From: russ <rucombs@cisco.com>
Date: Fri, 18 Sep 2015 15:16:36 +0000 (-0400)
Subject: cooked verdicts do not apply to raw packets
X-Git-Tag: 3.0.0-233~829^2
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=bf6de3db4d5250b58dc92123416dffe1c0f376da;p=thirdparty%2Fsnort3.git

cooked verdicts do not apply to raw packets
---

diff --git a/src/main/snort.cc b/src/main/snort.cc
index 46a168238..eb934f70e 100644
--- a/src/main/snort.cc
+++ b/src/main/snort.cc
@@ -741,6 +741,9 @@ DAQ_Verdict Snort::process_packet(
     // process flow verdicts here
     if ( Active::session_was_blocked() )
     {
+        if ( !Active::can_block() )
+            return DAQ_VERDICT_PASS;
+
         if ( Active::get_tunnel_bypass() )
         {
             aux_counts.internal_blacklist++;
@@ -759,7 +762,7 @@ DAQ_Verdict Snort::process_packet(
 // process (wire-only) packet verdicts here
 static DAQ_Verdict update_verdict(DAQ_Verdict verdict, int& inject)
 {
-    if ( Active::packet_was_dropped() )
+    if ( Active::packet_was_dropped() and Active::can_block() )
     {
         if ( verdict == DAQ_VERDICT_PASS )
             verdict = DAQ_VERDICT_BLOCK;
diff --git a/src/packet_io/active.h b/src/packet_io/active.h
index b71710b56..1088b7007 100644
--- a/src/packet_io/active.h
+++ b/src/packet_io/active.h
@@ -83,6 +83,9 @@ public:
     static ActiveStatus get_status()
     { return active_status; }
 
+    static bool can_block()
+    { return active_status == AST_ALLOW or active_status == AST_FORCE; }
+
     static const char* get_action_string();
 
     static void drop_packet(const Packet*, bool force = false);