stats: incr app-proto flow counter for detection-only

Ticket: 6633
(cherry picked from commit 3103505cb0fa87f18b63434a94c1b3814f5b8003)

diff --git a/src/app-layer.c b/src/app-layer.c
index b031afce8ac898d38733e66d0922f1fcfa4bedd4..794e8e84d315d32de131f215603788e3025c6f50 100644 (file)
--- a/src/app-layer.c
+++ b/src/app-layer.c
@@ -510,6 +510,20 @@ static int TCPProtoDetect(ThreadVars *tv, TcpReassemblyThreadCtx *ra_ctx,
         if (r != 1) {
             StreamTcpUpdateAppLayerProgress(ssn, direction, data_len);
         }
+        if (r == 0) {
+            if (*alproto_otherdir == ALPROTO_UNKNOWN) {
+                TcpStream *opposing_stream;
+                if (*stream == &ssn->client) {
+                    opposing_stream = &ssn->server;
+                } else {
+                    opposing_stream = &ssn->client;
+                }
+                if (StreamTcpIsSetStreamFlagAppProtoDetectionCompleted(opposing_stream)) {
+                    // can happen in detection-only
+                    AppLayerIncFlowCounter(tv, f);
+                }
+            }
+        }
         if (r < 0) {
             goto parser_error;
         }