suricata7 rule加载（二）加载header

suricata7.0.5
alert http any any -> [192.168.1.27,1.192.137.27] 80 (msg:“HTTP Request Example”; flow:established,to_server; http.method; content:“POST”; http.uri; content:“query.php”; bsize:>9; http.protocol; content:“HTTP/1.1”; bsize:8; http.host; content:“360”; bsize:>3; classtype:bad-unknown; sid:25; rev:1;)

一、加载header

1.1 解析protocol

根据名称，转换为对应的枚举类型值

s->alproto = AppLayerGetProtoByName((char *)protostr);

1.2 解析Address

• source
  any 将转换为0.0.0.0/0 和 ::/0
  

• destination
  

1.3 解析Ports

• source port
  any将转换为0:65535
  

• dest port