event: only sets APPLAYER_UNEXPECTED_PROTOCOL once

If f->alproto == ALPROTO_UNKNOWN, we do not know the new protocol
yet, so we do not set the event yet.

(cherry picked from commit e6925300212277a7300f4a3aa9b5c745ee10e0df)

diff --git a/src/app-layer.c b/src/app-layer.c
index 08100e240ecd35afae4e24f79bac444d3813d43c..e0301b96891326ade316708e444b609dbad2f70f 100644 (file)
--- a/src/app-layer.c
+++ b/src/app-layer.c
@@ -694,9 +694,8 @@ int AppLayerHandleTCPData(ThreadVars *tv, TcpReassemblyThreadCtx *ra_ctx,
         SCLogDebug("protocol change, old %s, new %s",
                 AppProtoToString(f->alproto_orig), AppProtoToString(f->alproto));
 
-        if (f->alproto_expect != ALPROTO_UNKNOWN &&
-                f->alproto != f->alproto_expect)
-        {
+        if (f->alproto_expect != ALPROTO_UNKNOWN && f->alproto != ALPROTO_UNKNOWN &&
+                f->alproto != f->alproto_expect) {
             AppLayerDecoderEventsSetEventRaw(&p->app_layer_events,
                                              APPLAYER_UNEXPECTED_PROTOCOL);