event: only sets APPLAYER_UNEXPECTED_PROTOCOL once

If f->alproto == ALPROTO_UNKNOWN, we do not know the new protocol
yet, so we do not set the event yet.

diff --git a/src/app-layer.c b/src/app-layer.c
index bd1942e1278ef059254821facc01e74321e72124..e7ac4d2eb3f48ed110f17c3864cc1eb5a7938e7c 100644 (file)
--- a/src/app-layer.c
+++ b/src/app-layer.c
@@ -737,9 +737,8 @@ int AppLayerHandleTCPData(ThreadVars *tv, TcpReassemblyThreadCtx *ra_ctx,
         SCLogDebug("protocol change, old %s, new %s",
                 AppProtoToString(f->alproto_orig), AppProtoToString(f->alproto));
 
-        if (f->alproto_expect != ALPROTO_UNKNOWN &&
-                f->alproto != f->alproto_expect)
-        {
+        if (f->alproto_expect != ALPROTO_UNKNOWN && f->alproto != ALPROTO_UNKNOWN &&
+                f->alproto != f->alproto_expect) {
             AppLayerDecoderEventsSetEventRaw(&p->app_layer_events,
                                              APPLAYER_UNEXPECTED_PROTOCOL);