suricata
app-layer-detect-proto.h
Go to the documentation of this file.
1 /* Copyright (C) 2007-2014 Open Information Security Foundation
2  *
3  * You can copy, redistribute or modify this Program under the terms of
4  * the GNU General Public License version 2 as published by the Free
5  * Software Foundation.
6  *
7  * This program is distributed in the hope that it will be useful,
8  * but WITHOUT ANY WARRANTY; without even the implied warranty of
9  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
10  * GNU General Public License for more details.
11  *
12  * You should have received a copy of the GNU General Public License
13  * version 2 along with this program; if not, write to the Free Software
14  * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA
15  * 02110-1301, USA.
16  */
17 
18 /**
19  * \file
20  *
21  * \author Victor Julien <victor@inliniac.net>
22  * \author Anoop Saldanha <anoopsaldanha@gmail.com>
23  */
24 
25 #ifndef __APP_LAYER_DETECT_PROTO__H__
26 #define __APP_LAYER_DETECT_PROTO__H__
27 
29 
31  Flow *f, uint8_t flags, const uint8_t *input, uint32_t input_len, uint8_t *rdir);
32 
33 /***** Protocol Retrieval *****/
34 
35 /**
36  * \brief Returns the app layer protocol given a buffer.
37  *
38  * \param tctx Pointer to the app layer protocol detection thread context.
39  * \param f Pointer to the flow.
40  * \param buf The buffer to be inspected.
41  * \param buflen The length of the above buffer.
42  * \param ipproto The ip protocol.
43  * \param flags The direction bitfield - STREAM_TOSERVER/STREAM_TOCLIENT.
44  * \param[out] reverse_flow true if flow is detected to be reversed
45  *
46  * \retval The app layer protocol.
47  */
49  const uint8_t *buf, uint32_t buflen, uint8_t ipproto, uint8_t flags, bool *reverse_flow);
50 
51 /***** State Preparation *****/
52 
53 /**
54  * \brief Prepares the internal state for protocol detection.
55  * This needs to be called once all the patterns and probing parser
56  * ports have been registered.
57  */
59 
60 /***** PP registration *****/
61 
62 void AppLayerProtoDetectPPRegister(uint8_t ipproto,
63  const char *portstr,
64  AppProto alproto,
65  uint16_t min_depth, uint16_t max_depth,
66  uint8_t direction,
67  ProbingParserFPtr ProbingParser1,
68  ProbingParserFPtr ProbingParser2);
69 /**
70  * \retval bool 0 if no config was found, 1 if config was found
71  */
72 int AppLayerProtoDetectPPParseConfPorts(const char *ipproto_name,
73  uint8_t ipproto,
74  const char *alproto_name,
75  AppProto alproto,
76  uint16_t min_depth, uint16_t max_depth,
77  ProbingParserFPtr ProbingParserTs,
78  ProbingParserFPtr ProbingParserTc);
79 
80 /***** PM registration *****/
81 
82 /**
83  * \brief Registers a case-sensitive pattern for protocol detection.
84  */
85 int AppLayerProtoDetectPMRegisterPatternCS(uint8_t ipproto, AppProto alproto,
86  const char *pattern, uint16_t depth, uint16_t offset,
87  uint8_t direction);
88 int AppLayerProtoDetectPMRegisterPatternCSwPP(uint8_t ipproto, AppProto alproto,
89  const char *pattern, uint16_t depth, uint16_t offset,
90  uint8_t direction,
91  ProbingParserFPtr PPFunc,
92  uint16_t pp_min_depth, uint16_t pp_max_depth);
93 
94 /**
95  * \brief Registers a case-insensitive pattern for protocol detection.
96  */
97 int AppLayerProtoDetectPMRegisterPatternCI(uint8_t ipproto, AppProto alproto,
98  const char *pattern,
99  uint16_t depth, uint16_t offset,
100  uint8_t direction);
101 
102 /***** Setup/General Registration *****/
103 
104 /**
105  * \brief The first function to be called. This initializes a global
106  * protocol detection context.
107  *
108  * \retval 0 On succcess;
109  * \retval -1 On failure.
110  */
111 int AppLayerProtoDetectSetup(void);
112 
113 /**
114  * \brief Reset proto detect for flow
115  */
117 
118 void AppLayerRequestProtocolChange(Flow *f, uint16_t dp, AppProto expect_proto);
120 
121 /**
122  * \brief Cleans up the app layer protocol detection phase.
123  */
125 
126 /**
127  * \brief Registers a protocol for protocol detection phase.
128  *
129  * This is the first function to be called after calling the
130  * setup function, AppLayerProtoDetectSetup(), before calling any other
131  * app layer functions, AppLayerParser or AppLayerProtoDetect, alike.
132  * With this function you are associating/registering a string
133  * that can be used by users to write rules, i.e.
