suricata
app-layer-protos.h
Go to the documentation of this file.
1
/* Copyright (C) 2007-2021 Open Information Security Foundation
2
*
3
* You can copy, redistribute or modify this Program under the terms of
4
* the GNU General Public License version 2 as published by the Free
5
* Software Foundation.
6
*
7
* This program is distributed in the hope that it will be useful,
8
* but WITHOUT ANY WARRANTY; without even the implied warranty of
9
* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
10
* GNU General Public License for more details.
11
*
12
* You should have received a copy of the GNU General Public License
13
* version 2 along with this program; if not, write to the Free Software
14
* Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA
15
* 02110-1301, USA.
16
*/
17
18
/**
19
* \file
20
*
21
* \author Victor Julien <victor@inliniac.net>
22
* \author Anoop Saldanha <anoopsaldanha@gmail.com>
23
*/
24
25
#ifndef SURICATA_APP_LAYER_PROTOS_H
26
#define SURICATA_APP_LAYER_PROTOS_H
27
28
enum
AppProtoEnum
{
29
ALPROTO_UNKNOWN
= 0,
30
ALPROTO_HTTP1
,
31
ALPROTO_FTP
,
32
ALPROTO_SMTP
,
33
ALPROTO_TLS
,
/* SSLv2, SSLv3 & TLSv1 */
34
ALPROTO_SSH
,
35
ALPROTO_IMAP
,
36
ALPROTO_JABBER
,
37
ALPROTO_SMB
,
38
ALPROTO_DCERPC
,
39
ALPROTO_IRC
,
40
41
ALPROTO_DNS
,
42
ALPROTO_MODBUS
,
43
ALPROTO_ENIP
,
44
ALPROTO_DNP3
,
45
ALPROTO_NFS
,
46
ALPROTO_NTP
,
47
ALPROTO_FTPDATA
,
48
ALPROTO_TFTP
,
49
ALPROTO_IKE
,
50
ALPROTO_KRB5
,
51
ALPROTO_QUIC
,
52
ALPROTO_DHCP
,
53
ALPROTO_SNMP
,
54
ALPROTO_SIP
,
55
ALPROTO_RFB
,
56
ALPROTO_MQTT
,
57
ALPROTO_PGSQL
,
58
ALPROTO_TELNET
,
59
ALPROTO_WEBSOCKET
,
60
ALPROTO_LDAP
,
61
ALPROTO_DOH2
,
62
ALPROTO_TEMPLATE
,
63
ALPROTO_RDP
,
64
ALPROTO_HTTP2
,
65
ALPROTO_BITTORRENT_DHT
,
66
ALPROTO_POP3
,
67
68
// signature-only (ie not seen in flow)
69
// HTTP for any version (ALPROTO_HTTP1 (version 1) or ALPROTO_HTTP2)
70
ALPROTO_HTTP
,
71
72
/* used by the probing parser when alproto detection fails
73
* permanently for that particular stream */
74
ALPROTO_FAILED
,
75
#ifdef UNITTESTS
76
ALPROTO_TEST
,
77
#endif
/* UNITESTS */
78
/* keep last */
79
ALPROTO_MAX
,
80
};
81
// NOTE: if ALPROTO's get >= 256, update SignatureNonPrefilterStore
82
83
/* not using the enum as that is a unsigned int, so 4 bytes */
84
typedef
uint16_t
AppProto
;
85
86
static
inline
bool
AppProtoIsValid(
AppProto
a)
87
{
88
return
((a >
ALPROTO_UNKNOWN
&& a <
ALPROTO_FAILED
));
89
}
90
91
// whether a signature AppProto matches a flow (or signature) AppProto
