From df7e7b391da0aaf7219f2eb20e79730117faa52d Mon Sep 17 00:00:00 2001
From: Matias Fontanini <matias.fontanini@gmail.com>
Date: Sun, 30 Oct 2016 10:31:16 -0700
Subject: [PATCH] Add flag to Stream to know whether it was attached

---
 include/tins/tcp_ip/stream.h |  5 +++++
 src/tcp_ip/stream.cpp        | 10 +++++++++-
 tests/src/tcp_ip_test.cpp    |  4 ++++
 3 files changed, 18 insertions(+), 1 deletion(-)

diff --git a/include/tins/tcp_ip/stream.h b/include/tins/tcp_ip/stream.h
index 9aea261..b6363e4 100644
--- a/include/tins/tcp_ip/stream.h
+++ b/include/tins/tcp_ip/stream.h
@@ -390,6 +390,10 @@ public:
     }
     #endif // TINS_HAVE_TCP_STREAM_CUSTOM_DATA
 
+    /**
+     * Indicates whether this is a stream that we attached to after it had actually started
+     */
+    bool is_attached() const;
 private:
     static Flow extract_client_flow(const PDU& packet);
     static Flow extract_server_flow(const PDU& packet);
@@ -416,6 +420,7 @@ private:
     timestamp_type last_seen_;
     bool auto_cleanup_client_;
     bool auto_cleanup_server_;
+    bool is_attached_;
 
     #ifdef TINS_HAVE_TCP_STREAM_CUSTOM_DATA
     boost::any user_data_;
diff --git a/src/tcp_ip/stream.cpp b/src/tcp_ip/stream.cpp
index ca52501..a0bd5ff 100644
--- a/src/tcp_ip/stream.cpp
+++ b/src/tcp_ip/stream.cpp
@@ -61,12 +61,16 @@ namespace TCPIP {
 Stream::Stream(PDU& packet, const timestamp_type& ts) 
 : client_flow_(extract_client_flow(packet)),
   server_flow_(extract_server_flow(packet)), create_time_(ts), 
-  last_seen_(ts), auto_cleanup_client_(true), auto_cleanup_server_(true) {
+  last_seen_(ts), auto_cleanup_client_(true), auto_cleanup_server_(true),
+  is_attached_(false) {
     const EthernetII* eth = packet.find_pdu<EthernetII>();
     if (eth) {
         client_hw_addr_ = eth->src_addr();
         server_hw_addr_ = eth->dst_addr();
     }
+    const TCP& tcp = packet.rfind_pdu<TCP>();
+    // If this is not the first packet of a stream (SYN), then we've attached to it
+    is_attached_ = tcp.flags() != TCP::SYN;
 }
 
 void Stream::process_packet(PDU& packet, const timestamp_type& ts) {
@@ -268,6 +272,10 @@ bool Stream::ack_tracking_enabled() const {
     return client_flow().ack_tracking_enabled() && server_flow().ack_tracking_enabled();
 }
 
+bool Stream::is_attached() const {
+    return is_attached_;
+}
+
 void Stream::on_client_flow_data(const Flow& /*flow*/) {
     if (on_client_data_callback_) {
         on_client_data_callback_(*this);
diff --git a/tests/src/tcp_ip_test.cpp b/tests/src/tcp_ip_test.cpp
index 221541c..718d57e 100644
--- a/tests/src/tcp_ip_test.cpp
+++ b/tests/src/tcp_ip_test.cpp
@@ -376,6 +376,7 @@ TEST_F(FlowTest, StreamFollower_ThreeWayHandshake) {
 
     EXPECT_EQ(Flow::ESTABLISHED, stream.server_flow().state());
     EXPECT_EQ(61U, stream.server_flow().sequence_number());
+    EXPECT_FALSE(stream.is_attached());
 }
 
 TEST_F(FlowTest, StreamFollower_TCPOptions) {
@@ -528,6 +529,9 @@ TEST_F(FlowTest, StreamFollower_AttachToStreams) {
     }
     EXPECT_EQ(packets.size(), stream_client_payload_chunks.size());
     EXPECT_EQ(payload, merge_chunks(stream_client_payload_chunks));
+
+    Stream& stream = follower.find_stream(IPv4Address("1.2.3.4"), 22, IPv4Address("4.3.2.1"), 25);
+    EXPECT_TRUE(stream.is_attached());
 }
 
 TEST_F(FlowTest, StreamFollower_AttachToStreams_PacketsInBothDirections) {