suricata
app-layer-protos.h
Go to the documentation of this file.
1 /* Copyright (C) 2007-2021 Open Information Security Foundation
2  *
3  * You can copy, redistribute or modify this Program under the terms of
4  * the GNU General Public License version 2 as published by the Free
5  * Software Foundation.
6  *
7  * This program is distributed in the hope that it will be useful,
8  * but WITHOUT ANY WARRANTY; without even the implied warranty of
9  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
10  * GNU General Public License for more details.
11  *
12  * You should have received a copy of the GNU General Public License
13  * version 2 along with this program; if not, write to the Free Software
14  * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA
15  * 02110-1301, USA.
16  */
17 
18 /**
19  * \file
20  *
21  * \author Victor Julien <victor@inliniac.net>
22  * \author Anoop Saldanha <anoopsaldanha@gmail.com>
23  */
24 
25 #ifndef SURICATA_APP_LAYER_PROTOS_H
26 #define SURICATA_APP_LAYER_PROTOS_H
27 
33  ALPROTO_TLS, /* SSLv2, SSLv3 & TLSv1 */
40 
67 
68  // signature-only (ie not seen in flow)
69  // HTTP for any version (ALPROTO_HTTP1 (version 1) or ALPROTO_HTTP2)
71 
72  /* used by the probing parser when alproto detection fails
73  * permanently for that particular stream */
75 #ifdef UNITTESTS
77 #endif /* UNITESTS */
78  /* keep last */
80 };
81 // NOTE: if ALPROTO's get >= 256, update SignatureNonPrefilterStore
82 
83 /* not using the enum as that is a unsigned int, so 4 bytes */
84 typedef uint16_t AppProto;
85 
86 static inline bool AppProtoIsValid(AppProto a)
87 {
88  return ((a > ALPROTO_UNKNOWN && a < ALPROTO_FAILED));
89 }
90 
91 // whether a signature AppProto matches a flow (or signature) AppProto
92 static inline bool AppProtoEquals(AppProto sigproto, AppProto alproto)
93 {
94  if (sigproto == alproto) {
95  return true;
96  }
97  switch (sigproto) {
98  case ALPROTO_DNS:
99  // a DNS signature matches on either DNS or DOH2 flows
100  return (alproto == ALPROTO_DOH2) || (alproto == ALPROTO_DNS);
101  case ALPROTO_HTTP2:
102  // a HTTP2 signature matches on either HTTP2 or DOH2 flows
103  return (alproto == ALPROTO_DOH2) || (alproto == ALPROTO_HTTP2);
104  case ALPROTO_DOH2:
105  // a DOH2 signature accepts dns, http2 or http generic keywords
106  return (alproto == ALPROTO_DOH2) || (alproto == ALPROTO_HTTP2) ||
107  (alproto == ALPROTO_DNS) || (alproto == ALPROTO_HTTP);
108  case ALPROTO_HTTP:
109  return (alproto == ALPROTO_HTTP1) || (alproto == ALPROTO_HTTP2);
110  case ALPROTO_DCERPC:
111  return (alproto == ALPROTO_SMB);
112  }
113  return false;
114 }
115 
116 // whether a signature AppProto matches a flow (or signature) AppProto
117 static inline AppProto AppProtoCommon(AppProto sigproto, AppProto alproto)
118 {
119  switch (sigproto) {
120  case ALPROTO_SMB:
121  if (alproto == ALPROTO_DCERPC) {
122  // ok to have dcerpc keywords in smb sig
123  return ALPROTO_SMB;
124  }
125  break;
126  case ALPROTO_HTTP:
127  // we had a generic http sig, now version specific
128  if (alproto == ALPROTO_HTTP1) {
129  return ALPROTO_HTTP1;
130  } else if (alproto == ALPROTO_HTTP2) {
131  return ALPROTO_HTTP2;
132  }
133  break;
134  case ALPROTO_HTTP1:
135  // version-specific sig with a generic keyword
136  if (alproto == ALPROTO_HTTP) {
137  return ALPROTO_HTTP1;
138  }
139  break;
140  case ALPROTO_HTTP2:
141  if (alproto == ALPROTO_HTTP) {
142  return ALPROTO_HTTP2;
143  }
144  break;
145  case ALPROTO_DOH2:
146  // DOH2 accepts different protocol keywords
147  if (alproto == ALPROTO_HTTP || alproto == ALPROTO_HTTP2 || alproto == ALPROTO_DNS) {
148  return ALPROTO_DOH2;
149  }
150  break;
151  }
152  if (sigproto != alproto) {
153  return ALPROTO_FAILED;
154  }
155  return alproto;
156 }
157 
158 /**
159  * \brief Maps the ALPROTO_*, to its string equivalent.
160  *
161  * \param alproto App layer protocol id.
162  *
163  * \retval String equivalent for the alproto.
164  */
165 const char *AppProtoToString(AppProto alproto);
166 
167 /**
168  * \brief Maps a string to its ALPROTO_* equivalent.
169  *
170  * \param String equivalent for the alproto.
