From: Philippe Antoine <pantoine@oisf.net>
Date: Thu, 20 Jun 2024 20:43:57 +0000 (+0200)
Subject: detect: run frames on pseudo flush packets
X-Git-Tag: suricata-8.0.0-beta1~973
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=6ae294c7706d2a82712b57edebde87517b2ad5b6;p=thirdparty%2Fsuricata.git

detect: run frames on pseudo flush packets

for SSH packets that mark the end of plaintext
---

diff --git a/src/detect.c b/src/detect.c
index 0302a374b5..aeb2fb625c 100644
--- a/src/detect.c
+++ b/src/detect.c
@@ -150,7 +150,13 @@ static void DetectRun(ThreadVars *th_v,
                 goto end;
             }
             const TcpSession *ssn = p->flow->protoctx;
-            if (ssn && (ssn->flags & STREAMTCP_FLAG_APP_LAYER_DISABLED) == 0) {
+            bool setting_nopayload = p->flow->alparser &&
+                                     AppLayerParserStateIssetFlag(
+                                             p->flow->alparser, APP_LAYER_PARSER_NO_INSPECTION) &&
+                                     !(p->flags & PKT_NOPAYLOAD_INSPECTION);
+            // we may be right after disabling app-layer (ssh)
+            if (ssn &&
+                    ((ssn->flags & STREAMTCP_FLAG_APP_LAYER_DISABLED) == 0 || setting_nopayload)) {
                 // PACKET_PROFILING_DETECT_START(p, PROF_DETECT_TX);
                 DetectRunFrames(th_v, de_ctx, det_ctx, p, pflow, &scratch);
                 // PACKET_PROFILING_DETECT_END(p, PROF_DETECT_TX);