Go to the documentation of this file.
25 #ifndef SURICATA_APP_LAYER_DETECT_PROTO__H
26 #define SURICATA_APP_LAYER_DETECT_PROTO__H
35 const Flow *f, uint8_t
flags,
const uint8_t *input, uint32_t input_len, uint8_t *rdir);
53 const uint8_t *buf, uint32_t buflen, uint8_t ipproto, uint8_t
flags,
bool *reverse_flow);
67 uint16_t min_depth, uint16_t max_depth, uint8_t direction,
ProbingParserFPtr ProbingParser1,
73 const char *alproto_name,
AppProto alproto, uint16_t min_depth, uint16_t max_depth,
82 uint16_t depth, uint16_t
offset, uint8_t direction);
84 const char *pattern, uint16_t depth, uint16_t
offset, uint8_t direction,
91 uint16_t depth, uint16_t
offset, uint8_t direction);
168 const char *ipproto,
const char *alproto,
bool default_enabled);
int SCAppLayerProtoDetectPMRegisterPatternCS(uint8_t ipproto, AppProto alproto, const char *pattern, uint16_t depth, uint16_t offset, uint8_t direction)
Registers a case-sensitive pattern for protocol detection.
void SCAppLayerForceProtocolChange(Flow *f, AppProto new_proto)
Forces a flow app-layer protocol change. Happens for instance when a HTTP2 flow is seen as DOH2.
void AppLayerProtoDetectRegisterProtocol(AppProto alproto, const char *alproto_name)
Registers a protocol for protocol detection phase.
const char * AppLayerProtoDetectGetProtoName(AppProto alproto)
void SCAppLayerProtoDetectPPRegister(uint8_t ipproto, const char *portstr, AppProto alproto, uint16_t min_depth, uint16_t max_depth, uint8_t direction, ProbingParserFPtr ProbingParser1, ProbingParserFPtr ProbingParser2)
register parser at a port
int SCAppLayerProtoDetectConfProtoDetectionEnabledDefault(const char *ipproto, const char *alproto, bool default_enabled)
Given a protocol name, checks if proto detection is enabled in the conf file.
int AppLayerProtoDetectSetup(void)
The first function to be called. This initializes a global protocol detection context.
int AppLayerProtoDetectDeSetup(void)
Cleans up the app layer protocol detection phase.
int AppLayerProtoDetectPrepareState(void)
Prepares the internal state for protocol detection. This needs to be called once all the patterns and...
void AppLayerProtoDetectSupportedAppProtocols(AppProto *alprotos)
AppProto AppLayerProtoDetectGetProtoByName(const char *alproto_name)
The app layer protocol detection thread context.
bool SCAppLayerRequestProtocolTLSUpgrade(Flow *f)
request applayer to wrap up this protocol and rerun protocol detection with expectation of TLS....
AppProto AppLayerProtoDetectGetProto(AppLayerProtoDetectThreadCtx *tctx, Flow *f, const uint8_t *buf, uint32_t buflen, uint8_t ipproto, uint8_t flags, bool *reverse_flow)
Returns the app layer protocol given a buffer.
void AppLayerProtoDetectUnittestsRegister(void)
Register unittests for app layer proto detection module.
AppLayerProtoDetectThreadCtx * AppLayerProtoDetectGetCtxThread(void)
Inits and returns an app layer protocol detection thread context.
int SCAppLayerProtoDetectPPParseConfPorts(const char *ipproto_name, uint8_t ipproto, const char *alproto_name, AppProto alproto, uint16_t min_depth, uint16_t max_depth, ProbingParserFPtr ProbingParserTs, ProbingParserFPtr ProbingParserTc)
int SCAppLayerProtoDetectConfProtoDetectionEnabled(const char *ipproto, const char *alproto)
Given a protocol name, checks if proto detection is enabled in the conf file.
void AppLayerProtoDetectUnittestCtxRestore(void)
Restores back the internal context used by the app layer proto detection module, that was previously ...
void AppLayerProtoDetectRegisterAlias(const char *proto_name, const char *proto_alias)
void AppLayerProtoDetectSupportedIpprotos(AppProto alproto, uint8_t *ipprotos)
bool AppLayerRequestProtocolChange(Flow *f, uint16_t dp, AppProto expect_proto)
request applayer to wrap up this protocol and rerun protocol detection.
int SCAppLayerProtoDetectPMRegisterPatternCSwPP(uint8_t ipproto, AppProto alproto, const char *pattern, uint16_t depth, uint16_t offset, uint8_t direction, ProbingParserFPtr PPFunc, uint16_t pp_min_depth, uint16_t pp_max_depth)
void AppLayerRegisterExpectationProto(uint8_t proto, AppProto alproto)
void AppLayerProtoDetectReset(Flow *)
Reset proto detect for flow.
AppProto(* ProbingParserFPtr)(const Flow *f, uint8_t flags, const uint8_t *input, uint32_t input_len, uint8_t *rdir)
int SCAppLayerProtoDetectPMRegisterPatternCI(uint8_t ipproto, AppProto alproto, const char *pattern, uint16_t depth, uint16_t offset, uint8_t direction)
Registers a case-insensitive pattern for protocol detection.
void AppLayerProtoDetectDestroyCtxThread(AppLayerProtoDetectThreadCtx *tctx)
Destroys the app layer protocol detection thread context.
void AppLayerProtoDetectUnittestCtxBackup(void)
Backs up the internal context used by the app layer proto detection module.