From a823160384bbc005450dc934f8924260b11516d3 Mon Sep 17 00:00:00 2001
From: Eric Leblond <eric@regit.org>
Date: Mon, 28 Feb 2011 17:44:32 +0100
Subject: [PATCH] detect: Add support for sctp option in rule

'sctp' can now be used as a keyword in signature. It is at the same
level as the 'tcp' or 'udp' keywords.
---
 src/detect-engine-proto.c | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/src/detect-engine-proto.c b/src/detect-engine-proto.c
index 404468bb34..2f219c56c0 100644
--- a/src/detect-engine-proto.c
+++ b/src/detect-engine-proto.c
@@ -116,6 +116,10 @@ int DetectProtoParse(DetectProto *dp, char *str)
         proto = IPPROTO_ICMPV6;
         dp->proto[proto / 8] |= 1 << (proto % 8);
         SCLogDebug("ICMP protocol detected, sig applies both to ICMPv4 and ICMPv6");
+    } else if (strcasecmp(str, "sctp") == 0) {
+        proto = IPPROTO_SCTP;
+        dp->proto[proto / 8] |= 1 << (proto % 8);
+        SCLogDebug("SCTP protocol detected");
     } else if (strcasecmp(str,"ip") == 0) {
         /* Proto "ip" is treated as an "any" */
         dp->flags |= DETECT_PROTO_ANY;