Pull request #5042: appid: add check to avoid setting brute force state for pending...

Merge in SNORT/snort3 from ~AAVILASE/snort3:set_brute_force_only_service_failure to master

Squashed commit of the following:

commit 1b508226cd69b2e38c2d732d52b5f4bf9afe09b8
Author: Andres Avila <aavilase@cisco.com>
Date:   Mon Dec 8 21:07:43 2025 -0500

    appid: add check to avoid setting brute force state for pending sessions that are pruned

diff --git a/src/network_inspectors/appid/service_state.cc b/src/network_inspectors/appid/service_state.cc
index 626d7d99abc28e495612f0d5309e58463ad2ff31..ca256bb79367f69aca73c2693ddce76b733777a2 100644 (file)
--- a/src/network_inspectors/appid/service_state.cc
+++ b/src/network_inspectors/appid/service_state.cc
@@ -190,7 +190,7 @@ void ServiceDiscoveryState::set_service_id_failed(AppIdSession& asd, const SfIp*
     }
     else if ( ( state == ServiceState::SEARCHING_PORT_PATTERN ) and
         ( asd.service_search_state == SESSION_SERVICE_SEARCH_STATE::PENDING ) and
-        asd.service_candidates.empty() and
+        asd.service_candidates.empty() and invalid_delta == 0 and
         !asd.get_session_flags(APPID_SESSION_MID | APPID_SESSION_OOO) )
     {
         if ( ( asd.protocol == IpProtocol::TCP ) or ( asd.protocol == IpProtocol::UDP ) )