From: Philippe Antoine <contact@catenacyber.fr>
Date: Wed, 17 Feb 2021 13:54:46 +0000 (+0100)
Subject: protodetect: only run ProbingParserTc if STREAM_TOCLIENT
X-Git-Tag: suricata-6.0.2~8
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=61718deabd1b4fe292bb18e723eb7a5893b95cca;p=thirdparty%2Fsuricata.git

protodetect: only run ProbingParserTc if STREAM_TOCLIENT

(cherry picked from commit 660e9e489b7d898509946d8a66f15c6107fd5a4e)
---

diff --git a/src/app-layer-detect-proto.c b/src/app-layer-detect-proto.c
index 13e2ca219b..f2562d016a 100644
--- a/src/app-layer-detect-proto.c
+++ b/src/app-layer-detect-proto.c
@@ -474,7 +474,7 @@ static inline AppProto PPGetProto(const AppLayerProtoDetectProbingParserElement
         AppProto alproto = ALPROTO_UNKNOWN;
         if (flags & STREAM_TOSERVER && pe->ProbingParserTs != NULL) {
             alproto = pe->ProbingParserTs(f, flags, buf, buflen, rdir);
-        } else if (pe->ProbingParserTc != NULL) {
+        } else if (flags & STREAM_TOCLIENT && pe->ProbingParserTc != NULL) {
             alproto = pe->ProbingParserTc(f, flags, buf, buflen, rdir);
         }
         if (AppProtoIsValid(alproto)) {