37 static void DetectAppLayerProtocolRegisterTests(
void);
40 static int DetectAppLayerProtocolPacketMatch(
67 SCLogDebug(
"toserver packet %"PRIu64
": looking for %u/neg %u, got %u",
74 SCLogDebug(
"toclient packet %"PRIu64
": looking for %u/neg %u, got %u",
80 SCLogDebug(
"packet %"PRIu64
": default case: direction %02x, approtos %u/%u/%u",
97 if (strcmp(arg,
"failed") == 0) {
103 "keyword supplied with unknown protocol \"%s\"", arg);
142 "have the rule match on an app layer protocol set through "
143 "other keywords that match on this protocol, or have "
144 "already seen a non-negated app-layer-protocol.");
153 for ( ; tsm != NULL; tsm = tsm->
next) {
157 if (HasConflicts(data, them)) {
159 "positive app-layer-protocol match with negated "
160 "match or match for 'failed'.");
171 sm->
ctx = (
void *)data;
196 if (!PrefilterPacketHeaderExtraMatch(ctx, p)) {
201 if (p->
flow == NULL) {
247 PrefilterPacketAppProtoSet,
248 PrefilterPacketAppProtoCompare,
249 PrefilterPacketAppProtoMatch);
252 static bool PrefilterAppProtoIsPrefilterable(
const Signature *s)
267 DetectAppLayerProtocolPacketMatch;
269 DetectAppLayerProtocolSetup;
271 DetectAppLayerProtocolFree;
274 DetectAppLayerProtocolRegisterTests;
280 PrefilterSetupAppProto;
282 PrefilterAppProtoIsPrefilterable;
290 static int DetectAppLayerProtocolTest01(
void)
296 DetectAppLayerProtocolFree(NULL, data);
300 static int DetectAppLayerProtocolTest02(
void)
306 DetectAppLayerProtocolFree(NULL, data);
310 static int DetectAppLayerProtocolTest03(
void)
319 "(app-layer-protocol:http; sid:1;)");
334 static int DetectAppLayerProtocolTest04(
void)
343 "(app-layer-protocol:!http; sid:1;)");
360 static int DetectAppLayerProtocolTest05(
void)
369 "(app-layer-protocol:!http; app-layer-protocol:!smtp; sid:1;)");
391 static int DetectAppLayerProtocolTest06(
void)
399 "(app-layer-protocol:smtp; sid:1;)");
405 static int DetectAppLayerProtocolTest07(
void)
413 "(app-layer-protocol:!smtp; sid:1;)");
419 static int DetectAppLayerProtocolTest08(
void)
427 "(app-layer-protocol:!smtp; app-layer-protocol:http; sid:1;)");
433 static int DetectAppLayerProtocolTest09(
void)
441 "(app-layer-protocol:http; app-layer-protocol:!smtp; sid:1;)");
447 static int DetectAppLayerProtocolTest10(
void)
455 "(app-layer-protocol:smtp; app-layer-protocol:!http; sid:1;)");
461 static int DetectAppLayerProtocolTest11(
void)
467 DetectAppLayerProtocolFree(NULL, data);
471 static int DetectAppLayerProtocolTest12(
void)
477 DetectAppLayerProtocolFree(NULL, data);
481 static int DetectAppLayerProtocolTest13(
void)
490 "(app-layer-protocol:failed; sid:1;)");
505 static int DetectAppLayerProtocolTest14(
void)
513 "(app-layer-protocol:http; flowbits:set,blah; sid:1;)");
523 "(app-layer-protocol:http; flow:to_client; sid:2;)");
534 "(app-layer-protocol:http; flow:to_client,established; sid:3;)");
553 static void DetectAppLayerProtocolRegisterTests(
void)
556 DetectAppLayerProtocolTest01);
558 DetectAppLayerProtocolTest02);
560 DetectAppLayerProtocolTest03);
562 DetectAppLayerProtocolTest04);
564 DetectAppLayerProtocolTest05);
566 DetectAppLayerProtocolTest06);
568 DetectAppLayerProtocolTest07);
570 DetectAppLayerProtocolTest08);
572 DetectAppLayerProtocolTest09);
574 DetectAppLayerProtocolTest10);
576 DetectAppLayerProtocolTest11);
578 DetectAppLayerProtocolTest12);
580 DetectAppLayerProtocolTest13);
582 DetectAppLayerProtocolTest14);