flow: force reassembly for bypassed flows

As capture method like nfq will cut both side of the flow instantly
we will not get the hack for most data which have been received. So
it is better to force reassembly to be sure to get the timeout of
the entry.
pull/2302/head
Eric Leblond 9 years ago committed by Victor Julien
parent 39c8786a8e
commit 68d9677eea

@ -265,6 +265,16 @@ static int FlowManagerFlowTimedOut(Flow *f, struct timeval *ts)
}
int server = 0, client = 0;
int state = SC_ATOMIC_GET(f->flow_state);
if ((state == FLOW_STATE_LOCAL_BYPASSED) ||
(state == FLOW_STATE_CAPTURE_BYPASSED)) {
if (FlowForceReassemblyNeedReassembly(f, &server, &client) == 1) {
FlowForceReassemblyForFlow(f, server, client);
}
return 1;
}
if (!(f->flags & FLOW_TIMEOUT_REASSEMBLY_DONE) &&
FlowForceReassemblyNeedReassembly(f, &server, &client) == 1) {
FlowForceReassemblyForFlow(f, server, client);

Loading…
Cancel
Save