From 73ccd0de1d5aabfc950d80fa31d108b490f917d4 Mon Sep 17 00:00:00 2001 From: Victor Julien Date: Fri, 3 Mar 2023 13:02:48 +0100 Subject: [PATCH] stream: fix TFO overlap detection with ECN/CWR flags (cherry picked from commit 5fe2fba1849afa3cd30a44dbf328a3dc256e4d08) --- src/stream-tcp-reassemble.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/src/stream-tcp-reassemble.c b/src/stream-tcp-reassemble.c index aab148eaf1..6d12443078 100644 --- a/src/stream-tcp-reassemble.c +++ b/src/stream-tcp-reassemble.c @@ -676,7 +676,7 @@ int StreamTcpReassembleHandleSegmentHandleData(ThreadVars *tv, TcpReassemblyThre seg->seq = TCP_GET_SEQ(p); /* HACK: for TFO SYN packets the seq for data starts at + 1 */ - if (TCP_HAS_TFO(p) && p->payload_len && p->tcph->th_flags == TH_SYN) + if (TCP_HAS_TFO(p) && p->payload_len && (p->tcph->th_flags & TH_SYN)) seg->seq += 1; /* proto detection skipped, but now we do get data. Set event. */ -- 2.47.2