detect/stream: fix async stream inspection

Move raw progress forward only if detect uses stream data, indicated
by the PKT_DETECT_HAS_STREAMDATA flag.

(cherry picked from commit 3c7c361b603653a4c0bb30a4261babc45988d163)

diff --git a/src/detect.c b/src/detect.c
index e9b7ff7adf8677eed9c7bdee456bd924c8321188..face274c1e00714f5a17e40b1ad32b9e5d87b8b4 100644 (file)
--- a/src/detect.c
+++ b/src/detect.c
@@ -954,8 +954,7 @@ static void DetectRunCleanup(DetectEngineThreadCtx *det_ctx,
     if (pflow != NULL) {
         /* update inspected tracker for raw reassembly */
         if (p->proto == IPPROTO_TCP && pflow->protoctx != NULL &&
-            (p->flags & PKT_STREAM_EST))
-        {
+                (p->flags & PKT_DETECT_HAS_STREAMDATA)) {
             StreamReassembleRawUpdateProgress(pflow->protoctx, p,
                     det_ctx->raw_stream_progress);
         }

diff --git a/src/tests/detect-http-uri.c b/src/tests/detect-http-uri.c
index 7d662f08faeab712a1be56e23d83e51605d14c4b..5b3c180113bfad32d57833d7b27bb09a5a1b95ff 100644 (file)
--- a/src/tests/detect-http-uri.c
+++ b/src/tests/detect-http-uri.c
@@ -1656,7 +1656,7 @@ static int UriTestSig16(void)
     UTHAddStreamToFlow(f, 0, http_buf1, http_buf1_len);
 
     p->flow = f;
-    p->flags |= PKT_HAS_FLOW|PKT_STREAM_EST;
+    p->flags |= PKT_HAS_FLOW | PKT_STREAM_EST | PKT_DETECT_HAS_STREAMDATA;
     p->flowflags |= FLOW_PKT_TOSERVER;
     p->flowflags |= FLOW_PKT_ESTABLISHED;
     f->alproto = ALPROTO_HTTP;