App layer registration cleanup - Support specifying same alproto names in rules for different ip protocols
|Assignee:||Anoop Saldanha||% Done:|
The main goal would be to use same alproto name in rules for app protocols that support various ip carriers.
For example, unify "dcerpc" and "dcerpcudp", into a single "dcerpc". This should allow use of rules in the format.
instead of separate
alert dcerpcudp and alert dcerpc
Also carry out other cleanup work in app layer registration.
#2 Updated by Anoop Saldanha almost 3 years ago
Victor Julien wrote:
What global steps need to be taken for this?
al_proto_table would be an array, the size of the array being the no of supported ip protocols.
On the cleanup side, I'd prefer to get rid of AppLayerLocalMap. Certainly not a necessary feature. ftp parser is the only one using it and our ftp parser is not streaming one and needs an update anyways. ftp parser update + this suggested code cleanup would go hand in hand.