Difuse/Mellaris
2
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Merge branch 'master' of git-ssh.difuse.io:Difuse/Mellaris

Browse Source
This commit is contained in:
hayzam
2026-05-14 09:41:35 +05:30
parent 1e5c1dea75 7dd3331760
commit c6a4058b04
1 changed files with 10 additions and 6 deletions
Download Patch File Download Diff File Expand all files Collapse all files
engine/tcp_flow.go
+10 -6
View File
@@ -56,11 +56,12 @@ func (f *tcpFlow) feed(l3 L3Info, tcp TCPInfo, payload []byte) io.Verdict {
if tcp.RST || tcp.FIN { if tcp.RST || tcp.FIN {
f.closeActiveEntries() f.closeActiveEntries()
f.runMatch(rs, version, rulesetChanged) f.runMatch(rs, version, rulesetChanged, true)
f.maybeFinalizeVerdict() f.maybeFinalizeVerdict()
return f.lastVerdict return f.lastVerdict
} }
propUpdated := false
if len(payload) > 0 { if len(payload) > 0 {
dir, rev := f.resolveDirection(tcp) dir, rev := f.resolveDirection(tcp)
expected := f.dirSeq[dir] expected := f.dirSeq[dir]
@@ -69,17 +70,18 @@ func (f *tcpFlow) feed(l3 L3Info, tcp TCPInfo, payload []byte) io.Verdict {
f.dirBuf[dir] = append(f.dirBuf[dir], payload...) f.dirBuf[dir] = append(f.dirBuf[dir], payload...)
f.dirSeq[dir] = tcp.Seq + uint32(len(payload)) f.dirSeq[dir] = tcp.Seq + uint32(len(payload))
if len(f.dirBuf[dir]) <= tcpFlowMaxBuffer { if len(f.dirBuf[dir]) <= tcpFlowMaxBuffer {
f.feedAnalyzers(rev) propUpdated = f.feedAnalyzers(rev)
} }
} }
} }
f.runMatch(rs, version, rulesetChanged) f.runMatch(rs, version, rulesetChanged, propUpdated)
f.maybeFinalizeVerdict() f.maybeFinalizeVerdict()
return f.lastVerdict return f.lastVerdict
} }
func (f *tcpFlow) feedAnalyzers(rev bool) { func (f *tcpFlow) feedAnalyzers(rev bool) bool {
updated := false
buf := f.dirBuf[uint8(tcpDirC2S)] buf := f.dirBuf[uint8(tcpDirC2S)]
if rev { if rev {
buf = f.dirBuf[uint8(tcpDirS2C)] buf = f.dirBuf[uint8(tcpDirS2C)]
@@ -90,6 +92,7 @@ func (f *tcpFlow) feedAnalyzers(rev bool) {
u1 := processPropUpdate(f.info.Props, entry.Name, update) u1 := processPropUpdate(f.info.Props, entry.Name, update)
u2 := processPropUpdate(f.info.Props, entry.Name, closeUpdate) u2 := processPropUpdate(f.info.Props, entry.Name, closeUpdate)
if u1 || u2 { if u1 || u2 {
updated = true
f.logger.TCPStreamPropUpdate(f.info, false) f.logger.TCPStreamPropUpdate(f.info, false)
} }
if done { if done {
@@ -97,10 +100,11 @@ func (f *tcpFlow) feedAnalyzers(rev bool) {
f.doneEntries = append(f.doneEntries, entry) f.doneEntries = append(f.doneEntries, entry)
} }
} }
return updated
} }
func (f *tcpFlow) runMatch(rs ruleset.Ruleset, version uint64, rulesetChanged bool) { func (f *tcpFlow) runMatch(rs ruleset.Ruleset, version uint64, rulesetChanged bool, propUpdated bool) {
if !f.virgin && !rulesetChanged { if !propUpdated && !f.virgin && !rulesetChanged {
return return
} }
f.virgin = false f.virgin = false