stream: disrupt never seen direction with async-oneside

Ticket: 8629

When we are in async-oneside mode, we see only one direction
of the traffic, and should not wait for the other direction
before cleaning up a transaction.

Author: catenacyber

rust/ffi/src/lib.rs

@@ -36,6 +36,8 @@ pub const STREAM_TOCLIENT: u8 = 0x08;
 pub const STREAM_GAP: u8 = 0x10;
 pub const STREAM_DEPTH: u8 = 0x20;
 pub const STREAM_MIDSTREAM: u8 = 0x40;
+/// stream is async : packets are seen in only one direction.
+pub const STREAM_ASYNC: u8 = 0x80;
 
 /// Cast pointer to a variable, as a mutable reference to an object
 ///

src/app-layer-parser.c

@@ -908,7 +908,7 @@ static void AppLayerParserFileTxHousekeeping(
     }
 }
 
-#define IS_DISRUPTED(flags) ((flags) & (STREAM_DEPTH | STREAM_GAP))
+#define IS_DISRUPTED(flags) ((flags) & (STREAM_DEPTH | STREAM_GAP | STREAM_ASYNC))
 
 extern int g_detect_disabled;
 extern bool g_file_logger_enabled;

src/flow.c

@@ -1184,6 +1184,11 @@ uint8_t FlowGetDisruptionFlags(const Flow *f, uint8_t flags)
     if (stream->flags & STREAMTCP_STREAM_FLAG_DEPTH_REACHED) {
         newflags |= STREAM_DEPTH;
     }
+    if (ssn->flags & STREAMTCP_FLAG_ASYNC) {
+        if (stream->tcp_flags == 0) {
+            newflags |= STREAM_ASYNC;
+        }
+    }
     /* todo: handle pass case (also for UDP!) */
 
     return newflags;