suricata
app-layer-detect-proto.h
Go to the documentation of this file.
1 /* Copyright (C) 2007-2014 Open Information Security Foundation
2  *
3  * You can copy, redistribute or modify this Program under the terms of
4  * the GNU General Public License version 2 as published by the Free
5  * Software Foundation.
6  *
7  * This program is distributed in the hope that it will be useful,
8  * but WITHOUT ANY WARRANTY; without even the implied warranty of
9  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
10  * GNU General Public License for more details.
11  *
12  * You should have received a copy of the GNU General Public License
13  * version 2 along with this program; if not, write to the Free Software
14  * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA
15  * 02110-1301, USA.
16  */
17 
18 /**
19  * \file
20  *
21  * \author Victor Julien <victor@inliniac.net>
22  * \author Anoop Saldanha <anoopsaldanha@gmail.com>
23  */
24 
25 #ifndef __APP_LAYER_DETECT_PROTO__H__
26 #define __APP_LAYER_DETECT_PROTO__H__
27 
29 
30 typedef AppProto (*ProbingParserFPtr)(Flow *f, uint8_t dir,
31  uint8_t *input, uint32_t input_len,
32  uint8_t *rdir);
33 
34 /***** Protocol Retrieval *****/
35 
36 /**
37  * \brief Returns the app layer protocol given a buffer.
38  *
39  * \param tctx Pointer to the app layer protocol detection thread context.
40  * \param f Pointer to the flow.
41  * \param buf The buffer to be inspected.
42  * \param buflen The length of the above buffer.
43  * \param ipproto The ip protocol.
44  * \param direction The direction bitfield - STREAM_TOSERVER/STREAM_TOCLIENT.
45  * \param[out] reverse_flow true if flow is detected to be reversed
46  *
47  * \retval The app layer protocol.
48  */
50  Flow *f,
51  uint8_t *buf, uint32_t buflen,
52  uint8_t ipproto, uint8_t direction,
53  bool *reverse_flow);
54 
55 /***** State Preparation *****/
56 
57 /**
58  * \brief Prepares the internal state for protocol detection.
59  * This needs to be called once all the patterns and probing parser
60  * ports have been registered.
61  */
63 
64 /***** PP registration *****/
65 
66 void AppLayerProtoDetectPPRegister(uint8_t ipproto,
67  const char *portstr,
68  AppProto alproto,
69  uint16_t min_depth, uint16_t max_depth,
70  uint8_t direction,
71  ProbingParserFPtr ProbingParser1,
72  ProbingParserFPtr ProbingParser2);
73 /**
74  * \retval bool 0 if no config was found, 1 if config was found
75  */
76 int AppLayerProtoDetectPPParseConfPorts(const char *ipproto_name,
77  uint8_t ipproto,
78  const char *alproto_name,
79  AppProto alproto,
80  uint16_t min_depth, uint16_t max_depth,
81  ProbingParserFPtr ProbingParserTs,
82  ProbingParserFPtr ProbingParserTc);
83 
84 /***** PM registration *****/
85 
86 /**
87  * \brief Registers a case-sensitive pattern for protocol detection.
88  */
89 int AppLayerProtoDetectPMRegisterPatternCS(uint8_t ipproto, AppProto alproto,
90  const char *pattern, uint16_t depth, uint16_t offset,
91  uint8_t direction);
92 int AppLayerProtoDetectPMRegisterPatternCSwPP(uint8_t ipproto, AppProto alproto,
93  const char *pattern, uint16_t depth, uint16_t offset,
94  uint8_t direction,
95  ProbingParserFPtr PPFunc,
96  uint16_t pp_min_depth, uint16_t pp_max_depth);
97 
98 /**
99  * \brief Registers a case-insensitive pattern for protocol detection.
100  */
101 int AppLayerProtoDetectPMRegisterPatternCI(uint8_t ipproto, AppProto alproto,
102  const char *pattern,
103  uint16_t depth, uint16_t offset,
104  uint8_t direction);
105 
106 /***** Setup/General Registration *****/
107 
108 /**
109  * \brief The first function to be called. This initializes a global
110  * protocol detection context.
111  *
112  * \retval 0 On succcess;
113  * \retval -1 On failure.
114  */
115 int AppLayerProtoDetectSetup(void);
116 
117 /**
118  * \brief Reset proto detect for flow
119  */
121 
122 void AppLayerRequestProtocolChange(Flow *f, uint16_t dp, AppProto expect_proto);
124 
125 /**
126  * \brief Cleans up the app layer protocol detection phase.
127  */
129 
130 /**
131  * \brief Registers a protocol for protocol detection phase.
132  *
133  * This is the first function to be called after calling the
134  * setup function, AppLayerProtoDetectSetup(), before calling any other
135  * app layer functions, AppLayerParser or AppLayerProtoDetect, alike.
136  * With this function you are associating/registering a string
137  * that can be used by users to write rules, i.e.
138  * you register the http protocol for protocol detection using
139  * AppLayerProtoDetectRegisterProtocol(ctx, ALPROTO_HTTP, "http"),
140  * following which you can write rules like -
141  * alert http any any -> any any (sid:1;)
142  * which basically matches on the HTTP protocol.
143  *
144  * \param alproto The protocol.
145  * \param alproto_str The string to associate with the above "alproto".
146  * Please send a static string that won't be destroyed
147  * post making this call, since this function won't
148  * create a copy of the received argument.
149  *
150  * \retval 0 On success;
151  * -1 On failure.
152  */
153 void AppLayerProtoDetectRegisterProtocol(AppProto alproto, const char *alproto_name);
154 
155 /**
156  * \brief Given a protocol name, checks if proto detection is enabled in
157  * the conf file.
158  *
159  * \param alproto Name of the app layer protocol.
