suricata
app-layer-register.c
Go to the documentation of this file.
1 /* Copyright (C) 2017 Open Information Security Foundation
2  *
3  * You can copy, redistribute or modify this Program under the terms of
4  * the GNU General Public License version 2 as published by the Free
5  * Software Foundation.
6  *
7  * This program is distributed in the hope that it will be useful,
8  * but WITHOUT ANY WARRANTY; without even the implied warranty of
9  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
10  * GNU General Public License for more details.
11  *
12  * You should have received a copy of the GNU General Public License
13  * version 2 along with this program; if not, write to the Free Software
14  * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA
15  * 02110-1301, USA.
16  */
17 
18 /**
19  * \file
20  *
21  * \author Pierre Chifflier <chifflier@wzdftpd.net>
22  *
23  * Parser registration functions.
24  */
25 
26 #include "suricata-common.h"
27 #include "stream.h"
28 #include "conf.h"
29 
30 #include "app-layer-detect-proto.h"
31 #include "app-layer-parser.h"
32 
33 #include "app-layer-register.h"
34 
35 static const char * IpProtoToString(int ip_proto);
36 
37 AppProto AppLayerRegisterProtocolDetection(const struct AppLayerParser *p, int enable_default)
38 {
39  AppProto alproto;
40  const char *ip_proto_str = NULL;
41 
42  if (p == NULL)
43  FatalError(SC_ERR_FATAL, "Call to %s with NULL pointer.", __FUNCTION__);
44 
45  alproto = StringToAppProto(p->name);
46  if (alproto == ALPROTO_UNKNOWN || alproto == ALPROTO_FAILED)
47  FatalError(SC_ERR_FATAL, "Unknown or invalid AppProto '%s'.", p->name);
48 
49  ip_proto_str = IpProtoToString(p->ip_proto);
50  if (ip_proto_str == NULL)
51  FatalError(SC_ERR_FATAL, "Unknown or unsupported ip_proto field in parser '%s'", p->name);
52 
53  SCLogDebug("%s %s protocol detection enabled.", ip_proto_str, p->name);
54 
56 
57  if (p->ProbeTS == NULL || p->ProbeTC == NULL) {
58  return alproto;
59  }
60 
61  if (RunmodeIsUnittests()) {
62 
63  SCLogDebug("Unittest mode, registering default configuration.");
65  alproto, p->min_depth, p->max_depth, STREAM_TOSERVER,
66  p->ProbeTS, p->ProbeTC);
67 
68  }
69  else {
70 
71  if (!AppLayerProtoDetectPPParseConfPorts(ip_proto_str, p->ip_proto,
72  p->name, alproto, p->min_depth, p->max_depth,
73  p->ProbeTS, p->ProbeTC)) {
74  if (enable_default != 0) {
75  SCLogDebug("No %s app-layer configuration, enabling %s"
76  " detection %s detection on port %s.",
77  p->name, p->name, ip_proto_str, p->default_port);
79  p->default_port, alproto,
81  p->ProbeTS, p->ProbeTC);
82  } else {
83  SCLogDebug("No %s app-layer configuration for detection port (%s).",
84  p->name, ip_proto_str);
85  }
86  }
87 
88  }
89 
90  return alproto;
91 }
92 
93 int AppLayerRegisterParser(const struct AppLayerParser *p, AppProto alproto)
94 {
95  const char *ip_proto_str = NULL;
96 
97  if (p == NULL)
98  FatalError(SC_ERR_FATAL, "Call to %s with NULL pointer.", __FUNCTION__);
99 
100  if (alproto == ALPROTO_UNKNOWN || alproto >= ALPROTO_FAILED)
101  FatalError(SC_ERR_FATAL, "Unknown or invalid AppProto '%s'.", p->name);
102 
103  ip_proto_str = IpProtoToString(p->ip_proto);
104  if (ip_proto_str == NULL)
105  FatalError(SC_ERR_FATAL, "Unknown or unsupported ip_proto field in parser '%s'", p->name);
106 
