flow: add util func to remove packet from flow

Unsets the p::flowflags that were previously set.

diff --git a/src/decode.h b/src/decode.h
index 9b16e036ccc03aca94cbf41ad4790bb58dc37f56..921aac3652c2cc962fc63e4adf977b8d2219f926 100644 (file)
--- a/src/decode.h
+++ b/src/decode.h
@@ -872,6 +872,10 @@ void AddressDebugPrint(Address *);
         (p)->flags |= PKT_NOPAYLOAD_INSPECTION;  \
     } while (0)
 
+#define DecodeUnsetNoPayloadInspectionFlag(p) do { \
+        (p)->flags &= ~PKT_NOPAYLOAD_INSPECTION;  \
+    } while (0)
+
 /** \brief Set the No packet inspection Flag for the packet.
  *
  * \param p Packet to set the flag in
@@ -879,6 +883,9 @@ void AddressDebugPrint(Address *);
 #define DecodeSetNoPacketInspectionFlag(p) do { \
         (p)->flags |= PKT_NOPACKET_INSPECTION;  \
     } while (0)
+#define DecodeUnsetNoPacketInspectionFlag(p) do { \
+        (p)->flags &= ~PKT_NOPACKET_INSPECTION;  \
+    } while (0)
 
 
 #define ENGINE_SET_EVENT(p, e) do { \

diff --git a/src/flow.c b/src/flow.c
index cdeb569226d5003230cddfcf065b01208ae53b2b..5ef5abeb79f5bdf5e8059376e47e517d917e382c 100644 (file)
--- a/src/flow.c
+++ b/src/flow.c
@@ -226,6 +226,37 @@ static inline int FlowUpdateSeenFlag(const Packet *p)
     return 1;
 }
 
+/**
+ *
+ *  Remove packet from flow. This assumes this happens *before* the packet
+ *  is added to the stream engine and other higher state.
+ *
+ *  \todo we can't restore the lastts
+ */
+void FlowHandlePacketUpdateRemove(Flow *f, Packet *p)
+{
+    if (p->flowflags & FLOW_PKT_TOSERVER) {
+        f->todstpktcnt--;
+        f->todstbytecnt -= GET_PKT_LEN(p);
+        p->flowflags &= ~FLOW_PKT_TOSERVER;
+    } else {
+        f->tosrcpktcnt--;
+        f->tosrcbytecnt -= GET_PKT_LEN(p);
+        p->flowflags &= ~FLOW_PKT_TOCLIENT;
+    }
+    p->flowflags &= ~FLOW_PKT_ESTABLISHED;
+
+    /*set the detection bypass flags*/
+    if (f->flags & FLOW_NOPACKET_INSPECTION) {
+        SCLogDebug("unsetting FLOW_NOPACKET_INSPECTION flag on flow %p", f);
+        DecodeUnsetNoPacketInspectionFlag(p);
+    }
+    if (f->flags & FLOW_NOPAYLOAD_INSPECTION) {
+        SCLogDebug("unsetting FLOW_NOPAYLOAD_INSPECTION flag on flow %p", f);
+        DecodeUnsetNoPayloadInspectionFlag(p);
+    }
+}
+
 /** \brief Update Packet and Flow
  *
  *  Updates packet and flow based on the new packet.

diff --git a/src/flow.h b/src/flow.h
index f7fd63e8c83ffcf0221647f1e2e9e611d1596715..2ef95d724f1dfcf26a79a5b97e367a624d6035dd 100644 (file)
--- a/src/flow.h
+++ b/src/flow.h
@@ -575,6 +575,8 @@ int FlowClearMemory(Flow *,uint8_t );
 AppProto FlowGetAppProtocol(Flow *f);
 void *FlowGetAppState(Flow *f);
 
+
+void FlowHandlePacketUpdateRemove(Flow *f, Packet *p);
 void FlowHandlePacketUpdate(Flow *f, Packet *p);
 
 #endif /* __FLOW_H__ */