134  * you register the http protocol for protocol detection using
135  * AppLayerProtoDetectRegisterProtocol(ctx, ALPROTO_HTTP1, "http"),
136  * following which you can write rules like -
137  * alert http any any -> any any (sid:1;)
138  * which basically matches on the HTTP protocol.
139  *
140  * \param alproto The protocol.
141  * \param alproto_str The string to associate with the above "alproto".
142  * Please send a static string that won't be destroyed
143  * post making this call, since this function won't
144  * create a copy of the received argument.
145  *
146  * \retval 0 On success;
147  * -1 On failure.
148  */
149 void AppLayerProtoDetectRegisterProtocol(AppProto alproto, const char *alproto_name);
150 
151 void AppLayerProtoDetectRegisterAlias(const char *proto_name, const char *proto_alias);
152 
153 /**
154  * \brief Given a protocol name, checks if proto detection is enabled in
155  * the conf file.
156  *
157  * \param alproto Name of the app layer protocol.
158  *
159  * \retval 1 If enabled.
160  * \retval 0 If disabled.
161  */
162 int AppLayerProtoDetectConfProtoDetectionEnabled(const char *ipproto,
163  const char *alproto);
164 
165 /**
166  * \brief Inits and returns an app layer protocol detection thread context.
167 
168  * \param ctx Pointer to the app layer protocol detection context.
169  *
170  * \retval Pointer to the thread context, on success;
171  * NULL, on failure.
172  */
174 
175 /**
176  * \brief Destroys the app layer protocol detection thread context.
177  *
178  * \param tctx Pointer to the app layer protocol detection thread context.
179  */
181 
182 /***** Utility *****/
183 
184 void AppLayerProtoDetectSupportedIpprotos(AppProto alproto, uint8_t *ipprotos);
185 AppProto AppLayerProtoDetectGetProtoByName(const char *alproto_name);
186 const char *AppLayerProtoDetectGetProtoName(AppProto alproto);
188 
189 void AppLayerRegisterExpectationProto(uint8_t proto, AppProto alproto);
190 
191 /***** Unittests *****/
192 
193 #ifdef UNITTESTS
194 
195 /**
196  * \brief Backs up the internal context used by the app layer proto detection
197  * module.
198  */
200 
201 /**
202  * \brief Restores back the internal context used by the app layer proto
203  * detection module, that was previously backed up by calling
204  * AppLayerProtoDetectUnittestCtxBackup().
205  */
207 
208 /**
209  * \brief Register unittests for app layer proto detection module.
210  */
212 
213 #endif /* UNITTESTS */
214 
215 #endif /* __APP_LAYER_DETECT_PROTO__H__ */
AppLayerRequestProtocolTLSUpgrade
void AppLayerRequestProtocolTLSUpgrade(Flow *f)
request applayer to wrap up this protocol and rerun protocol detection with expectation of TLS....
Definition: app-layer-detect-proto.c:1963
offset
uint64_t offset
Definition: util-streaming-buffer.h:0
AppLayerProtoDetectPMRegisterPatternCS
int AppLayerProtoDetectPMRegisterPatternCS(uint8_t ipproto, AppProto alproto, const char *pattern, uint16_t depth, uint16_t offset, uint8_t direction)
Registers a case-sensitive pattern for protocol detection.
Definition: app-layer-detect-proto.c:1785
AppLayerProtoDetectPPRegister
void AppLayerProtoDetectPPRegister(uint8_t ipproto, const char *portstr, AppProto alproto, uint16_t min_depth, uint16_t max_depth, uint8_t direction, ProbingParserFPtr ProbingParser1, ProbingParserFPtr ProbingParser2)
register parser at a port
Definition: app-layer-detect-proto.c:1677
AppProto
uint16_t AppProto
Definition: app-layer-protos.h:77
AppLayerRequestProtocolChange
void AppLayerRequestProtocolChange(Flow *f, uint16_t dp, AppProto expect_proto)
request applayer to wrap up this protocol and rerun protocol detection.
Definition: app-layer-detect-proto.c:1939
AppLayerProtoDetectRegisterProtocol
void AppLayerProtoDetectRegisterProtocol(AppProto alproto, const char *alproto_name)
Registers a protocol for protocol detection phase.
Definition: app-layer-detect-proto.c:1889
Flow_
Flow data structure.
