]> git.ipfire.org Git - thirdparty/suricata.git/commitdiff
app layer: uint16_t alproto -> AppProto alproto
authorVictor Julien <victor@inliniac.net>
Thu, 9 Jan 2014 10:32:40 +0000 (11:32 +0100)
committerVictor Julien <victor@inliniac.net>
Fri, 10 Jan 2014 10:53:41 +0000 (11:53 +0100)
This conversion was missing in a couple of places.

22 files changed:
src/app-layer-detect-proto.c
src/app-layer-dns-common.c
src/app-layer-dns-common.h
src/app-layer-parser.c
src/app-layer-parser.h
src/app-layer-smb.c
src/app-layer.c
src/detect-app-layer-event.c
src/detect-app-layer-event.h
src/detect-app-layer-protocol.c
src/detect-app-layer-protocol.h
src/detect-engine-apt-event.c
src/detect-engine-state.c
src/detect-engine-state.h
src/detect-engine.c
src/detect-engine.h
src/detect-parse.c
src/detect-parse.h
src/detect-simd.c
src/detect.c
src/detect.h
src/flow.h

index 8359e46fba45e643b8a6ce02a42cd099e51be421..d98e1b9fd9864d53d51bed1f72f27c6f67c36863 100644 (file)
@@ -65,7 +65,7 @@
 #include "runmodes.h"
 
 typedef struct AppLayerProtoDetectProbingParserElement_ {
-    uint16_t alproto;
+    AppProto alproto;
     /* \todo don't really need it.  See if you can get rid of it */
     uint16_t port;
     /* \todo calculate at runtime and get rid of this var */
@@ -388,7 +388,7 @@ static void AppLayerProtoDetectPPGetIpprotos(AppProto alproto,
     SCReturn;
 }
 
-static uint32_t AppLayerProtoDetectProbingParserGetMask(uint16_t alproto)
+static uint32_t AppLayerProtoDetectProbingParserGetMask(AppProto alproto)
 {
     SCEnter();
 
@@ -490,7 +490,7 @@ static inline void DeAllocAppLayerProtoDetectProbingParser(AppLayerProtoDetectPr
 }
 
 static AppLayerProtoDetectProbingParserElement *
-AppLayerProtoDetectCreateAppLayerProtoDetectProbingParserElement(uint16_t alproto,
+AppLayerProtoDetectCreateAppLayerProtoDetectProbingParserElement(AppProto alproto,
                                                                  uint16_t port,
                                                                  uint16_t min_depth,
                                                                  uint16_t max_depth,
@@ -752,7 +752,7 @@ static inline void AppendAppLayerProtoDetectProbingParserPort(AppLayerProtoDetec
 static inline void AppLayerProtoDetectInsertNewProbingParser(AppLayerProtoDetectProbingParser **pp,
                                                              uint16_t ip_proto,
                                                              uint16_t port,
-                                                             uint16_t alproto,
+                                                             AppProto alproto,
                                                              uint16_t min_depth, uint16_t max_depth,
                                                              uint8_t direction,
                                                              ProbingParserFPtr ProbingParser)
@@ -1153,7 +1153,7 @@ static int AppLayerProtoDetectPMAddSignature(AppLayerProtoDetectPMCtx *ctx, Dete
     SCReturnInt(ret);
 }
 
-static int AppLayerProtoDetectPMRegisterPattern(uint8_t ipproto, uint16_t alproto,
+static int AppLayerProtoDetectPMRegisterPattern(uint8_t ipproto, AppProto alproto,
                                                 char *pattern,
                                                 uint16_t depth, uint16_t offset,
                                                 uint8_t direction,
@@ -1286,7 +1286,7 @@ int AppLayerProtoDetectPrepareState(void)
 
 void AppLayerProtoDetectPPRegister(uint8_t ipproto,
                                    char *portstr,
-                                   uint16_t alproto,
+                                   AppProto alproto,
                                    uint16_t min_depth, uint16_t max_depth,
                                    uint8_t direction,
                                    ProbingParserFPtr ProbingParser)
@@ -2676,7 +2676,7 @@ int AppLayerProtoDetectTest14(void)
 
 typedef struct AppLayerProtoDetectPPTestDataElement_ {
     char *alproto_name;
-    uint16_t alproto;
+    AppProto alproto;
     uint16_t port;
     uint32_t alproto_mask;
     uint32_t min_depth;
index 28df0130e8ab12e62af3fdbece0a9757d908bd77..e07920d755d25f103f260e7b884e5d33b3b5571c 100644 (file)
@@ -69,7 +69,7 @@ int DNSStateGetEventInfo(const char *event_name,
     return 0;
 }
 
