From 78b766048e5d7c88d164630515e2e0234c21dd82 Mon Sep 17 00:00:00 2001 From: Philippe Antoine Date: Sat, 30 Dec 2023 21:36:07 +0100 Subject: [PATCH] protodetect: run expected probing parser When there is a protocol change, and a specific protocol is expected, like WebSeocket, always run it, no matter the port. --- src/app-layer-detect-proto.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/src/app-layer-detect-proto.c b/src/app-layer-detect-proto.c index 35fc39ced4..c47a437659 100644 --- a/src/app-layer-detect-proto.c +++ b/src/app-layer-detect-proto.c @@ -581,7 +581,10 @@ again_midstream: } } - if (dir == STREAM_TOSERVER && f->alproto_tc != ALPROTO_UNKNOWN) { + if (f->alproto_expect != ALPROTO_UNKNOWN) { + // needed for websocket which does not use ports + pe0 = AppLayerProtoDetectGetProbingParser(alpd_ctx.ctx_pp, ipproto, f->alproto_expect); + } else if (dir == STREAM_TOSERVER && f->alproto_tc != ALPROTO_UNKNOWN) { pe0 = AppLayerProtoDetectGetProbingParser(alpd_ctx.ctx_pp, ipproto, f->alproto_tc); } else if (dir == STREAM_TOCLIENT && f->alproto_ts != ALPROTO_UNKNOWN) { pe0 = AppLayerProtoDetectGetProbingParser(alpd_ctx.ctx_pp, ipproto, f->alproto_ts); -- 2.47.3