detect: set action from utility function

Set actions that are set directly from Signatures using the new
utility function DetectSignatureApplyActions. This will apply
the actions and also store info about the 'drop' that first made
the rule drop.

diff --git a/src/decode.h b/src/decode.h
index 9a0bfde924c44087856cea429a07115daa4807ff..0ea4c15f7a9f6cbdd3036ddccdd38bd5b8498745 100644 (file)
--- a/src/decode.h
+++ b/src/decode.h
@@ -277,6 +277,9 @@ typedef struct PacketAlert_ {
 typedef struct PacketAlerts_ {
     uint16_t cnt;
     PacketAlert alerts[PACKET_ALERT_MAX];
+    /* single pa used when we're dropping,
+     * so we can log it out in the drop log. */
+    PacketAlert drop;
 } PacketAlerts;
 
 /** number of decoder events we support per packet. Power of 2 minus 1
@@ -723,6 +726,7 @@ typedef struct DecodeThreadVars_
         (p)->payload_len = 0;                   \
         (p)->pktlen = 0;                        \
         (p)->alerts.cnt = 0;                    \
+        (p)->alerts.drop.action = 0;            \
         (p)->pcap_cnt = 0;                      \
         (p)->tunnel_rtv_cnt = 0;                \
         (p)->tunnel_tpr_cnt = 0;                \

diff --git a/src/detect-engine-alert.c b/src/detect-engine-alert.c
index 428ff42195abf52e860fef01a5bc2ed69fd7c9ca..8f91a4b8375d6c19510ed84527b2e69142cdc8b0 100644 (file)
--- a/src/detect-engine-alert.c
+++ b/src/detect-engine-alert.c
@@ -286,8 +286,8 @@ void PacketAlertFinalize(DetectEngineCtx *de_ctx, DetectEngineThreadCtx *det_ctx
                 }
             }
 
-            /* set verdict on packet */
-            PACKET_UPDATE_ACTION(p, p->alerts.alerts[i].action);
+            /* set actions on packet */
+            DetectSignatureApplyActions(p, p->alerts.alerts[i].s);
 
             if (PACKET_TEST_ACTION(p, ACTION_PASS)) {
                 /* Ok, reset the alert cnt to end in the previous of pass

diff --git a/src/detect-engine-iponly.c b/src/detect-engine-iponly.c
index d279295d485a53919253beb10f991a54b048d2d1..d98fa0e50c326aad908518e2b36b92404d18165e 100644 (file)
--- a/src/detect-engine-iponly.c
+++ b/src/detect-engine-iponly.c
@@ -1086,7 +1086,7 @@ void IPOnlyMatchPacket(ThreadVars *tv,
                             PacketAlertAppend(det_ctx, s, p, 0, 0);
                     } else {
                         /* apply actions for noalert/rule suppressed as well */
-                        PACKET_UPDATE_ACTION(p, s->action);
+                        DetectSignatureApplyActions(p, s);
                     }
                 }
             }

diff --git a/src/detect-engine-state.c b/src/detect-engine-state.c
index 2ca789afa7fd19ccd22afa2e4852d5eb6cbae3b0..5c84bc7abf089a42c4ab38680ff75a402ff35f4d 100644 (file)
--- a/src/detect-engine-state.c
+++ b/src/detect-engine-state.c
@@ -331,7 +331,7 @@ int DeStateDetectStartDetection(ThreadVars *tv, DetectEngineCtx *de_ctx,
                     PacketAlertAppend(det_ctx, s, p, tx_id,
                             PACKET_ALERT_FLAG_STATE_MATCH|PACKET_ALERT_FLAG_TX);
                 } else {
-                    PACKET_UPDATE_ACTION(p, s->action);
+                    DetectSignatureApplyActions(p, s);
                 }
 