-void DNSAppLayerRegisterGetEventInfo(uint8_t ipproto, uint16_t alproto)
+void DNSAppLayerRegisterGetEventInfo(uint8_t ipproto, AppProto alproto)
 {
     AppLayerParserRegisterGetEventInfo(ipproto, alproto, DNSStateGetEventInfo);
 
index 6e42cf02f59572e60d525c35d492f29ec587bcda..6fb13c8f2e05d8c28cc300f2f99422f7d41c0233 100644 (file)
@@ -165,7 +165,7 @@ void DNSParserRegisterTests(void);
 void DNSAppLayerDecoderEventsRegister(int alproto);
 int DNSStateGetEventInfo(const char *event_name,
                          int *event_id, AppLayerEventType *event_type);
-void DNSAppLayerRegisterGetEventInfo(uint8_t ipproto, uint16_t alproto);
+void DNSAppLayerRegisterGetEventInfo(uint8_t ipproto, AppProto alproto);
 
 void *DNSGetTx(void *alstate, uint64_t tx_id);
 uint64_t DNSGetTxCnt(void *alstate);
index a791fa31ce17e06f57edaa5c026dfc6273375adb..6cfe49e5e8c26c1075cf38a28f16e41ef7db2a2e 100644 (file)
@@ -466,7 +466,7 @@ void AppLayerParserRegisterGetTx(uint8_t ipproto, AppProto alproto,
 }
 
 void AppLayerParserRegisterGetStateProgressCompletionStatus(uint8_t ipproto,
-                                                   uint16_t alproto,
+                                                   AppProto alproto,
     int (*StateGetProgressCompletionStatus)(uint8_t direction))
 {
     SCEnter();
@@ -667,7 +667,7 @@ int AppLayerParserGetEventInfo(uint8_t ipproto, AppProto alproto, const char *ev
     SCReturnInt(r);
 }
 
-uint8_t AppLayerParserGetFirstDataDir(uint8_t ipproto, uint16_t alproto)
+uint8_t AppLayerParserGetFirstDataDir(uint8_t ipproto, AppProto alproto)
 {
     SCEnter();
     SCReturnCT(alp_ctx.ctxs[FlowGetProtoMapping(ipproto)][alproto].
@@ -1179,7 +1179,7 @@ void AppLayerParserRegisterUnittests(void)
     SCEnter();
 
     int ip;
-    uint16_t alproto;
+    AppProto alproto;
     AppLayerParserProtoCtx *ctx;
 
     for (ip = 0; ip < FLOW_PROTO_DEFAULT; ip++) {
index 1b91329375b92c20468af21595e61c3dd862fc11..4527af33758cb1016288d29574fe3e08ef4e14c2 100644 (file)
@@ -105,7 +105,7 @@ void AppLayerParserRegisterGetTxCnt(uint8_t ipproto, AppProto alproto,
 void AppLayerParserRegisterGetTx(uint8_t ipproto, AppProto alproto,
                       void *(StateGetTx)(void *alstate, uint64_t tx_id));
 void AppLayerParserRegisterGetStateProgressCompletionStatus(uint8_t ipproto,
-                                                 uint16_t alproto,
+                                                 AppProto alproto,
     int (*StateGetStateProgressCompletionStatus)(uint8_t direction));
 void AppLayerParserRegisterGetEventInfo(uint8_t ipproto, AppProto alproto,
     int (*StateGetEventInfo)(const char *event_name, int *event_id,
@@ -142,7 +142,7 @@ int AppLayerParserGetEventInfo(uint8_t ipproto, AppProto alproto, const char *ev
 
 uint64_t AppLayerParserGetTransactionActive(uint8_t ipproto, AppProto alproto, void *pstate, uint8_t direction);
 
-uint8_t AppLayerParserGetFirstDataDir(uint8_t ipproto, uint16_t alproto);
+uint8_t AppLayerParserGetFirstDataDir(uint8_t ipproto, AppProto alproto);
 
