]> git.ipfire.org Git - thirdparty/suricata.git/commitdiff
app-layer: increment flow counter if one sided
authorEric Leblond <eric@regit.org>
Sun, 14 May 2017 18:40:51 +0000 (20:40 +0200)
committerVictor Julien <victor@inliniac.net>
Tue, 11 Jul 2017 12:27:39 +0000 (14:27 +0200)
In the case of protocol like SMTP, we detect application layer on
only one side.  Consequence was a missed increment in the flow
counter.

src/app-layer.c

index 98a12ed94c5a04ec42c5721805e303d71479961e..aa6dd6acf8e678171c55e250c1c546facfc47725 100644 (file)
@@ -498,6 +498,7 @@ static int TCPProtoDetect(ThreadVars *tv,
                 TcpSessionSetReassemblyDepth(ssn,
                         AppLayerParserGetStreamDepth(f));
                 *alproto = ALPROTO_FAILED;
+                AppLayerIncFlowCounter(tv, f);
                 FlagPacketFlow(p, f, flags);
 
                 SCLogDebug("packet %u: pd done(us %u them %u), parser called (r==%d), APPLAYER_DETECT_PROTOCOL_ONLY_ONE_DIRECTION set",