suricata
app-layer-protos.h
Go to the documentation of this file.
1
/* Copyright (C) 2007-2021 Open Information Security Foundation
2
*
3
* You can copy, redistribute or modify this Program under the terms of
4
* the GNU General Public License version 2 as published by the Free
5
* Software Foundation.
6
*
7
* This program is distributed in the hope that it will be useful,
8
* but WITHOUT ANY WARRANTY; without even the implied warranty of
9
* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
10
* GNU General Public License for more details.
11
*
12
* You should have received a copy of the GNU General Public License
13
* version 2 along with this program; if not, write to the Free Software
14
* Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA
15
* 02110-1301, USA.
16
*/
17
18
/**
19
* \file
20
*
21
* \author Victor Julien <victor@inliniac.net>
22
* \author Anoop Saldanha <anoopsaldanha@gmail.com>
23
*/
24
25
#ifndef __APP_LAYER_PROTOS_H__
26
#define __APP_LAYER_PROTOS_H__
27
28
enum
AppProtoEnum
{
29
ALPROTO_UNKNOWN
= 0,
30
ALPROTO_HTTP1
,
31
ALPROTO_FTP
,
32
ALPROTO_SMTP
,
33
ALPROTO_TLS
,
/* SSLv2, SSLv3 & TLSv1 */
34
ALPROTO_SSH
,
35
ALPROTO_IMAP
,
36
ALPROTO_JABBER
,
37
ALPROTO_SMB
,
38
ALPROTO_DCERPC
,
39
ALPROTO_IRC
,
40
41
ALPROTO_DNS
,
42
ALPROTO_MODBUS
,
43
ALPROTO_ENIP
,
44
ALPROTO_DNP3
,
45
ALPROTO_NFS
,
46
ALPROTO_NTP
,
47
ALPROTO_FTPDATA
,
48
ALPROTO_TFTP
,
49
ALPROTO_IKE
,
50
ALPROTO_KRB5
,
51
ALPROTO_QUIC
,
52
ALPROTO_DHCP
,
53
ALPROTO_SNMP
,
54
ALPROTO_SIP
,
55
ALPROTO_RFB
,
56
ALPROTO_MQTT
,
57
ALPROTO_PGSQL
,
58
ALPROTO_TELNET
,
59
ALPROTO_TEMPLATE
,
60
ALPROTO_RDP
,
61
ALPROTO_HTTP2
,
62
ALPROTO_BITTORRENT_DHT
,
63
64
// signature-only (ie not seen in flow)
65
// HTTP for any version (ALPROTO_HTTP1 (version 1) or ALPROTO_HTTP2)
66
ALPROTO_HTTP
,
67
68
/* used by the probing parser when alproto detection fails
69
* permanently for that particular stream */
70
ALPROTO_FAILED
,
71
#ifdef UNITTESTS
72
ALPROTO_TEST
,
73
#endif
/* UNITESTS */
74
/* keep last */
75
ALPROTO_MAX
,
76
};
77
// NOTE: if ALPROTO's get >= 256, update SignatureNonPrefilterStore
78
79
/* not using the enum as that is a unsigned int, so 4 bytes */
80
typedef
uint16_t
AppProto
;
81
82
static
inline
bool
AppProtoIsValid(
AppProto
a)
83
{
84
return
((a >
ALPROTO_UNKNOWN
&& a <
ALPROTO_FAILED
));
85
}
86
87
// whether a signature AppProto matches a flow (or signature) AppProto
88
static
inline
bool
AppProtoEquals(
AppProto
sigproto,
AppProto
alproto)
89
{
90
switch
(sigproto) {
91
case
ALPROTO_HTTP
:
92
return
(alproto ==
ALPROTO_HTTP1
) || (alproto ==
ALPROTO_HTTP2
) ||
93
(alproto ==
ALPROTO_HTTP
);
94
case
ALPROTO_DCERPC
:
95
return
(alproto ==
ALPROTO_DCERPC
|| alproto ==
ALPROTO_SMB
);
96
}
97
return
(sigproto == alproto);
98
}
99
100
/**
101
* \brief Maps the ALPROTO_*, to its string equivalent.
102
*
103
* \param alproto App layer protocol id.
104
*
105
* \retval String equivalent for the alproto.
106
*/
107
const
char
*
AppProtoToString
(
AppProto
alproto);
108
109
/**
110
* \brief Maps a string to its ALPROTO_* equivalent.
111
*
112
* \param String equivalent for the alproto.
113
*
114
* \retval alproto App layer protocol id, or ALPROTO_UNKNOWN.
