From 41a139b590a059171d0517a455c562486e1a21c2 Mon Sep 17 00:00:00 2001 From: Angelo Mirabella Date: Thu, 20 Jan 2022 14:52:33 +0000 Subject: [PATCH] stream-tcp-reassemble: fix reassembly direction for FIN packets Suricata invokes the stream reassembly logic only for the current packet direction if the packet contains a FIN flag. However, this does not handle the case in which the packet ACKs data from the opposing direction. This patch forces the invocation of the stream reassembly logic on both direction when Suricata sees a FIN packet. --- src/stream-tcp-reassemble.c | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) diff --git a/src/stream-tcp-reassemble.c b/src/stream-tcp-reassemble.c index 99f0912d1d..9ff2916bb3 100644 --- a/src/stream-tcp-reassemble.c +++ b/src/stream-tcp-reassemble.c @@ -1853,7 +1853,11 @@ int StreamTcpReassembleHandleSegment(ThreadVars *tv, TcpReassemblyThreadCtx *ra_ } else if (p->tcph->th_flags & TH_RST) { // accepted rst dir = UPDATE_DIR_PACKET; } else if ((p->tcph->th_flags & TH_FIN) && ssn->state > TCP_TIME_WAIT) { - dir = UPDATE_DIR_PACKET; + if (p->tcph->th_flags & TH_ACK) { + dir = UPDATE_DIR_BOTH; + } else { + dir = UPDATE_DIR_PACKET; + } } else if (ssn->state == TCP_CLOSED) { dir = UPDATE_DIR_BOTH; }