suricata
app-layer-detect-proto.h
Go to the documentation of this file.
1 /* Copyright (C) 2007-2014 Open Information Security Foundation
2  *
3  * You can copy, redistribute or modify this Program under the terms of
4  * the GNU General Public License version 2 as published by the Free
5  * Software Foundation.
6  *
7  * This program is distributed in the hope that it will be useful,
8  * but WITHOUT ANY WARRANTY; without even the implied warranty of
9  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
10  * GNU General Public License for more details.
11  *
12  * You should have received a copy of the GNU General Public License
13  * version 2 along with this program; if not, write to the Free Software
14  * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA
15  * 02110-1301, USA.
16  */
17 
18 /**
19  * \file
20  *
21  * \author Victor Julien <victor@inliniac.net>
22  * \author Anoop Saldanha <anoopsaldanha@gmail.com>
23  */
24 
25 #ifndef SURICATA_APP_LAYER_DETECT_PROTO__H
26 #define SURICATA_APP_LAYER_DETECT_PROTO__H
27 
28 #include "flow.h"
29 #include "app-layer-protos.h"
30 
32 
34  Flow *f, uint8_t flags, const uint8_t *input, uint32_t input_len, uint8_t *rdir);
35 
36 /***** Protocol Retrieval *****/
37 
38 /**
39  * \brief Returns the app layer protocol given a buffer.
40  *
41  * \param tctx Pointer to the app layer protocol detection thread context.
42  * \param f Pointer to the flow.
43  * \param buf The buffer to be inspected.
44  * \param buflen The length of the above buffer.
45  * \param ipproto The ip protocol.
46  * \param flags The direction bitfield - STREAM_TOSERVER/STREAM_TOCLIENT.
47  * \param[out] reverse_flow true if flow is detected to be reversed
48  *
49  * \retval The app layer protocol.
50  */
52  const uint8_t *buf, uint32_t buflen, uint8_t ipproto, uint8_t flags, bool *reverse_flow);
53 
54 /***** State Preparation *****/
55 
56 /**
57  * \brief Prepares the internal state for protocol detection.
58  * This needs to be called once all the patterns and probing parser
59  * ports have been registered.
60  */
62 
63 /***** PP registration *****/
64 
65 void AppLayerProtoDetectPPRegister(uint8_t ipproto,
66  const char *portstr,
67  AppProto alproto,
68  uint16_t min_depth, uint16_t max_depth,
69  uint8_t direction,
70  ProbingParserFPtr ProbingParser1,
71  ProbingParserFPtr ProbingParser2);
72 /**
73  * \retval bool 0 if no config was found, 1 if config was found
74  */
75 int AppLayerProtoDetectPPParseConfPorts(const char *ipproto_name,
76  uint8_t ipproto,
77  const char *alproto_name,
78  AppProto alproto,
79  uint16_t min_depth, uint16_t max_depth,
80  ProbingParserFPtr ProbingParserTs,
81  ProbingParserFPtr ProbingParserTc);
82 
83 /***** PM registration *****/
84 
85 /**
86  * \brief Registers a case-sensitive pattern for protocol detection.
87  */
88 int AppLayerProtoDetectPMRegisterPatternCS(uint8_t ipproto, AppProto alproto,
89  const char *pattern, uint16_t depth, uint16_t offset,
90  uint8_t direction);
91 int AppLayerProtoDetectPMRegisterPatternCSwPP(uint8_t ipproto, AppProto alproto,
92  const char *pattern, uint16_t depth, uint16_t offset,
93  uint8_t direction,
94  ProbingParserFPtr PPFunc,
95  uint16_t pp_min_depth, uint16_t pp_max_depth);
96 
97 /**
98  * \brief Registers a case-insensitive pattern for protocol detection.
99  */
100 int AppLayerProtoDetectPMRegisterPatternCI(uint8_t ipproto, AppProto alproto,
101  const char *pattern,
102  uint16_t depth, uint16_t offset,
103  uint8_t direction);
104 
105 /***** Setup/General Registration *****/
106 
107 /**
108  * \brief The first function to be called. This initializes a global
109  * protocol detection context.
110  *
111  * \retval 0 On success;
112  * \retval -1 On failure.
113  */
114 int AppLayerProtoDetectSetup(void);
115 
116 /**
117  * \brief Reset proto detect for flow
118  */
120 
121 bool AppLayerRequestProtocolChange(Flow *f, uint16_t dp, AppProto expect_proto);
123 
124 /**
125  * \brief Cleans up the app layer protocol detection phase.
126  */
128 
129 /**
130  * \brief Registers a protocol for protocol detection phase.
131  *
132  * This is the first function to be called after calling the
133  * setup function, AppLayerProtoDetectSetup(), before calling any other
134  * app layer functions, AppLayerParser or AppLayerProtoDetect, alike.
135  * With this function you are associating/registering a string
136  * that can be used by users to write rules, i.e.
137  * you register the http protocol for protocol detection using
138  * AppLayerProtoDetectRegisterProtocol(ctx, ALPROTO_HTTP1, "http"),
139  * following which you can write rules like -
140  * alert http any any -> any any (sid:1;)
141  * which basically matches on the HTTP protocol.
