From ac6cdd973cc17fbd74fa62a30376a8e05334bc14 Mon Sep 17 00:00:00 2001 From: Philippe Antoine Date: Wed, 1 Jun 2022 15:04:34 +0200 Subject: [PATCH] event: only sets APPLAYER_UNEXPECTED_PROTOCOL once If f->alproto == ALPROTO_UNKNOWN, we do not know the new protocol yet, so we do not set the event yet. (cherry picked from commit e6925300212277a7300f4a3aa9b5c745ee10e0df) --- src/app-layer.c | 5 ++--- 1 file changed, 2 insertions(+), 3 deletions(-) diff --git a/src/app-layer.c b/src/app-layer.c index 08100e240e..e0301b9689 100644 --- a/src/app-layer.c +++ b/src/app-layer.c @@ -694,9 +694,8 @@ int AppLayerHandleTCPData(ThreadVars *tv, TcpReassemblyThreadCtx *ra_ctx, SCLogDebug("protocol change, old %s, new %s", AppProtoToString(f->alproto_orig), AppProtoToString(f->alproto)); - if (f->alproto_expect != ALPROTO_UNKNOWN && - f->alproto != f->alproto_expect) - { + if (f->alproto_expect != ALPROTO_UNKNOWN && f->alproto != ALPROTO_UNKNOWN && + f->alproto != f->alproto_expect) { AppLayerDecoderEventsSetEventRaw(&p->app_layer_events, APPLAYER_UNEXPECTED_PROTOCOL); -- 2.47.3