From 8bc74333b8324e81fc32166353ec341a8b3f0171 Mon Sep 17 00:00:00 2001
From: bol-van <none@none.none>
Date: Tue, 12 Nov 2024 21:49:01 +0300
Subject: [PATCH] nfqws: fallback to unknown proto pos if failed to resolve
 known proto pos

---
 nfq/desync.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/nfq/desync.c b/nfq/desync.c
index 620fbb8..53aba77 100644
--- a/nfq/desync.c
+++ b/nfq/desync.c
@@ -1179,6 +1179,7 @@ static uint8_t dpi_desync_tcp_packet_play(bool replay, size_t reasm_offset, uint
 		{
 			multisplit_count=0;
 			split_pos = ResolvePos(rdata_payload, rlen_payload, l7proto, spos);
+			if (!split_pos) split_pos = dp->split_unknown.pos;
 			DLOG("regular split pos: %zu\n",split_pos);
 			if (!split_pos || split_pos>rlen_payload) split_pos=1;
 			split_pos=pos_normalize(split_pos,reasm_offset,dis->len_payload);