Feature #424
App layer registration cleanup - Support specifying same alproto names in rules for different ip protocols
Description
The main goal would be to use same alproto name in rules for app protocols that support various ip carriers.
For example, unify "dcerpc" and "dcerpcudp", into a single "dcerpc". This should allow use of rules in the format.
alert dcerpc
instead of separate
alert dcerpcudp and alert dcerpc
Also carry out other cleanup work in app layer registration.
History
Updated by Anoop Saldanha about 7 years ago
Victor Julien wrote:
What global steps need to be taken for this?
al_proto_table would be an array, the size of the array being the no of supported ip protocols.
On the cleanup side, I'd prefer to get rid of AppLayerLocalMap. Certainly not a necessary feature. ftp parser is the only one using it and our ftp parser is not streaming one and needs an update anyways. ftp parser update + this suggested code cleanup would go hand in hand.
Updated by Victor Julien about 5 years ago
- Status changed from New to Closed
- % Done changed from 0 to 100