]> git.ipfire.org Git - thirdparty/suricata.git/commitdiff
protodetect: make expectation_proto part of AppLayerProtoDetectCtx
authorPhilippe Antoine <pantoine@oisf.net>
Mon, 2 Sep 2024 08:28:04 +0000 (10:28 +0200)
committerVictor Julien <victor@inliniac.net>
Wed, 8 Jan 2025 16:06:13 +0000 (17:06 +0100)
instead of a global variable.

For easier initialization with dynamic number of protocols

src/app-layer-detect-proto.c

index a65a98c88a41a1c7a1aaaee8c966cd2932f9df95..dd17b560c5fb23df5c6a0670e9d1eec7b2eb4fc8 100644 (file)
@@ -160,6 +160,9 @@ typedef struct AppLayerProtoDetectCtx_ {
      * for protocol detection.  This table is independent of the
      * ipproto. */
     const char *alproto_names[ALPROTO_MAX];
+
+    /* Protocol expectations, like ftp-data on tcp */
+    uint8_t expectation_proto[ALPROTO_MAX];
 } AppLayerProtoDetectCtx;
 
 typedef struct AppLayerProtoDetectAliases_ {
@@ -2111,27 +2114,25 @@ void AppLayerProtoDetectSupportedAppProtocols(AppProto *alprotos)
     SCReturn;
 }
 
-uint8_t expectation_proto[ALPROTO_MAX];
-
 static void AppLayerProtoDetectPEGetIpprotos(AppProto alproto,
                                              uint8_t *ipprotos)
 {
-    if (expectation_proto[alproto] == IPPROTO_TCP) {
+    if (alpd_ctx.expectation_proto[alproto] == IPPROTO_TCP) {
         ipprotos[IPPROTO_TCP / 8] |= 1 << (IPPROTO_TCP % 8);
     }
-    if (expectation_proto[alproto] == IPPROTO_UDP) {
+    if (alpd_ctx.expectation_proto[alproto] == IPPROTO_UDP) {
         ipprotos[IPPROTO_UDP / 8] |= 1 << (IPPROTO_UDP % 8);
     }
 }
 
 void AppLayerRegisterExpectationProto(uint8_t proto, AppProto alproto)
 {
-    if (expectation_proto[alproto]) {
-        if (proto != expectation_proto[alproto]) {
+    if (alpd_ctx.expectation_proto[alproto]) {
+        if (proto != alpd_ctx.expectation_proto[alproto]) {
             SCLogError("Expectation on 2 IP protocols are not supported");
         }
     }
-    expectation_proto[alproto] = proto;
+    alpd_ctx.expectation_proto[alproto] = proto;
 }
 
 /***** Unittests *****/