 /***** General *****/
 
index d22d4f44c57e3c39ff7d5f256711891b579d224e..039920597cb070747da9141555e75e9ff2878e85 100644 (file)
@@ -2187,7 +2187,7 @@ int SMBParserTest05(void)
     uint32_t smblen2 = sizeof(smbbuf2);
 
     int result = 0;
-    uint16_t alproto;
+    AppProto alproto;
     Flow f;
     void *alpd_tctx;
     memset(&f, 0, sizeof(f));
@@ -2270,7 +2270,7 @@ int SMBParserTest06(void)
     uint32_t smblen2 = sizeof(smbbuf2);
 
     int result = 0;
-    uint16_t alproto;
+    AppProto alproto;
     Flow f;
     void *alpd_tctx;
     memset(&f, 0, sizeof(f));
index bd36d14e91c55784b2647b508b49c961f3d21317..f0f9a2071ea914a28b6430675610be7c3e4bf6b9 100644 (file)
@@ -56,7 +56,7 @@ typedef struct AppLayerThreadCtx_ {
     uint64_t ticks_start;
     uint64_t ticks_end;
     uint64_t ticks_spent;
-    uint16_t alproto;
+    AppProto alproto;
     uint64_t proto_detect_ticks_start;
     uint64_t proto_detect_ticks_end;
     uint64_t proto_detect_ticks_spent;
@@ -76,8 +76,8 @@ int AppLayerHandleTCPData(ThreadVars *tv, TcpReassemblyThreadCtx *ra_ctx,
     DEBUG_ASSERT_FLOW_LOCKED(f);
 
     AppLayerThreadCtx *app_tctx = ra_ctx->app_tctx;
-    uint16_t *alproto;
-    uint16_t *alproto_otherdir;
+    AppProto *alproto;
+    AppProto *alproto_otherdir;
     uint8_t dir;
     uint32_t data_al_so_far;
     int r = 0;
index e21a206b8716b625c9830a4c081588f16d6dad3c..55b8a70b8069ac971bc1f94858279ec3dd0dae0e 100644 (file)
@@ -169,7 +169,7 @@ static DetectAppLayerEventData *DetectAppLayerEventParseAppP1(const char *arg)
 {
     /* period index */
     DetectAppLayerEventData *aled;
-    uint16_t alproto;
+    AppProto alproto;
     const char *p_idx;
     char alproto_name[50];
 
index 6a5ac42d97a1377a36ef3a89a05749746886fc5d..a3ed6088288db46d1aa2246c3ceae61b4830f7be 100644 (file)
@@ -25,7 +25,7 @@
 #define __DETECT_APP_LAYER_EVENT_H__
 
 typedef struct DetectAppLayerEventData_ {
-    uint16_t alproto;
+    AppProto alproto;
     int event_id;
 
     char *arg;
index cb07fbf0faddb0fb0b028c9f1934aaac36aa57f8..4bc1a3e45292d4bcd0e97dcfc1bfce5b583f48ac 100644 (file)
@@ -51,7 +51,7 @@ int DetectAppLayerProtocolMatch(ThreadVars *t, DetectEngineThreadCtx *det_ctx,
 static DetectAppLayerProtocolData *DetectAppLayerProtocolParse(const char *arg)
 {
     DetectAppLayerProtocolData *data;
-    uint16_t alproto = ALPROTO_UNKNOWN;
+    AppProto alproto = ALPROTO_UNKNOWN;
     uint8_t negated = 0;
 
     if (arg == NULL) {
index 07a34e519dba2b7c8caa1bc8be9e8db0a68bf2cd..616c4f2a567378cf0a2983db494a72bd358529f7 100644 (file)
@@ -25,7 +25,7 @@
 #define __DETECT_APP_LAYER_PROTOCOL__H__
 
 typedef struct DetectAppLayerProtocolData_ {
-    uint16_t alproto;
+    AppProto alproto;
     uint8_t negated;
 } DetectAppLayerProtocolData;
 
index 9488491f21e4ad2b1cad103b9361b03077ce1b26..5ca416892dc627fe1e3b8d148971d79ef4b352f9 100644 (file)
@@ -40,7 +40,7 @@ int DetectEngineAptEventInspect(ThreadVars *tv,
 {
     AppLayerDecoderEvents *decoder_events = NULL;
     int r = 0;
-    uint16_t alproto;
+    AppProto alproto;
     SigMatch *sm;
     DetectAppLayerEventData *aled = NULL;
 
index 7e310359b4426d67df9aabc4c929518271b38c67..da8e0bdcf9a500dd3612a91d0ab8775dfe64490f 100644 (file)
@@ -156,7 +156,7 @@ static int DeStateStoreFilestoreSigsCantMatch(SigGroupHead *sgh, DetectEngineSta
         return 0;
 }
 