107  SCLogDebug("Registering %s protocol parser.", p->name);
108 
109  /* Register functions for state allocation and freeing. A
110  * state is allocated for every new flow. */
112  p->StateAlloc, p->StateFree);
113 
114  /* Register request parser for parsing frame from server to server. */
117 
118  /* Register response parser for parsing frames from server to client. */
121 
122  /* Register a function to be called by the application layer
123  * when a transaction is to be freed. */
126 
127  /* Register a function to return the current transaction count. */
129  p->StateGetTxCnt);
130 
131  /* Transaction handling. */
135  p->StateGetProgress);
137  p->StateGetTx);
138 
139  if (p->StateGetTxLogged && p->StateSetTxLogged) {
142  }
143 
144  /* What is this being registered for? */
147 
148  if (p->StateGetEventInfo) {
150  p->StateGetEventInfo);
151  }
152  if (p->StateGetEventInfoById) {
155  }
156  if (p->StateGetEvents) {
158  p->StateGetEvents);
159  }
160  if (p->LocalStorageAlloc && p->LocalStorageFree) {
163  }
164  if (p->GetTxMpmIDs && p->SetTxMpmIDs) {
166  p->GetTxMpmIDs, p->SetTxMpmIDs);
167  }
168  if (p->StateGetFiles) {
170  p->StateGetFiles);
171  }
172 
173  if (p->GetTxIterator) {
175  p->GetTxIterator);
176  }
177 
178  if (p->SetTxDetectFlags && p->GetTxDetectFlags) {
181  }
182 
183  return 0;
184 }
185 
186 static const char * IpProtoToString(int ip_proto)
187 {
188  switch (ip_proto) {
189  case IPPROTO_TCP:
190  return "tcp";
191  case IPPROTO_UDP:
192  return "udp";
193  default:
194  return NULL;
195  };
196 
197 }
AppLayerParser::StateGetEventInfo
int(* StateGetEventInfo)(const char *event_name, int *event_id, AppLayerEventType *event_type)
Definition: app-layer-register.h:58
AppLayerParser::StateSetTxLogged
void(* StateSetTxLogged)(void *alstate, void *tx, uint32_t logger)
Definition: app-layer-register.h:52
AppLayerParserRegisterGetStateProgressFunc
void AppLayerParserRegisterGetStateProgressFunc(uint8_t ipproto, AppProto alproto, int(*StateGetProgress)(void *alstate, uint8_t direction))
Definition: app-layer-parser.c:490
AppLayerProtoDetectPPParseConfPorts
int AppLayerProtoDetectPPParseConfPorts(const char *ipproto_name, uint8_t ipproto, const char *alproto_name, AppProto alproto, uint16_t min_depth, uint16_t max_depth, ProbingParserFPtr ProbingParserTs, ProbingParserFPtr ProbingParserTc)
Definition: app-layer-detect-proto.c:1645
AppLayerParser::SetTxMpmIDs
int(* SetTxMpmIDs)(void *tx, uint64_t)
Definition: app-layer-register.h:67
app-layer-register.h
AppLayerParserRegisterLocalStorageFunc
void AppLayerParserRegisterLocalStorageFunc(uint8_t ipproto, AppProto alproto, void *(*LocalStorageAlloc)(void), void(*LocalStorageFree)(void *))
Definition: app-layer-parser.c:411
AppLayerParserRegisterStateFuncs
void AppLayerParserRegisterStateFuncs(uint8_t ipproto, AppProto alproto, void *(*StateAlloc)(void), void(*StateFree)(void *))
Definition: app-layer-parser.c:397
AppLayerParser::default_port
const char * default_port
Definition: app-layer-register.h:29
AppLayerParserRegisterMpmIDsFuncs
void AppLayerParserRegisterMpmIDsFuncs(uint8_t ipproto, AppProto alproto, uint64_t(*GetTxMpmIDs)(void *tx), int(*SetTxMpmIDs)(void *tx, uint64_t))
Definition: app-layer-parser.c:601
AppLayerParser::max_depth
uint16_t max_depth
Definition: app-layer-register.h:36
SCLogDebug
#define SCLogDebug(...)
