app-layer: fix gap handling in protocol detection

A GAP during protocol detection would lead to all reassembly
getting disabled, so also the raw reassembly. In addition, it
could prevent the opposing side from doing protocol detection.

This patch remove the 'disable reassembly' logic. Stream engine
will take the stream with GAP and app-layer will make the proto
detection as complete.
pull/2634/head
Victor Julien 10 years ago
parent 7bdc28cae9
commit 68652f302f

@ -560,7 +560,6 @@ int AppLayerHandleTCPData(ThreadVars *tv, TcpReassemblyThreadCtx *ra_ctx,
AppLayerThreadCtx *app_tctx = ra_ctx->app_tctx; AppLayerThreadCtx *app_tctx = ra_ctx->app_tctx;
AppProto alproto; AppProto alproto;
uint8_t dir;
int r = 0; int r = 0;
SCLogDebug("data_len %u flags %02X", data_len, flags); SCLogDebug("data_len %u flags %02X", data_len, flags);
@ -571,10 +570,8 @@ int AppLayerHandleTCPData(ThreadVars *tv, TcpReassemblyThreadCtx *ra_ctx,
if (flags & STREAM_TOSERVER) { if (flags & STREAM_TOSERVER) {
alproto = f->alproto_ts; alproto = f->alproto_ts;
dir = 0;
} else { } else {
alproto = f->alproto_tc; alproto = f->alproto_tc;
dir = 1;
} }
/* if we don't know the proto yet and we have received a stream /* if we don't know the proto yet and we have received a stream
@ -583,7 +580,6 @@ int AppLayerHandleTCPData(ThreadVars *tv, TcpReassemblyThreadCtx *ra_ctx,
* only run the proto detection once. */ * only run the proto detection once. */
if (alproto == ALPROTO_UNKNOWN && (flags & STREAM_GAP)) { if (alproto == ALPROTO_UNKNOWN && (flags & STREAM_GAP)) {
StreamTcpSetStreamFlagAppProtoDetectionCompleted(stream); StreamTcpSetStreamFlagAppProtoDetectionCompleted(stream);
StreamTcpSetSessionNoReassemblyFlag(ssn, dir);
SCLogDebug("ALPROTO_UNKNOWN flow %p, due to GAP in stream start", f); SCLogDebug("ALPROTO_UNKNOWN flow %p, due to GAP in stream start", f);
} else if (alproto == ALPROTO_UNKNOWN && (flags & STREAM_START)) { } else if (alproto == ALPROTO_UNKNOWN && (flags & STREAM_START)) {

@ -2903,7 +2903,7 @@ int StreamTcpReassembleAppLayer (ThreadVars *tv, TcpReassemblyThreadCtx *ra_ctx,
/* this function can be directly called by app layer protocol /* this function can be directly called by app layer protocol
* detection. */ * detection. */
if (stream->flags & STREAMTCP_STREAM_FLAG_NOREASSEMBLY) { if (stream->flags & (STREAMTCP_STREAM_FLAG_NOREASSEMBLY|STREAMTCP_STREAM_FLAG_GAP)) {
SCLogDebug("stream no reassembly flag set. Mostly called via " SCLogDebug("stream no reassembly flag set. Mostly called via "
"app proto detection."); "app proto detection.");
SCReturnInt(0); SCReturnInt(0);

Loading…
Cancel
Save