suricata
app-layer-protos.h
Go to the documentation of this file.
1 /* Copyright (C) 2007-2021 Open Information Security Foundation
2  *
3  * You can copy, redistribute or modify this Program under the terms of
4  * the GNU General Public License version 2 as published by the Free
5  * Software Foundation.
6  *
7  * This program is distributed in the hope that it will be useful,
8  * but WITHOUT ANY WARRANTY; without even the implied warranty of
9  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
10  * GNU General Public License for more details.
11  *
12  * You should have received a copy of the GNU General Public License
13  * version 2 along with this program; if not, write to the Free Software
14  * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA
15  * 02110-1301, USA.
16  */
17 
18 /**
19  * \file
20  *
21  * \author Victor Julien <victor@inliniac.net>
22  * \author Anoop Saldanha <anoopsaldanha@gmail.com>
23  */
24 
25 #ifndef SURICATA_APP_LAYER_PROTOS_H
26 #define SURICATA_APP_LAYER_PROTOS_H
27 
33  ALPROTO_TLS, /* SSLv2, SSLv3 & TLSv1 */
40 
63 
64  // signature-only (ie not seen in flow)
65  // HTTP for any version (ALPROTO_HTTP1 (version 1) or ALPROTO_HTTP2)
67 
68  /* used by the probing parser when alproto detection fails
69  * permanently for that particular stream */
71 #ifdef UNITTESTS
73 #endif /* UNITESTS */
74  /* keep last */
76 };
77 // NOTE: if ALPROTO's get >= 256, update SignatureNonPrefilterStore
78 
79 /* not using the enum as that is a unsigned int, so 4 bytes */
80 typedef uint16_t AppProto;
81 
82 static inline bool AppProtoIsValid(AppProto a)
83 {
84  return ((a > ALPROTO_UNKNOWN && a < ALPROTO_FAILED));
85 }
86 
87 // whether a signature AppProto matches a flow (or signature) AppProto
88 static inline bool AppProtoEquals(AppProto sigproto, AppProto alproto)
89 {
90  if (sigproto == alproto) {
91  return true;
92  }
93  switch (sigproto) {
94  case ALPROTO_HTTP:
95  return (alproto == ALPROTO_HTTP1) || (alproto == ALPROTO_HTTP2);
96  case ALPROTO_DCERPC:
97  return (alproto == ALPROTO_SMB);
98  }
99  return false;
100 }
101 
102 /**
103  * \brief Maps the ALPROTO_*, to its string equivalent.
104  *
105  * \param alproto App layer protocol id.
106  *
107  * \retval String equivalent for the alproto.
108  */
109 const char *AppProtoToString(AppProto alproto);
110 
111 /**
112  * \brief Maps a string to its ALPROTO_* equivalent.
113  *
114  * \param String equivalent for the alproto.
115  *
116  * \retval alproto App layer protocol id, or ALPROTO_UNKNOWN.
117  */
118 AppProto StringToAppProto(const char *proto_name);
119 
120 #endif /* SURICATA_APP_LAYER_PROTOS_H */
ALPROTO_TEST
@ ALPROTO_TEST
Definition: app-layer-protos.h:72
ALPROTO_IKE
@ ALPROTO_IKE
Definition: app-layer-protos.h:49
ALPROTO_DCERPC
@ ALPROTO_DCERPC
Definition: app-layer-protos.h:38
ALPROTO_DNS
@ ALPROTO_DNS
Definition: app-layer-protos.h:41
ALPROTO_ENIP
@ ALPROTO_ENIP
Definition: app-layer-protos.h:43
ALPROTO_TLS
@ ALPROTO_TLS
Definition: app-layer-protos.h:33
ALPROTO_MODBUS
@ ALPROTO_MODBUS
Definition: app-layer-protos.h:42
AppProto
uint16_t AppProto
Definition: app-layer-protos.h:80
ALPROTO_QUIC
@ ALPROTO_QUIC
Definition: app-layer-protos.h:51
ALPROTO_JABBER
@ ALPROTO_JABBER
Definition: app-layer-protos.h:36
ALPROTO_IRC
@ ALPROTO_IRC
Definition: app-layer-protos.h:39
ALPROTO_SIP
@ ALPROTO_SIP
Definition: app-layer-protos.h:54
ALPROTO_FTP
@ ALPROTO_FTP
Definition: app-layer-protos.h:31
ALPROTO_SSH
@ ALPROTO_SSH
Definition: app-layer-protos.h:34
ALPROTO_DHCP
@ ALPROTO_DHCP
Definition: app-layer-protos.h:52
ALPROTO_MAX
@ ALPROTO_MAX
Definition: app-layer-protos.h:75
ALPROTO_KRB5
@ ALPROTO_KRB5
Definition: app-layer-protos.h:50
ALPROTO_SNMP
@ ALPROTO_SNMP
Definition: app-layer-protos.h:53
ALPROTO_DNP3
@ ALPROTO_DNP3
Definition: app-layer-protos.h:44
ALPROTO_SMTP
@ ALPROTO_SMTP
Definition: app-layer-protos.h:32
StringToAppProto
AppProto StringToAppProto(const char *proto_name)
Maps a string to its ALPROTO_* equivalent.
Definition: app-layer-protos.c:94
ALPROTO_IMAP
@ ALPROTO_IMAP
Definition: app-layer-protos.h:35
ALPROTO_RDP
@ ALPROTO_RDP
Definition: app-layer-protos.h:60
ALPROTO_TELNET
@ ALPROTO_TELNET
Definition: app-layer-protos.h:58
ALPROTO_TFTP
@ ALPROTO_TFTP
Definition: app-layer-protos.h:48
ALPROTO_HTTP2
@ ALPROTO_HTTP2
Definition: app-layer-protos.h:61
ALPROTO_HTTP1
@ ALPROTO_HTTP1
Definition: app-layer-protos.h:30
ALPROTO_PGSQL
@ ALPROTO_PGSQL
Definition: app-layer-protos.h:57
ALPROTO_FTPDATA
@ ALPROTO_FTPDATA
Definition: app-layer-protos.h:47
AppProtoToString
const char * AppProtoToString(AppProto alproto)
Maps the ALPROTO_*, to its string equivalent.
Definition: app-layer-protos.c:74
ALPROTO_MQTT
@ ALPROTO_MQTT
Definition: app-layer-protos.h:56
ALPROTO_HTTP
@ ALPROTO_HTTP
Definition: app-layer-protos.h:66
ALPROTO_UNKNOWN
@ ALPROTO_UNKNOWN
Definition: app-layer-protos.h:29
ALPROTO_FAILED
@ ALPROTO_FAILED
Definition: app-layer-protos.h:70
ALPROTO_TEMPLATE
@ ALPROTO_TEMPLATE
Definition: app-layer-protos.h:59
ALPROTO_RFB
@ ALPROTO_RFB
Definition: app-layer-protos.h:55
ALPROTO_BITTORRENT_DHT
@ ALPROTO_BITTORRENT_DHT
Definition: app-layer-protos.h:62
ALPROTO_NTP
@ ALPROTO_NTP
Definition: app-layer-protos.h:46
ALPROTO_SMB
@ ALPROTO_SMB
Definition: app-layer-protos.h:37
AppProtoEnum
AppProtoEnum
Definition: app-layer-protos.h:28
ALPROTO_NFS
@ ALPROTO_NFS
Definition: app-layer-protos.h:45