From: Victor Julien <victor@inliniac.net>
Date: Wed, 23 Apr 2014 15:55:24 +0000 (+0200)
Subject: app-layer: improve no payload inspect flag
X-Git-Tag: suricata-2.0.1rc1~8
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=ad355c3c0acf088adbf6e2a5f8916b33dd1c116a;p=thirdparty%2Fsuricata.git

app-layer: improve no payload inspect flag

If setting APP_LAYER_PARSER_NO_INSPECTION_PAYLOAD, trigger raw
reassembly.
---

diff --git a/src/app-layer-parser.c b/src/app-layer-parser.c
index d36de193c7..24c22d9a75 100644
--- a/src/app-layer-parser.c
+++ b/src/app-layer-parser.c
@@ -852,6 +852,7 @@ int AppLayerParserParse(AppLayerParserThreadCtx *alp_tctx, Flow *f, AppProto alp
     /* In cases like HeartBleed for TLS we need to inspect AppLayer but not Payload */
     if (pstate->flags & APP_LAYER_PARSER_NO_INSPECTION_PAYLOAD) {
         FlowSetNoPayloadInspectionFlag(f);
+        AppLayerParserTriggerRawStreamReassembly(f);
     }
 
     /* next, see if we can get rid of transactions now */