From: Oleksii Shumeiko -X (oshumeik - SOFTSERVE INC at Cisco) <oshumeik@cisco.com>
Date: Mon, 6 Nov 2023 09:48:42 +0000 (+0000)
Subject: Pull request #4082: Ips option ack
X-Git-Tag: 3.1.74.0~3
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=f2c77cae6567719a67757f5e461536232a0e2bd7;p=thirdparty%2Fsnort3.git

Pull request #4082: Ips option ack

Merge in SNORT/snort3 from ~OSHUMEIK/snort3:ips_option_ack to master

Squashed commit of the following:

commit 9001bca22553e7cd2a393a195ef0348b535bf5cc
Author: Oleksii Shumeiko <oshumeik@cisco.com>
Date:   Wed Nov 1 13:35:11 2023 +0200

    ips_options: fix ack option

    Packet header contains ACK in network representation.
---

diff --git a/src/ips_options/ips_ack.cc b/src/ips_options/ips_ack.cc
index 9f00fa10f..02833413c 100644
--- a/src/ips_options/ips_ack.cc
+++ b/src/ips_options/ips_ack.cc
@@ -82,10 +82,12 @@ IpsOption::EvalStatus TcpAckOption::eval(Cursor&, Packet* p)
     // cppcheck-suppress unreadVariable
     RuleProfile profile(tcpAckPerfStats);
 
-    if ( p->ptrs.tcph && config.eval(p->ptrs.tcph->th_ack) )
-        return MATCH;
+    if ( !p->ptrs.tcph )
+        return NO_MATCH;
 
-    return NO_MATCH;
+    auto ack = p->ptrs.tcph->ack();
+
+    return config.eval(ack) ? MATCH : NO_MATCH;
 }
 
 //-------------------------------------------------------------------------