1c03e00d98e840942476c517;p=thirdparty%2Fsnort3.git

Merge pull request #2892 in SNORT/snort3 from ~MMATIRKO/snort3:last_seen_fix to master

Squashed commit of the following:

commit a320cce2f258f3390fbddca2993c19ca108a6ff5
Author: Michael Matirko <mmatirko@cisco.com>
Date:   Tue Apr 20 11:38:37 2021 -0400

    rna: update last seen time on deleted host rediscovery
---

diff --git a/src/host_tracker/host_tracker.cc b/src/host_tracker/host_tracker.cc
index 758d873f2..a663cb2fa 100644
--- a/src/host_tracker/host_tracker.cc
+++ b/src/host_tracker/host_tracker.cc
@@ -124,12 +124,16 @@ bool HostTracker::add_mac(const uint8_t* mac, uint8_t ttl, uint8_t primary)
             }
 
             hm_t.visibility = true;
+            hm_t.last_seen = last_seen;
             num_visible_macs++;
             return true;
         }
 
         if ( !invisible_swap_candidate and !hm_t.visibility )
+        {
             invisible_swap_candidate = &hm_t;
+            break;
+        }
     }
 
     if ( invisible_swap_candidate )
@@ -138,6 +142,7 @@ bool HostTracker::add_mac(const uint8_t* mac, uint8_t ttl, uint8_t primary)
         invisible_swap_candidate->ttl = ttl;
         invisible_swap_candidate->primary = primary;
         invisible_swap_candidate->visibility = true;
+        invisible_swap_candidate->last_seen = last_seen;
         num_visible_macs++;
         return true;
     }
diff --git a/src/network_inspectors/rna/rna_pnd.cc b/src/network_inspectors/rna/rna_pnd.cc
index 177a51155..c1b89cc08 100644
--- a/src/network_inspectors/rna/rna_pnd.cc
+++ b/src/network_inspectors/rna/rna_pnd.cc
@@ -77,7 +77,10 @@ HostCacheIp::Data RnaPnd::find_or_create_host_tracker(const SfIp& ip, bool& new_
     // Also if it was not new (we had it in the cache) and it went from
     // not visible to visible, then it's as good as new.
     if (!new_host and !ht->set_visibility(true))
+    {
+        ht->update_last_seen();
         new_host = true;
+    }
 
     return ht;
 }