From 77539e08fc8a4e548035663c46fc5f9bea8188d3 Mon Sep 17 00:00:00 2001
From: Victor Julien <victor@inliniac.net>
Date: Wed, 11 Dec 2019 20:57:07 +0100
Subject: [PATCH] stream: in IDS mode, call app-layer at EOF

On stream end call app-layer with empty message in IDS mode.
---
 src/stream-tcp-reassemble.c | 6 +++++-
 1 file changed, 5 insertions(+), 1 deletion(-)

diff --git a/src/stream-tcp-reassemble.c b/src/stream-tcp-reassemble.c
index 9b03d8b17d..7b450db0b7 100644
--- a/src/stream-tcp-reassemble.c
+++ b/src/stream-tcp-reassemble.c
@@ -1025,7 +1025,11 @@ static int ReassembleUpdateAppLayer (ThreadVars *tv,
             continue;
         } else if (mydata == NULL || mydata_len == 0) {
             /* Possibly a gap, but no new data. */
-            return 0;
+            if ((p->flags & PKT_PSEUDO_STREAM_END) == 0 || ssn->state < TCP_CLOSED)
+                SCReturnInt(0);
+
+            mydata = NULL;
+            mydata_len = 0;
         }
         SCLogDebug("%"PRIu64" got %p/%u", p->pcap_cnt, mydata, mydata_len);
         break;
-- 
2.47.2