171  *
172  * \retval alproto App layer protocol id, or ALPROTO_UNKNOWN.
173  */
174 AppProto StringToAppProto(const char *proto_name);
175 
176 #endif /* SURICATA_APP_LAYER_PROTOS_H */
ALPROTO_TEST
@ ALPROTO_TEST
Definition: app-layer-protos.h:76
ALPROTO_IKE
@ ALPROTO_IKE
Definition: app-layer-protos.h:49
ALPROTO_DCERPC
@ ALPROTO_DCERPC
Definition: app-layer-protos.h:38
ALPROTO_DNS
@ ALPROTO_DNS
Definition: app-layer-protos.h:41
ALPROTO_ENIP
@ ALPROTO_ENIP
Definition: app-layer-protos.h:43
ALPROTO_TLS
@ ALPROTO_TLS
Definition: app-layer-protos.h:33
ALPROTO_MODBUS
@ ALPROTO_MODBUS
Definition: app-layer-protos.h:42
AppProto
uint16_t AppProto
Definition: app-layer-protos.h:84
ALPROTO_QUIC
@ ALPROTO_QUIC
Definition: app-layer-protos.h:51
ALPROTO_POP3
@ ALPROTO_POP3
Definition: app-layer-protos.h:66
ALPROTO_JABBER
@ ALPROTO_JABBER
Definition: app-layer-protos.h:36
ALPROTO_IRC
@ ALPROTO_IRC
Definition: app-layer-protos.h:39
ALPROTO_SIP
@ ALPROTO_SIP
Definition: app-layer-protos.h:54
ALPROTO_LDAP
@ ALPROTO_LDAP
Definition: app-layer-protos.h:60
ALPROTO_FTP
@ ALPROTO_FTP
Definition: app-layer-protos.h:31
ALPROTO_SSH
@ ALPROTO_SSH
Definition: app-layer-protos.h:34
ALPROTO_DHCP
@ ALPROTO_DHCP
Definition: app-layer-protos.h:52
ALPROTO_MAX
@ ALPROTO_MAX
Definition: app-layer-protos.h:79
ALPROTO_KRB5
@ ALPROTO_KRB5
Definition: app-layer-protos.h:50
ALPROTO_SNMP
@ ALPROTO_SNMP
Definition: app-layer-protos.h:53
ALPROTO_DNP3
@ ALPROTO_DNP3
Definition: app-layer-protos.h:44
ALPROTO_SMTP
@ ALPROTO_SMTP
Definition: app-layer-protos.h:32
StringToAppProto
AppProto StringToAppProto(const char *proto_name)
Maps a string to its ALPROTO_* equivalent.
Definition: app-layer-protos.c:98
ALPROTO_IMAP
@ ALPROTO_IMAP
Definition: app-layer-protos.h:35
ALPROTO_RDP
@ ALPROTO_RDP
Definition: app-layer-protos.h:63
ALPROTO_TELNET
@ ALPROTO_TELNET
Definition: app-layer-protos.h:58
ALPROTO_DOH2
@ ALPROTO_DOH2
Definition: app-layer-protos.h:61
ALPROTO_TFTP
@ ALPROTO_TFTP
Definition: app-layer-protos.h:48
ALPROTO_HTTP2
@ ALPROTO_HTTP2
Definition: app-layer-protos.h:64
ALPROTO_HTTP1
@ ALPROTO_HTTP1
Definition: app-layer-protos.h:30
ALPROTO_PGSQL
@ ALPROTO_PGSQL
Definition: app-layer-protos.h:57
ALPROTO_FTPDATA
@ ALPROTO_FTPDATA
Definition: app-layer-protos.h:47
ALPROTO_WEBSOCKET
@ ALPROTO_WEBSOCKET
Definition: app-layer-protos.h:59
AppProtoToString
const char * AppProtoToString(AppProto alproto)
Maps the ALPROTO_*, to its string equivalent.
Definition: app-layer-protos.c:78
ALPROTO_MQTT
@ ALPROTO_MQTT
Definition: app-layer-protos.h:56
ALPROTO_HTTP
@ ALPROTO_HTTP
Definition: app-layer-protos.h:70
ALPROTO_UNKNOWN
@ ALPROTO_UNKNOWN
Definition: app-layer-protos.h:29
ALPROTO_FAILED
@ ALPROTO_FAILED
Definition: app-layer-protos.h:74
ALPROTO_TEMPLATE
@ ALPROTO_TEMPLATE
Definition: app-layer-protos.h:62
ALPROTO_RFB
@ ALPROTO_RFB
Definition: app-layer-protos.h:55
ALPROTO_BITTORRENT_DHT
@ ALPROTO_BITTORRENT_DHT
Definition: app-layer-protos.h:65
ALPROTO_NTP
@ ALPROTO_NTP
Definition: app-layer-protos.h:46
ALPROTO_SMB
@ ALPROTO_SMB
Definition: app-layer-protos.h:37
AppProtoEnum
AppProtoEnum
Definition: app-layer-protos.h:28
ALPROTO_NFS
@ ALPROTO_NFS
Definition: app-layer-protos.h:45