1 files changed, 32 insertions, 5 deletions
diff --git a/tests/test_dissector.cpp b/tests/test_dissector.cpp
index 9dd4135..4517ae7 100644
--- a/tests/test_dissector.cpp
+++ b/tests/test_dissector.cpp
@@ -23,9 +23,10 @@ private:
 
 class AlwaysMatchesDissector : public L7Dissector {
 public:
-    AlwaysMatchesDissector(std::uint16_t port, std::string label)
-        : port_(port), label_(std::move(label)) {}
+    AlwaysMatchesDissector(std::uint16_t port, std::string label, Transport transport = Transport::kAny)
+        : port_(port), label_(std::move(label)), transport_(transport) {}
     std::uint16_t port() const override { return port_; }
+    Transport transport() const override { return transport_; }
     std::optional<std::string> summarize(std::span<const unsigned char>) const override {
         return label_;
     }
@@ -33,6 +34,7 @@ public:
 private:
     std::uint16_t port_;
     std::string label_;
+    Transport transport_;
 };
 
 }  // namespace
@@ -46,7 +48,7 @@ TEST_CASE("L7Registry falls through to a later dissector on the same port "
     registry.add(&tls_like);
     registry.add(&quic_like);
 
-    auto result = registry.dissect(443, {});
+    auto result = registry.dissect(443, Transport::kTcp, {});
     REQUIRE(result.has_value());
     CHECK(*result == "QUIC something");
 }
@@ -59,7 +61,7 @@ TEST_CASE("L7Registry still returns the first dissector to succeed, not the last
     registry.add(&first);
     registry.add(&second);
 
-    auto result = registry.dissect(80, {});
+    auto result = registry.dissect(80, Transport::kTcp, {});
     REQUIRE(result.has_value());
     CHECK(*result == "first");
 }
@@ -70,5 +72,30 @@ TEST_CASE("L7Registry returns nullopt when no dissector on the port matches") {
     L7Registry registry;
     registry.add(&only);
 
-    CHECK_FALSE(registry.dissect(443, {}).has_value());
+    CHECK_FALSE(registry.dissect(443, Transport::kTcp, {}).has_value());
+}
+
+TEST_CASE("L7Registry skips a dissector whose declared transport doesn't match, even on the "
+          "right port") {
+    // The actual fix for QUIC's false positives on TCP:443: a
+    // dissector that only claims UDP must never be tried against a
+    // TCP payload on the same port, regardless of what its own
+    // summarize() would have returned.
+    AlwaysMatchesDissector udp_only(443, "UDP thing", Transport::kUdp);
+
+    L7Registry registry;
+    registry.add(&udp_only);
+
+    CHECK_FALSE(registry.dissect(443, Transport::kTcp, {}).has_value());
+    CHECK(registry.dissect(443, Transport::kUdp, {}).has_value());
+}
+
+TEST_CASE("L7Registry's default kAny transport matches either TCP or UDP") {
+    AlwaysMatchesDissector any(53, "DNS-like");  // default transport: kAny
+
+    L7Registry registry;
+    registry.add(&any);
+
+    CHECK(registry.dissect(53, Transport::kTcp, {}).has_value());
+    CHECK(registry.dissect(53, Transport::kUdp, {}).has_value());
 }