]> git.ipfire.org Git - people/ms/suricata.git/commitdiff
tx: fix unidir tx cleanup
authorJason Ish <jason.ish@oisf.net>
Thu, 22 Apr 2021 15:38:24 +0000 (09:38 -0600)
committerJason Ish <jason.ish@oisf.net>
Thu, 22 Apr 2021 15:44:54 +0000 (09:44 -0600)
A unidirection protocol parser should only have its transactions
marked as "skipped" if it is skipped in both the TS and TC
directions, otherwise unidir transactions are always considered
skipped and the cleanup will never updates its minimum id.

Redmine issue:
https://redmine.openinfosecfoundation.org/issues/4437

src/app-layer-parser.c

index 982e0978be66860a2c0af6feef2528e9f816d6ce..4814ee572b662e3f1240da820ed0324065803f9a 100644 (file)
@@ -951,7 +951,7 @@ void AppLayerParserTransactionsCleanup(Flow *f)
                 if (!(detect_flags_ts & APP_LAYER_TX_INSPECTED_FLAG)) {
                     SCLogDebug("%p/%"PRIu64" skipping: TS inspect not done: ts:%"PRIx64,
                             tx, i, detect_flags_ts);
-                    tx_skipped = skipped = true;
+                    tx_skipped = true;
                 } else {
                     inspected = true;
                 }
@@ -961,7 +961,7 @@ void AppLayerParserTransactionsCleanup(Flow *f)
                 if (!(detect_flags_tc & APP_LAYER_TX_INSPECTED_FLAG)) {
                     SCLogDebug("%p/%"PRIu64" skipping: TC inspect not done: tc:%"PRIx64,
                             tx, i, detect_flags_tc);
-                    tx_skipped = skipped = true;
+                    tx_skipped = true;
                 } else {
                     inspected = true;
                 }
@@ -972,6 +972,7 @@ void AppLayerParserTransactionsCleanup(Flow *f)
         // been inspected.
         if (!is_unidir && tx_skipped) {
             SCLogDebug("%p/%" PRIu64 " !is_unidir && tx_skipped", tx, i);
+            skipped = true;
             goto next;
         }
 
@@ -981,6 +982,7 @@ void AppLayerParserTransactionsCleanup(Flow *f)
         // tx inspected flag checked.
         if (is_unidir && tx_skipped && !inspected) {
             SCLogDebug("%p/%" PRIu64 " is_unidir && tx_skipped && !inspected", tx, i);
+            skipped = true;
             goto next;
         }