From 5fe2fba1849afa3cd30a44dbf328a3dc256e4d08 Mon Sep 17 00:00:00 2001 From: Victor Julien Date: Fri, 3 Mar 2023 13:02:48 +0100 Subject: [PATCH] stream: fix TFO overlap detection with ECN/CWR flags --- src/stream-tcp-reassemble.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/src/stream-tcp-reassemble.c b/src/stream-tcp-reassemble.c index 8ef0fcd5ff..52118ace38 100644 --- a/src/stream-tcp-reassemble.c +++ b/src/stream-tcp-reassemble.c @@ -790,7 +790,7 @@ int StreamTcpReassembleHandleSegmentHandleData(ThreadVars *tv, TcpReassemblyThre seg->seq = TCP_GET_SEQ(p); /* HACK: for TFO SYN packets the seq for data starts at + 1 */ - if (TCP_HAS_TFO(p) && p->payload_len && p->tcph->th_flags == TH_SYN) + if (TCP_HAS_TFO(p) && p->payload_len && (p->tcph->th_flags & TH_SYN)) seg->seq += 1; /* proto detection skipped, but now we do get data. Set event. */ -- 2.47.2