Fix stateful inspection not always inspecting at stream end.

diff --git a/src/app-layer-parser.c b/src/app-layer-parser.c
index da6aefb36443b5a437e14e13d59eb057fe4b9e61..5a0cd7b58798f0b1bcc5f8bca26cfb39c8bb1f80 100644 (file)
--- a/src/app-layer-parser.c
+++ b/src/app-layer-parser.c
@@ -209,6 +209,9 @@ void AppLayerSetEOF(Flow *f)
         parser_state_store->id_flags |= APP_LAYER_TRANSACTION_EOF;
         parser_state_store->to_client.flags |= APP_LAYER_PARSER_EOF;
         parser_state_store->to_server.flags |= APP_LAYER_PARSER_EOF;
+        /* increase version so we will inspect it one more time
+         * with the EOF flags now set */
+        parser_state_store->version++;
     }
 }
 

diff --git a/src/detect.c b/src/detect.c
index c02a27a5fee4a05d0f5a94303e5a6229a4afb04b..e7b1e9b0f81989515133c4aa5e697cba07c2e5ec 100644 (file)
--- a/src/detect.c
+++ b/src/detect.c
@@ -1355,7 +1355,7 @@ int SigMatchSignatures(ThreadVars *th_v, DetectEngineCtx *de_ctx, DetectEngineTh
 
         /* if applicable, continue stateful detection */
         int state = DeStateFlowHasState(p->flow, flags, alversion);
-        if (state == 1) {
+        if (state == 1 || (flags & STREAM_EOF)) {
             DeStateDetectContinueDetection(th_v, de_ctx, det_ctx, p->flow,
                     flags, alstate, alproto, alversion);
         } else if (state == 2) {