From: Mike Stepanek (mstepane) <mstepane@cisco.com>
Date: Mon, 7 Feb 2022 13:42:44 +0000 (+0000)
Subject: Pull request #3259: detection: add direction abort check in skip_raw_tcp
X-Git-Tag: 3.1.23.0~5
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=31a9f54a6057834d89e107205a511e32c17864ac;p=thirdparty%2Fsnort3.git

Pull request #3259: detection: add direction abort check in skip_raw_tcp

Merge in SNORT/snort3 from ~ASERBENI/snort3:aborted_dir_raw_inspect to master

Squashed commit of the following:

commit d2541d8336523a682eb86f8c4c7b39e4bd8bf7c5
Author: Andrii Serbeniuk <aserbeni@cisco.com>
Date:   Thu Feb 3 10:14:44 2022 +0200

    detection: add dir abort check in skip_raw_tcp
---

diff --git a/src/detection/fp_detect.cc b/src/detection/fp_detect.cc
index 6c8e02a16..c53f84bc8 100644
--- a/src/detection/fp_detect.cc
+++ b/src/detection/fp_detect.cc
@@ -1246,7 +1246,7 @@ static inline bool skip_raw_tcp(const Packet* p)
     if ( !(p->packet_flags & PKT_STREAM_INSERT) )
         return false;
 
-    if ( !p->flow or !p->flow->gadget )
+    if ( !p->flow or !p->flow->gadget or p->flow->is_direction_aborted(p->is_from_client()) )
         return false;
 
     if ( !p->context->conf->fast_pattern_config->get_stream_insert() )