From 71905d3f7e8e781fd69792378a4d0f6fa5958136 Mon Sep 17 00:00:00 2001
From: Thea Rossman <thearossman@gmail.com>
Date: Fri, 26 Jun 2026 14:33:20 -0700
Subject: [PATCH 1/2] run update_body before adding more predicates in compiler

---
 compiler/src/state_filters.rs | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/compiler/src/state_filters.rs b/compiler/src/state_filters.rs
index 1e6e4308..d1ac6a7b 100644
--- a/compiler/src/state_filters.rs
+++ b/compiler/src/state_filters.rs
@@ -244,8 +244,8 @@ fn add_unary_pred(
     };
 
     let mut body: Vec<proc_macro2::TokenStream> = vec![];
-    gen_state_filter_util(&mut body, node, tree, statics, sub, extract_sessions);
     update_body(&mut body, node, sub);
+    gen_state_filter_util(&mut body, node, tree, statics, sub, extract_sessions);
 
     if first_unary {
         code.push(quote! {
@@ -304,8 +304,8 @@ fn add_pred(
     extract_sessions: bool,
 ) {
     let mut body: Vec<proc_macro2::TokenStream> = vec![];
-    gen_state_filter_util(&mut body, node, tree, statics, sub, extract_sessions);
     update_body(&mut body, node, sub);
+    gen_state_filter_util(&mut body, node, tree, statics, sub, extract_sessions);
     if node.if_else {
         code.push(quote! {
             else if #pred_tokenstream {

From 0379bfc6dc184ccf250c3002a5ad85e711d3b8a4 Mon Sep 17 00:00:00 2001
From: Thea Rossman <thearossman@gmail.com>
Date: Thu, 9 Jul 2026 16:08:03 -0700
Subject: [PATCH 2/2] include TLS state in handshake data

---
 core/src/protocols/stream/tls/mod.rs | 19 ++++++++++++++++++-
 1 file changed, 18 insertions(+), 1 deletion(-)

diff --git a/core/src/protocols/stream/tls/mod.rs b/core/src/protocols/stream/tls/mod.rs
index 41776955..ee5809dd 100644
--- a/core/src/protocols/stream/tls/mod.rs
+++ b/core/src/protocols/stream/tls/mod.rs
@@ -9,6 +9,12 @@ use itertools::Itertools;
 use serde::Serialize;
 use tls_parser::{TlsCipherSuite, TlsState};
 
+/// Serializes [`TlsState`] using its `Debug` representation, since the upstream `tls-parser`
+/// crate does not implement `Serialize` for it.
+fn serialize_state<S: serde::Serializer>(state: &TlsState, s: S) -> Result<S::Ok, S::Error> {
+    s.serialize_str(&format!("{:?}", state))
+}
+
 /// GREASE values. See [RFC 8701](https://datatracker.ietf.org/doc/html/rfc8701).
 const GREASE_TABLE: &[u16] = &[
     0x0a0a, 0x1a1a, 0x2a2a, 0x3a3a, 0x4a4a, 0x5a5a, 0x6a6a, 0x7a7a, 0x8a8a, 0x9a9a, 0xaaaa, 0xbaba,
@@ -34,7 +40,7 @@ pub struct Tls {
     pub client_key_exchange: Option<ClientKeyExchange>,
 
     /// TLS state.
-    #[serde(skip)]
+    #[serde(serialize_with = "serialize_state")]
     state: TlsState,
     /// TCP chunks defragmentation buffer. Defragments TCP segments that arrive over multiple
     /// packets.
@@ -139,6 +145,17 @@ impl Tls {
         }
     }
 
+    /// Returns `true` if the handshake state machine encountered an invalid or out-of-order
+    /// message sequence.
+    ///
+    /// ## Remarks
+    /// A handshake can still be fully parsed (e.g. a valid ClientHello/SNI) even if a later
+    /// message renders the overall state invalid, so this should be checked in addition to
+    /// inspecting the parsed handshake contents.
+    pub fn is_invalid(&self) -> bool {
+        self.state == TlsState::Invalid
+    }
+
     /// Returns the name of the server the client is trying to connect to.
     ///
     /// ## Remarks