]> git.ipfire.org Git - thirdparty/suricata.git/commit
detect/app-layer-proto: don't run detection on ALPROTO_UNKNOWN
authorVictor Julien <vjulien@oisf.net>
Fri, 6 Sep 2024 09:21:48 +0000 (11:21 +0200)
committerVictor Julien <vjulien@oisf.net>
Wed, 11 Sep 2024 08:12:50 +0000 (10:12 +0200)
commit9d922af7c1fbb70c940d9d2787cc2a44c0bec5d8
tree812120ae544634c285275a274e5968262862268e
parent98fd40a4b3fd833df245ce44bcf879f6186418eb
detect/app-layer-proto: don't run detection on ALPROTO_UNKNOWN

Don't return true for negated protocol check if no protocol has been
evaluated due to ALPROTO_UNKNOWN in the packet direction.

This leads to false positives for negated matching, as an expression
like "!tls" will match if checked against ALPROTO_UNKNOWN.

This patch readds missing check. The keyword returns no match as
long as the alproto is ALPROTO_UNKNOWN.

Fixes: bf9bbdd61285 ("detect: fix app-layer-protocol keyword for HTTP")
Ticket: #7242.
src/detect-app-layer-protocol.c