stream: disrupt never seen direction with async-oneside

Ticket: 8629

When we are in async-oneside mode, we see only one direction
of the traffic, and should not wait for the other direction
before cleaning up a transaction.

(cherry picked from commit 7ec9d72)

Author: catenacyber

rust/src/core.rs

@@ -40,6 +40,8 @@ pub const STREAM_TOCLIENT: u8 = 0x08;
 pub const STREAM_GAP:      u8 = 0x10;
 pub const STREAM_DEPTH:    u8 = 0x20;
 pub const STREAM_MIDSTREAM:u8 = 0x40;
+/// stream is async: packets are seen in only one direction.
+pub const STREAM_ASYNC:    u8 = 0x80;
 pub const DIR_BOTH:        u8 = 0b0000_1100;
 const DIR_TOSERVER:        u8 = 0b0000_0100;
 const DIR_TOCLIENT:        u8 = 0b0000_1000;

src/app-layer-parser.c

@@ -921,7 +921,7 @@ static void AppLayerParserFileTxHousekeeping(
     }
 }
 
-#define IS_DISRUPTED(flags) ((flags) & (STREAM_DEPTH | STREAM_GAP))
+#define IS_DISRUPTED(flags) ((flags) & (STREAM_DEPTH | STREAM_GAP | STREAM_ASYNC))
 
 extern int g_detect_disabled;
 extern bool g_file_logger_enabled;

src/flow.c

@@ -1182,6 +1182,11 @@ uint8_t FlowGetDisruptionFlags(const Flow *f, uint8_t flags)
     if (stream->flags & STREAMTCP_STREAM_FLAG_DEPTH_REACHED) {
         newflags |= STREAM_DEPTH;
     }
+    if (ssn->flags & STREAMTCP_FLAG_ASYNC) {
+        if (stream->tcp_flags == 0) {
+            newflags |= STREAM_ASYNC;
+        }
+    }
     /* todo: handle pass case (also for UDP!) */
 
     return newflags;