From: Jeff Lucovsky <jeff.lucovsky@corelight.com>
Date: Mon, 15 Apr 2024 14:17:17 +0000 (-0400)
Subject: flow/inject: Select thread_id by flow flag
X-Git-Tag: suricata-7.0.5~24
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=6be6d53bc609adfd2670f5ddb78cfde2981d1224;p=thirdparty%2Fsuricata.git

flow/inject: Select thread_id by flow flag

Issue: 6957

Rather than selecting the thread_id index by packets traveling to the
server, use the flow flags. If the flow has been reversed, the second
slot is represents the thread id to be used.

(cherry picked from commit c305ed149c58818779c504b6666fe9c2cb0be4ff)
---

diff --git a/src/flow-timeout.c b/src/flow-timeout.c
index 2b4b08dc0e..6efa3827a7 100644
--- a/src/flow-timeout.c
+++ b/src/flow-timeout.c
@@ -342,9 +342,8 @@ int FlowForceReassemblyNeedReassembly(Flow *f)
  *        The function requires flow to be locked beforehand.
  *
  * Normally, the first thread_id value should be used. This is when the flow is
- * created on seeing the first packet to the server; sometimes, if the first
- * packet is determined to be to the client, the second thread_id value should
- * be used.
+ * created on seeing the first packet to the server; when the flow's reversed
+ * flag is set, choose the second thread_id (to client/source).
  *
  * \param f Pointer to the flow.
  *
@@ -352,9 +351,9 @@ int FlowForceReassemblyNeedReassembly(Flow *f)
  */
 void FlowForceReassemblyForFlow(Flow *f)
 {
-    // Have packets traveled to the server? If not,
-    // use the reverse direction
-    int idx = f->todstpktcnt > 0 ? 0 : 1;
+    // Choose the thread_id based on whether the flow has been
+    // reversed.
+    int idx = f->flags & FLOW_DIR_REVERSED ? 1 : 0;
     TmThreadsInjectFlowById(f, (const int)f->thread_id[idx]);
 }