Feature #424: App layer registration cleanup - Support specifying same alproto names in rules for different ip protocols - Suricata - Open Information Security Foundation

Feature #424

App layer registration cleanup - Support specifying same alproto names in rules for different ip protocols

Added by Anoop Saldanha over 8 years ago. Updated over 6 years ago.

Status:

Closed

Priority:

Normal

Assignee:

Anoop Saldanha

Target version:

2.0rc1

Effort:

Difficulty:

Label:

Description

The main goal would be to use same alproto name in rules for app protocols that support various ip carriers.

For example, unify "dcerpc" and "dcerpcudp", into a single "dcerpc". This should allow use of rules in the format.

alert dcerpc

instead of separate

alert dcerpcudp and alert dcerpc

Also carry out other cleanup work in app layer registration.

Updated by Victor Julien over 8 years ago

What global steps need to be taken for this?

Updated by Anoop Saldanha over 8 years ago

Victor Julien wrote:

What global steps need to be taken for this?

al_proto_table would be an array, the size of the array being the no of supported ip protocols.

On the cleanup side, I'd prefer to get rid of AppLayerLocalMap. Certainly not a necessary feature. ftp parser is the only one using it and our ftp parser is not streaming one and needs an update anyways. ftp parser update + this suggested code cleanup would go hand in hand.