mirror of https://github.com/OISF/suricata
You cannot select more than 25 topics
Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.
353885acc2
Extend the app-layer-protocol keyword to accept a pipe-separated list of
protocol values, so a single rule can match any of several protocols:
app-layer-protocol:[!]<proto1>|<proto2>[|...][,<qualifier>]...;
A non-negated list matches when the flow's protocol equals any listed value
(OR); a negated list matches when it equals none of them (NOR). The
single-value form and the trailing mode qualifier are unchanged.
Matching keeps the historical AppProtoEquals() equivalences by default
(dns/doh2, http/http1/http2, dcerpc/smb, ...). An `exact` qualifier selects
strict identity matching with no equivalences and no http umbrella; it
combines with a direction mode in any order. Because a flow is never the
generic ALPROTO_HTTP, `http,exact` is rejected at load.
Values are expanded once at rule load into an effective match-set bitmask, so
the per-packet match is a single bitmask test. Single-value rules remain
prefilterable; multi-value rules are excluded from prefiltering and an
explicit prefilter on them is rejected. Conflicting keyword combinations
(duplicate or overlapping negations, mixed positive/negated) are rejected at
load. Engine-analysis reports the effective match set.
Ticket: 7705
(cherry picked from commit
|
4 days ago | |
|---|---|---|
| .. | ||
| dataset-examples | 4 years ago | |
| dns-keywords | ||
| fast-pattern | ||
| flow-keywords | 6 years ago | |
| header-keywords | 9 years ago | |
| http-keywords | 6 years ago | |
| intro | 9 years ago | |
| normalized-buffers | ||
| payload-keywords | 7 months ago | |
| pcre | 9 years ago | |
| rule-types | 2 years ago | |
| app-layer.rst | 4 days ago | |
| base64-keywords.rst | 2 years ago | |
| bypass-keyword.rst | 1 year ago | |
| config.rst | 1 year ago | |
| datasets.rst | 3 weeks ago | |
| dcerpc-keywords.rst | 6 months ago | |
| decode-layer.rst | 2 years ago | |
| dhcp-keywords.rst | 3 years ago | |
| differences-from-snort.rst | 2 years ago | |
| dnp3-keywords.rst | 7 years ago | |
| dns-keywords.rst | 1 year ago | |
| email-keywords.rst | 1 year ago | |
| enip-keyword.rst | 2 years ago | |
| fast-pattern-explained.rst | 3 years ago | |
| file-keywords.rst | 3 years ago | |
| flow-keywords.rst | 3 months ago | |
| ftp-keywords.rst | 2 months ago | |
| header-keywords.rst | 6 months ago | |
| http-keywords.rst | 1 year ago | |
| http2-keywords.rst | 2 years ago | |
| ike-keywords.rst | 3 years ago | |
| index.rst | 4 months ago | |
| integer-keywords.rst | 1 year ago | |
| intro.rst | 11 months ago | |
| ip-reputation-rules.rst | 2 years ago | |
| ipaddr.rst | 4 years ago | |
| ja-keywords.rst | 2 years ago | |
| kerberos-keywords.rst | 3 years ago | |
| ldap-keywords.rst | 1 year ago | |
| lua-detection.rst | 1 year ago | |
| mdns-keywords.rst | 1 year ago | |
| meta.rst | 1 year ago | |
| modbus-keyword.rst | 8 years ago | |
| mqtt-keywords.rst | 2 years ago | |
| multi-buffer-matching.rst | 1 year ago | |
| nfs-keywords.rst | 3 years ago | |
| noalert.rst | 2 years ago | |
| ntp-keywords.rst | 4 months ago | |
| payload-keywords.rst | 2 weeks ago | |
| pgsql-keywords.rst | 1 year ago | |
| prefilter-keywords.rst | 7 years ago | |
| quic-keywords.rst | 3 years ago | |
| rfb-keywords.rst | 2 years ago | |
| rule-types.rst | 12 months ago | |
| rules-internals.rst | 1 year ago | |
| sdp-keywords.rst | 1 year ago | |
| sip-keywords.rst | 2 years ago | |
| smb-keywords.rst | 3 years ago | |
| smtp-keywords.rst | 2 years ago | |
| snmp-keywords.rst | 5 months ago | |
| ssh-keywords.rst | 11 months ago | |
| tag.rst | 3 years ago | |
| thresholding.rst | 2 years ago | |
| tls-keywords.rst | 9 months ago | |
| transforms.rst | 6 months ago | |
| vlan-keywords.rst | 2 years ago | |
| websocket-keywords.rst | 2 years ago | |
| xbits.rst | 11 months ago | |