142  *
143  * \param alproto The protocol.
144  * \param alproto_str The string to associate with the above "alproto".
145  * Please send a static string that won't be destroyed
146  * post making this call, since this function won't
147  * create a copy of the received argument.
148  *
149  * \retval 0 On success;
150  * -1 On failure.
151  */
152 void AppLayerProtoDetectRegisterProtocol(AppProto alproto, const char *alproto_name);
153 
154 void AppLayerProtoDetectRegisterAlias(const char *proto_name, const char *proto_alias);
155 
156 /**
157  * \brief Given a protocol name, checks if proto detection is enabled in
158  * the conf file.
159  *
160  * \param alproto Name of the app layer protocol.
161  *
162  * \retval 1 If enabled.
163  * \retval 0 If disabled.
164  */
165 int AppLayerProtoDetectConfProtoDetectionEnabled(const char *ipproto,
166  const char *alproto);
167 
168 /**
169  * \brief Given a protocol name, checks if proto detection is enabled in
170  * the conf file.
171  *
172  * \param alproto Name of the app layer protocol.
173  * \param default_enabled enable by default if not in the configuration file
174  *
175  * \retval 1 If enabled.
176  * \retval 0 If disabled.
177  */
179  const char *ipproto, const char *alproto, bool default_enabled);
180 
181 /**
182  * \brief Inits and returns an app layer protocol detection thread context.
183 
184  * \param ctx Pointer to the app layer protocol detection context.
185  *
186  * \retval Pointer to the thread context, on success;
187  * NULL, on failure.
188  */
190 
191 /**
192  * \brief Destroys the app layer protocol detection thread context.
193  *
194  * \param tctx Pointer to the app layer protocol detection thread context.
195  */
197 
198 /***** Utility *****/
199 
200 void AppLayerProtoDetectSupportedIpprotos(AppProto alproto, uint8_t *ipprotos);
201 AppProto AppLayerProtoDetectGetProtoByName(const char *alproto_name);
202 const char *AppLayerProtoDetectGetProtoName(AppProto alproto);
204 
205 void AppLayerRegisterExpectationProto(uint8_t proto, AppProto alproto);
206 
207 /***** Unittests *****/
208 
209 #ifdef UNITTESTS
210 
211 /**
212  * \brief Backs up the internal context used by the app layer proto detection
213  * module.
214  */
216 
217 /**
218  * \brief Restores back the internal context used by the app layer proto
219  * detection module, that was previously backed up by calling
220  * AppLayerProtoDetectUnittestCtxBackup().
221  */
223 
224 /**
225  * \brief Register unittests for app layer proto detection module.
226  */
228 
229 #endif /* UNITTESTS */
230 
231 #endif /* SURICATA_APP_LAYER_DETECT_PROTO__H */
offset
uint64_t offset
Definition: util-streaming-buffer.h:0
AppLayerProtoDetectPMRegisterPatternCS
int AppLayerProtoDetectPMRegisterPatternCS(uint8_t ipproto, AppProto alproto, const char *pattern, uint16_t depth, uint16_t offset, uint8_t direction)
Registers a case-sensitive pattern for protocol detection.
Definition: app-layer-detect-proto.c:1679
AppLayerProtoDetectPPRegister
void AppLayerProtoDetectPPRegister(uint8_t ipproto, const char *portstr, AppProto alproto, uint16_t min_depth, uint16_t max_depth, uint8_t direction, ProbingParserFPtr ProbingParser1, ProbingParserFPtr ProbingParser2)
register parser at a port
Definition: app-layer-detect-proto.c:1566
AppProto
uint16_t AppProto
Definition: app-layer-protos.h:80
AppLayerProtoDetectRegisterProtocol
void AppLayerProtoDetectRegisterProtocol(AppProto alproto, const char *alproto_name)
Registers a protocol for protocol detection phase.
Definition: app-layer-detect-proto.c:1783
Flow_
Flow data structure.
Definition: flow.h:350
AppLayerProtoDetectGetProtoName
const char * AppLayerProtoDetectGetProtoName(AppProto alproto)
Definition: app-layer-detect-proto.c:2084
AppLayerProtoDetectPMRegisterPatternCSwPP
int AppLayerProtoDetectPMRegisterPatternCSwPP(uint8_t ipproto, AppProto alproto, const char *pattern, uint16_t depth, uint16_t offset, uint8_t direction, ProbingParserFPtr PPFunc, uint16_t pp_min_depth, uint16_t pp_max_depth)
Definition: app-layer-detect-proto.c:1692
ProbingParserFPtr
AppProto(* ProbingParserFPtr)(Flow *f, uint8_t flags, const uint8_t *input, uint32_t input_len, uint8_t *rdir)
Definition: app-layer-detect-proto.h:33
AppLayerProtoDetectPPParseConfPorts
int AppLayerProtoDetectPPParseConfPorts(const char *ipproto_name, uint8_t ipproto, const char *alproto_name, AppProto alproto, uint16_t min_depth, uint16_t max_depth, ProbingParserFPtr ProbingParserTs, ProbingParserFPtr ProbingParserTc)
Definition: app-layer-detect-proto.c:1605
proto
uint8_t proto
Definition: decode-template.h:0
AppLayerProtoDetectSetup
int AppLayerProtoDetectSetup(void)
The first function to be called. This initializes a global protocol detection context.
