eve: stamp the NFS records in the flow direction

Txs flushed by the synthetic flow-timeout pseudo packets at flow end
carry no wire direction, and the NFS eve log normalized them - and only
them - to the flow direction, while a record completed on a real packet
kept the packet direction. One flow then logged the same transaction
under two directions, which no other app-layer does: SMB, HTTP and DNS
all normalize every record. A gapped v3 READ file tx whose last reply
never arrives shows it: logged on the response side, unreachable by
request-side (dest port 2049) filters.

Normalize on the flow direction for every NFS record and drop the FFR
conditional. The v3 pins move with it, since the request and its reply
now agree on the record.

Ticket: #9265.

doc/userguide/upgrade.rst

@@ -127,6 +127,11 @@ Logging Changes
   ``client_hello_done`` is now ``client_hello``). See
   :doc:`firewall/tls-state-migration` for the old-to-new mapping.
 
+- NFS eve records are now logged in the flow direction, like SMB, HTTP and
+  DNS records: a record completed on a reply carries the client as
+  ``src_ip``/``src_port`` where 8.x logged the packet's addresses. Filters
+  that matched responses on ``src_port 2049`` need ``dest_port 2049`` now.
+
 Removals
 ~~~~~~~~
 

src/output-json-nfs.c

@@ -79,7 +79,11 @@ static int JsonNFSLogger(ThreadVars *tv, void *thread_data,
     if (SCNfsTxLoggingIsFiltered(state, nfstx))
         return TM_ECODE_OK;
 
-    SCJsonBuilder *jb = CreateEveHeader(p, LOG_DIR_PACKET, "nfs", NULL, thread->ctx);
+    /* Log in the flow (request) direction, as SMB, HTTP and DNS do. A record
+     * is stamped once, when the tx ends, so with the packet direction the same
+     * flow would report its txs in both directions: toclient for the txs a real
+     * reply completed, toserver for the ones the flow-timeout flush ended. */
+    SCJsonBuilder *jb = CreateEveHeader(p, LOG_DIR_FLOW, "nfs", NULL, thread->ctx);
     if (unlikely(jb == NULL)) {
         return TM_ECODE_OK;
     }