-static void DeStateResetFileInspection(Flow *f, uint16_t alproto, void *alstate, uint8_t direction)
+static void DeStateResetFileInspection(Flow *f, AppProto alproto, void *alstate, uint8_t direction)
 {
     if (f == NULL || alproto != ALPROTO_HTTP || alstate == NULL || f->de_state == NULL)
         return;
@@ -212,7 +212,7 @@ void DetectEngineStateFree(DetectEngineState *state)
     return;
 }
 
-int DeStateFlowHasInspectableState(Flow *f, uint16_t alproto, uint16_t alversion, uint8_t flags)
+int DeStateFlowHasInspectableState(Flow *f, AppProto alproto, uint16_t alversion, uint8_t flags)
 {
     int r = 0;
 
@@ -240,7 +240,7 @@ int DeStateFlowHasInspectableState(Flow *f, uint16_t alproto, uint16_t alversion
 int DeStateDetectStartDetection(ThreadVars *tv, DetectEngineCtx *de_ctx,
                                 DetectEngineThreadCtx *det_ctx,
                                 Signature *s, Packet *p, Flow *f, uint8_t flags,
-                                void *alstate, uint16_t alproto, uint16_t alversion)
+                                void *alstate, AppProto alproto, uint16_t alversion)
 {
     DetectEngineAppInspectionEngine *engine = NULL;
     SigMatch *sm = NULL;
@@ -452,7 +452,7 @@ int DeStateDetectStartDetection(ThreadVars *tv, DetectEngineCtx *de_ctx,
 void DeStateDetectContinueDetection(ThreadVars *tv, DetectEngineCtx *de_ctx,
                                     DetectEngineThreadCtx *det_ctx,
                                     Packet *p, Flow *f, uint8_t flags, void *alstate,
-                                    uint16_t alproto, uint16_t alversion)
+                                    AppProto alproto, uint16_t alversion)
 {
     SCMutexLock(&f->de_state_m);
 
index 7606278f9d1f1d818dffaa1c58c6c529aa3da61e..1e47dd462dfba22be5bd1239d23a31ce1db4c0e1 100644 (file)
@@ -150,7 +150,7 @@ void DetectEngineStateFree(DetectEngineState *state);
  * \retval 1 Has state.
  * \retval 0 Has no state.
  */
-int DeStateFlowHasInspectableState(Flow *f, uint16_t alproto, uint16_t alversion, uint8_t flags);
+int DeStateFlowHasInspectableState(Flow *f, AppProto alproto, uint16_t alversion, uint8_t flags);
 
 /**
  * \brief Match app layer sig list against app state and store relevant match
@@ -171,7 +171,7 @@ int DeStateFlowHasInspectableState(Flow *f, uint16_t alproto, uint16_t alversion
 int DeStateDetectStartDetection(ThreadVars *tv, DetectEngineCtx *de_ctx,
                                 DetectEngineThreadCtx *det_ctx,
                                 Signature *s, Packet *p, Flow *f, uint8_t flags,
-                                void *alstate, uint16_t alproto,
+                                void *alstate, AppProto alproto,
                                 uint16_t alversion);
 
 /**
@@ -189,7 +189,7 @@ int DeStateDetectStartDetection(ThreadVars *tv, DetectEngineCtx *de_ctx,
 void DeStateDetectContinueDetection(ThreadVars *tv, DetectEngineCtx *de_ctx,
                                     DetectEngineThreadCtx *det_ctx,
                                     Packet *p, Flow *f, uint8_t flags, void *alstate,
-                                    uint16_t alproto, uint16_t alversion);
+                                    AppProto alproto, uint16_t alversion);
 
 /**
  *  \brief Update the inspect id.
index d9de03a02a4a53753faf158eaf24c4ddd1b012cf..5127a385c111ae1d93a941e54e6178e2eea81876 100644 (file)
@@ -108,7 +108,7 @@ static void DetectEnginePrintAppInspectionEngines(DetectEngineAppInspectionEngin
 {
     printf("\n");
 
