Merge pull request #376 in SNORT/snort3 from reset_after_data_fix to master

Squashed commit of the following:

commit d6e92a7f139f5cfb4b9549993b07c71c09685b69
Author: davis mcpherson <davis.mcpherson@gmail.com>
Date:   Mon Mar 28 17:28:39 2016 -0400

    only generate data after reset alert when packet has data len > 0

diff --git a/src/stream/tcp/tcp_state_closed.cc b/src/stream/tcp/tcp_state_closed.cc
index a94ff09d92e28f1aa910927b73b9e80e24e1f330..33f3d3c11735d2e7c3741f90f147f27e8f558145 100644 (file)
--- a/src/stream/tcp/tcp_state_closed.cc
+++ b/src/stream/tcp/tcp_state_closed.cc
@@ -138,10 +138,13 @@ bool TcpStateClosed::fin_recv(TcpSegmentDescriptor& tsd, TcpStreamTracker& track
 
     trk.update_tracker_ack_recv(tsd);
 
-    if ( trk.is_rst_pkt_sent() )
-        session.tel.set_tcp_event(EVENT_DATA_AFTER_RESET);
-    else
-        session.tel.set_tcp_event(EVENT_DATA_AFTER_RST_RCVD);
+    if( tsd.get_seg_len() > 0 )
+    {
+        if ( trk.is_rst_pkt_sent() )
+            session.tel.set_tcp_event(EVENT_DATA_AFTER_RESET);
+        else
+            session.tel.set_tcp_event(EVENT_DATA_AFTER_RST_RCVD);
+    }
 
     return default_state_action(tsd, trk);
 }