suricata
app-layer-protos.h
Go to the documentation of this file.
1
/* Copyright (C) 2007-2021 Open Information Security Foundation
2
*
3
* You can copy, redistribute or modify this Program under the terms of
4
* the GNU General Public License version 2 as published by the Free
5
* Software Foundation.
6
*
7
* This program is distributed in the hope that it will be useful,
8
* but WITHOUT ANY WARRANTY; without even the implied warranty of
9
* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
10
* GNU General Public License for more details.
11
*
12
* You should have received a copy of the GNU General Public License
13
* version 2 along with this program; if not, write to the Free Software
14
* Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA
15
* 02110-1301, USA.
16
*/
17
18
/**
19
* \file
20
*
21
* \author Victor Julien <victor@inliniac.net>
22
* \author Anoop Saldanha <anoopsaldanha@gmail.com>
23
*/
24
25
#ifndef SURICATA_APP_LAYER_PROTOS_H
26
#define SURICATA_APP_LAYER_PROTOS_H
27
28
enum
AppProtoEnum
{
29
ALPROTO_UNKNOWN
= 0,
30
ALPROTO_HTTP1
,
31
ALPROTO_FTP
,
32
ALPROTO_SMTP
,
33
ALPROTO_TLS
,
/* SSLv2, SSLv3 & TLSv1 */
34
ALPROTO_SSH
,
35
ALPROTO_IMAP
,
36
ALPROTO_JABBER
,
37
ALPROTO_SMB
,
38
ALPROTO_DCERPC
,
39
ALPROTO_IRC
,
40
41
ALPROTO_DNS
,
42
ALPROTO_MODBUS
,
43
ALPROTO_ENIP
,
44
ALPROTO_DNP3
,
45
ALPROTO_NFS
,
46
ALPROTO_NTP
,
47
ALPROTO_FTPDATA
,
48
ALPROTO_TFTP
,
49
ALPROTO_IKE
,
50
ALPROTO_KRB5
,
51
ALPROTO_QUIC
,
52
ALPROTO_DHCP
,
53
ALPROTO_SNMP
,
54
ALPROTO_SIP
,
55
ALPROTO_RFB
,
56
ALPROTO_MQTT
,
57
ALPROTO_PGSQL
,
58
ALPROTO_TELNET
,
59
ALPROTO_WEBSOCKET
,
60
ALPROTO_TEMPLATE
,
61
ALPROTO_RDP
,
62
ALPROTO_HTTP2
,
63
ALPROTO_BITTORRENT_DHT
,
64
65
// signature-only (ie not seen in flow)
66
// HTTP for any version (ALPROTO_HTTP1 (version 1) or ALPROTO_HTTP2)
67
ALPROTO_HTTP
,
68
69
/* used by the probing parser when alproto detection fails
70
* permanently for that particular stream */
71
ALPROTO_FAILED
,
72
#ifdef UNITTESTS
73
ALPROTO_TEST
,
74
#endif
/* UNITESTS */
75
/* keep last */
76
ALPROTO_MAX
,
77
};
78
// NOTE: if ALPROTO's get >= 256, update SignatureNonPrefilterStore
79
80
/* not using the enum as that is a unsigned int, so 4 bytes */
81
typedef
uint16_t
AppProto
;
82
83
static
inline
bool
AppProtoIsValid(
AppProto
a)
84
{
85
return
((a >
ALPROTO_UNKNOWN
&& a <
ALPROTO_FAILED
));
86
}
87
88
// whether a signature AppProto matches a flow (or signature) AppProto
89
static
inline
bool
AppProtoEquals(
AppProto
sigproto,
AppProto
alproto)
90
{
91
if
(sigproto == alproto) {
92
return
true
;
93
}
94
switch
(sigproto) {
95
case
ALPROTO_HTTP
:
96
return
(alproto ==
ALPROTO_HTTP1
) || (alproto ==
ALPROTO_HTTP2
);
97
case
ALPROTO_DCERPC
:
98
return
(alproto ==
ALPROTO_SMB
);
99
}
100
return
false
;
101
}
102
103
/**
104
* \brief Maps the ALPROTO_*, to its string equivalent.
105
*
106
* \param alproto App layer protocol id.
107
*
108
* \retval String equivalent for the alproto.
109
*/
110
const
char
*
AppProtoToString
(
AppProto
alproto);
111
112
/**
113
* \brief Maps a string to its ALPROTO_* equivalent.
114
*
115
* \param String equivalent for the alproto.
116
*
117
* \retval alproto App layer protocol id, or ALPROTO_UNKNOWN.
