diff --git a/src/app-layer-parser.c b/src/app-layer-parser.c index da6aefb364..5a0cd7b587 100644 --- a/src/app-layer-parser.c +++ b/src/app-layer-parser.c @@ -209,6 +209,9 @@ void AppLayerSetEOF(Flow *f) parser_state_store->id_flags |= APP_LAYER_TRANSACTION_EOF; parser_state_store->to_client.flags |= APP_LAYER_PARSER_EOF; parser_state_store->to_server.flags |= APP_LAYER_PARSER_EOF; + /* increase version so we will inspect it one more time + * with the EOF flags now set */ + parser_state_store->version++; } } diff --git a/src/detect.c b/src/detect.c index c02a27a5fe..e7b1e9b0f8 100644 --- a/src/detect.c +++ b/src/detect.c @@ -1355,7 +1355,7 @@ int SigMatchSignatures(ThreadVars *th_v, DetectEngineCtx *de_ctx, DetectEngineTh /* if applicable, continue stateful detection */ int state = DeStateFlowHasState(p->flow, flags, alversion); - if (state == 1) { + if (state == 1 || (flags & STREAM_EOF)) { DeStateDetectContinueDetection(th_v, de_ctx, det_ctx, p->flow, flags, alstate, alproto, alversion); } else if (state == 2) {