kerberos: fix probing parser tag condition

according to the comment

(cherry picked from commit cb150e97d09baea09a738388426eafad3cccff2a)

diff --git a/rust/src/krb/krb5.rs b/rust/src/krb/krb5.rs
index 70a0b8e3bf45b0c3e371aaa78aca75c889050053..eb753600db48da7d9c0155342681956d38361bc1 100644 (file)
--- a/rust/src/krb/krb5.rs
+++ b/rust/src/krb/krb5.rs
@@ -445,7 +445,7 @@ pub extern "C" fn rs_krb5_probing_parser(_flow: *const Flow,
             // Kerberos messages start with an APPLICATION header
             if hdr.class != 0b01 { return unsafe{ALPROTO_FAILED}; }
             // Tag number should be <= 30
-            if hdr.tag >= 30 { return unsafe{ALPROTO_FAILED}; }
+            if hdr.tag > 30 { return unsafe{ALPROTO_FAILED}; }
             // Kerberos messages contain sequences
             if rem.is_empty() || rem[0] != 0x30 { return unsafe{ALPROTO_FAILED}; }
             // Check kerberos version