]>
git.ipfire.org Git - thirdparty/suricata.git/commit
detect/app-layer-proto: don't run detection on ALPROTO_UNKNOWN
Don't return true for negated protocol check if no protocol has been
evaluated due to ALPROTO_UNKNOWN in the packet direction.
This leads to false positives for negated matching, as an expression
like "!tls" will match if checked against ALPROTO_UNKNOWN.
This patch readds missing check. The keyword returns no match as
long as the alproto is ALPROTO_UNKNOWN.
Fixes: bf9bbdd61285 ("detect: fix app-layer-protocol keyword for HTTP")
Ticket: #7242.