app-layer: don't switch dir if proto already known

src/app-layer.c

@@ -399,20 +399,26 @@ static int TCPProtoDetect(ThreadVars *tv,
         TcpSessionSetReassemblyDepth(ssn,
                 AppLayerParserGetStreamDepth(f));
         FlagPacketFlow(p, f, flags);
+
         /* if protocol detection indicated that we need to reverse
          * the direction of the flow, do it now. We flip the flow,
          * packet and the direction flags */
         if (reverse_flow && (ssn->flags & STREAMTCP_FLAG_MIDSTREAM)) {
-            SCLogDebug("reversing flow after proto detect told us so");
+            /* but only if we didn't already detect it on the other side. */
-            PacketSwap(p);
+            if (*alproto_otherdir == ALPROTO_UNKNOWN) {
-            FlowSwap(f);
+                SCLogDebug("reversing flow after proto detect told us so");
-            SWAP_FLAGS(flags, STREAM_TOSERVER, STREAM_TOCLIENT);
+                PacketSwap(p);
-            if (*stream == &ssn->client) {
+                FlowSwap(f);
-                *stream = &ssn->server;
+                SWAP_FLAGS(flags, STREAM_TOSERVER, STREAM_TOCLIENT);
+                if (*stream == &ssn->client) {
+                    *stream = &ssn->server;
+                } else {
+                    *stream = &ssn->client;
+                }
+                direction = 1 - direction;
             } else {
-                *stream = &ssn->client;
+                // TODO event, error?
             }
-            direction = 1 - direction;
         }
 
         /* account flow if we have both sides */