From 55ed6c2a55d41155a56efda237b475ff6ed72d54 Mon Sep 17 00:00:00 2001 From: Anoop Saldanha Date: Tue, 22 Nov 2011 02:56:00 +0530 Subject: [PATCH] disable session reassembly for either/both the directions, only when we have established failed proto detection in both the directions --- src/app-layer.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/src/app-layer.c b/src/app-layer.c index b508b5f837..4a19cff935 100644 --- a/src/app-layer.c +++ b/src/app-layer.c @@ -175,17 +175,17 @@ int AppLayerHandleTCPData(AlpProtoDetectThreadCtx *dp_ctx, Flow *f, if (f->flags & FLOW_TS_PM_PP_ALPROTO_DETECT_DONE) { //ssn->flags |= STREAMTCP_FLAG_APPPROTO_DETECTION_COMPLETED; SCLogDebug("ALPROTO_UNKNOWN flow %p", f); - StreamTcpSetSessionNoReassemblyFlag(ssn, 0); } } else { if (f->flags & FLOW_TC_PM_PP_ALPROTO_DETECT_DONE) { //ssn->flags |= STREAMTCP_FLAG_APPPROTO_DETECTION_COMPLETED; SCLogDebug("ALPROTO_UNKNOWN flow %p", f); - StreamTcpSetSessionNoReassemblyFlag(ssn, 1); } } if (f->flags & FLOW_TS_PM_PP_ALPROTO_DETECT_DONE && f->flags & FLOW_TC_PM_PP_ALPROTO_DETECT_DONE) { + StreamTcpSetSessionNoReassemblyFlag(ssn, 0); + StreamTcpSetSessionNoReassemblyFlag(ssn, 1); ssn->flags |= STREAMTCP_FLAG_APPPROTO_DETECTION_COMPLETED; } }