From 8bc74333b8324e81fc32166353ec341a8b3f0171 Mon Sep 17 00:00:00 2001 From: bol-van <none@none.none> Date: Tue, 12 Nov 2024 21:49:01 +0300 Subject: [PATCH] nfqws: fallback to unknown proto pos if failed to resolve known proto pos --- nfq/desync.c | 1 + 1 file changed, 1 insertion(+) diff --git a/nfq/desync.c b/nfq/desync.c index 620fbb8..53aba77 100644 --- a/nfq/desync.c +++ b/nfq/desync.c @@ -1179,6 +1179,7 @@ static uint8_t dpi_desync_tcp_packet_play(bool replay, size_t reasm_offset, uint { multisplit_count=0; split_pos = ResolvePos(rdata_payload, rlen_payload, l7proto, spos); + if (!split_pos) split_pos = dp->split_unknown.pos; DLOG("regular split pos: %zu\n",split_pos); if (!split_pos || split_pos>rlen_payload) split_pos=1; split_pos=pos_normalize(split_pos,reasm_offset,dis->len_payload);