From 449cc82943f434f43987203db9448e431f9efd09 Mon Sep 17 00:00:00 2001 From: Victor Julien Date: Tue, 18 Jan 2022 14:52:13 +0100 Subject: [PATCH] proto-detect: fix UDP not setting alproto_ts/tc This would lead to the `app-layer-protocol` keyword not matching correctly. --- src/app-layer.c | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/src/app-layer.c b/src/app-layer.c index 073a693fb..0996c1643 100644 --- a/src/app-layer.c +++ b/src/app-layer.c @@ -769,6 +769,12 @@ int AppLayerHandleUdp(ThreadVars *tv, AppLayerThreadCtx *tctx, Packet *p, Flow * if (f->alproto != ALPROTO_UNKNOWN) { AppLayerIncFlowCounter(tv, f); + if (p->flowflags & FLOW_PKT_TOSERVER) { + f->alproto_ts = f->alproto; + } else { + f->alproto_tc = f->alproto; + } + if (reverse_flow) { SCLogDebug("reversing flow after proto detect told us so"); PacketSwap(p); -- 2.47.3