detect/stream: fix async stream inspection

Move raw progress forward only if detect uses stream data, indicated
by the PKT_DETECT_HAS_STREAMDATA flag.
pull/5678/head
Victor Julien 5 years ago
parent 8aa02c6d15
commit 3c7c361b60

@ -952,8 +952,7 @@ static void DetectRunCleanup(DetectEngineThreadCtx *det_ctx,
if (pflow != NULL) {
/* update inspected tracker for raw reassembly */
if (p->proto == IPPROTO_TCP && pflow->protoctx != NULL &&
(p->flags & PKT_STREAM_EST))
{
(p->flags & PKT_DETECT_HAS_STREAMDATA)) {
StreamReassembleRawUpdateProgress(pflow->protoctx, p,
det_ctx->raw_stream_progress);
}

@ -1656,7 +1656,7 @@ static int UriTestSig16(void)
UTHAddStreamToFlow(f, 0, http_buf1, http_buf1_len);
p->flow = f;
p->flags |= PKT_HAS_FLOW|PKT_STREAM_EST;
p->flags |= PKT_HAS_FLOW | PKT_STREAM_EST | PKT_DETECT_HAS_STREAMDATA;
p->flowflags |= FLOW_PKT_TOSERVER;
p->flowflags |= FLOW_PKT_ESTABLISHED;
f->alproto = ALPROTO_HTTP;

Loading…
Cancel
Save