diff --git a/rust/src/core.rs b/rust/src/core.rs index be164e6734..e448998945 100644 --- a/rust/src/core.rs +++ b/rust/src/core.rs @@ -40,6 +40,8 @@ pub const STREAM_TOCLIENT: u8 = 0x08; pub const STREAM_GAP: u8 = 0x10; pub const STREAM_DEPTH: u8 = 0x20; pub const STREAM_MIDSTREAM:u8 = 0x40; +/// stream is async: packets are seen in only one direction. +pub const STREAM_ASYNC: u8 = 0x80; pub const DIR_BOTH: u8 = 0b0000_1100; const DIR_TOSERVER: u8 = 0b0000_0100; const DIR_TOCLIENT: u8 = 0b0000_1000; diff --git a/src/app-layer-parser.c b/src/app-layer-parser.c index 6cab5fb79f..e7dac6a1cc 100644 --- a/src/app-layer-parser.c +++ b/src/app-layer-parser.c @@ -921,7 +921,7 @@ static void AppLayerParserFileTxHousekeeping( } } -#define IS_DISRUPTED(flags) ((flags) & (STREAM_DEPTH | STREAM_GAP)) +#define IS_DISRUPTED(flags) ((flags) & (STREAM_DEPTH | STREAM_GAP | STREAM_ASYNC)) extern int g_detect_disabled; extern bool g_file_logger_enabled; diff --git a/src/flow.c b/src/flow.c index d044c1e198..91971c81da 100644 --- a/src/flow.c +++ b/src/flow.c @@ -1182,6 +1182,11 @@ uint8_t FlowGetDisruptionFlags(const Flow *f, uint8_t flags) if (stream->flags & STREAMTCP_STREAM_FLAG_DEPTH_REACHED) { newflags |= STREAM_DEPTH; } + if (ssn->flags & STREAMTCP_FLAG_ASYNC) { + if (stream->tcp_flags == 0) { + newflags |= STREAM_ASYNC; + } + } /* todo: handle pass case (also for UDP!) */ return newflags;