stream: fix TFO overlap detection with ECN/CWR flags

(cherry picked from commit 5fe2fba184)
3 years ago · 73ccd0de1d
parent 85fc446c55
commit 73ccd0de1d
1 changed files with 1 additions and 1 deletions
--- a/src/stream-tcp-reassemble.c
+++ b/src/stream-tcp-reassemble.c
@ -676,7 +676,7 @@ int StreamTcpReassembleHandleSegmentHandleData(ThreadVars *tv, TcpReassemblyThre
    seg->seq = TCP_GET_SEQ(p);

    /* HACK: for TFO SYN packets the seq for data starts at + 1 */
-    if (TCP_HAS_TFO(p) && p->payload_len && p->tcph->th_flags == TH_SYN)
+    if (TCP_HAS_TFO(p) && p->payload_len && (p->tcph->th_flags & TH_SYN))
        seg->seq += 1;

    /* proto detection skipped, but now we do get data. Set event. */