From 096b85ab683856ec0e718a879c1698d01b42a331 Mon Sep 17 00:00:00 2001 From: Victor Julien Date: Wed, 10 Dec 2014 17:31:57 +0100 Subject: [PATCH] stream: don't send EOF to AppLayer too soon Sending EOF too soon results in the AppLayer cleaning up prematurely. --- src/stream-tcp-reassemble.c | 10 ++++++++-- 1 file changed, 8 insertions(+), 2 deletions(-) diff --git a/src/stream-tcp-reassemble.c b/src/stream-tcp-reassemble.c index 2d1170a14c..5333c3e6ca 100644 --- a/src/stream-tcp-reassemble.c +++ b/src/stream-tcp-reassemble.c @@ -1919,7 +1919,10 @@ int StreamTcpReassembleHandleSegmentHandleData(ThreadVars *tv, TcpReassemblyThre if (!(stream->flags & STREAMTCP_STREAM_FLAG_APPPROTO_DETECTION_COMPLETED)) {\ flag |= STREAM_START; \ } \ - if (stream->flags & STREAMTCP_STREAM_FLAG_CLOSE_INITIATED) { \ + if (ssn->state == TCP_CLOSED) { \ + flag |= STREAM_EOF; \ + } \ + if (p->flags & PKT_PSEUDO_STREAM_END) { \ flag |= STREAM_EOF; \ } \ if ((p)->flowflags & FLOW_PKT_TOSERVER) { \ @@ -1937,7 +1940,10 @@ int StreamTcpReassembleHandleSegmentHandleData(ThreadVars *tv, TcpReassemblyThre if (!(stream->flags & STREAMTCP_STREAM_FLAG_APPPROTO_DETECTION_COMPLETED)) {\ flag |= STREAM_START; \ } \ - if (stream->flags & STREAMTCP_STREAM_FLAG_CLOSE_INITIATED) { \ + if (ssn->state == TCP_CLOSED) { \ + flag |= STREAM_EOF; \ + } \ + if (p->flags & PKT_PSEUDO_STREAM_END) { \ flag |= STREAM_EOF; \ } \ if ((p)->flowflags & FLOW_PKT_TOSERVER) { \ -- 2.47.2