suricata
app-layer-detect-proto.h
Go to the documentation of this file.
1 /* Copyright (C) 2007-2014 Open Information Security Foundation
2  *
3  * You can copy, redistribute or modify this Program under the terms of
4  * the GNU General Public License version 2 as published by the Free
5  * Software Foundation.
6  *
7  * This program is distributed in the hope that it will be useful,
8  * but WITHOUT ANY WARRANTY; without even the implied warranty of
9  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
10  * GNU General Public License for more details.
11  *
12  * You should have received a copy of the GNU General Public License
13  * version 2 along with this program; if not, write to the Free Software
14  * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA
15  * 02110-1301, USA.
16  */
17 
18 /**
19  * \file
20  *
21  * \author Victor Julien <victor@inliniac.net>
22  * \author Anoop Saldanha <anoopsaldanha@gmail.com>
23  */
24 
25 #ifndef SURICATA_APP_LAYER_DETECT_PROTO__H
26 #define SURICATA_APP_LAYER_DETECT_PROTO__H
27 
28 #include "flow.h"
29 #include "app-layer-protos.h"
30 
32 
34  Flow *f, uint8_t flags, const uint8_t *input, uint32_t input_len, uint8_t *rdir);
35 
36 /***** Protocol Retrieval *****/
37 
38 /**
39  * \brief Returns the app layer protocol given a buffer.
40  *
41  * \param tctx Pointer to the app layer protocol detection thread context.
42  * \param f Pointer to the flow.
43  * \param buf The buffer to be inspected.
44  * \param buflen The length of the above buffer.
45  * \param ipproto The ip protocol.
46  * \param flags The direction bitfield - STREAM_TOSERVER/STREAM_TOCLIENT.
47  * \param[out] reverse_flow true if flow is detected to be reversed
48  *
49  * \retval The app layer protocol.
50  */
52  const uint8_t *buf, uint32_t buflen, uint8_t ipproto, uint8_t flags, bool *reverse_flow);
53 
54 /***** State Preparation *****/
55 
56 /**
57  * \brief Prepares the internal state for protocol detection.
58  * This needs to be called once all the patterns and probing parser
59  * ports have been registered.
60  */
62 
63 /***** PP registration *****/
64 
65 void AppLayerProtoDetectPPRegister(uint8_t ipproto,
66  const char *portstr,
67  AppProto alproto,
68  uint16_t min_depth, uint16_t max_depth,
69  uint8_t direction,
70  ProbingParserFPtr ProbingParser1,
71  ProbingParserFPtr ProbingParser2);
72 /**
73  * \retval bool 0 if no config was found, 1 if config was found
74  */
75 int AppLayerProtoDetectPPParseConfPorts(const char *ipproto_name,
76  uint8_t ipproto,
77  const char *alproto_name,
78  AppProto alproto,
79  uint16_t min_depth, uint16_t max_depth,
80  ProbingParserFPtr ProbingParserTs,
81  ProbingParserFPtr ProbingParserTc);
82 
83 /***** PM registration *****/
84 
85 /**
86  * \brief Registers a case-sensitive pattern for protocol detection.
87  */
88 int AppLayerProtoDetectPMRegisterPatternCS(uint8_t ipproto, AppProto alproto,
89  const char *pattern, uint16_t depth, uint16_t offset,
90  uint8_t direction);
91 int AppLayerProtoDetectPMRegisterPatternCSwPP(uint8_t ipproto, AppProto alproto,
92  const char *pattern, uint16_t depth, uint16_t offset,
93  uint8_t direction,
94  ProbingParserFPtr PPFunc,
95  uint16_t pp_min_depth, uint16_t pp_max_depth);
96 
97 /**
98  * \brief Registers a case-insensitive pattern for protocol detection.
99  */
100 int AppLayerProtoDetectPMRegisterPatternCI(uint8_t ipproto, AppProto alproto,
101  const char *pattern,
102  uint16_t depth, uint16_t offset,
103  uint8_t direction);
104 
105 /***** Setup/General Registration *****/
106 
107 /**
108  * \brief The first function to be called. This initializes a global
109  * protocol detection context.
