[Snort-devel] question about a change made.

Kreimendahl, Chad J Chad.Kreimendahl at ...1167...
Mon Jun 10 08:17:04 EDT 2002


This question relates to the last update made to stream4.   The wonderful
CVS page showed this change, which made me a little curious.  If you've set
asynchronus_link, then wouldn't you want to call the one that handled Async?
I've pasted a bit of the code from TcpActionAsync... It appears to be the
only major difference between TcpAction and TcpActionAsync is what i've put
below... 

Also, if that's the only difference in code... why not just make
TcpActionAsync call TcpAction after it's run that one difference before it?
Would save you from having to update code in multiple places when you had to
make a change...

-CJK


This change:
     if(s4data.asynchronous_link)
     {
         TcpAction(ssn, p, action, direction, pkt_seq, pkt_ack);
     }
     else 
     {
         TcpActionAsync(ssn, p, action, direction, pkt_seq, pkt_ack);
     }


The diff:
    if(direction == FROM_CLIENT)
    {
        if(!ssn->client.isn)
        {
            ssn->client.isn = pkt_seq;
        }

        ssn->client.last_ack = pkt_seq;
       
    }
    else
    {
        if(!ssn->client.isn)
        {
            ssn->client.isn = pkt_seq;
        }

        ssn->server.last_ack = pkt_seq;
    } 




More information about the Snort-devel mailing list