From 41bb3b95f9c4517c32d2ac141bfa652cf9b71fc8 Mon Sep 17 00:00:00 2001 From: Anoop Saldanha Date: Thu, 19 Jul 2012 13:32:01 +0530 Subject: [PATCH] bug 508 - List (ack | cwr | ecn) combination to be accepted by our stream engine. This isn't a perfect solution. More like we have patched this for the case we are in tcp's established state. The right solution would be to accept states based on the presence(using operator OR) of certain flags in the tcp header, rather than list out all possible flag combinations. --- src/stream-tcp.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/src/stream-tcp.c b/src/stream-tcp.c index 2e6f219455..c40a708188 100644 --- a/src/stream-tcp.c +++ b/src/stream-tcp.c @@ -1965,14 +1965,15 @@ static int StreamTcpPacketStateEstablished(ThreadVars *tv, Packet *p, StreamTcpSetEvent(p, STREAM_EST_SYNACK_RESEND); return -1; break; - case TH_ACK|TH_URG: case TH_ACK: + case TH_ACK|TH_URG: case TH_ACK|TH_CWR: case TH_ACK|TH_ECN: case TH_ACK|TH_PUSH: case TH_ACK|TH_PUSH|TH_ECN: case TH_ACK|TH_PUSH|TH_ECN|TH_CWR: case TH_ACK|TH_PUSH|TH_URG: + case TH_ACK|TH_PUSH|TH_CWR: /* Urgent pointer size can be more than the payload size, as it tells * the future coming data from the sender will be handled urgently * until data of size equal to urgent offset has been processed