From: Philippe Antoine <pantoine@oisf.net>
Date: Thu, 14 Dec 2023 10:31:37 +0000 (+0100)
Subject: stats: incr app-proto flow counter for detection-only
X-Git-Tag: suricata-8.0.0-beta1~1904
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=3103505cb0fa87f18b63434a94c1b3814f5b8003;p=thirdparty%2Fsuricata.git

stats: incr app-proto flow counter for detection-only

Ticket: 6633
---

diff --git a/src/app-layer.c b/src/app-layer.c
index 102319042b..e159b932af 100644
--- a/src/app-layer.c
+++ b/src/app-layer.c
@@ -510,6 +510,20 @@ static int TCPProtoDetect(ThreadVars *tv, TcpReassemblyThreadCtx *ra_ctx,
         if (r != 1) {
             StreamTcpUpdateAppLayerProgress(ssn, direction, data_len);
         }
+        if (r == 0) {
+            if (*alproto_otherdir == ALPROTO_UNKNOWN) {
+                TcpStream *opposing_stream;
+                if (*stream == &ssn->client) {
+                    opposing_stream = &ssn->server;
+                } else {
+                    opposing_stream = &ssn->client;
+                }
+                if (StreamTcpIsSetStreamFlagAppProtoDetectionCompleted(opposing_stream)) {
+                    // can happen in detection-only
+                    AppLayerIncFlowCounter(tv, f);
+                }
+            }
+        }
         if (r < 0) {
             goto parser_error;
         }