From ef6adfb0720e0d5dd7bbc7d488f1e1c920bef75b Mon Sep 17 00:00:00 2001
From: Jeff Lucovsky <jlucovsky@oisf.net>
Date: Tue, 18 Jun 2024 09:45:06 -0400
Subject: [PATCH 1/3] af-packet: Remove unused preprocessor define

Remove unused preprocessor value; exposed by compilation warning
---
 src/source-af-packet.c | 1 -
 1 file changed, 1 deletion(-)

diff --git a/src/source-af-packet.c b/src/source-af-packet.c
index 09cb554e10ea..f4614bf9f4b9 100644
--- a/src/source-af-packet.c
+++ b/src/source-af-packet.c
@@ -257,7 +257,6 @@ static int AFPBypassCallback(Packet *p);
 static int AFPXDPBypassCallback(Packet *p);
 #endif
 
-#define MAX_MAPS 32
 /**
  * \brief Structure to hold thread specific variables.
  */

From 88ca08094d33ef729ad7de1783d1e3001818984a Mon Sep 17 00:00:00 2001
From: Philippe Antoine <pantoine@oisf.net>
Date: Wed, 19 Jun 2024 13:39:08 +0200
Subject: [PATCH 2/3] detect: fix check for app_layer events

Ticket: 7106
---
 src/detect-engine-build.c | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/src/detect-engine-build.c b/src/detect-engine-build.c
index f4bc4b653bef..8f292025a360 100644
--- a/src/detect-engine-build.c
+++ b/src/detect-engine-build.c
@@ -37,6 +37,7 @@
 #include "detect-flow.h"
 #include "detect-config.h"
 #include "detect-flowbits.h"
+#include "app-layer-events.h"
 
 #include "util-port-interval-tree.h"
 #include "util-profiling.h"
@@ -420,7 +421,8 @@ PacketCreateMask(Packet *p, SignatureMask *mask, AppProto alproto,
         (*mask) |= SIG_MASK_REQUIRE_NO_PAYLOAD;
     }
 
-    if (p->events.cnt > 0 || app_decoder_events != 0 || p->app_layer_events != NULL) {
+    if (p->events.cnt > 0 || app_decoder_events != 0 ||
+            (p->app_layer_events != NULL && p->app_layer_events->cnt)) {
         SCLogDebug("packet/flow has events set");
         (*mask) |= SIG_MASK_REQUIRE_ENGINE_EVENT;
     }

From 863d67cd9089296fee33ec7ccc1e537f0d1f4da6 Mon Sep 17 00:00:00 2001
From: Philippe Antoine <pantoine@oisf.net>
Date: Wed, 19 Jun 2024 13:42:32 +0200
Subject: [PATCH 3/3] detect: add to signature mask for decode events

Ticket: 6291
---
 src/detect-engine-build.c | 7 +++++--
 1 file changed, 5 insertions(+), 2 deletions(-)

diff --git a/src/detect-engine-build.c b/src/detect-engine-build.c
index 8f292025a360..f69def1c7d54 100644
--- a/src/detect-engine-build.c
+++ b/src/detect-engine-build.c
@@ -536,9 +536,12 @@ static int SignatureCreateMask(Signature *s)
                 }
                 break;
             }
+            case DETECT_DECODE_EVENT:
+                // fallthrough
+            case DETECT_STREAM_EVENT:
+                // fallthrough
             case DETECT_AL_APP_LAYER_EVENT:
-                s->mask |= SIG_MASK_REQUIRE_ENGINE_EVENT;
-                break;
+                // fallthrough
             case DETECT_ENGINE_EVENT:
                 s->mask |= SIG_MASK_REQUIRE_ENGINE_EVENT;
                 break;