bittorrent: add bittorrent-events.rules file

Add a file containing rules to match bittorrent protocol events.

Ticket: 8421
(cherry picked from commit 42123cc8d9)

rules/Makefile.am

@@ -2,6 +2,7 @@ ruledir = $(datadir)/suricata/rules
 
 dist_rule_DATA = \
 app-layer-events.rules \
+bittorrent-events.rules \
 decoder-events.rules \
 dhcp-events.rules \
 dnp3-events.rules \

rules/README.md

@@ -33,6 +33,7 @@ signature IDs.
 | DNS      | 2240000 | 2240999 |
 | PGSQL    | 2241000 | 2241999 |
 | mDNS     | 2242000 | 2242999 |
+| Bittorent| 2243000 | 2243999 |
 | MODBUS   | 2250000 | 2250999 |
 | DNP3     | 2270000 | 2270999 |
 | HTTP2    | 2290000 | 2290999 |

rules/bittorrent-events.rules

@@ -0,0 +1,7 @@
+# BitTorrent DHT app layer event rules
+#
+# SID's fall in the 2243000+ range. See https://redmine.openinfosecfoundation.org/projects/suricata/wiki/AppLayer
+#
+# These sigs fire at most once per connection.
+#
+alert bittorrent-dht any any -> any any (msg:"SURICATA BitTorrent DHT malformed packet"; app-layer-event:bittorrent-dht.malformed_packet; classtype:protocol-command-decode; sid:2243000; rev:1;)