From: Tom Peters <thopeter@cisco.com>
Date: Fri, 24 Oct 2014 14:33:19 +0000 (-0400)
Subject: stream integration fixes
X-Git-Tag: 3.0.0-233~1332^2~1
X-Git-Url: http://git.ipfire.org/gitweb.cgi?a=commitdiff_plain;h=c78aa94b9feb56d6bf288c840faafa43f395fbe1;p=thirdparty%2Fsnort3.git

stream integration fixes
---

diff --git a/src/service_inspectors/nhttp_inspect/nhttp_stream_splitter.cc b/src/service_inspectors/nhttp_inspect/nhttp_stream_splitter.cc
index e96e1f2c8..da79886ea 100644
--- a/src/service_inspectors/nhttp_inspect/nhttp_stream_splitter.cc
+++ b/src/service_inspectors/nhttp_inspect/nhttp_stream_splitter.cc
@@ -212,20 +212,12 @@ const StreamBuffer* NHttpStreamSplitter::reassemble(Flow* flow, unsigned total,
 
     /* FIXIT-L Temporary printf while we shake out stream interface */
     if (!NHttpTestManager::use_test_input() && NHttpTestManager::use_test_output()) {
-        printf("reassemble() from flow %p direction %d\n", (void*)flow, 1 - (int)to_server()); fflush(nullptr);
+        printf("reassemble() from flow %p direction %d total %u length %u offset %u\n", (void*)flow, 1 - (int)to_server(), total, len, offset); fflush(nullptr);
     }
 
     NHttpFlowData* session_data = (NHttpFlowData*)flow->get_application_data(NHttpFlowData::nhttp_flow_id);
     assert(session_data != nullptr);
     SourceId source_id = to_server() ? SRC_CLIENT : SRC_SERVER;
-    if (session_data->section_type[source_id] == SEC__NOTCOMPUTE) {
-        // FIXIT-M Apparently scan() did not flush this data. Probably Stream is flushing excess data while it prunes
-        // a session. In any event it doesn't belong here because we cannot process it. Forward it to our parent class
-        // for processing. There should be no more calls to scan() for this session but tell it to abort just in case.
-
-        // session_data->type_expected[source_id] = SEC_ABORT; /* FIXIT-M this statetment breaks the test tool */
-        return StreamSplitter::reassemble(flow, total, offset, data, len, flags, copied);
-    }
     copied = len;
 
     if (NHttpTestManager::use_test_input()) {
@@ -247,6 +239,15 @@ const StreamBuffer* NHttpStreamSplitter::reassemble(Flow* flow, unsigned total,
         fflush(stdout);
     }
 
+    if (session_data->section_type[source_id] == SEC__NOTCOMPUTE) {
+        // FIXIT-M Apparently scan() did not flush this data. Probably Stream is flushing excess data while it prunes
+        // a session. In any event it doesn't belong here because we cannot process it. Forward it to our parent class
+        // for processing. There should be no more calls to scan() for this session but tell it to abort just in case.
+
+        // session_data->type_expected[source_id] = SEC_ABORT; /* FIXIT-M this statetment breaks the test tool */
+        return StreamSplitter::reassemble(flow, total, offset, data, len, flags, copied);
+    }
+
     session_data->tcp_close[source_id] = tcp_close || session_data->tcp_close[source_id];
 
     // FIXIT-P stream should be enhanced to do discarding for us. For now flush-then-discard here is how scan() handles