inliniac/suricata — pull request #909 by inliniac (2014-03-27 15:48:58+00:00)
Title: app-layer: proto detection update

Instead of the notion of toserver and toclient protocol detection, use
destination port and source port.

Independent of the data direction, the flow's port settings will be used
to find the correct probing parser, where we first try the dest port,
and if that fails the source port.

Update the configuration file format, where toserver is replaced by 'dp'
and toclient by 'sp'. Toserver is intrepreted as 'dp' and toclient as
'sp' for backwards compatibility.

Example for dns:

dns:
# memcaps. Globally and per flow/state.
#global-memcap: 16mb
#state-memcap: 512kb

# How many unreplied DNS requests are considered a flood.
# If the limit is reached, app-layer-event:dns.flooded; will match.
#request-flood: 500

tcp:
enabled: yes
detection-ports:
dp: 53
udp:
enabled: yes
detection-ports:
dp: 53

Like before, progress of protocol detection is tracked per flow direction.

Bug #1142. https://redmine.openinfosecfoundation.org/issues/1142

Prscript:
- PR build: https://buildbot.suricata-ids.org/builders/inliniac/builds/247
- PR pcaps: https://buildbot.suricata-ids.org/builders/inliniac-pcap/builds/166