38 static void DetectAppLayerProtocolRegisterTests(
void);
46 static int DetectAppLayerProtocolPacketMatch(
72 SCLogDebug(
"toserver packet %"PRIu64
": looking for %u/neg %u, got %u",
79 SCLogDebug(
"toclient packet %"PRIu64
": looking for %u/neg %u, got %u",
85 SCLogDebug(
"packet %"PRIu64
": default case: direction %02x, approtos %u/%u/%u",
102 if (strcmp(arg,
"failed") == 0) {
108 "keyword supplied with unknown protocol \"%s\"",
148 "have the rule match on an app layer protocol set through "
149 "other keywords that match on this protocol, or have "
150 "already seen a non-negated app-layer-protocol.");
159 for ( ; tsm != NULL; tsm = tsm->
next) {
163 if (HasConflicts(data, them)) {
165 "positive app-layer-protocol match with negated "
166 "match or match for 'failed'.");
177 sm->
ctx = (
void *)data;
202 if (!PrefilterPacketHeaderExtraMatch(ctx, p)) {
207 if (p->
flow == NULL) {
253 PrefilterPacketAppProtoSet,
254 PrefilterPacketAppProtoCompare,
255 PrefilterPacketAppProtoMatch);
258 static bool PrefilterAppProtoIsPrefilterable(
const Signature *s)
273 DetectAppLayerProtocolPacketMatch;
275 DetectAppLayerProtocolSetup;
277 DetectAppLayerProtocolFree;
280 DetectAppLayerProtocolRegisterTests;
286 PrefilterSetupAppProto;
288 PrefilterAppProtoIsPrefilterable;
296 static int DetectAppLayerProtocolTest01(
void)
302 DetectAppLayerProtocolFree(NULL, data);
306 static int DetectAppLayerProtocolTest02(
void)
312 DetectAppLayerProtocolFree(NULL, data);
316 static int DetectAppLayerProtocolTest03(
void)
325 "(app-layer-protocol:http; sid:1;)");
340 static int DetectAppLayerProtocolTest04(
void)
349 "(app-layer-protocol:!http; sid:1;)");
366 static int DetectAppLayerProtocolTest05(
void)
375 "(app-layer-protocol:!http; app-layer-protocol:!smtp; sid:1;)");
397 static int DetectAppLayerProtocolTest06(
void)
405 "(app-layer-protocol:smtp; sid:1;)");
411 static int DetectAppLayerProtocolTest07(
void)
419 "(app-layer-protocol:!smtp; sid:1;)");
425 static int DetectAppLayerProtocolTest08(
void)
433 "(app-layer-protocol:!smtp; app-layer-protocol:http; sid:1;)");
439 static int DetectAppLayerProtocolTest09(
void)
447 "(app-layer-protocol:http; app-layer-protocol:!smtp; sid:1;)");
453 static int DetectAppLayerProtocolTest10(
void)
461 "(app-layer-protocol:smtp; app-layer-protocol:!http; sid:1;)");
467 static int DetectAppLayerProtocolTest11(
void)
473 DetectAppLayerProtocolFree(NULL, data);
477 static int DetectAppLayerProtocolTest12(
void)
483 DetectAppLayerProtocolFree(NULL, data);
487 static int DetectAppLayerProtocolTest13(
void)
496 "(app-layer-protocol:failed; sid:1;)");
511 static int DetectAppLayerProtocolTest14(
void)
519 "(app-layer-protocol:http; flowbits:set,blah; sid:1;)");
529 "(app-layer-protocol:http; flow:to_client; sid:2;)");
540 "(app-layer-protocol:http; flow:to_client,established; sid:3;)");
559 static void DetectAppLayerProtocolRegisterTests(
void)
562 DetectAppLayerProtocolTest01);
564 DetectAppLayerProtocolTest02);
566 DetectAppLayerProtocolTest03);
568 DetectAppLayerProtocolTest04);
570 DetectAppLayerProtocolTest05);
572 DetectAppLayerProtocolTest06);
574 DetectAppLayerProtocolTest07);
576 DetectAppLayerProtocolTest08);
578 DetectAppLayerProtocolTest09);
580 DetectAppLayerProtocolTest10);
582 DetectAppLayerProtocolTest11);
584 DetectAppLayerProtocolTest12);
586 DetectAppLayerProtocolTest13);
588 DetectAppLayerProtocolTest14);