115
*/
116
AppProto
StringToAppProto
(
const
char
*proto_name);
117
118
#endif
/* __APP_LAYER_PROTOS_H__ */
ALPROTO_TEST
@ ALPROTO_TEST
Definition:
app-layer-protos.h:72
ALPROTO_IKE
@ ALPROTO_IKE
Definition:
app-layer-protos.h:49
ALPROTO_DCERPC
@ ALPROTO_DCERPC
Definition:
app-layer-protos.h:38
ALPROTO_DNS
@ ALPROTO_DNS
Definition:
app-layer-protos.h:41
ALPROTO_ENIP
@ ALPROTO_ENIP
Definition:
app-layer-protos.h:43
ALPROTO_TLS
@ ALPROTO_TLS
Definition:
app-layer-protos.h:33
ALPROTO_MODBUS
@ ALPROTO_MODBUS
Definition:
app-layer-protos.h:42
AppProto
uint16_t AppProto
Definition:
app-layer-protos.h:80
ALPROTO_QUIC
@ ALPROTO_QUIC
Definition:
app-layer-protos.h:51
ALPROTO_JABBER
@ ALPROTO_JABBER
Definition:
app-layer-protos.h:36
ALPROTO_IRC
@ ALPROTO_IRC
Definition:
app-layer-protos.h:39
ALPROTO_SIP
@ ALPROTO_SIP
Definition:
app-layer-protos.h:54
ALPROTO_FTP
@ ALPROTO_FTP
Definition:
app-layer-protos.h:31
ALPROTO_SSH
@ ALPROTO_SSH
Definition:
app-layer-protos.h:34
ALPROTO_DHCP
@ ALPROTO_DHCP
Definition:
app-layer-protos.h:52
ALPROTO_MAX
@ ALPROTO_MAX
Definition:
app-layer-protos.h:75
ALPROTO_KRB5
@ ALPROTO_KRB5
Definition:
app-layer-protos.h:50
ALPROTO_SNMP
@ ALPROTO_SNMP
Definition:
app-layer-protos.h:53
ALPROTO_DNP3
@ ALPROTO_DNP3
Definition:
app-layer-protos.h:44
ALPROTO_SMTP
@ ALPROTO_SMTP
Definition:
app-layer-protos.h:32
StringToAppProto
AppProto StringToAppProto(const char *proto_name)
Maps a string to its ALPROTO_* equivalent.
Definition:
app-layer-protos.c:94
ALPROTO_IMAP
@ ALPROTO_IMAP
Definition:
app-layer-protos.h:35
ALPROTO_RDP
@ ALPROTO_RDP
Definition:
app-layer-protos.h:60
ALPROTO_TELNET
@ ALPROTO_TELNET
Definition:
app-layer-protos.h:58
ALPROTO_TFTP
@ ALPROTO_TFTP
Definition:
app-layer-protos.h:48
ALPROTO_HTTP2
@ ALPROTO_HTTP2
Definition:
app-layer-protos.h:61
ALPROTO_HTTP1
@ ALPROTO_HTTP1
Definition:
app-layer-protos.h:30
ALPROTO_PGSQL
@ ALPROTO_PGSQL
Definition:
app-layer-protos.h:57
ALPROTO_FTPDATA
@ ALPROTO_FTPDATA
Definition:
app-layer-protos.h:47
AppProtoToString
const char * AppProtoToString(AppProto alproto)
Maps the ALPROTO_*, to its string equivalent.
Definition:
app-layer-protos.c:74
ALPROTO_MQTT
@ ALPROTO_MQTT
Definition:
app-layer-protos.h:56
ALPROTO_HTTP
@ ALPROTO_HTTP
Definition:
app-layer-protos.h:66
ALPROTO_UNKNOWN
@ ALPROTO_UNKNOWN
Definition:
app-layer-protos.h:29
ALPROTO_FAILED
@ ALPROTO_FAILED
Definition:
app-layer-protos.h:70
ALPROTO_TEMPLATE
@ ALPROTO_TEMPLATE
Definition:
app-layer-protos.h:59
ALPROTO_RFB
@ ALPROTO_RFB
Definition:
app-layer-protos.h:55
ALPROTO_BITTORRENT_DHT
@ ALPROTO_BITTORRENT_DHT
Definition:
app-layer-protos.h:62
ALPROTO_NTP
@ ALPROTO_NTP
Definition:
app-layer-protos.h:46
ALPROTO_SMB
@ ALPROTO_SMB
Definition:
app-layer-protos.h:37
AppProtoEnum
AppProtoEnum
Definition:
app-layer-protos.h:28
ALPROTO_NFS
@ ALPROTO_NFS
Definition:
app-layer-protos.h:45
src
app-layer-protos.h
Generated on Tue Oct 3 2023 23:30:29 for suricata by
1.8.18