Definition: util-debug.h:298
AppLayerParserRegisterDetectFlagsFuncs
void AppLayerParserRegisterDetectFlagsFuncs(uint8_t ipproto, AppProto alproto, uint64_t(*GetTxDetectFlags)(void *tx, uint8_t dir), void(*SetTxDetectFlags)(void *tx, uint8_t dir, uint64_t))
Definition: app-layer-parser.c:589
AppLayerParserRegisterLoggerFuncs
void AppLayerParserRegisterLoggerFuncs(uint8_t ipproto, AppProto alproto, LoggerId(*StateGetTxLogged)(void *, void *), void(*StateSetTxLogged)(void *, void *, LoggerId))
Definition: app-layer-parser.c:447
AppProto
uint16_t AppProto
Definition: app-layer-protos.h:71
AppLayerParserRegisterGetEventsFunc
void AppLayerParserRegisterGetEventsFunc(uint8_t ipproto, AppProto alproto, AppLayerDecoderEvents *(*StateGetEvents)(void *))
Definition: app-layer-parser.c:436
AppLayerParser::ProbeTS
ProbingParserFPtr ProbeTS
Definition: app-layer-register.h:32
AppLayerParser::StateAlloc
void *(* StateAlloc)(void)
Definition: app-layer-register.h:38
AppLayerParserRegisterTxFreeFunc
void AppLayerParserRegisterTxFreeFunc(uint8_t ipproto, AppProto alproto, void(*StateTransactionFree)(void *, uint64_t))
Definition: app-layer-parser.c:501
AppLayerParser::LocalStorageAlloc
void *(* LocalStorageAlloc)(void)
Definition: app-layer-register.h:63
AppLayerParserRegisterDetectStateFuncs
void AppLayerParserRegisterDetectStateFuncs(uint8_t ipproto, AppProto alproto, DetectEngineState *(*GetTxDetectState)(void *tx), int(*SetTxDetectState)(void *tx, DetectEngineState *))
Definition: app-layer-parser.c:577
AppLayerParser::ParseTS
AppLayerParserFPtr ParseTS
Definition: app-layer-register.h:41
AppLayerParser::StateFree
void(* StateFree)(void *)
Definition: app-layer-register.h:39
AppLayerProtoDetectPPRegister
void AppLayerProtoDetectPPRegister(uint8_t ipproto, const char *portstr, AppProto alproto, uint16_t min_depth, uint16_t max_depth, uint8_t direction, ProbingParserFPtr ProbingParser1, ProbingParserFPtr ProbingParser2)
register parser at a port
Definition: app-layer-detect-proto.c:1611
app-layer-detect-proto.h
AppLayerParser::StateGetProgress
int(* StateGetProgress)(void *alstate, uint8_t direction)
Definition: app-layer-register.h:49
AppLayerParser
Definition: app-layer-register.h:27
AppLayerParser::StateGetProgressCompletionStatus
int(* StateGetProgressCompletionStatus)(uint8_t direction)
Definition: app-layer-register.h:48
AppLayerParser::StateTransactionFree
void(* StateTransactionFree)(void *, uint64_t)
Definition: app-layer-register.h:46
AppLayerParser::min_depth
uint16_t min_depth
Definition: app-layer-register.h:35
STREAM_TOSERVER
#define STREAM_TOSERVER
Definition: stream.h:31
StringToAppProto
AppProto StringToAppProto(const char *proto_name)
Maps a string to its ALPROTO_* equivalent.
Definition: app-layer-protos.c:131
AppLayerParserRegisterGetFilesFunc
void AppLayerParserRegisterGetFilesFunc(uint8_t ipproto, AppProto alproto, FileContainer *(*StateGetFiles)(void *, uint8_t))
Definition: app-layer-parser.c:425
AppLayerParser::ip_proto
int ip_proto
Definition: app-layer-register.h:30
AppLayerParser::ProbeTC
ProbingParserFPtr ProbeTC
Definition: app-layer-register.h:33
AppLayerParser::GetTxMpmIDs
uint64_t(* GetTxMpmIDs)(void *tx)
Definition: app-layer-register.h:66
app-layer-parser.h
AppLayerParser::GetTxDetectFlags
uint64_t(* GetTxDetectFlags)(void *, uint8_t)
Definition: app-layer-register.h:76
AppLayerParser::LocalStorageFree
void(* LocalStorageFree)(void *)
Definition: app-layer-register.h:64
stream.h
AppLayerParser::StateGetEventInfoById
int(* StateGetEventInfoById)(int event_id, const char **event_name, AppLayerEventType *event_type)
Definition: app-layer-register.h:60
conf.h
AppLayerParserRegisterGetEventInfo
void AppLayerParserRegisterGetEventInfo(uint8_t ipproto, AppProto alproto, int(*StateGetEventInfo)(const char *event_name, int *event_id, AppLayerEventType *event_type))
Definition: app-layer-parser.c:565
AppLayerProtoDetectRegisterProtocol
void AppLayerProtoDetectRegisterProtocol(AppProto alproto, const char *alproto_name)
Registers a protocol for protocol detection phase.
