From ad355c3c0acf088adbf6e2a5f8916b33dd1c116a Mon Sep 17 00:00:00 2001 From: Victor Julien Date: Wed, 23 Apr 2014 17:55:24 +0200 Subject: [PATCH] app-layer: improve no payload inspect flag If setting APP_LAYER_PARSER_NO_INSPECTION_PAYLOAD, trigger raw reassembly. --- src/app-layer-parser.c | 1 + 1 file changed, 1 insertion(+) diff --git a/src/app-layer-parser.c b/src/app-layer-parser.c index d36de193c7..24c22d9a75 100644 --- a/src/app-layer-parser.c +++ b/src/app-layer-parser.c @@ -852,6 +852,7 @@ int AppLayerParserParse(AppLayerParserThreadCtx *alp_tctx, Flow *f, AppProto alp /* In cases like HeartBleed for TLS we need to inspect AppLayer but not Payload */ if (pstate->flags & APP_LAYER_PARSER_NO_INSPECTION_PAYLOAD) { FlowSetNoPayloadInspectionFlag(f); + AppLayerParserTriggerRawStreamReassembly(f); } /* next, see if we can get rid of transactions now */