110  *
111  * \retval 0 On success;
112  * \retval -1 On failure.
113  */
114 int AppLayerProtoDetectSetup(void);
115 
116 /**
117  * \brief Reset proto detect for flow
118  */
120 
121 bool AppLayerRequestProtocolChange(Flow *f, uint16_t dp, AppProto expect_proto);
123 
124 void AppLayerForceProtocolChange(Flow *f, AppProto new_proto);
125 
126 /**
127  * \brief Cleans up the app layer protocol detection phase.
128  */
130 
131 /**
132  * \brief Registers a protocol for protocol detection phase.
133  *
134  * This is the first function to be called after calling the
135  * setup function, AppLayerProtoDetectSetup(), before calling any other
136  * app layer functions, AppLayerParser or AppLayerProtoDetect, alike.
137  * With this function you are associating/registering a string
138  * that can be used by users to write rules, i.e.
139  * you register the http protocol for protocol detection using
140  * AppLayerProtoDetectRegisterProtocol(ctx, ALPROTO_HTTP1, "http"),
141  * following which you can write rules like -
142  * alert http any any -> any any (sid:1;)
143  * which basically matches on the HTTP protocol.
144  *
145  * \param alproto The protocol.
146  * \param alproto_str The string to associate with the above "alproto".
147  * Please send a static string that won't be destroyed
148  * post making this call, since this function won't
149  * create a copy of the received argument.
150  *
151  * \retval 0 On success;
152  * -1 On failure.
153  */
154 void AppLayerProtoDetectRegisterProtocol(AppProto alproto, const char *alproto_name);
155 
156 void AppLayerProtoDetectRegisterAlias(const char *proto_name, const char *proto_alias);
157 
158 /**
159  * \brief Given a protocol name, checks if proto detection is enabled in
160  * the conf file.
161  *
162  * \param alproto Name of the app layer protocol.
163  *
164  * \retval 1 If enabled.
165  * \retval 0 If disabled.
166  */
167 int AppLayerProtoDetectConfProtoDetectionEnabled(const char *ipproto,
168  const char *alproto);
169 
170 /**
171  * \brief Given a protocol name, checks if proto detection is enabled in
172  * the conf file.
173  *
174  * \param alproto Name of the app layer protocol.
175  * \param default_enabled enable by default if not in the configuration file
176  *
177  * \retval 1 If enabled.
178  * \retval 0 If disabled.
179  */
181  const char *ipproto, const char *alproto, bool default_enabled);
182 
183 /**
184  * \brief Inits and returns an app layer protocol detection thread context.
185 
186  * \param ctx Pointer to the app layer protocol detection context.
187  *
188  * \retval Pointer to the thread context, on success;
189  * NULL, on failure.
190  */
192 
193 /**
194  * \brief Destroys the app layer protocol detection thread context.
195  *
196  * \param tctx Pointer to the app layer protocol detection thread context.
197  */
199 
200 /***** Utility *****/
201 
202 void AppLayerProtoDetectSupportedIpprotos(AppProto alproto, uint8_t *ipprotos);
203 AppProto AppLayerProtoDetectGetProtoByName(const char *alproto_name);
204 const char *AppLayerProtoDetectGetProtoName(AppProto alproto);
206 
207 void AppLayerRegisterExpectationProto(uint8_t proto, AppProto alproto);
208 
209 /***** Unittests *****/
210 
211 #ifdef UNITTESTS
212 
213 /**
214  * \brief Backs up the internal context used by the app layer proto detection
215  * module.
216  */
218 
219 /**
220  * \brief Restores back the internal context used by the app layer proto
221  * detection module, that was previously backed up by calling
222  * AppLayerProtoDetectUnittestCtxBackup().
223  */
225 
226 /**
227  * \brief Register unittests for app layer proto detection module.
