DetectAppLayerProtocolData_ Struct Reference

Per-rule keyword data for app-layer-protocol:. More...

#include <detect-app-layer-protocol.h>

Data Fields
AppProto	alproto
bool	negated
bool	exact
bool	is_list
uint8_t	mode
uint8_t *	alprotos

Detailed Description

Per-rule keyword data for app-layer-protocol:.

alprotos is the effective match set: a bitmask (one bit per AppProto, sized g_alproto_max) holding every flow protocol that should match, with the AppProtoEquals() equivalences (or, with the exact option, only the exact values) already expanded in at rule load. The per-packet match is then a single bitmask test. alproto is the first configured value, used as the prefilter bucket key for single-value (prefilterable) rules.

Definition at line 45 of file detect-app-layer-protocol.h.

Field Documentation

alproto

AppProto DetectAppLayerProtocolData_::alproto

first configured value; single-value prefilter key

Definition at line 46 of file detect-app-layer-protocol.h.

alprotos

uint8_t* DetectAppLayerProtocolData_::alprotos

effective match set (g_alproto_max bits)

Definition at line 51 of file detect-app-layer-protocol.h.

exact

bool DetectAppLayerProtocolData_::exact

exact option: strict identity, no equivalences/umbrella

Definition at line 48 of file detect-app-layer-protocol.h.

is_list

bool DetectAppLayerProtocolData_::is_list

more than one value configured (not prefilterable)

Definition at line 49 of file detect-app-layer-protocol.h.

mode

uint8_t DetectAppLayerProtocolData_::mode

Definition at line 50 of file detect-app-layer-protocol.h.

negated

bool DetectAppLayerProtocolData_::negated

Definition at line 47 of file detect-app-layer-protocol.h.

---

The documentation for this struct was generated from the following file:

• src/detect-app-layer-protocol.h