From: Russ Combs (rucombs) <rucombs@cisco.com>
Date: Mon, 28 Mar 2016 21:57:24 +0000 (-0400)
Subject: Merge pull request #376 in SNORT/snort3 from reset_after_data_fix to master
X-Git-Tag: 3.0.0-233~499
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=72ef6afc287d6c7a55aed98963e3cef8ed4561fb;p=thirdparty%2Fsnort3.git

Merge pull request #376 in SNORT/snort3 from reset_after_data_fix to master

Squashed commit of the following:

commit d6e92a7f139f5cfb4b9549993b07c71c09685b69
Author: davis mcpherson <davis.mcpherson@gmail.com>
Date:   Mon Mar 28 17:28:39 2016 -0400

    only generate data after reset alert when packet has data len > 0
---

diff --git a/src/stream/tcp/tcp_state_closed.cc b/src/stream/tcp/tcp_state_closed.cc
index a94ff09d9..33f3d3c11 100644
--- a/src/stream/tcp/tcp_state_closed.cc
+++ b/src/stream/tcp/tcp_state_closed.cc
@@ -138,10 +138,13 @@ bool TcpStateClosed::fin_recv(TcpSegmentDescriptor& tsd, TcpStreamTracker& track
 
     trk.update_tracker_ack_recv(tsd);
 
-    if ( trk.is_rst_pkt_sent() )
-        session.tel.set_tcp_event(EVENT_DATA_AFTER_RESET);
-    else
-        session.tel.set_tcp_event(EVENT_DATA_AFTER_RST_RCVD);
+    if( tsd.get_seg_len() > 0 )
+    {
+        if ( trk.is_rst_pkt_sent() )
+            session.tel.set_tcp_event(EVENT_DATA_AFTER_RESET);
+        else
+            session.tel.set_tcp_event(EVENT_DATA_AFTER_RST_RCVD);
+    }
 
     return default_state_action(tsd, trk);
 }