From 7ec9d72d28b9370712cf77a5b9d40d6b5db27cb4 Mon Sep 17 00:00:00 2001 From: Philippe Antoine Date: Thu, 2 Jul 2026 11:00:05 +0200 Subject: [PATCH] stream: disrupt never seen direction with async-oneside Ticket: 8629 When we are in async-oneside mode, we see only one direction of the traffic, and should not wait for the other direction before cleaning up a transaction. --- rust/ffi/src/lib.rs | 2 ++ src/app-layer-parser.c | 2 +- src/flow.c | 5 +++++ 3 files changed, 8 insertions(+), 1 deletion(-) diff --git a/rust/ffi/src/lib.rs b/rust/ffi/src/lib.rs index b9ca52d328..4132b53b35 100644 --- a/rust/ffi/src/lib.rs +++ b/rust/ffi/src/lib.rs @@ -36,6 +36,8 @@ pub const STREAM_TOCLIENT: u8 = 0x08; pub const STREAM_GAP: u8 = 0x10; pub const STREAM_DEPTH: u8 = 0x20; pub const STREAM_MIDSTREAM: u8 = 0x40; +/// stream is async : packets are seen in only one direction. +pub const STREAM_ASYNC: u8 = 0x80; /// Cast pointer to a variable, as a mutable reference to an object /// diff --git a/src/app-layer-parser.c b/src/app-layer-parser.c index df4df8c102..a087c21470 100644 --- a/src/app-layer-parser.c +++ b/src/app-layer-parser.c @@ -908,7 +908,7 @@ static void AppLayerParserFileTxHousekeeping( } } -#define IS_DISRUPTED(flags) ((flags) & (STREAM_DEPTH | STREAM_GAP)) +#define IS_DISRUPTED(flags) ((flags) & (STREAM_DEPTH | STREAM_GAP | STREAM_ASYNC)) extern int g_detect_disabled; extern bool g_file_logger_enabled; diff --git a/src/flow.c b/src/flow.c index 75995cb9c1..06bf319d52 100644 --- a/src/flow.c +++ b/src/flow.c @@ -1184,6 +1184,11 @@ uint8_t FlowGetDisruptionFlags(const Flow *f, uint8_t flags) if (stream->flags & STREAMTCP_STREAM_FLAG_DEPTH_REACHED) { newflags |= STREAM_DEPTH; } + if (ssn->flags & STREAMTCP_FLAG_ASYNC) { + if (stream->tcp_flags == 0) { + newflags |= STREAM_ASYNC; + } + } /* todo: handle pass case (also for UDP!) */ return newflags;