From: Philippe Antoine <pantoine@oisf.net>
Date: Thu, 16 Jan 2025 08:26:30 +0000 (+0100)
Subject: protodetect: finish probing parser sooner
X-Git-Tag: suricata-7.0.9~46
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=a71051d09b1113e23263a809bf0677776405491c;p=thirdparty%2Fsuricata.git

protodetect: finish probing parser sooner

Ticket: 7495

We want to finish also if we tested all the expected protocols
in mask, or if we tested even more.

There can be one more protocol coming from pe0, which can be
the protocol already found in the other direction.

(cherry picked from commit b5094b00b62ada4d8825f3c45898fc4c5e9d5b1f)
---

diff --git a/src/app-layer-detect-proto.c b/src/app-layer-detect-proto.c
index c7f902edc2..2341ab6fe1 100644
--- a/src/app-layer-detect-proto.c
+++ b/src/app-layer-detect-proto.c
@@ -614,7 +614,7 @@ again_midstream:
         else if (pp_port_sp)
             mask = pp_port_sp->alproto_mask;
 
-        if (alproto_masks[0] == mask) {
+        if ((alproto_masks[0] & mask) == mask) {
             FLOW_SET_PP_DONE(f, dir);
             SCLogDebug("%s, mask is now %08x, needed %08x, so done",
                     (dir == STREAM_TOSERVER) ? "toserver":"toclient",