                 alert_cnt = 1;
@@ -373,7 +373,7 @@ int DeStateDetectStartDetection(ThreadVars *tv, DetectEngineCtx *de_ctx,
                     PacketAlertAppend(det_ctx, s, p, 0,
                             PACKET_ALERT_FLAG_STATE_MATCH);
                 } else {
-                    PACKET_UPDATE_ACTION(p, s->action);
+                    DetectSignatureApplyActions(p, s);
                 }
 
                 alert_cnt = 1;
@@ -387,7 +387,7 @@ int DeStateDetectStartDetection(ThreadVars *tv, DetectEngineCtx *de_ctx,
                     PacketAlertAppend(det_ctx, s, p, 0,
                             PACKET_ALERT_FLAG_STATE_MATCH);
                 } else {
-                    PACKET_UPDATE_ACTION(p, s->action);
+                    DetectSignatureApplyActions(p, s);
                 }
 
             }
@@ -442,7 +442,7 @@ int DeStateDetectStartDetection(ThreadVars *tv, DetectEngineCtx *de_ctx,
                     PacketAlertAppend(det_ctx, s, p, 0,
                             PACKET_ALERT_FLAG_STATE_MATCH);
                 } else {
-                    PACKET_UPDATE_ACTION(p, s->action);
+                    DetectSignatureApplyActions(p, s);
                 }
                 alert_cnt = 1;
             }
@@ -736,7 +736,7 @@ void DeStateDetectContinueDetection(ThreadVars *tv, DetectEngineCtx *de_ctx,
                         PacketAlertAppend(det_ctx, s, p, 0,
                                 PACKET_ALERT_FLAG_STATE_MATCH);
                 } else {
-                    PACKET_UPDATE_ACTION(p, s->action);
+                    DetectSignatureApplyActions(p, s);
                 }
             }
 

diff --git a/src/detect.c b/src/detect.c
index a3f7d3406f0c5767e8e7eaee8e006b14bf2a334b..3bc7d3b46f18806240d5a1548bd6d216195bcc89 100644 (file)
--- a/src/detect.c
+++ b/src/detect.c
@@ -1688,7 +1688,7 @@ int SigMatchSignatures(ThreadVars *th_v, DetectEngineCtx *de_ctx, DetectEngineTh
                 PacketAlertAppend(det_ctx, s, p, 0, alert_flags);
         } else {
             /* apply actions even if not alerting */
-            PACKET_UPDATE_ACTION(p, s->action);
+            DetectSignatureApplyActions(p, s);
         }
         alerts++;
 next:
@@ -1826,6 +1826,21 @@ end:
     SCReturnInt((int)(alerts > 0));
 }
 
+/** \brief Apply action(s) and Set 'drop' sig info,
+ *         if applicable */
+void DetectSignatureApplyActions(Packet *p, const Signature *s)
+{
+    PACKET_UPDATE_ACTION(p, s->action);
+
+    if (s->action & ACTION_DROP) {
+        if (p->alerts.drop.action == 0) {
+            p->alerts.drop.num = s->num;
+            p->alerts.drop.action = s->action;
+            p->alerts.drop.s = (Signature *)s;
+        }
+    }
+}
+
 /* tm module api functions */
 
 /** \brief Detection engine thread wrapper.

diff --git a/src/detect.h b/src/detect.h
index 4a7ce480fc3b531a24aef1530e7322d3c8800c0b..13481ae7d5f1409f218bcf49e65ccc31b42752b9 100644 (file)
--- a/src/detect.h
+++ b/src/detect.h
@@ -1207,6 +1207,7 @@ void *DetectThreadCtxGetKeywordThreadCtx(DetectEngineThreadCtx *, int);
 int SigMatchSignaturesRunPostMatch(ThreadVars *tv,
                                    DetectEngineCtx *de_ctx, DetectEngineThreadCtx *det_ctx, Packet *p,
                                    Signature *s);
+void DetectSignatureApplyActions(Packet *p, const Signature *s);
 
 #endif /* __DETECT_H__ */