-    uint16_t alproto = ALPROTO_UNKNOWN + 1;
+    AppProto alproto = ALPROTO_UNKNOWN + 1;
     for ( ; alproto < ALPROTO_MAX; alproto++) {
         printf("alproto - %d\n", alproto);
         int dir = 0;
@@ -137,7 +137,7 @@ void DetectEngineRegisterAppInspectionEngines(void)
 {
     struct tmp_t {
         uint8_t ipproto;
-        uint16_t alproto;
+        AppProto alproto;
         int32_t sm_list;
         uint32_t inspect_flags;
         uint32_t match_flags;
@@ -362,7 +362,7 @@ static void AppendAppInspectionEngine(DetectEngineAppInspectionEngine *engine,
 }
 
 void DetectEngineRegisterAppInspectionEngine(uint8_t ipproto,
-                                             uint16_t alproto,
+                                             AppProto alproto,
                                              uint16_t dir,
                                              int32_t sm_list,
                                              uint32_t inspect_flags,
index 14008ea86025acf25d87908d95e6ea8b9d188c73..73b3554f20ffefb2bb644606a950ec4668c4928c 100644 (file)
@@ -30,7 +30,7 @@
 
 typedef struct DetectEngineAppInspectionEngine_ {
     uint8_t ipproto;
-    uint16_t alproto;
+    AppProto alproto;
     uint16_t dir;
 
     int32_t sm_list;
@@ -82,7 +82,7 @@ const char *DetectSigmatchListEnumToString(enum DetectSigmatchListEnum type);
  * \param Callback The engine callback.
  */
 void DetectEngineRegisterAppInspectionEngine(uint8_t ipproto,
-                                             uint16_t alproto,
+                                             AppProto alproto,
                                              uint16_t direction,
                                              int32_t sm_list,
                                              uint32_t inspect_flags,
index e12bedbaa6fdc4801de836b3bbe9e1824d964381..c898b49b3d9fe0eb274ba40c5175f7f198618d93 100644 (file)
@@ -141,7 +141,7 @@ typedef struct SignatureParser_ {
 
 int DetectEngineContentModifierBufferSetup(DetectEngineCtx *de_ctx, Signature *s, char *arg,
                                            uint8_t sm_type, uint8_t sm_list,
-                                           uint16_t alproto,  void (*CustomCallback)(Signature *s))
+                                           AppProto alproto,  void (*CustomCallback)(Signature *s))
 {
     SigMatch *sm = NULL;
     int ret = -1;
index e3f29383e3e6b56088c0c4f5a380cb074397b1df..c90560a916cfcfeb810253c39a857c92b5e25444 100644 (file)
@@ -62,7 +62,7 @@ void DetectParseDupSigHashFree(DetectEngineCtx *);
 
 int DetectEngineContentModifierBufferSetup(DetectEngineCtx *de_ctx, Signature *s, char *arg,
                                            uint8_t sm_type, uint8_t sm_list,
-                                           uint16_t alproto,  void (*CustomCallback)(Signature *s));
+                                           AppProto alproto,  void (*CustomCallback)(Signature *s));
 
 #endif /* __DETECT_PARSE_H__ */
 
index 0323ba8a025ebaafbcbd6a818a4a34d0df4ba0f2..0773bc964ca57401ecaad2e10b3a73233ab98f80 100644 (file)
@@ -45,7 +45,7 @@
  *  The size of a register is leading here.
  */
 void SigMatchSignaturesBuildMatchArray(DetectEngineThreadCtx *det_ctx,
-                                       Packet *p, SignatureMask mask, uint16_t alproto)
+                                       Packet *p, SignatureMask mask, AppProto alproto)
 {
     uint32_t u;
     SigIntId x;
@@ -190,7 +190,7 @@ void SigMatchSignaturesBuildMatchArray(DetectEngineThreadCtx *det_ctx,
  *  futher inspection.
  */
 void SigMatchSignaturesBuildMatchArray(DetectEngineThreadCtx *det_ctx,
-                                       Packet *p, SignatureMask mask, uint16_t alproto)
+                                       Packet *p, SignatureMask mask, AppProto alproto)
 {
     uint32_t u;
     register uint64_t bm; /* bit mask, 64 bits used */
index f16209b346654f08659e049d3dba71a5c1e2d2f2..e8b9d28476711ed0d09c66b6c22e64daa24f9fe2 100644 (file)
@@ -496,7 +496,7 @@ int SigLoadSignatures(DetectEngineCtx *de_ctx, char *sig_file, int sig_file_excl
  */
 int SigMatchSignaturesBuildMatchArrayAddSignature(DetectEngineThreadCtx *det_ctx,
                                                   Packet *p, SignatureHeader *s,
-                                                  uint16_t alproto)
+                                                  AppProto alproto)
 {
     /* if the sig has alproto and the session as well they should match */
     if (likely(s->flags & SIG_FLAG_APPLAYER)) {
@@ -577,7 +577,7 @@ int SigMatchSignaturesBuildMatchArrayAddSignature(DetectEngineThreadCtx *det_ctx
  */
 void SigMatchSignaturesBuildMatchArray(DetectEngineThreadCtx *det_ctx,
                                        Packet *p, SignatureMask mask,
-                                       uint16_t alproto)
+                                       AppProto alproto)
 {
     uint32_t u;
 
