From: Philippe Antoine <contact@catenacyber.fr>
Date: Wed, 17 Feb 2021 13:54:46 +0000 (+0100)
Subject: protodetect: only run ProbingParserTc if STREAM_TOCLIENT
X-Git-Tag: suricata-7.0.0-beta1~1749
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=660e9e489b7d898509946d8a66f15c6107fd5a4e;p=thirdparty%2Fsuricata.git

protodetect: only run ProbingParserTc if STREAM_TOCLIENT
---

diff --git a/src/app-layer-detect-proto.c b/src/app-layer-detect-proto.c
index f659b9b97f..91080a15d4 100644
--- a/src/app-layer-detect-proto.c
+++ b/src/app-layer-detect-proto.c
@@ -477,7 +477,7 @@ static inline AppProto PPGetProto(const AppLayerProtoDetectProbingParserElement
         AppProto alproto = ALPROTO_UNKNOWN;
         if (flags & STREAM_TOSERVER && pe->ProbingParserTs != NULL) {
             alproto = pe->ProbingParserTs(f, flags, buf, buflen, rdir);
-        } else if (pe->ProbingParserTc != NULL) {
+        } else if (flags & STREAM_TOCLIENT && pe->ProbingParserTc != NULL) {
             alproto = pe->ProbingParserTc(f, flags, buf, buflen, rdir);
         }
         if (AppProtoIsValid(alproto)) {