Definition: app-layer-detect-proto.c:1826
RunmodeIsUnittests
int RunmodeIsUnittests(void)
Definition: suricata.c:264
AppLayerParserRegisterParser
int AppLayerParserRegisterParser(uint8_t ipproto, AppProto alproto, uint8_t direction, AppLayerParserFPtr Parser)
Register app layer parser for the protocol.
Definition: app-layer-parser.c:364
AppLayerParserRegisterGetStateProgressCompletionStatus
void AppLayerParserRegisterGetStateProgressCompletionStatus(AppProto alproto, int(*StateGetProgressCompletionStatus)(uint8_t direction))
Definition: app-layer-parser.c:542
AppLayerParserRegisterGetTx
void AppLayerParserRegisterGetTx(uint8_t ipproto, AppProto alproto, void *(StateGetTx)(void *alstate, uint64_t tx_id))
Definition: app-layer-parser.c:523
AppLayerParser::GetTxDetectState
DetectEngineState *(* GetTxDetectState)(void *tx)
Definition: app-layer-register.h:54
suricata-common.h
AppLayerParser::name
const char * name
Definition: app-layer-register.h:28
STREAM_TOCLIENT
#define STREAM_TOCLIENT
Definition: stream.h:32
AppLayerParser::StateGetEvents
AppLayerDecoderEvents *(* StateGetEvents)(void *)
Definition: app-layer-register.h:57
AppLayerParser::ParseTC
AppLayerParserFPtr ParseTC
Definition: app-layer-register.h:42
FatalError
#define FatalError(x,...)
Definition: util-debug.h:532
AppLayerParser::StateGetFiles
FileContainer *(* StateGetFiles)(void *, uint8_t)
Definition: app-layer-register.h:69
AppLayerRegisterProtocolDetection
AppProto AppLayerRegisterProtocolDetection(const struct AppLayerParser *p, int enable_default)
App layer protocol detection function.
Definition: app-layer-register.c:37
AppLayerParserRegisterGetTxIterator
void AppLayerParserRegisterGetTxIterator(uint8_t ipproto, AppProto alproto, AppLayerGetTxIteratorFunc Func)
Definition: app-layer-parser.c:534
SC_ERR_FATAL
@ SC_ERR_FATAL
Definition: util-error.h:203
AppLayerParserRegisterGetEventInfoById
void AppLayerParserRegisterGetEventInfoById(uint8_t ipproto, AppProto alproto, int(*StateGetEventInfoById)(int event_id, const char **event_name, AppLayerEventType *event_type))
Definition: app-layer-parser.c:553
AppLayerParser::StateGetTxCnt
uint64_t(* StateGetTxCnt)(void *alstate)
Definition: app-layer-register.h:44
AppLayerParser::SetTxDetectState
int(* SetTxDetectState)(void *tx, DetectEngineState *)
Definition: app-layer-register.h:55
ALPROTO_UNKNOWN
@ ALPROTO_UNKNOWN
Definition: app-layer-protos.h:29
ALPROTO_FAILED
@ ALPROTO_FAILED
Definition: app-layer-protos.h:61
AppLayerRegisterParser
int AppLayerRegisterParser(const struct AppLayerParser *p, AppProto alproto)
App layer protocol registration function.
Definition: app-layer-register.c:93
AppLayerParser::StateGetTxLogged
uint32_t(* StateGetTxLogged)(void *alstate, void *tx)
Definition: app-layer-register.h:51
AppLayerParserRegisterGetTxCnt
void AppLayerParserRegisterGetTxCnt(uint8_t ipproto, AppProto alproto, uint64_t(*StateGetTxCnt)(void *alstate))
Definition: app-layer-parser.c:512
AppLayerParser::GetTxIterator
AppLayerGetTxIterTuple(* GetTxIterator)(const uint8_t ipproto, const AppProto alproto, void *alstate, uint64_t min_tx_id, uint64_t max_tx_id, AppLayerGetTxIterState *istate)
Definition: app-layer-register.h:71
AppLayerParser::SetTxDetectFlags
void(* SetTxDetectFlags)(void *, uint8_t, uint64_t)
Definition: app-layer-register.h:75
AppLayerParser::StateGetTx
void *(* StateGetTx)(void *alstate, uint64_t tx_id)
Definition: app-layer-register.h:45