From 629a16e3733dd577822d0c82d2e81cbeb3b9a4d2 Mon Sep 17 00:00:00 2001
From: Philippe Antoine <contact@catenacyber.fr>
Date: Fri, 19 Jun 2020 11:53:16 +0200
Subject: [PATCH] dnp3: probing parser fixes direction based on dnp3 header

---
 src/app-layer-dnp3.c | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/src/app-layer-dnp3.c b/src/app-layer-dnp3.c
index be682bb019..c1ce7898f0 100644
--- a/src/app-layer-dnp3.c
+++ b/src/app-layer-dnp3.c
@@ -298,6 +298,11 @@ static uint16_t DNP3ProbingParser(Flow *f, uint8_t direction,
     }
 
 end:
+    // Test compatibility between direction and dnp3.ctl.direction
+    if ((DNP3_LINK_DIR(hdr->control) != 0) ^
+        ((direction & STREAM_TOCLIENT) != 0)) {
+        *rdir = 1;
+    }
     SCLogDebug("Detected DNP3.");
     return ALPROTO_DNP3;
 }