diff --git a/src/RuleCondition.cc b/src/RuleCondition.cc index 977eb9f8e2..0650ea309b 100644 --- a/src/RuleCondition.cc +++ b/src/RuleCondition.cc @@ -32,16 +32,16 @@ bool RuleConditionTCPState::DoMatch(Rule* rule, RuleEndpointState* state, auto* ta = static_cast(root); - if ( tcpstates & STATE_STATELESS ) + if ( tcpstates & RULE_STATE_STATELESS ) return true; - if ( (tcpstates & STATE_ORIG) && ! state->IsOrig() ) + if ( (tcpstates & RULE_STATE_ORIG) && ! state->IsOrig() ) return false; - if ( (tcpstates & STATE_RESP) && state->IsOrig() ) + if ( (tcpstates & RULE_STATE_RESP) && state->IsOrig() ) return false; - if ( (tcpstates & STATE_ESTABLISHED ) && + if ( (tcpstates & RULE_STATE_ESTABLISHED ) && ! (is_established(ta->Orig()) && is_established(ta->Resp()))) return false; diff --git a/src/RuleCondition.h b/src/RuleCondition.h index aa735cf854..5951b86eaf 100644 --- a/src/RuleCondition.h +++ b/src/RuleCondition.h @@ -22,16 +22,16 @@ public: virtual void PrintDebug() = 0; }; +enum RuleStateKind { + RULE_STATE_ESTABLISHED = 1, + RULE_STATE_ORIG = 2, + RULE_STATE_RESP = 4, + RULE_STATE_STATELESS = 8 +}; + // Implements the "tcp-state" keyword. class RuleConditionTCPState : public RuleCondition { public: - enum TCPState { - STATE_ESTABLISHED = 1, - STATE_ORIG = 2, - STATE_RESP = 4, - STATE_STATELESS = 8 - }; - explicit RuleConditionTCPState(int arg_tcpstates) { tcpstates = arg_tcpstates; } diff --git a/src/rule-scan.l b/src/rule-scan.l index c7ccb90009..0660105513 100644 --- a/src/rule-scan.l +++ b/src/rule-scan.l @@ -75,22 +75,22 @@ true { rules_lval.val = true; return TOK_BOOL; } false { rules_lval.val = false; return TOK_BOOL; } established { - rules_lval.val = zeek::detail::RuleConditionTCPState::STATE_ESTABLISHED; + rules_lval.val = zeek::detail::RULE_STATE_ESTABLISHED; return TOK_STATE_SYM; } originator { - rules_lval.val = zeek::detail::RuleConditionTCPState::STATE_ORIG; + rules_lval.val = zeek::detail::RULE_STATE_ORIG; return TOK_STATE_SYM; } responder { - rules_lval.val = zeek::detail::RuleConditionTCPState::STATE_RESP; + rules_lval.val = zeek::detail::RULE_STATE_RESP; return TOK_STATE_SYM; } stateless { - rules_lval.val = zeek::detail::RuleConditionTCPState::STATE_STATELESS; + rules_lval.val = zeek::detail::RULE_STATE_STATELESS; return TOK_STATE_SYM; }