From 04c9fd9e22450f2fda1d4cef0b1dffeea56a9578 Mon Sep 17 00:00:00 2001 From: Lukas Sismis Date: Tue, 28 Jul 2026 18:08:32 +0200 Subject: [PATCH] detect/firewall: address HTTP/1 policies as http1 AppProtoToString(ALPROTO_HTTP1) returns "http", so an HTTP/1 policy had to be written as `http:` while its rule hooks were already spelled `http1:`. Use the same name in both places. Ticket: 8712 --- doc/userguide/firewall/firewall-design.rst | 2 +- doc/userguide/firewall/firewall-example.rst | 2 +- src/detect-parse.c | 4 ++-- 3 files changed, 4 insertions(+), 4 deletions(-) diff --git a/doc/userguide/firewall/firewall-design.rst b/doc/userguide/firewall/firewall-design.rst index 36951962f8..b795e6bb51 100644 --- a/doc/userguide/firewall/firewall-design.rst +++ b/doc/userguide/firewall/firewall-design.rst @@ -62,7 +62,7 @@ Application layer tables ~~~~~~~~~~~~~~~~~~~~~~~~ If applayer is available, rules from the following tables apply. The tables for the -application layer are per app layer protocol and per protocol state. e.g. ``http:request_line``. +application layer are per app layer protocol and per protocol state. e.g. ``http1:request_line``. .. table:: diff --git a/doc/userguide/firewall/firewall-example.rst b/doc/userguide/firewall/firewall-example.rst index 002de6da7e..a4f6049c86 100644 --- a/doc/userguide/firewall/firewall-example.rst +++ b/doc/userguide/firewall/firewall-example.rst @@ -67,7 +67,7 @@ In the example below: the config auto accepts various hooks, leaving just ``http firewall: policies: - http: + http1: request-started: - "accept:hook" request-line: diff --git a/src/detect-parse.c b/src/detect-parse.c index a0af3fdd99..06c5578773 100644 --- a/src/detect-parse.c +++ b/src/detect-parse.c @@ -4176,7 +4176,7 @@ static int DoParseAppSubStatePolicy(const char *prefix, const AppProto app_proto nname[i] = '-'; } - const char *app_name = AppProtoToString(app_proto); + const char *app_name = AppProtoToStringRaw(app_proto); int r = snprintf(policy_name, sizeof(policy_name), "%s.%s.%s.%s", prefix, app_name, sub_state_name, nname); SCLogDebug("policy_name %s", policy_name); @@ -4245,7 +4245,7 @@ static int DoParseAppPolicy(const char *prefix, const AppProto app_proto, const nname[i] = '-'; } - const char *app_name = AppProtoToString(app_proto); + const char *app_name = AppProtoToStringRaw(app_proto); int r = snprintf(policy_name, sizeof(policy_name), "%s.%s.%s", prefix, app_name, nname); SCFree(nname); if (r < 0 || (size_t)r >= sizeof(policy_name)) {