Pull request #5011: appid: fix client process regex mapping logic

Merge in SNORT/snort3 from ~BHRYNIV/snort3:fix_eve_process_matching to master

Squashed commit of the following:

commit 20f93fcd90c115c5783b76d0c4f1d6dc62a5efbd
Author: Bohdan Hryniv <bhryniv@cisco>
Date:   Mon Nov 24 11:14:30 2025 -0500

    appid: fix client process regex mapping logic

diff --git a/src/network_inspectors/appid/appid_eve_process_event_handler.cc b/src/network_inspectors/appid/appid_eve_process_event_handler.cc
index c7e25101cec9b4eb6a44c8f56b180cedd9c97fd8..6c6a2f5ee79c2b3f2837bd672725e098b16da203 100644 (file)
--- a/src/network_inspectors/appid/appid_eve_process_event_handler.cc
+++ b/src/network_inspectors/appid/appid_eve_process_event_handler.cc
@@ -106,7 +106,8 @@ void AppIdEveProcessEventHandler::handle(DataEvent& event, Flow* flow)
 
         snort_free(version);
     }
-    else if (!name.empty() and is_client_process_flag)
+
+    if ((client_id == APP_ID_NONE) and !name.empty() and is_client_process_flag)
     {
         client_id = odp_ctxt.get_eve_ca_matchers().match_eve_ca_pattern(name, conf);