118
*/
119
AppProto
StringToAppProto
(
const
char
*proto_name);
120
121
#endif
/* SURICATA_APP_LAYER_PROTOS_H */
ALPROTO_TEST
@ ALPROTO_TEST
Definition:
app-layer-protos.h:73
ALPROTO_IKE
@ ALPROTO_IKE
Definition:
app-layer-protos.h:49
ALPROTO_DCERPC
@ ALPROTO_DCERPC
Definition:
app-layer-protos.h:38
ALPROTO_DNS
@ ALPROTO_DNS
Definition:
app-layer-protos.h:41
ALPROTO_ENIP
@ ALPROTO_ENIP
Definition:
app-layer-protos.h:43
ALPROTO_TLS
@ ALPROTO_TLS
Definition:
app-layer-protos.h:33
ALPROTO_MODBUS
@ ALPROTO_MODBUS
Definition:
app-layer-protos.h:42
AppProto
uint16_t AppProto
Definition:
app-layer-protos.h:81
ALPROTO_QUIC
@ ALPROTO_QUIC
Definition:
app-layer-protos.h:51
ALPROTO_JABBER
@ ALPROTO_JABBER
Definition:
app-layer-protos.h:36
ALPROTO_IRC
@ ALPROTO_IRC
Definition:
app-layer-protos.h:39
ALPROTO_SIP
@ ALPROTO_SIP
Definition:
app-layer-protos.h:54
ALPROTO_FTP
@ ALPROTO_FTP
Definition:
app-layer-protos.h:31
ALPROTO_SSH
@ ALPROTO_SSH
Definition:
app-layer-protos.h:34
ALPROTO_DHCP
@ ALPROTO_DHCP
Definition:
app-layer-protos.h:52
ALPROTO_MAX
@ ALPROTO_MAX
Definition:
app-layer-protos.h:76
ALPROTO_KRB5
@ ALPROTO_KRB5
Definition:
app-layer-protos.h:50
ALPROTO_SNMP
@ ALPROTO_SNMP
Definition:
app-layer-protos.h:53
ALPROTO_DNP3
@ ALPROTO_DNP3
Definition:
app-layer-protos.h:44
ALPROTO_SMTP
@ ALPROTO_SMTP
Definition:
app-layer-protos.h:32
StringToAppProto
AppProto StringToAppProto(const char *proto_name)
Maps a string to its ALPROTO_* equivalent.
Definition:
app-layer-protos.c:95
ALPROTO_IMAP
@ ALPROTO_IMAP
Definition:
app-layer-protos.h:35
ALPROTO_RDP
@ ALPROTO_RDP
Definition:
app-layer-protos.h:61
ALPROTO_TELNET
@ ALPROTO_TELNET
Definition:
app-layer-protos.h:58
ALPROTO_TFTP
@ ALPROTO_TFTP
Definition:
app-layer-protos.h:48
ALPROTO_HTTP2
@ ALPROTO_HTTP2
Definition:
app-layer-protos.h:62
ALPROTO_HTTP1
@ ALPROTO_HTTP1
Definition:
app-layer-protos.h:30
ALPROTO_PGSQL
@ ALPROTO_PGSQL
Definition:
app-layer-protos.h:57
ALPROTO_FTPDATA
@ ALPROTO_FTPDATA
Definition:
app-layer-protos.h:47
ALPROTO_WEBSOCKET
@ ALPROTO_WEBSOCKET
Definition:
app-layer-protos.h:59
AppProtoToString
const char * AppProtoToString(AppProto alproto)
Maps the ALPROTO_*, to its string equivalent.
Definition:
app-layer-protos.c:75
ALPROTO_MQTT
@ ALPROTO_MQTT
Definition:
app-layer-protos.h:56
ALPROTO_HTTP
@ ALPROTO_HTTP
Definition:
app-layer-protos.h:67
ALPROTO_UNKNOWN
@ ALPROTO_UNKNOWN
Definition:
app-layer-protos.h:29
ALPROTO_FAILED
@ ALPROTO_FAILED
Definition:
app-layer-protos.h:71
ALPROTO_TEMPLATE
@ ALPROTO_TEMPLATE
Definition:
app-layer-protos.h:60
ALPROTO_RFB
@ ALPROTO_RFB
Definition:
app-layer-protos.h:55
ALPROTO_BITTORRENT_DHT
@ ALPROTO_BITTORRENT_DHT
Definition:
app-layer-protos.h:63
ALPROTO_NTP
@ ALPROTO_NTP
Definition:
app-layer-protos.h:46
ALPROTO_SMB
@ ALPROTO_SMB
Definition:
app-layer-protos.h:37
AppProtoEnum
AppProtoEnum
Definition:
app-layer-protos.h:28
ALPROTO_NFS
@ ALPROTO_NFS
Definition:
app-layer-protos.h:45
src
app-layer-protos.h
Generated on Fri Apr 26 2024 23:30:33 for suricata by
1.8.18