From: Victor Julien <vjulien@oisf.net>
Date: Sat, 23 Apr 2022 11:59:34 +0000 (+0200)
Subject: stream: improve flow end payload logging
X-Git-Tag: suricata-5.0.10~74
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=69a63043f3e754104c2c456992fddea0f386ea55;p=thirdparty%2Fsuricata.git

stream: improve flow end payload logging

Use all available data, including un-ACK'd, when in flow timeout
mode.

Bug: #5276.
(cherry picked from commit c40df43609becc467e86d756098829b3174c80c7)
---

diff --git a/src/stream-tcp.c b/src/stream-tcp.c
index 98ae70ee5c..e9dfecfc0e 100644
--- a/src/stream-tcp.c
+++ b/src/stream-tcp.c
@@ -6269,9 +6269,16 @@ int StreamTcpSegmentForEach(const Packet *p, uint8_t flag, StreamSegmentCallback
     /* for IDS, return ack'd segments. For IPS all. */
     TcpSegment *seg;
     RB_FOREACH(seg, TCPSEG, &stream->seg_tree) {
-        if (!((stream_config.flags & STREAMTCP_INIT_FLAG_INLINE)
-                    || SEQ_LT(seg->seq, stream->last_ack)))
-            break;
+        if (!(stream_config.flags & STREAMTCP_INIT_FLAG_INLINE)) {
+            if (PKT_IS_PSEUDOPKT(p)) {
+                /* use un-ACK'd data as well */
+            } else {
+                /* in IDS mode, use ACK'd data */
+                if (SEQ_GEQ(seg->seq, stream->last_ack)) {
+                    break;
+                }
+            }
+        }
 
         const uint8_t *seg_data;
         uint32_t seg_datalen;