suricata
app-layer-protos.h
Go to the documentation of this file.
1 /* Copyright (C) 2007-2013 Open Information Security Foundation
2  *
3  * You can copy, redistribute or modify this Program under the terms of
4  * the GNU General Public License version 2 as published by the Free
5  * Software Foundation.
6  *
7  * This program is distributed in the hope that it will be useful,
8  * but WITHOUT ANY WARRANTY; without even the implied warranty of
9  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
10  * GNU General Public License for more details.
11  *
12  * You should have received a copy of the GNU General Public License
13  * version 2 along with this program; if not, write to the Free Software
14  * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA
15  * 02110-1301, USA.
16  */
17 
18 /**
19  * \file
20  *
21  * \author Victor Julien <victor@inliniac.net>
22  * \author Anoop Saldanha <anoopsaldanha@gmail.com>
23  */
24 
25 #ifndef __APP_LAYER_PROTOS_H__
26 #define __APP_LAYER_PROTOS_H__
27 
33  ALPROTO_TLS, /* SSLv2, SSLv3 & TLSv1 */
40 
60 
61  // signature-only (ie not seen in flow)
62  // HTTP for any version (ALPROTO_HTTP1 (version 1) or ALPROTO_HTTP2)
64 
65  /* used by the probing parser when alproto detection fails
66  * permanently for that particular stream */
68 #ifdef UNITTESTS
70 #endif /* UNITESTS */
71  /* keep last */
73 };
74 // NOTE: if ALPROTO's get >= 256, update SignatureNonPrefilterStore
75 
76 /* not using the enum as that is a unsigned int, so 4 bytes */
77 typedef uint16_t AppProto;
78 
79 static inline bool AppProtoIsValid(AppProto a)
80 {
81  return ((a > ALPROTO_UNKNOWN && a < ALPROTO_FAILED));
82 }
83 
84 // wether a signature AppProto matches a flow (or signature) AppProto
85 static inline bool AppProtoEquals(AppProto sigproto, AppProto alproto)
86 {
87  switch (sigproto) {
88  case ALPROTO_HTTP:
89  return (alproto == ALPROTO_HTTP1) || (alproto == ALPROTO_HTTP2) ||
90  (alproto == ALPROTO_HTTP);
91  }
92  return (sigproto == alproto);
93 }
94 
95 /**
96  * \brief Maps the ALPROTO_*, to its string equivalent.
97  *
98  * \param alproto App layer protocol id.
99  *
100  * \retval String equivalent for the alproto.
101  */
102 const char *AppProtoToString(AppProto alproto);
103 
104 /**
105  * \brief Maps a string to its ALPROTO_* equivalent.
106  *
107  * \param String equivalent for the alproto.
108  *
109  * \retval alproto App layer protocol id, or ALPROTO_UNKNOWN.
110  */
111 AppProto StringToAppProto(const char *proto_name);
112 
113 #endif /* __APP_LAYER_PROTOS_H__ */
ALPROTO_TEST
@ ALPROTO_TEST
Definition: app-layer-protos.h:69
ALPROTO_IKE
@ ALPROTO_IKE
Definition: app-layer-protos.h:49
ALPROTO_DCERPC
@ ALPROTO_DCERPC
Definition: app-layer-protos.h:38
ALPROTO_DNS
@ ALPROTO_DNS
Definition: app-layer-protos.h:41
ALPROTO_ENIP
@ ALPROTO_ENIP
Definition: app-layer-protos.h:43
ALPROTO_TLS
@ ALPROTO_TLS
Definition: app-layer-protos.h:33
ALPROTO_MODBUS
@ ALPROTO_MODBUS
Definition: app-layer-protos.h:42
AppProto
uint16_t AppProto
Definition: app-layer-protos.h:77
ALPROTO_JABBER
@ ALPROTO_JABBER
Definition: app-layer-protos.h:36
ALPROTO_IRC
@ ALPROTO_IRC
Definition: app-layer-protos.h:39
ALPROTO_SIP
@ ALPROTO_SIP
Definition: app-layer-protos.h:53
ALPROTO_FTP
@ ALPROTO_FTP
Definition: app-layer-protos.h:31
ALPROTO_SSH
@ ALPROTO_SSH
Definition: app-layer-protos.h:34
ALPROTO_DHCP
@ ALPROTO_DHCP
Definition: app-layer-protos.h:51
ALPROTO_MAX
@ ALPROTO_MAX
Definition: app-layer-protos.h:72
ALPROTO_KRB5
@ ALPROTO_KRB5
Definition: app-layer-protos.h:50
ALPROTO_SNMP
@ ALPROTO_SNMP
Definition: app-layer-protos.h:52
ALPROTO_DNP3
@ ALPROTO_DNP3
Definition: app-layer-protos.h:44
ALPROTO_SMTP
@ ALPROTO_SMTP
Definition: app-layer-protos.h:32
StringToAppProto
AppProto StringToAppProto(const char *proto_name)
Maps a string to its ALPROTO_* equivalent.
Definition: app-layer-protos.c:140
ALPROTO_IMAP
@ ALPROTO_IMAP
Definition: app-layer-protos.h:35
ALPROTO_RDP
@ ALPROTO_RDP
Definition: app-layer-protos.h:58
ALPROTO_TFTP
@ ALPROTO_TFTP
Definition: app-layer-protos.h:48
ALPROTO_HTTP2
@ ALPROTO_HTTP2
Definition: app-layer-protos.h:59
ALPROTO_HTTP1
@ ALPROTO_HTTP1
Definition: app-layer-protos.h:30
ALPROTO_FTPDATA
@ ALPROTO_FTPDATA
Definition: app-layer-protos.h:47
AppProtoToString
const char * AppProtoToString(AppProto alproto)
Maps the ALPROTO_*, to its string equivalent.
Definition: app-layer-protos.c:30
ALPROTO_MQTT
@ ALPROTO_MQTT
Definition: app-layer-protos.h:55
ALPROTO_HTTP
@ ALPROTO_HTTP
Definition: app-layer-protos.h:63
ALPROTO_UNKNOWN
@ ALPROTO_UNKNOWN
Definition: app-layer-protos.h:29
ALPROTO_FAILED
@ ALPROTO_FAILED
Definition: app-layer-protos.h:67
ALPROTO_TEMPLATE
@ ALPROTO_TEMPLATE
Definition: app-layer-protos.h:56
ALPROTO_RFB
@ ALPROTO_RFB
Definition: app-layer-protos.h:54
ALPROTO_NTP
@ ALPROTO_NTP
Definition: app-layer-protos.h:46
ALPROTO_SMB
@ ALPROTO_SMB
Definition: app-layer-protos.h:37
AppProtoEnum
AppProtoEnum
Definition: app-layer-protos.h:28
ALPROTO_NFS
@ ALPROTO_NFS
Definition: app-layer-protos.h:45
ALPROTO_TEMPLATE_RUST
@ ALPROTO_TEMPLATE_RUST
Definition: app-layer-protos.h:57