From: Victor Julien <victor@inliniac.net>
Date: Sun, 31 Jan 2016 12:40:07 +0000 (+0100)
Subject: eve: fix stream payload logging wrong direction
X-Git-Tag: suricata-3.0.1RC1~156
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=6152d1abca7af90e01c69873fa38a272456f76b5;p=thirdparty%2Fsuricata.git

eve: fix stream payload logging wrong direction

In the EVE stream payload logging the IPS path logged the wrong dir.
Both IDS and IPS can take the same path as the detection engine
inspects in the same direction in both cases, so the alert is also
generated in the same direction.

Bug #1684
---

diff --git a/src/output-json-alert.c b/src/output-json-alert.c
index 5bfe562857..32ec6c8498 100644
--- a/src/output-json-alert.c
+++ b/src/output-json-alert.c
@@ -275,18 +275,10 @@ static int AlertJson(ThreadVars *tv, JsonAlertLogThread *aft, const Packet *p)
 
                 MemBufferReset(payload);
 
-                if (!EngineModeIsIPS()) {
-                    if (p->flowflags & FLOW_PKT_TOSERVER) {
-                        flag = FLOW_PKT_TOCLIENT;
-                    } else {
-                        flag = FLOW_PKT_TOSERVER;
-                    }
+                if (p->flowflags & FLOW_PKT_TOSERVER) {
+                    flag = FLOW_PKT_TOCLIENT;
                 } else {
-                    if (p->flowflags & FLOW_PKT_TOSERVER) {
-                        flag = FLOW_PKT_TOSERVER;
-                    } else {
-                        flag = FLOW_PKT_TOCLIENT;
-                    }
+                    flag = FLOW_PKT_TOSERVER;
                 }
 
                 StreamSegmentForEach((const Packet *)p, flag,