@@ -790,7 +790,7 @@ end:
  */
 static inline void DetectMpmPrefilter(DetectEngineCtx *de_ctx,
         DetectEngineThreadCtx *det_ctx, StreamMsg *smsg, Packet *p,
-        uint8_t flags, uint16_t alproto, void *alstate, uint8_t *sms_runflags)
+        uint8_t flags, AppProto alproto, void *alstate, uint8_t *sms_runflags)
 {
     /* have a look at the reassembled stream (if any) */
     if (p->flowflags & FLOW_PKT_ESTABLISHED) {
@@ -1086,7 +1086,7 @@ int SigMatchSignatures(ThreadVars *th_v, DetectEngineCtx *de_ctx, DetectEngineTh
 {
     uint8_t sms_runflags = 0;   /* function flags */
     uint8_t alert_flags = 0;
-    uint16_t alproto = ALPROTO_UNKNOWN;
+    AppProto alproto = ALPROTO_UNKNOWN;
 #ifdef PROFILING
     int smatch = 0; /* signature match: 1, no match: 0 */
 #endif
@@ -2043,7 +2043,7 @@ deonly:
  * SIG_MASK_REQUIRE_HTTP_STATE, SIG_MASK_REQUIRE_DCE_STATE
  */
 static void
-PacketCreateMask(Packet *p, SignatureMask *mask, uint16_t alproto, void *alstate, StreamMsg *smsg,
+PacketCreateMask(Packet *p, SignatureMask *mask, AppProto alproto, void *alstate, StreamMsg *smsg,
         int app_decoder_events)
 {
     /* no payload inspect flag doesn't apply to smsg */
index 439edd1e00e9e72c38254abb5a04f51f6e949cb3..86469995c433108eab70c30aad7f097e9d44a4c5 100644 (file)
@@ -340,7 +340,7 @@ typedef struct SignatureHeader_ {
         struct {
             /* coccinelle: SignatureHeader:flags:SIG_FLAG */
             uint32_t flags;
-            uint16_t alproto;
+            AppProto alproto;
             uint16_t dsize_low;
         };
         uint64_t hdr_copy1;
@@ -379,7 +379,7 @@ typedef struct Signature_ {
         struct {
             /* coccinelle: Signature:flags:SIG_FLAG */
             uint32_t flags;
-            uint16_t alproto;
+            AppProto alproto;
             uint16_t dsize_low;
         };
         uint64_t hdr_copy1;
@@ -888,7 +888,7 @@ typedef struct SigTableElmt_ {
         uint8_t flags, File *, Signature *, SigMatch *);
 
     /** app layer proto from app-layer-protos.h this match applies to */
-    uint16_t alproto;
+    AppProto alproto;
 
     /** keyword setup function pointer */
     int (*Setup)(DetectEngineCtx *, Signature *, char *);
index b4ec6666891a52e8920d12e2f10ea70dc4e1fc91..f9155b4c58aa701a6445100f0cec4927ccbd1416 100644 (file)
@@ -332,9 +332,9 @@ typedef struct Flow_
     uint8_t protomap;
     uint8_t pad0;
 
-    uint16_t alproto; /**< \brief application level protocol */
-    uint16_t alproto_ts;
-    uint16_t alproto_tc;
+    AppProto alproto; /**< \brief application level protocol */
+    AppProto alproto_ts;
+    AppProto alproto_tc;
 
     uint32_t data_al_so_far[2];