228  */
230 
231 #endif /* UNITTESTS */
232 
233 #endif /* SURICATA_APP_LAYER_DETECT_PROTO__H */
offset
uint64_t offset
Definition: util-streaming-buffer.h:0
AppLayerProtoDetectPMRegisterPatternCS
int AppLayerProtoDetectPMRegisterPatternCS(uint8_t ipproto, AppProto alproto, const char *pattern, uint16_t depth, uint16_t offset, uint8_t direction)
Registers a case-sensitive pattern for protocol detection.
Definition: app-layer-detect-proto.c:1657
AppLayerProtoDetectPPRegister
void AppLayerProtoDetectPPRegister(uint8_t ipproto, const char *portstr, AppProto alproto, uint16_t min_depth, uint16_t max_depth, uint8_t direction, ProbingParserFPtr ProbingParser1, ProbingParserFPtr ProbingParser2)
register parser at a port
Definition: app-layer-detect-proto.c:1543
AppProto
uint16_t AppProto
Definition: app-layer-protos.h:84
AppLayerProtoDetectRegisterProtocol
void AppLayerProtoDetectRegisterProtocol(AppProto alproto, const char *alproto_name)
Registers a protocol for protocol detection phase.
Definition: app-layer-detect-proto.c:1761
Flow_
Flow data structure.
Definition: flow.h:356
AppLayerProtoDetectGetProtoName
const char * AppLayerProtoDetectGetProtoName(AppProto alproto)
Definition: app-layer-detect-proto.c:2081
AppLayerProtoDetectPMRegisterPatternCSwPP
int AppLayerProtoDetectPMRegisterPatternCSwPP(uint8_t ipproto, AppProto alproto, const char *pattern, uint16_t depth, uint16_t offset, uint8_t direction, ProbingParserFPtr PPFunc, uint16_t pp_min_depth, uint16_t pp_max_depth)
Definition: app-layer-detect-proto.c:1670
ProbingParserFPtr
AppProto(* ProbingParserFPtr)(Flow *f, uint8_t flags, const uint8_t *input, uint32_t input_len, uint8_t *rdir)
Definition: app-layer-detect-proto.h:33
AppLayerProtoDetectPPParseConfPorts
int AppLayerProtoDetectPPParseConfPorts(const char *ipproto_name, uint8_t ipproto, const char *alproto_name, AppProto alproto, uint16_t min_depth, uint16_t max_depth, ProbingParserFPtr ProbingParserTs, ProbingParserFPtr ProbingParserTc)
Definition: app-layer-detect-proto.c:1583
proto
uint8_t proto
Definition: decode-template.h:0
AppLayerProtoDetectSetup
int AppLayerProtoDetectSetup(void)
The first function to be called. This initializes a global protocol detection context.
Definition: app-layer-detect-proto.c:1699
AppLayerProtoDetectDeSetup
int AppLayerProtoDetectDeSetup(void)
Cleans up the app layer protocol detection phase.
Definition: app-layer-detect-proto.c:1729
AppLayerForceProtocolChange
void AppLayerForceProtocolChange(Flow *f, AppProto new_proto)
Forces a flow app-layer protocol change. Happens for instance when a HTTP2 flow is seen as DOH2.
Definition: app-layer-detect-proto.c:1853
AppLayerProtoDetectPrepareState
int AppLayerProtoDetectPrepareState(void)
Prepares the internal state for protocol detection. This needs to be called once all the patterns and...
Definition: app-layer-detect-proto.c:1499
AppLayerProtoDetectSupportedAppProtocols
void AppLayerProtoDetectSupportedAppProtocols(AppProto *alprotos)
Definition: app-layer-detect-proto.c:2098
AppLayerProtoDetectGetProtoByName
AppProto AppLayerProtoDetectGetProtoByName(const char *alproto_name)
Definition: app-layer-detect-proto.c:2056
AppLayerProtoDetectThreadCtx_
The app layer protocol detection thread context.
