Pull request #4495: appid: add new api to check if service is over quic

Merge in SNORT/snort3 from ~SHIBOSE/snort3:quic_white_list to master

Squashed commit of the following:

commit 92bcf5b8b1199b4a135ffa8d664d8603c7fd92f1
Author: shibose <shibose@cisco.com>
Date:   Fri Oct 25 08:13:08 2024 +0000

    appid: add new api to check if service is over quic

diff --git a/src/network_inspectors/appid/appid_session_api.cc b/src/network_inspectors/appid/appid_session_api.cc
index ce106837d325f92ac203797fdc6f8192e4738ec1..2108a6c442f92fc47194e8490c46036364805e8e 100644 (file)
--- a/src/network_inspectors/appid/appid_session_api.cc
+++ b/src/network_inspectors/appid/appid_session_api.cc
@@ -225,6 +225,19 @@ void AppIdSessionApi::get_app_id(AppId* service, AppId* client,
         *referred = get_referred_app_id();
 }
 
+bool AppIdSessionApi::is_service_over_quic() const
+{
+    switch(get_service_app_id())
+    {
+        case APP_ID_HTTP3:
+        case APP_ID_QUIC:
+        case APP_ID_SMB_OVER_QUIC:
+        case APP_ID_DNS_OVER_QUIC:
+            return true;
+    }
+    return false;
+}
+
 bool AppIdSessionApi::is_appid_inspecting_session() const
 {
     if (!asd)

diff --git a/src/network_inspectors/appid/appid_session_api.h b/src/network_inspectors/appid/appid_session_api.h
index 4548021342e90f0d7eeb3caff86113acdea74e01..f160ae1ceaa5df47d76c8717f8871292a44df321 100644 (file)
--- a/src/network_inspectors/appid/appid_session_api.h
+++ b/src/network_inspectors/appid/appid_session_api.h
@@ -133,6 +133,7 @@ public:
     const char* get_netbios_name() const;
     const char* get_netbios_domain() const;
     ClientAppDetectType get_client_app_detect_type() const;
+    bool is_service_over_quic() const;
 
     // For protocols such as HTTP2/HTTP3 which can have multiple streams within a single flow,
     // get_first_stream_* methods return the appids in the first stream seen in a packet.