From: Shravan Rangarajuvenkata (shrarang) <shrarang@cisco.com>
Date: Wed, 9 Sep 2020 02:27:31 +0000 (+0000)
Subject: Merge pull request #2456 in SNORT/snort3 from ~KAMURTHI/snort3:pkt_OOO to master
X-Git-Tag: 3.0.2-6~9
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=a9a6c6d25dba25019d732cd935373ca997009727;p=thirdparty%2Fsnort3.git

Merge pull request #2456 in SNORT/snort3 from ~KAMURTHI/snort3:pkt_OOO to master

Squashed commit of the following:

commit 34f8a158f2501809f47d7a5384c2d83740c9402d
Author: kamurthi <kamurthi@cisco.com>
Date:   Wed Sep 2 21:07:19 2020 -0400

    appid: set payload to unknown for out-of-order flows
---

diff --git a/src/network_inspectors/appid/appid_discovery.cc b/src/network_inspectors/appid/appid_discovery.cc
index e9431d7fd..86317c457 100644
--- a/src/network_inspectors/appid/appid_discovery.cc
+++ b/src/network_inspectors/appid/appid_discovery.cc
@@ -488,6 +488,9 @@ bool AppIdDiscovery::do_pre_discovery(Packet* p, AppIdSession*& asd, AppIdInspec
                 (p->ptrs.sp != 21 && p->ptrs.dp != 21)) // exception for ftp-control
             {
                 asd->service_disco_state = APPID_DISCO_STATE_FINISHED;
+                if (asd->get_payload_id() == APP_ID_NONE and
+                    (asd->is_tp_appid_available() or asd->get_session_flags(APPID_SESSION_NO_TPI)))
+                        asd->set_payload_id(APP_ID_UNKNOWN);
                 asd->client_disco_state = APPID_DISCO_STATE_FINISHED;
                 asd->set_session_flags(APPID_SESSION_SERVICE_DETECTED |
                     APPID_SESSION_CLIENT_DETECTED);