92
static
inline
bool
AppProtoEquals(
AppProto
sigproto,
AppProto
alproto)
93
{
94
if
(sigproto == alproto) {
95
return
true
;
96
}
97
switch
(sigproto) {
98
case
ALPROTO_DNS
:
99
// a DNS signature matches on either DNS or DOH2 flows
100
return
(alproto ==
ALPROTO_DOH2
) || (alproto ==
ALPROTO_DNS
);
101
case
ALPROTO_HTTP2
:
102
// a HTTP2 signature matches on either HTTP2 or DOH2 flows
103
return
(alproto ==
ALPROTO_DOH2
) || (alproto ==
ALPROTO_HTTP2
);
104
case
ALPROTO_DOH2
:
105
// a DOH2 signature accepts dns, http2 or http generic keywords
106
return
(alproto ==
ALPROTO_DOH2
) || (alproto ==
ALPROTO_HTTP2
) ||
107
(alproto ==
ALPROTO_DNS
) || (alproto ==
ALPROTO_HTTP
);
108
case
ALPROTO_HTTP
:
109
return
(alproto ==
ALPROTO_HTTP1
) || (alproto ==
ALPROTO_HTTP2
);
110
case
ALPROTO_DCERPC
:
111
return
(alproto ==
ALPROTO_SMB
);
112
}
113
return
false
;
114
}
115
116
// whether a signature AppProto matches a flow (or signature) AppProto
117
static
inline
AppProto
AppProtoCommon(
AppProto
sigproto,
AppProto
alproto)
118
{
119
switch
(sigproto) {
120
case
ALPROTO_SMB
:
121
if
(alproto ==
ALPROTO_DCERPC
) {
122
// ok to have dcerpc keywords in smb sig
123
return
ALPROTO_SMB
;
124
}
125
break
;
126
case
ALPROTO_HTTP
:
127
// we had a generic http sig, now version specific
128
if
(alproto ==
ALPROTO_HTTP1
) {
129
return
ALPROTO_HTTP1
;
130
}
else
if
(alproto ==
ALPROTO_HTTP2
) {
131
return
ALPROTO_HTTP2
;
132
}
133
break
;
134
case
ALPROTO_HTTP1
:
135
// version-specific sig with a generic keyword
136
if
(alproto ==
ALPROTO_HTTP
) {
137
return
ALPROTO_HTTP1
;
138
}
139
break
;
140
case
ALPROTO_HTTP2
:
141
if
(alproto ==
ALPROTO_HTTP
) {
142
return
ALPROTO_HTTP2
;
143
}
144
break
;
145
case
ALPROTO_DOH2
:
146
// DOH2 accepts different protocol keywords
147
if
(alproto ==
ALPROTO_HTTP
|| alproto ==
ALPROTO_HTTP2
|| alproto ==
ALPROTO_DNS
) {
148
return
ALPROTO_DOH2
;
149
}
150
break
;
151
}
152
if
(sigproto != alproto) {
153
return
ALPROTO_FAILED
;
154
}
155
return
alproto;
156
}
157
158
/**
159
* \brief Maps the ALPROTO_*, to its string equivalent.
160
*
161
* \param alproto App layer protocol id.
162
*
163
* \retval String equivalent for the alproto.
164
*/
165
const
char
*
AppProtoToString
(
AppProto
alproto);
166
167
/**
168
* \brief Maps a string to its ALPROTO_* equivalent.
169
*
170
* \param String equivalent for the alproto.
171
*
172
* \retval alproto App layer protocol id, or ALPROTO_UNKNOWN.
