From 41e3bbefbbdc72b540ac9796d181431212e968a0 Mon Sep 17 00:00:00 2001 From: Victor Julien Date: Wed, 10 Dec 2014 17:31:57 +0100 Subject: [PATCH] stream: don't send EOF to AppLayer too soon Sending EOF too soon results in the AppLayer cleaning up prematurely. --- src/stream-tcp-reassemble.c | 10 ++++++++-- 1 file changed, 8 insertions(+), 2 deletions(-) diff --git a/src/stream-tcp-reassemble.c b/src/stream-tcp-reassemble.c index 7dc7b7696a..3eb7547611 100644 --- a/src/stream-tcp-reassemble.c +++ b/src/stream-tcp-reassemble.c @@ -1911,7 +1911,10 @@ int StreamTcpReassembleHandleSegmentHandleData(ThreadVars *tv, TcpReassemblyThre if (!(stream->flags & STREAMTCP_STREAM_FLAG_APPPROTO_DETECTION_COMPLETED)) {\ flag |= STREAM_START; \ } \ - if (stream->flags & STREAMTCP_STREAM_FLAG_CLOSE_INITIATED) { \ + if (ssn->state == TCP_CLOSED) { \ + flag |= STREAM_EOF; \ + } \ + if (p->flags & PKT_PSEUDO_STREAM_END) { \ flag |= STREAM_EOF; \ } \ if ((p)->flowflags & FLOW_PKT_TOSERVER) { \ @@ -1929,7 +1932,10 @@ int StreamTcpReassembleHandleSegmentHandleData(ThreadVars *tv, TcpReassemblyThre if (!(stream->flags & STREAMTCP_STREAM_FLAG_APPPROTO_DETECTION_COMPLETED)) {\ flag |= STREAM_START; \ } \ - if (stream->flags & STREAMTCP_STREAM_FLAG_CLOSE_INITIATED) { \ + if (ssn->state == TCP_CLOSED) { \ + flag |= STREAM_EOF; \ + } \ + if (p->flags & PKT_PSEUDO_STREAM_END) { \ flag |= STREAM_EOF; \ } \ if ((p)->flowflags & FLOW_PKT_TOSERVER) { \ -- 2.47.3