app-layer: update flow counter if an alproto is detected

If alproto for the current direction was not detected but the opposite
side was successfully detected, if the Pattern Matching and Pattern
Probing on the flow was also successfully done and the current
direction's alproto is still unknown, a decoder event is set to indicate
that the protocol detection only happened in one direction.

This event is set after having sent the current data to the applayer
parser. Now, the respective applayer parser may or may not successfully
parse the data. However, the alproto on flow is already set from the
other direction so there will be a flow event generated by Suricata. In
order to keep this consistent with the stats, also make sure to
increment the flow counter when the decode event is set so that the flow
counter is incremented irrespective of the parsing status reported by
the applayer parser.

This patch makes stats for several specific applayer flow count equal to
the number of flow events logged for those specific applayer protocols.

Bug 7238

diff --git a/src/app-layer.c b/src/app-layer.c
index 14d93c84aa02fe9f900502944c9a08e1f4483e1c..10dc12928614d1dede2c11bbdec4749ccea913ba 100644 (file)
--- a/src/app-layer.c
+++ b/src/app-layer.c
@@ -653,6 +653,7 @@ static int TCPProtoDetect(ThreadVars *tv, TcpReassemblyThreadCtx *ra_ctx,
                             APPLAYER_DETECT_PROTOCOL_ONLY_ONE_DIRECTION);
                     TcpSessionSetReassemblyDepth(ssn,
                             AppLayerParserGetStreamDepth(f));
+                    AppLayerIncFlowCounter(tv, f);
 
                     *alproto = *alproto_otherdir;
                     SCLogDebug("packet %"PRIu64": pd done(us %u them %u), parser called (r==%d), APPLAYER_DETECT_PROTOCOL_ONLY_ONE_DIRECTION set",
@@ -663,7 +664,6 @@ static int TCPProtoDetect(ThreadVars *tv, TcpReassemblyThreadCtx *ra_ctx,
                 }
                 *alproto = ALPROTO_FAILED;
                 StreamTcpSetStreamFlagAppProtoDetectionCompleted(*stream);
-                AppLayerIncFlowCounter(tv, f);
                 FlagPacketFlow(p, f, flags);
 
             } else if (flags & STREAM_EOF) {