Merge pull request #2456 in SNORT/snort3 from ~KAMURTHI/snort3:pkt_OOO to master

Squashed commit of the following:

commit 34f8a158f2501809f47d7a5384c2d83740c9402d
Author: kamurthi <kamurthi@cisco.com>
Date:   Wed Sep 2 21:07:19 2020 -0400

    appid: set payload to unknown for out-of-order flows

diff --git a/src/network_inspectors/appid/appid_discovery.cc b/src/network_inspectors/appid/appid_discovery.cc
index e9431d7fd712481118dd0e4dd2bb867661cef3f4..86317c45714223912103498fd1c00c186c90d9ce 100644 (file)
--- a/src/network_inspectors/appid/appid_discovery.cc
+++ b/src/network_inspectors/appid/appid_discovery.cc
@@ -488,6 +488,9 @@ bool AppIdDiscovery::do_pre_discovery(Packet* p, AppIdSession*& asd, AppIdInspec
                 (p->ptrs.sp != 21 && p->ptrs.dp != 21)) // exception for ftp-control
             {
                 asd->service_disco_state = APPID_DISCO_STATE_FINISHED;
+                if (asd->get_payload_id() == APP_ID_NONE and
+                    (asd->is_tp_appid_available() or asd->get_session_flags(APPID_SESSION_NO_TPI)))
+                        asd->set_payload_id(APP_ID_UNKNOWN);
                 asd->client_disco_state = APPID_DISCO_STATE_FINISHED;
                 asd->set_session_flags(APPID_SESSION_SERVICE_DETECTED |
                     APPID_SESSION_CLIENT_DETECTED);