Definition: app-layer-detect-proto.c:1721
AppLayerProtoDetectDeSetup
int AppLayerProtoDetectDeSetup(void)
Cleans up the app layer protocol detection phase.
Definition: app-layer-detect-proto.c:1751
AppLayerProtoDetectPrepareState
int AppLayerProtoDetectPrepareState(void)
Prepares the internal state for protocol detection. This needs to be called once all the patterns and...
Definition: app-layer-detect-proto.c:1522
AppLayerProtoDetectSupportedAppProtocols
void AppLayerProtoDetectSupportedAppProtocols(AppProto *alprotos)
Definition: app-layer-detect-proto.c:2101
AppLayerProtoDetectGetProtoByName
AppProto AppLayerProtoDetectGetProtoByName(const char *alproto_name)
Definition: app-layer-detect-proto.c:2059
AppLayerProtoDetectThreadCtx_
The app layer protocol detection thread context.
Definition: app-layer-detect-proto.c:173
AppLayerProtoDetectPMRegisterPatternCI
int AppLayerProtoDetectPMRegisterPatternCI(uint8_t ipproto, AppProto alproto, const char *pattern, uint16_t depth, uint16_t offset, uint8_t direction)
Registers a case-insensitive pattern for protocol detection.
Definition: app-layer-detect-proto.c:1706
AppLayerProtoDetectConfProtoDetectionEnabledDefault
int AppLayerProtoDetectConfProtoDetectionEnabledDefault(const char *ipproto, const char *alproto, bool default_enabled)
Given a protocol name, checks if proto detection is enabled in the conf file.
Definition: app-layer-detect-proto.c:1888
AppLayerProtoDetectGetProto
AppProto AppLayerProtoDetectGetProto(AppLayerProtoDetectThreadCtx *tctx, Flow *f, const uint8_t *buf, uint32_t buflen, uint8_t ipproto, uint8_t flags, bool *reverse_flow)
Returns the app layer protocol given a buffer.
Definition: app-layer-detect-proto.c:1419
AppLayerProtoDetectUnittestsRegister
void AppLayerProtoDetectUnittestsRegister(void)
Register unittests for app layer proto detection module.
Definition: app-layer-detect-proto.c:3658
AppLayerProtoDetectGetCtxThread
AppLayerProtoDetectThreadCtx * AppLayerProtoDetectGetCtxThread(void)
Inits and returns an app layer protocol detection thread context.
Definition: app-layer-detect-proto.c:1963
AppLayerProtoDetectUnittestCtxRestore
void AppLayerProtoDetectUnittestCtxRestore(void)
Restores back the internal context used by the app layer proto detection module, that was previously ...
Definition: app-layer-detect-proto.c:2157
AppLayerProtoDetectRegisterAlias
void AppLayerProtoDetectRegisterAlias(const char *proto_name, const char *proto_alias)
Definition: app-layer-detect-proto.c:1793
AppLayerProtoDetectSupportedIpprotos
void AppLayerProtoDetectSupportedIpprotos(AppProto alproto, uint8_t *ipprotos)
Definition: app-layer-detect-proto.c:2042
AppLayerRequestProtocolChange
bool AppLayerRequestProtocolChange(Flow *f, uint16_t dp, AppProto expect_proto)
request applayer to wrap up this protocol and rerun protocol detection.
Definition: app-layer-detect-proto.c:1833
flags
uint8_t flags
Definition: decode-gre.h:0
AppLayerRequestProtocolTLSUpgrade
bool AppLayerRequestProtocolTLSUpgrade(Flow *f)
request applayer to wrap up this protocol and rerun protocol detection with expectation of TLS....
Definition: app-layer-detect-proto.c:1864
AppLayerProtoDetectConfProtoDetectionEnabled
int AppLayerProtoDetectConfProtoDetectionEnabled(const char *ipproto, const char *alproto)
Given a protocol name, checks if proto detection is enabled in the conf file.
Definition: app-layer-detect-proto.c:1958
AppLayerRegisterExpectationProto
void AppLayerRegisterExpectationProto(uint8_t proto, AppProto alproto)
Definition: app-layer-detect-proto.c:2130
AppLayerProtoDetectReset
void AppLayerProtoDetectReset(Flow *)
Reset proto detect for flow.
Definition: app-layer-detect-proto.c:1869
app-layer-protos.h
flow.h
AppLayerProtoDetectDestroyCtxThread
void AppLayerProtoDetectDestroyCtxThread(AppLayerProtoDetectThreadCtx *tctx)
Destroys the app layer protocol detection thread context.
Definition: app-layer-detect-proto.c:2016
AppLayerProtoDetectUnittestCtxBackup
void AppLayerProtoDetectUnittestCtxBackup(void)
Backs up the internal context used by the app layer proto detection module.
Definition: app-layer-detect-proto.c:2149