Merge pull request #2543 in SNORT/snort3 from ~DAVMCPHE/snort3:stream_bad_meta_ack...

Squashed commit of the following:

commit e92e548a1d23179ecdd14ffc76ec9148580f4158
Author: davis mcpherson <davmcphe@cisco.com>
Date:   Mon Oct 12 16:11:00 2020 -0400

    stream_tcp: don't attempt to drop 'meta_ack packets', there is no wire packet for these acks

diff --git a/src/stream/tcp/tcp_normalizer.cc b/src/stream/tcp/tcp_normalizer.cc
index 1d848d4ad0d7b95418c50c77e0fc057972287568..027bd335a00c99f550d0f707a698e74aad7db3a3 100644 (file)
--- a/src/stream/tcp/tcp_normalizer.cc
+++ b/src/stream/tcp/tcp_normalizer.cc
@@ -90,6 +90,9 @@ bool TcpNormalizer::strip_tcp_timestamp(
 bool TcpNormalizer::packet_dropper(
     TcpNormalizerState& tns, TcpSegmentDescriptor& tsd, NormFlags f)
 {
+    if ( tsd.is_meta_ack_packet() )
+        return false;
+
     const int8_t mode = (f == NORM_TCP_BLOCK) ? tns.tcp_block : tns.opt_block;
 
     tcp_norm_stats[PC_TCP_BLOCK][mode]++;