Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
detect: inspect all packets in multi-layer tunneling
When the decoders encounter multiple layers of tunneling, multiple tunnel packets are created. These are then stored in ThreadVars::decode_pq, where they are processed after the current thread "slot" is done. However, due to a logic error, the tunnel packets after the first, where not called for the correct position in the packet pipeline. This would lead to these packets not going through the FlowWorker module, so skipping everything from flow tracking, detection and logging. This would only happen for single and workers, due to how the pipelines are constructed. This patch addresses the issue by making sure only a "decode" thread slot will service the ThreadVars::decode_pq. Bug: OISF#6402.
- Loading branch information