Definition: flow.h:350
AppLayerProtoDetectGetProtoName
const char * AppLayerProtoDetectGetProtoName(AppProto alproto)
Definition: app-layer-detect-proto.c:2170
AppLayerProtoDetectPMRegisterPatternCSwPP
int AppLayerProtoDetectPMRegisterPatternCSwPP(uint8_t ipproto, AppProto alproto, const char *pattern, uint16_t depth, uint16_t offset, uint8_t direction, ProbingParserFPtr PPFunc, uint16_t pp_min_depth, uint16_t pp_max_depth)
Definition: app-layer-detect-proto.c:1798
ProbingParserFPtr
AppProto(* ProbingParserFPtr)(Flow *f, uint8_t flags, const uint8_t *input, uint32_t input_len, uint8_t *rdir)
Definition: app-layer-detect-proto.h:30
AppLayerProtoDetectPPParseConfPorts
int AppLayerProtoDetectPPParseConfPorts(const char *ipproto_name, uint8_t ipproto, const char *alproto_name, AppProto alproto, uint16_t min_depth, uint16_t max_depth, ProbingParserFPtr ProbingParserTs, ProbingParserFPtr ProbingParserTc)
Definition: app-layer-detect-proto.c:1711
proto
uint8_t proto
Definition: decode-template.h:0
AppLayerProtoDetectSetup
int AppLayerProtoDetectSetup(void)
The first function to be called. This initializes a global protocol detection context.
Definition: app-layer-detect-proto.c:1827
AppLayerProtoDetectDeSetup
int AppLayerProtoDetectDeSetup(void)
Cleans up the app layer protocol detection phase.
Definition: app-layer-detect-proto.c:1857
AppLayerProtoDetectPrepareState
int AppLayerProtoDetectPrepareState(void)
Prepares the internal state for protocol detection. This needs to be called once all the patterns and...
Definition: app-layer-detect-proto.c:1633
AppLayerProtoDetectSupportedAppProtocols
void AppLayerProtoDetectSupportedAppProtocols(AppProto *alprotos)
Definition: app-layer-detect-proto.c:2175
AppLayerProtoDetectGetProtoByName
AppProto AppLayerProtoDetectGetProtoByName(const char *alproto_name)
Definition: app-layer-detect-proto.c:2145
AppLayerProtoDetectThreadCtx_
The app layer protocol detection thread context.
Definition: app-layer-detect-proto.c:175
AppLayerProtoDetectPMRegisterPatternCI
int AppLayerProtoDetectPMRegisterPatternCI(uint8_t ipproto, AppProto alproto, const char *pattern, uint16_t depth, uint16_t offset, uint8_t direction)
Registers a case-insensitive pattern for protocol detection.
Definition: app-layer-detect-proto.c:1812
AppLayerProtoDetectGetProto
AppProto AppLayerProtoDetectGetProto(AppLayerProtoDetectThreadCtx *tctx, Flow *f, const uint8_t *buf, uint32_t buflen, uint8_t ipproto, uint8_t flags, bool *reverse_flow)
Returns the app layer protocol given a buffer.
Definition: app-layer-detect-proto.c:1530
AppLayerProtoDetectUnittestsRegister
void AppLayerProtoDetectUnittestsRegister(void)
Register unittests for app layer proto detection module.
Definition: app-layer-detect-proto.c:3744
AppLayerProtoDetectGetCtxThread
AppLayerProtoDetectThreadCtx * AppLayerProtoDetectGetCtxThread(void)
Inits and returns an app layer protocol detection thread context.
Definition: app-layer-detect-proto.c:2048
AppLayerProtoDetectUnittestCtxRestore
void AppLayerProtoDetectUnittestCtxRestore(void)
Restores back the internal context used by the app layer proto detection module, that was previously ...
Definition: app-layer-detect-proto.c:2231
AppLayerProtoDetectRegisterAlias
void AppLayerProtoDetectRegisterAlias(const char *proto_name, const char *proto_alias)
Definition: app-layer-detect-proto.c:1899
AppLayerProtoDetectSupportedIpprotos
void AppLayerProtoDetectSupportedIpprotos(AppProto alproto, uint8_t *ipprotos)
Definition: app-layer-detect-proto.c:2128
flags
uint8_t flags
Definition: decode-gre.h:0
AppLayerProtoDetectConfProtoDetectionEnabled
int AppLayerProtoDetectConfProtoDetectionEnabled(const char *ipproto, const char *alproto)
Given a protocol name, checks if proto detection is enabled in the conf file.
Definition: app-layer-detect-proto.c:1987
AppLayerRegisterExpectationProto
void AppLayerRegisterExpectationProto(uint8_t proto, AppProto alproto)
Definition: app-layer-detect-proto.c:2204
AppLayerProtoDetectReset
void AppLayerProtoDetectReset(Flow *)
Reset proto detect for flow.
Definition: app-layer-detect-proto.c:1968
AppLayerProtoDetectDestroyCtxThread
void AppLayerProtoDetectDestroyCtxThread(AppLayerProtoDetectThreadCtx *tctx)
Destroys the app layer protocol detection thread context.
Definition: app-layer-detect-proto.c:2102
AppLayerProtoDetectUnittestCtxBackup
void AppLayerProtoDetectUnittestCtxBackup(void)
Backs up the internal context used by the app layer proto detection module.
Definition: app-layer-detect-proto.c:2223