diff --git a/include/types/proto_tcp.h b/include/types/proto_tcp.h index ce21daefc..f41933b5b 100644 --- a/include/types/proto_tcp.h +++ b/include/types/proto_tcp.h @@ -40,6 +40,7 @@ enum { TCP_ACT_CLOSE, /* close at the sender's */ TCP_ACT_CAPTURE, /* capture a fetched sample */ TCP_ACT_CUSTOM, /* Use for custom registered keywords. */ + TCP_ACT_CUSTOM_CONT, /* Use for custom registered keywords. */ }; struct capture_prm { diff --git a/src/proto_tcp.c b/src/proto_tcp.c index 38883786c..4a4a806d1 100644 --- a/src/proto_tcp.c +++ b/src/proto_tcp.c @@ -1221,8 +1221,10 @@ resume_execution: goto missing_data; } - /* otherwise accept */ - break; + /* accept */ + if (rule->action == TCP_ACT_CUSTOM) + break; + /* otherwise continue */ } } } @@ -1342,8 +1344,10 @@ resume_execution: return 0; } - /* otherwise accept */ - break; + /* accept */ + if (rule->action == TCP_ACT_CUSTOM) + break; + /* otherwise continue */ } } }