From 78715a5f3f71d1a6f414791833940093b9de368c Mon Sep 17 00:00:00 2001
From: Philippe Antoine <pantoine@oisf.net>
Date: Thu, 19 Dec 2024 11:19:56 +0100
Subject: [PATCH] smtp: recognize if client initiated TLS

Ticket: 7469
---
 src/app-layer-smtp.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/src/app-layer-smtp.c b/src/app-layer-smtp.c
index b2bf22a531..472ef7b040 100644
--- a/src/app-layer-smtp.c
+++ b/src/app-layer-smtp.c
@@ -1699,7 +1699,7 @@ static AppProto SMTPServerProbingParser(
         return ALPROTO_UNKNOWN;
     }
     AppProto r = ALPROTO_UNKNOWN;
-    if (f->todstbytecnt > 4 && f->alproto_ts == ALPROTO_UNKNOWN) {
+    if (f->todstbytecnt > 4 && (f->alproto_ts == ALPROTO_UNKNOWN || f->alproto_ts == ALPROTO_TLS)) {
         // Only validates SMTP if client side is unknown
         // despite having received bytes.
         r = ALPROTO_SMTP;
-- 
2.47.2