diff --git a/nfq2/desync.c b/nfq2/desync.c index c5f818a..2e2d661 100644 --- a/nfq2/desync.c +++ b/nfq2/desync.c @@ -1627,9 +1627,7 @@ static uint8_t dpi_desync_tcp_packet_play( { // likely exceeded packet limit or unlikely out of memory DLOG_ERR("rawpacket_queue failed !\n"); - reasm_client_cancel(ps.ctrack); - ps.l7payload = L7P_UNKNOWN; // middle packet may be not L7P_TLS_CLIENT_HELLO - goto rediscover; + goto reasm_cancel_rediscover; } if (ReasmIsFull(&ps.ctrack->reasm_client)) { @@ -1661,6 +1659,13 @@ pass: pass_reasm_cancel: reasm_client_cancel(ps.ctrack); goto pass; + +reasm_cancel_rediscover: + reasm_client_cancel(ps.ctrack); + rdata_payload = dis->data_payload; + rlen_payload = dis->len_payload; + ps.l7payload = L7P_UNKNOWN; // could be middle packet + goto rediscover; } // return : true - should continue, false - should stop with verdict