]> git.ipfire.org Git - thirdparty/suricata.git/commitdiff
protodetect: finish probing parser sooner 12463/head
authorPhilippe Antoine <pantoine@oisf.net>
Thu, 16 Jan 2025 08:26:30 +0000 (09:26 +0100)
committerPhilippe Antoine <pantoine@oisf.net>
Thu, 23 Jan 2025 20:41:06 +0000 (21:41 +0100)
Ticket: 7495

We want to finish also if we tested all the expected protocols
in mask, or if we tested even more.

There can be one more protocol coming from pe0, which can be
the protocol already found in the other direction.

(cherry picked from commit b5094b00b62ada4d8825f3c45898fc4c5e9d5b1f)

src/app-layer-detect-proto.c

index c7f902edc22f2d126c5f0f98efec1e70b04a8ec2..2341ab6fe14015a203e684945cf19f88d00fab76 100644 (file)
@@ -614,7 +614,7 @@ again_midstream:
         else if (pp_port_sp)
             mask = pp_port_sp->alproto_mask;
 
-        if (alproto_masks[0] == mask) {
+        if ((alproto_masks[0] & mask) == mask) {
             FLOW_SET_PP_DONE(f, dir);
             SCLogDebug("%s, mask is now %08x, needed %08x, so done",
                     (dir == STREAM_TOSERVER) ? "toserver":"toclient",