38 static void DetectAppLayerProtocolRegisterTests(
void);
46 static int DetectAppLayerProtocolPacketMatch(
72 SCLogDebug(
"toserver packet %"PRIu64
": looking for %u/neg %u, got %u",
79 SCLogDebug(
"toclient packet %"PRIu64
": looking for %u/neg %u, got %u",
85 SCLogDebug(
"packet %"PRIu64
": default case: direction %02x, approtos %u/%u/%u",
102 if (strcmp(arg,
"failed") == 0) {
108 "keyword supplied with unknown protocol \"%s\"",
147 "have the rule match on an app layer protocol set through "
148 "other keywords that match on this protocol, or have "
149 "already seen a non-negated app-layer-protocol.");
158 for ( ; tsm != NULL; tsm = tsm->
next) {
162 if (HasConflicts(data, them)) {
164 "positive app-layer-protocol match with negated "
165 "match or match for 'failed'.");
197 if (!PrefilterPacketHeaderExtraMatch(ctx, p)) {
202 if (p->
flow == NULL) {
248 PrefilterPacketAppProtoSet,
249 PrefilterPacketAppProtoCompare,
250 PrefilterPacketAppProtoMatch);
253 static bool PrefilterAppProtoIsPrefilterable(
const Signature *s)
268 DetectAppLayerProtocolPacketMatch;
270 DetectAppLayerProtocolSetup;
272 DetectAppLayerProtocolFree;
275 DetectAppLayerProtocolRegisterTests;
281 PrefilterSetupAppProto;
283 PrefilterAppProtoIsPrefilterable;
291 static int DetectAppLayerProtocolTest01(
void)
297 DetectAppLayerProtocolFree(NULL, data);
301 static int DetectAppLayerProtocolTest02(
void)
307 DetectAppLayerProtocolFree(NULL, data);
311 static int DetectAppLayerProtocolTest03(
void)
320 "(app-layer-protocol:http; sid:1;)");
335 static int DetectAppLayerProtocolTest04(
void)
344 "(app-layer-protocol:!http; sid:1;)");
361 static int DetectAppLayerProtocolTest05(
void)
370 "(app-layer-protocol:!http; app-layer-protocol:!smtp; sid:1;)");
392 static int DetectAppLayerProtocolTest06(
void)
400 "(app-layer-protocol:smtp; sid:1;)");
406 static int DetectAppLayerProtocolTest07(
void)
414 "(app-layer-protocol:!smtp; sid:1;)");
420 static int DetectAppLayerProtocolTest08(
void)
428 "(app-layer-protocol:!smtp; app-layer-protocol:http; sid:1;)");
434 static int DetectAppLayerProtocolTest09(
void)
442 "(app-layer-protocol:http; app-layer-protocol:!smtp; sid:1;)");
448 static int DetectAppLayerProtocolTest10(
void)
456 "(app-layer-protocol:smtp; app-layer-protocol:!http; sid:1;)");
462 static int DetectAppLayerProtocolTest11(
void)
468 DetectAppLayerProtocolFree(NULL, data);
472 static int DetectAppLayerProtocolTest12(
void)
478 DetectAppLayerProtocolFree(NULL, data);
482 static int DetectAppLayerProtocolTest13(
void)
491 "(app-layer-protocol:failed; sid:1;)");
506 static int DetectAppLayerProtocolTest14(
void)
514 "(app-layer-protocol:http; flowbits:set,blah; sid:1;)");
524 "(app-layer-protocol:http; flow:to_client; sid:2;)");
535 "(app-layer-protocol:http; flow:to_client,established; sid:3;)");
554 static void DetectAppLayerProtocolRegisterTests(
void)
557 DetectAppLayerProtocolTest01);
559 DetectAppLayerProtocolTest02);
561 DetectAppLayerProtocolTest03);
563 DetectAppLayerProtocolTest04);
565 DetectAppLayerProtocolTest05);
567 DetectAppLayerProtocolTest06);
569 DetectAppLayerProtocolTest07);
571 DetectAppLayerProtocolTest08);
573 DetectAppLayerProtocolTest09);
575 DetectAppLayerProtocolTest10);
577 DetectAppLayerProtocolTest11);
579 DetectAppLayerProtocolTest12);
581 DetectAppLayerProtocolTest13);
583 DetectAppLayerProtocolTest14);