diff --git a/src/detect-engine-payload.c b/src/detect-engine-payload.c index add1ba6a3d..a5752464be 100644 --- a/src/detect-engine-payload.c +++ b/src/detect-engine-payload.c @@ -265,7 +265,7 @@ int DetectEngineInspectStreamPayload(DetectEngineCtx *de_ctx, Flow *f, Packet *p) { SCEnter(); - + SCLogDebug("FLUSH? %s", (s->flags & SIG_FLAG_FLUSH)?"true":"false"); uint64_t unused; struct StreamContentInspectData inspect_data = { de_ctx, det_ctx, s, f }; int r = StreamReassembleRaw(f->protoctx, p, @@ -334,8 +334,9 @@ int DetectEngineInspectStream(ThreadVars *tv, if (ssn == NULL) return DETECT_ENGINE_INSPECT_SIG_CANT_MATCH; - SCLogDebug("pre-inspect det_ctx->raw_stream_progress %"PRIu64, - det_ctx->raw_stream_progress); + SCLogDebug("pre-inspect det_ctx->raw_stream_progress %"PRIu64" FLUSH? %s", + det_ctx->raw_stream_progress, + (s->flags & SIG_FLAG_FLUSH)?"true":"false"); uint64_t unused; struct StreamContentInspectEngineData inspect_data = { de_ctx, det_ctx, s, smd, f }; int match = StreamReassembleRaw(f->protoctx, p, diff --git a/src/detect-engine.c b/src/detect-engine.c index c2e43b1471..78cc2248c2 100644 --- a/src/detect-engine.c +++ b/src/detect-engine.c @@ -630,6 +630,7 @@ next: } if (s->init_data->init_flags & SIG_FLAG_INIT_NEED_FLUSH) { + SCLogDebug("set SIG_FLAG_FLUSH on %u", s->id); s->flags |= SIG_FLAG_FLUSH; } } diff --git a/src/detect.c b/src/detect.c index 890c743f2b..5cac567fff 100644 --- a/src/detect.c +++ b/src/detect.c @@ -1072,6 +1072,7 @@ static bool DetectRunTxInspectRule(ThreadVars *tv, flow_flags &=~ STREAM_FLUSH; TRACE_SID_TXS(s->id, tx, "starting %s", direction ? "toclient" : "toserver"); + TRACE_SID_TXS(s->id, tx, "FLUSH? %s", (flow_flags & STREAM_FLUSH)?"true":"false"); /* for a new inspection we inspect pkt header and packet matches */ if (likely(stored_flags == NULL)) { diff --git a/src/stream-tcp-reassemble.c b/src/stream-tcp-reassemble.c index 647b0d4145..d8e16b4416 100644 --- a/src/stream-tcp-reassemble.c +++ b/src/stream-tcp-reassemble.c @@ -1534,6 +1534,12 @@ static int StreamReassembleRawDo(TcpSession *ssn, TcpStream *stream, * use a minimal inspect depth, we actually take the app progress * as that is the right edge of the data. Then we take the window * of 'min_inspect_depth' before that. */ + + SCLogDebug("respect_inspect_depth %s STREAMTCP_STREAM_FLAG_TRIGGER_RAW %s stream->min_inspect_depth %u", + respect_inspect_depth ? "true" : "false", + (stream->flags & STREAMTCP_STREAM_FLAG_TRIGGER_RAW) ? "true" : "false", + stream->min_inspect_depth); + if (respect_inspect_depth && (stream->flags & STREAMTCP_STREAM_FLAG_TRIGGER_RAW) && stream->min_inspect_depth)