app-layer: don't switch dir if proto already known

diff --git a/src/app-layer.c b/src/app-layer.c
index 4e64b3eb0266b7a921ab43cfccd99cd788b03ebc..c7651f571adab942ba7b0aa9d7ee9b4585839643 100644 (file)
--- a/src/app-layer.c
+++ b/src/app-layer.c
@@ -399,20 +399,26 @@ static int TCPProtoDetect(ThreadVars *tv,
         TcpSessionSetReassemblyDepth(ssn,
                 AppLayerParserGetStreamDepth(f));
         FlagPacketFlow(p, f, flags);
+
         /* if protocol detection indicated that we need to reverse
          * the direction of the flow, do it now. We flip the flow,
          * packet and the direction flags */
         if (reverse_flow && (ssn->flags & STREAMTCP_FLAG_MIDSTREAM)) {
-            SCLogDebug("reversing flow after proto detect told us so");
-            PacketSwap(p);
-            FlowSwap(f);
-            SWAP_FLAGS(flags, STREAM_TOSERVER, STREAM_TOCLIENT);
-            if (*stream == &ssn->client) {
-                *stream = &ssn->server;
+            /* but only if we didn't already detect it on the other side. */
+            if (*alproto_otherdir == ALPROTO_UNKNOWN) {
+                SCLogDebug("reversing flow after proto detect told us so");
+                PacketSwap(p);
+                FlowSwap(f);
+                SWAP_FLAGS(flags, STREAM_TOSERVER, STREAM_TOCLIENT);
+                if (*stream == &ssn->client) {
+                    *stream = &ssn->server;
+                } else {
+                    *stream = &ssn->client;
+                }
+                direction = 1 - direction;
             } else {
-                *stream = &ssn->client;
+                // TODO event, error?
             }
-            direction = 1 - direction;
         }
 
         /* account flow if we have both sides */