app-layer: add decoder event for missing TLS after STARTTLS

rules/app-layer-events.rules

@@ -10,5 +10,6 @@ alert ip any any -> any any (msg:"SURICATA Applayer Mismatch protocol both direc
 alert ip any any -> any any (msg:"SURICATA Applayer Wrong direction first Data"; flow:established; app-layer-event:applayer_wrong_direction_first_data; flowint:applayer.anomaly.count,+,1; classtype:protocol-command-decode; sid:2260001; rev:1;)
 alert ip any any -> any any (msg:"SURICATA Applayer Detect protocol only one direction"; flow:established; app-layer-event:applayer_detect_protocol_only_one_direction; flowint:applayer.anomaly.count,+,1; classtype:protocol-command-decode; sid:2260002; rev:1;)
 alert ip any any -> any any (msg:"SURICATA Applayer Protocol detection skipped"; flow:established; app-layer-event:applayer_proto_detection_skipped; flowint:applayer.anomaly.count,+,1; classtype:protocol-command-decode; sid:2260003; rev:1;)
+alert ip any any -> any any (msg:"SURICATA Applayer No TLS after STARTTLS"; flow:established; app-layer-event:applayer_no_tls_after_starttls; flowint:applayer.anomaly.count,+,1; classtype:protocol-command-decode; sid:226004; rev:1;)
 
-#next sid is 2260004
+#next sid is 2260005

src/app-layer-events.c

@@ -40,6 +40,8 @@ SCEnumCharMap app_layer_event_pkt_table[ ] = {
       APPLAYER_DETECT_PROTOCOL_ONLY_ONE_DIRECTION },
     { "APPLAYER_PROTO_DETECTION_SKIPPED",
       APPLAYER_PROTO_DETECTION_SKIPPED },
+    { "APPLAYER_NO_TLS_AFTER_STARTTLS",
+      APPLAYER_NO_TLS_AFTER_STARTTLS },
     { NULL,
       -1 },
 };

src/app-layer-events.h

@@ -46,6 +46,7 @@ enum {
     APPLAYER_WRONG_DIRECTION_FIRST_DATA,
     APPLAYER_DETECT_PROTOCOL_ONLY_ONE_DIRECTION,
     APPLAYER_PROTO_DETECTION_SKIPPED,
+    APPLAYER_NO_TLS_AFTER_STARTTLS,
 };
 
 /* the event types for app events */

src/app-layer.c

@@ -574,6 +574,10 @@ int AppLayerHandleTCPData(ThreadVars *tv, TcpReassemblyThreadCtx *ra_ctx,
         }
         SCLogDebug("protocol change, old %s, new %s",
                 AppProtoToString(f->alproto_orig), AppProtoToString(f->alproto));
+        if (f->alproto != ALPROTO_TLS) {
+            AppLayerDecoderEventsSetEventRaw(&p->app_layer_events,
+                                             APPLAYER_NO_TLS_AFTER_STARTTLS);
+        }
     } else {
         SCLogDebug("stream data (len %" PRIu32 " alproto "
                    "%"PRIu16" (flow %p)", data_len, f->alproto, f);