160  *
161  * \retval 1 If enabled.
162  * \retval 0 If disabled.
163  */
164 int AppLayerProtoDetectConfProtoDetectionEnabled(const char *ipproto,
165  const char *alproto);
166 
167 /**
168  * \brief Inits and returns an app layer protocol detection thread context.
169 
170  * \param ctx Pointer to the app layer protocol detection context.
171  *
172  * \retval Pointer to the thread context, on success;
173  * NULL, on failure.
174  */
176 
177 /**
178  * \brief Destroys the app layer protocol detection thread context.
179  *
180  * \param tctx Pointer to the app layer protocol detection thread context.
181  */
183 
184 /***** Utility *****/
185 
186 void AppLayerProtoDetectSupportedIpprotos(AppProto alproto, uint8_t *ipprotos);
187 AppProto AppLayerProtoDetectGetProtoByName(const char *alproto_name);
188 const char *AppLayerProtoDetectGetProtoName(AppProto alproto);
190 
191 void AppLayerRegisterExpectationProto(uint8_t proto, AppProto alproto);
192 
193 /***** Unittests *****/
194 
195 #ifdef UNITTESTS
196 
197 /**
198  * \brief Backs up the internal context used by the app layer proto detection
199  * module.
200  */
202 
203 /**
204  * \brief Restores back the internal context used by the app layer proto
205  * detection module, that was previously backed up by calling
206  * AppLayerProtoDetectUnittestCtxBackup().
207  */
209 
210 /**
211  * \brief Register unittests for app layer proto detection module.
212  */
214 
215 #endif /* UNITTESTS */
216 
217 #endif /* __APP_LAYER_DETECT_PROTO__H__ */
void AppLayerProtoDetectSupportedIpprotos(AppProto alproto, uint8_t *ipprotos)
int AppLayerProtoDetectPMRegisterPatternCSwPP(uint8_t ipproto, AppProto alproto, const char *pattern, uint16_t depth, uint16_t offset, uint8_t direction, ProbingParserFPtr PPFunc, uint16_t pp_min_depth, uint16_t pp_max_depth)
AppProto AppLayerProtoDetectGetProto(AppLayerProtoDetectThreadCtx *tctx, Flow *f, uint8_t *buf, uint32_t buflen, uint8_t ipproto, uint8_t direction, bool *reverse_flow)
Returns the app layer protocol given a buffer.
AppProto(* ProbingParserFPtr)(Flow *f, uint8_t dir, uint8_t *input, uint32_t input_len, uint8_t *rdir)
uint64_t offset
void AppLayerProtoDetectDestroyCtxThread(AppLayerProtoDetectThreadCtx *tctx)
Destroys the app layer protocol detection thread context.
void AppLayerProtoDetectUnittestsRegister(void)
Register unittests for app layer proto detection module.
const char * AppLayerProtoDetectGetProtoName(AppProto alproto)
void AppLayerRequestProtocolChange(Flow *f, uint16_t dp, AppProto expect_proto)
request applayer to wrap up this protocol and rerun protocol detection.
int AppLayerProtoDetectPMRegisterPatternCI(uint8_t ipproto, AppProto alproto, const char *pattern, uint16_t depth, uint16_t offset, uint8_t direction)
Registers a case-insensitive pattern for protocol detection.
void AppLayerProtoDetectUnittestCtxBackup(void)
Backs up the internal context used by the app layer proto detection module.
uint16_t AppProto
void AppLayerProtoDetectRegisterProtocol(AppProto alproto, const char *alproto_name)
Registers a protocol for protocol detection phase.
AppProto AppLayerProtoDetectGetProtoByName(const char *alproto_name)
int AppLayerProtoDetectSetup(void)
The first function to be called. This initializes a global protocol detection context.
void AppLayerProtoDetectSupportedAppProtocols(AppProto *alprotos)
int AppLayerProtoDetectPrepareState(void)
Prepares the internal state for protocol detection. This needs to be called once all the patterns and...
uint8_t proto
AppLayerProtoDetectThreadCtx * AppLayerProtoDetectGetCtxThread(void)
Inits and returns an app layer protocol detection thread context.
void AppLayerRegisterExpectationProto(uint8_t proto, AppProto alproto)
int AppLayerProtoDetectPPParseConfPorts(const char *ipproto_name, uint8_t ipproto, const char *alproto_name, AppProto alproto, uint16_t min_depth, uint16_t max_depth, ProbingParserFPtr ProbingParserTs, ProbingParserFPtr ProbingParserTc)
void AppLayerProtoDetectUnittestCtxRestore(void)
Restores back the internal context used by the app layer proto detection module, that was previously ...
void AppLayerProtoDetectReset(Flow *)
Reset proto detect for flow.
void AppLayerProtoDetectPPRegister(uint8_t ipproto, const char *portstr, AppProto alproto, uint16_t min_depth, uint16_t max_depth, uint8_t direction, ProbingParserFPtr ProbingParser1, ProbingParserFPtr ProbingParser2)
register parser at a port
int AppLayerProtoDetectDeSetup(void)
Cleans up the app layer protocol detection phase.
void AppLayerRequestProtocolTLSUpgrade(Flow *f)
request applayer to wrap up this protocol and rerun protocol detection with expectation of TLS...
The app layer protocol detection thread context.
int AppLayerProtoDetectConfProtoDetectionEnabled(const char *ipproto, const char *alproto)
Given a protocol name, checks if proto detection is enabled in the conf file.
int AppLayerProtoDetectPMRegisterPatternCS(uint8_t ipproto, AppProto alproto, const char *pattern, uint16_t depth, uint16_t offset, uint8_t direction)
Registers a case-sensitive pattern for protocol detection.
Flow data structure.
Definition: flow.h:325