From: Philippe Antoine <contact@catenacyber.fr>
Date: Wed, 1 Jun 2022 13:04:34 +0000 (+0200)
Subject: event: only sets APPLAYER_UNEXPECTED_PROTOCOL once
X-Git-Tag: suricata-6.0.6~7
X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=ac6cdd973cc17fbd74fa62a30376a8e05334bc14;p=thirdparty%2Fsuricata.git

event: only sets APPLAYER_UNEXPECTED_PROTOCOL once

If f->alproto == ALPROTO_UNKNOWN, we do not know the new protocol
yet, so we do not set the event yet.

(cherry picked from commit e6925300212277a7300f4a3aa9b5c745ee10e0df)
---

diff --git a/src/app-layer.c b/src/app-layer.c
index 08100e240e..e0301b9689 100644
--- a/src/app-layer.c
+++ b/src/app-layer.c
@@ -694,9 +694,8 @@ int AppLayerHandleTCPData(ThreadVars *tv, TcpReassemblyThreadCtx *ra_ctx,
         SCLogDebug("protocol change, old %s, new %s",
                 AppProtoToString(f->alproto_orig), AppProtoToString(f->alproto));
 
-        if (f->alproto_expect != ALPROTO_UNKNOWN &&
-                f->alproto != f->alproto_expect)
-        {
+        if (f->alproto_expect != ALPROTO_UNKNOWN && f->alproto != ALPROTO_UNKNOWN &&
+                f->alproto != f->alproto_expect) {
             AppLayerDecoderEventsSetEventRaw(&p->app_layer_events,
                                              APPLAYER_UNEXPECTED_PROTOCOL);