Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
stream: improve 3whs completed by ACK with data
If the ACK packet completing the 3whs is received, the stream engine will transition to "established". However, the packet itself will not be tagged as "established". This will only happen for the next packet after the 3whs, so that `flow:established` only matches after the 3whs. It is possible that the ACK packet completing the 3whs was lost. Since the ACK packets themselves are not acknowledged, there will be no retransmission of them. Instead, the next packet can have the expected ACK flag as well as data. This case was mishandled in a subtle way. The stream engine state transition was done correctly, as well as the data handling and app-layer updates. However, the packet itself was not tagged as "established", which meant that `flow:established` would not yet match. This patch detects this case and tags the packet as established if ACK with data is received that completes the 3whs. Bug: OISF#7264.
- Loading branch information