]> git.ipfire.org Git - thirdparty/suricata.git/commitdiff
flow/inject: Ensure initialized thread value used
authorJeff Lucovsky <jeff.lucovsky@corelight.com>
Mon, 11 Mar 2024 18:57:16 +0000 (14:57 -0400)
committerJeff Lucovsky <jlucovsky@oisf.net>
Sat, 30 Mar 2024 12:20:00 +0000 (08:20 -0400)
Issue: 6835

When injecting a flow, ensure that the selected thread_id has been
initialized. When a flow is picked up midstream, the initialized thread
can be the second thread element.

(cherry picked from commit 9ad73faa0a52428e47412474514b125fda6aa03d)

src/flow-timeout.c

index e5d2794e5cfcf77b1fe88faf22f1c8bf5efca890..2b4b08dc0e0b9b79ae57e7baa29b27cdfbebcb4f 100644 (file)
@@ -341,14 +341,21 @@ int FlowForceReassemblyNeedReassembly(Flow *f)
  *
  *        The function requires flow to be locked beforehand.
  *
+ * Normally, the first thread_id value should be used. This is when the flow is
+ * created on seeing the first packet to the server; sometimes, if the first
+ * packet is determined to be to the client, the second thread_id value should
+ * be used.
+ *
  * \param f Pointer to the flow.
  *
  * \retval 0 This flow doesn't need any reassembly processing; 1 otherwise.
  */
 void FlowForceReassemblyForFlow(Flow *f)
 {
-    const int thread_id = (int)f->thread_id[0];
-    TmThreadsInjectFlowById(f, thread_id);
+    // Have packets traveled to the server? If not,
+    // use the reverse direction
+    int idx = f->todstpktcnt > 0 ? 0 : 1;
+    TmThreadsInjectFlowById(f, (const int)f->thread_id[idx]);
 }
 
 /**