173
*/
174
AppProto
StringToAppProto
(
const
char
*proto_name);
175
176
#endif
/* SURICATA_APP_LAYER_PROTOS_H */
ALPROTO_TEST
@ ALPROTO_TEST
Definition:
app-layer-protos.h:76
ALPROTO_IKE
@ ALPROTO_IKE
Definition:
app-layer-protos.h:49
ALPROTO_DCERPC
@ ALPROTO_DCERPC
Definition:
app-layer-protos.h:38
ALPROTO_DNS
@ ALPROTO_DNS
Definition:
app-layer-protos.h:41
ALPROTO_ENIP
@ ALPROTO_ENIP
Definition:
app-layer-protos.h:43
ALPROTO_TLS
@ ALPROTO_TLS
Definition:
app-layer-protos.h:33
ALPROTO_MODBUS
@ ALPROTO_MODBUS
Definition:
app-layer-protos.h:42
AppProto
uint16_t AppProto
Definition:
app-layer-protos.h:84
ALPROTO_QUIC
@ ALPROTO_QUIC
Definition:
app-layer-protos.h:51
ALPROTO_POP3
@ ALPROTO_POP3
Definition:
app-layer-protos.h:66
ALPROTO_JABBER
@ ALPROTO_JABBER
Definition:
app-layer-protos.h:36
ALPROTO_IRC
@ ALPROTO_IRC
Definition:
app-layer-protos.h:39
ALPROTO_SIP
@ ALPROTO_SIP
Definition:
app-layer-protos.h:54
ALPROTO_LDAP
@ ALPROTO_LDAP
Definition:
app-layer-protos.h:60
ALPROTO_FTP
@ ALPROTO_FTP
Definition:
app-layer-protos.h:31
ALPROTO_SSH
@ ALPROTO_SSH
Definition:
app-layer-protos.h:34
ALPROTO_DHCP
@ ALPROTO_DHCP
Definition:
app-layer-protos.h:52
ALPROTO_MAX
@ ALPROTO_MAX
Definition:
app-layer-protos.h:79
ALPROTO_KRB5
@ ALPROTO_KRB5
Definition:
app-layer-protos.h:50
ALPROTO_SNMP
@ ALPROTO_SNMP
Definition:
app-layer-protos.h:53
ALPROTO_DNP3
@ ALPROTO_DNP3
Definition:
app-layer-protos.h:44
ALPROTO_SMTP
@ ALPROTO_SMTP
Definition:
app-layer-protos.h:32
StringToAppProto
AppProto StringToAppProto(const char *proto_name)
Maps a string to its ALPROTO_* equivalent.
Definition:
app-layer-protos.c:98
ALPROTO_IMAP
@ ALPROTO_IMAP
Definition:
app-layer-protos.h:35
ALPROTO_RDP
@ ALPROTO_RDP
Definition:
app-layer-protos.h:63
ALPROTO_TELNET
@ ALPROTO_TELNET
Definition:
app-layer-protos.h:58
ALPROTO_DOH2
@ ALPROTO_DOH2
Definition:
app-layer-protos.h:61
ALPROTO_TFTP
@ ALPROTO_TFTP
Definition:
app-layer-protos.h:48
ALPROTO_HTTP2
@ ALPROTO_HTTP2
Definition:
app-layer-protos.h:64
ALPROTO_HTTP1
@ ALPROTO_HTTP1
Definition:
app-layer-protos.h:30
ALPROTO_PGSQL
@ ALPROTO_PGSQL
Definition:
app-layer-protos.h:57
ALPROTO_FTPDATA
@ ALPROTO_FTPDATA
Definition:
app-layer-protos.h:47
ALPROTO_WEBSOCKET
@ ALPROTO_WEBSOCKET
Definition:
app-layer-protos.h:59
AppProtoToString
const char * AppProtoToString(AppProto alproto)
Maps the ALPROTO_*, to its string equivalent.
Definition:
app-layer-protos.c:78
ALPROTO_MQTT
@ ALPROTO_MQTT
Definition:
app-layer-protos.h:56
ALPROTO_HTTP
@ ALPROTO_HTTP
Definition:
app-layer-protos.h:70
ALPROTO_UNKNOWN
@ ALPROTO_UNKNOWN
Definition:
app-layer-protos.h:29
ALPROTO_FAILED
@ ALPROTO_FAILED
Definition:
app-layer-protos.h:74
ALPROTO_TEMPLATE
@ ALPROTO_TEMPLATE
Definition:
app-layer-protos.h:62
ALPROTO_RFB
@ ALPROTO_RFB
Definition:
app-layer-protos.h:55
ALPROTO_BITTORRENT_DHT
@ ALPROTO_BITTORRENT_DHT
Definition:
app-layer-protos.h:65
ALPROTO_NTP
@ ALPROTO_NTP
Definition:
app-layer-protos.h:46
ALPROTO_SMB
@ ALPROTO_SMB
Definition:
app-layer-protos.h:37
AppProtoEnum
AppProtoEnum
Definition:
app-layer-protos.h:28
ALPROTO_NFS
@ ALPROTO_NFS
Definition:
app-layer-protos.h:45
src
app-layer-protos.h
Generated on Wed Oct 9 2024 23:30:25 for suricata by
1.8.18