From: Philippe Antoine <contact@catenacyber.fr>
Date: Thu, 11 Mar 2021 15:12:36 +0000 (+0100)
Subject: kerberos: fix probing parser tag condition
X-Git-Tag: suricata-7.0.0-beta1~1721
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=cb150e97d09baea09a738388426eafad3cccff2a;p=thirdparty%2Fsuricata.git

kerberos: fix probing parser tag condition

according to the comment
---

diff --git a/rust/src/krb/krb5.rs b/rust/src/krb/krb5.rs
index 067213abdc..389bbc7b3c 100644
--- a/rust/src/krb/krb5.rs
+++ b/rust/src/krb/krb5.rs
@@ -415,7 +415,7 @@ pub extern "C" fn rs_krb5_probing_parser(_flow: *const Flow,
             // Kerberos messages start with an APPLICATION header
             if hdr.class != BerClass::Application { return unsafe{ALPROTO_FAILED}; }
             // Tag number should be <= 30
-            if hdr.tag.0 >= 30 { return unsafe{ALPROTO_FAILED}; }
+            if hdr.tag.0 > 30 { return unsafe{ALPROTO_FAILED}; }
             // Kerberos messages contain sequences
             if rem.is_empty() || rem[0] != 0x30 { return unsafe{ALPROTO_FAILED}; }
             // Check kerberos version