protodetect: finish probing parser sooner

Ticket: 7495

We want to finish also if we tested all the expected protocols
in mask, or if we tested even more.

There can be one more protocol coming from pe0, which can be
the protocol already found in the other direction.

(cherry picked from commit b5094b00b6)
pull/12463/head
Philippe Antoine 9 months ago
parent 2be430ec0c
commit a71051d09b

@ -614,7 +614,7 @@ again_midstream:
else if (pp_port_sp) else if (pp_port_sp)
mask = pp_port_sp->alproto_mask; mask = pp_port_sp->alproto_mask;
if (alproto_masks[0] == mask) { if ((alproto_masks[0] & mask) == mask) {
FLOW_SET_PP_DONE(f, dir); FLOW_SET_PP_DONE(f, dir);
SCLogDebug("%s, mask is now %08x, needed %08x, so done", SCLogDebug("%s, mask is now %08x, needed %08x, so done",
(dir == STREAM_TOSERVER) ? "toserver":"toclient", (dir == STREAM_TOSERVER) ? "toserver":"toclient",

Loading…
Cancel
Save