38 static void DetectAppLayerProtocolRegisterTests(
void);
46 static int DetectAppLayerProtocolPacketMatch(
73 SCLogDebug(
"toserver packet %"PRIu64
": looking for %u/neg %u, got %u",
80 SCLogDebug(
"toclient packet %"PRIu64
": looking for %u/neg %u, got %u",
86 SCLogDebug(
"packet %"PRIu64
": default case: direction %02x, approtos %u/%u/%u",
103 if (strcmp(arg,
"failed") == 0) {
109 "keyword supplied with unknown protocol \"%s\"",
149 "have the rule match on an app layer protocol set through "
150 "other keywords that match on this protocol, or have "
151 "already seen a non-negated app-layer-protocol.");
160 for ( ; tsm != NULL; tsm = tsm->
next) {
164 if (HasConflicts(data, them)) {
166 "positive app-layer-protocol match with negated "
167 "match or match for 'failed'.");
178 sm->
ctx = (
void *)data;
203 if (!PrefilterPacketHeaderExtraMatch(ctx, p)) {
208 if (p->
flow == NULL) {
254 PrefilterPacketAppProtoSet,
255 PrefilterPacketAppProtoCompare,
256 PrefilterPacketAppProtoMatch);
259 static bool PrefilterAppProtoIsPrefilterable(
const Signature *s)
274 DetectAppLayerProtocolPacketMatch;
276 DetectAppLayerProtocolSetup;
278 DetectAppLayerProtocolFree;
281 DetectAppLayerProtocolRegisterTests;
287 PrefilterSetupAppProto;
289 PrefilterAppProtoIsPrefilterable;
297 static int DetectAppLayerProtocolTest01(
void)
303 DetectAppLayerProtocolFree(NULL, data);
307 static int DetectAppLayerProtocolTest02(
void)
313 DetectAppLayerProtocolFree(NULL, data);
317 static int DetectAppLayerProtocolTest03(
void)
326 "(app-layer-protocol:http; sid:1;)");
341 static int DetectAppLayerProtocolTest04(
void)
350 "(app-layer-protocol:!http; sid:1;)");
367 static int DetectAppLayerProtocolTest05(
void)
376 "(app-layer-protocol:!http; app-layer-protocol:!smtp; sid:1;)");
398 static int DetectAppLayerProtocolTest06(
void)
406 "(app-layer-protocol:smtp; sid:1;)");
412 static int DetectAppLayerProtocolTest07(
void)
420 "(app-layer-protocol:!smtp; sid:1;)");
426 static int DetectAppLayerProtocolTest08(
void)
434 "(app-layer-protocol:!smtp; app-layer-protocol:http; sid:1;)");
440 static int DetectAppLayerProtocolTest09(
void)
448 "(app-layer-protocol:http; app-layer-protocol:!smtp; sid:1;)");
454 static int DetectAppLayerProtocolTest10(
void)
462 "(app-layer-protocol:smtp; app-layer-protocol:!http; sid:1;)");
468 static int DetectAppLayerProtocolTest11(
void)
474 DetectAppLayerProtocolFree(NULL, data);
478 static int DetectAppLayerProtocolTest12(
void)
484 DetectAppLayerProtocolFree(NULL, data);
488 static int DetectAppLayerProtocolTest13(
void)
497 "(app-layer-protocol:failed; sid:1;)");
512 static int DetectAppLayerProtocolTest14(
void)
520 "(app-layer-protocol:http; flowbits:set,blah; sid:1;)");
530 "(app-layer-protocol:http; flow:to_client; sid:2;)");
541 "(app-layer-protocol:http; flow:to_client,established; sid:3;)");
560 static void DetectAppLayerProtocolRegisterTests(
void)
563 DetectAppLayerProtocolTest01);
565 DetectAppLayerProtocolTest02);
567 DetectAppLayerProtocolTest03);
569 DetectAppLayerProtocolTest04);
571 DetectAppLayerProtocolTest05);
573 DetectAppLayerProtocolTest06);
575 DetectAppLayerProtocolTest07);
577 DetectAppLayerProtocolTest08);
579 DetectAppLayerProtocolTest09);
581 DetectAppLayerProtocolTest10);
583 DetectAppLayerProtocolTest11);
585 DetectAppLayerProtocolTest12);
587 DetectAppLayerProtocolTest13);
589 DetectAppLayerProtocolTest14);