Definition: app-layer-detect-proto.c:174
AppLayerProtoDetectPMRegisterPatternCI
int AppLayerProtoDetectPMRegisterPatternCI(uint8_t ipproto, AppProto alproto, const char *pattern, uint16_t depth, uint16_t offset, uint8_t direction)
Registers a case-insensitive pattern for protocol detection.
Definition: app-layer-detect-proto.c:1684
AppLayerProtoDetectConfProtoDetectionEnabledDefault
int AppLayerProtoDetectConfProtoDetectionEnabledDefault(const char *ipproto, const char *alproto, bool default_enabled)
Given a protocol name, checks if proto detection is enabled in the conf file.
Definition: app-layer-detect-proto.c:1882
AppLayerProtoDetectGetProto
AppProto AppLayerProtoDetectGetProto(AppLayerProtoDetectThreadCtx *tctx, Flow *f, const uint8_t *buf, uint32_t buflen, uint8_t ipproto, uint8_t flags, bool *reverse_flow)
Returns the app layer protocol given a buffer.
Definition: app-layer-detect-proto.c:1396
AppLayerProtoDetectUnittestsRegister
void AppLayerProtoDetectUnittestsRegister(void)
Register unittests for app layer proto detection module.
Definition: app-layer-detect-proto.c:3649
AppLayerProtoDetectGetCtxThread
AppLayerProtoDetectThreadCtx * AppLayerProtoDetectGetCtxThread(void)
Inits and returns an app layer protocol detection thread context.
Definition: app-layer-detect-proto.c:1957
AppLayerProtoDetectUnittestCtxRestore
void AppLayerProtoDetectUnittestCtxRestore(void)
Restores back the internal context used by the app layer proto detection module, that was previously ...
Definition: app-layer-detect-proto.c:2154
AppLayerProtoDetectRegisterAlias
void AppLayerProtoDetectRegisterAlias(const char *proto_name, const char *proto_alias)
Definition: app-layer-detect-proto.c:1771
AppLayerProtoDetectSupportedIpprotos
void AppLayerProtoDetectSupportedIpprotos(AppProto alproto, uint8_t *ipprotos)
Definition: app-layer-detect-proto.c:2036
AppLayerRequestProtocolChange
bool AppLayerRequestProtocolChange(Flow *f, uint16_t dp, AppProto expect_proto)
request applayer to wrap up this protocol and rerun protocol detection.
Definition: app-layer-detect-proto.c:1811
flags
uint8_t flags
Definition: decode-gre.h:0
AppLayerRequestProtocolTLSUpgrade
bool AppLayerRequestProtocolTLSUpgrade(Flow *f)
request applayer to wrap up this protocol and rerun protocol detection with expectation of TLS....
Definition: app-layer-detect-proto.c:1842
AppLayerProtoDetectConfProtoDetectionEnabled
int AppLayerProtoDetectConfProtoDetectionEnabled(const char *ipproto, const char *alproto)
Given a protocol name, checks if proto detection is enabled in the conf file.
Definition: app-layer-detect-proto.c:1952
AppLayerRegisterExpectationProto
void AppLayerRegisterExpectationProto(uint8_t proto, AppProto alproto)
Definition: app-layer-detect-proto.c:2127
AppLayerProtoDetectReset
void AppLayerProtoDetectReset(Flow *)
Reset proto detect for flow.
Definition: app-layer-detect-proto.c:1863
app-layer-protos.h
flow.h
AppLayerProtoDetectDestroyCtxThread
void AppLayerProtoDetectDestroyCtxThread(AppLayerProtoDetectThreadCtx *tctx)
Destroys the app layer protocol detection thread context.
Definition: app-layer-detect-proto.c:2010
AppLayerProtoDetectUnittestCtxBackup
void AppLayerProtoDetectUnittestCtxBackup(void)
Backs up the internal context used by the app layer proto detection module.
Definition: app-layer-detect-proto.c:2146