suricata
app-layer-register.c
Go to the documentation of this file.
1 /* Copyright (C) 2017-2020 Open Information Security Foundation
2  *
3  * You can copy, redistribute or modify this Program under the terms of
4  * the GNU General Public License version 2 as published by the Free
5  * Software Foundation.
6  *
7  * This program is distributed in the hope that it will be useful,
8  * but WITHOUT ANY WARRANTY; without even the implied warranty of
9  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
10  * GNU General Public License for more details.
11  *
12  * You should have received a copy of the GNU General Public License
13  * version 2 along with this program; if not, write to the Free Software
14  * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA
15  * 02110-1301, USA.
16  */
17 
18 /**
19  * \file
20  *
21  * \author Pierre Chifflier <chifflier@wzdftpd.net>
22  *
23  * Parser registration functions.
24  */
25 
26 #include "suricata-common.h"
27 #include "suricata.h"
28 #include "stream.h"
29 #include "conf.h"
30 #include "rust.h"
31 
32 #include "app-layer-detect-proto.h"
33 #include "app-layer-parser.h"
34 
35 #include "app-layer-register.h"
36 
37 static const char * IpProtoToString(int ip_proto);
38 
39 AppProto AppLayerRegisterProtocolDetection(const struct AppLayerParser *p, int enable_default)
40 {
41  AppProto alproto;
42  const char *ip_proto_str = NULL;
43 
44  if (p == NULL)
45  FatalError("Call to %s with NULL pointer.", __FUNCTION__);
46 
47  alproto = StringToAppProto(p->name);
48  if (alproto == ALPROTO_UNKNOWN || alproto == ALPROTO_FAILED)
49  FatalError("Unknown or invalid AppProto '%s'.", p->name);
50 
51  BUG_ON(strcmp(p->name, AppProtoToString(alproto)) != 0);
52 
53  ip_proto_str = IpProtoToString(p->ip_proto);
54  if (ip_proto_str == NULL)
55  FatalError("Unknown or unsupported ip_proto field in parser '%s'", p->name);
56 
57  SCLogDebug("%s %s protocol detection enabled.", ip_proto_str, p->name);
58 
60 
61  if (p->ProbeTS == NULL && p->ProbeTC == NULL) {
62  BUG_ON(p->default_port != NULL);
63  return alproto;
64  }
65 
66  if (RunmodeIsUnittests()) {
67 
68  SCLogDebug("Unittest mode, registering default configuration.");
70  p->max_depth, STREAM_TOSERVER, p->ProbeTS, p->ProbeTC);
71 
72  }
73  else {
74 
75  if (!SCAppLayerProtoDetectPPParseConfPorts(ip_proto_str, p->ip_proto, p->name, alproto,
76  p->min_depth, p->max_depth, p->ProbeTS, p->ProbeTC)) {
77  if (enable_default != 0) {
78  SCLogDebug("No %s app-layer configuration, enabling %s"
79  " detection %s detection on port %s.",
80  p->name, p->name, ip_proto_str, p->default_port);
82  p->max_depth, STREAM_TOSERVER, p->ProbeTS, p->ProbeTC);
83  } else {
84  SCLogDebug("No %s app-layer configuration for detection port (%s).",
85  p->name, ip_proto_str);
86  }
87  }
88  }
89 
90  return alproto;
91 }
92 
93 int AppLayerRegisterParser(const struct AppLayerParser *p, AppProto alproto)
94 {
95  const char *ip_proto_str = NULL;
96 
97  if (p == NULL)
98  FatalError("Call to %s with NULL pointer.", __FUNCTION__);
99 
100  if (!AppProtoIsValid(alproto))
101  FatalError("Unknown or invalid AppProto '%s'.", p->name);
102 
103  BUG_ON(strcmp(p->name, AppProtoToString(alproto)) != 0);
104 
105  ip_proto_str = IpProtoToString(p->ip_proto);
106  if (ip_proto_str == NULL)
107  FatalError("Unknown or unsupported ip_proto field in parser '%s'", p->name);
108 
109  SCLogDebug("Registering %s protocol parser.", p->name);
110 
111  /* Register functions for state allocation and freeing. A
112  * state is allocated for every new flow. */
114  p->StateAlloc, p->StateFree);
115 
116  /* Register request parser for parsing frame from server to server. */
118  STREAM_TOSERVER, p->ParseTS);
119 
120  /* Register response parser for parsing frames from server to client. */
122  STREAM_TOCLIENT, p->ParseTC);
123 
124  /* Register a function to be called by the application layer
125  * when a transaction is to be freed. */
128 
129  /* Register a function to return the current transaction count. */
131  p->StateGetTxCnt);
132 
133  /* Transaction handling. */
135 
137  p->StateGetProgress);
139  p->StateGetTx);
140 
141  if (p->StateGetEventInfo) {
143  p->StateGetEventInfo);
144  }
145  if (p->StateGetEventInfoById) {
148  }
149  if (p->LocalStorageAlloc && p->LocalStorageFree) {
152  }
153  if (p->GetTxFiles) {
155  }
156 
157  if (p->GetTxIterator) {
159  p->GetTxIterator);
160  }
161 
162  if (p->GetTxData) {
164  p->GetTxData);
165  }
166 
167  if (p->GetStateData) {
169  }
170 
171  if (p->ApplyTxConfig) {
173  p->ApplyTxConfig);
174  }
175 
176  if (p->flags) {
178  p->flags);
179 
180  }
181 
182  if (p->GetFrameIdByName && p->GetFrameNameById) {
184  p->ip_proto, alproto, p->GetFrameIdByName, p->GetFrameNameById);
185  }
186 
187  if (p->GetStateIdByName && p->GetStateNameById) {
189  p->ip_proto, alproto, p->GetStateIdByName, p->GetStateNameById);
190  }
191 
192  return 0;
193 }
194 
195 int AppLayerRegisterParserAlias(const char *proto_name, const char *proto_alias)
196 {
197  AppLayerProtoDetectRegisterAlias(proto_name, proto_alias);
198 
199  return 0;
200 }
201 
202 static const char * IpProtoToString(int ip_proto)
203 {
204  switch (ip_proto) {
205  case IPPROTO_TCP:
206  return "tcp";
207  case IPPROTO_UDP:
208  return "udp";
209  default:
210  return NULL;
211  };
212 
213 }
AppLayerParser::ip_proto
uint8_t ip_proto
Definition: app-layer-register.h:32
AppLayerParserRegisterGetStateProgressFunc
void AppLayerParserRegisterGetStateProgressFunc(uint8_t ipproto, AppProto alproto, int(*StateGetProgress)(void *alstate, uint8_t direction))
Definition: app-layer-parser.c:500
app-layer-register.h
AppLayerParserRegisterLocalStorageFunc
void AppLayerParserRegisterLocalStorageFunc(uint8_t ipproto, AppProto alproto, void *(*LocalStorageAlloc)(void), void(*LocalStorageFree)(void *))
Definition: app-layer-parser.c:460
AppLayerParserRegisterOptionFlags
void AppLayerParserRegisterOptionFlags(uint8_t ipproto, AppProto alproto, uint32_t flags)
Definition: app-layer-parser.c:425
AppLayerParser::default_port
const char * default_port
Definition: app-layer-register.h:31
AppLayerParser::max_depth
uint16_t max_depth
Definition: app-layer-register.h:38
SCLogDebug
#define SCLogDebug(...)
Definition: util-debug.h:275
AppProto
uint16_t AppProto
Definition: app-layer-protos.h:86
AppProtoToString
const char * AppProtoToString(AppProto alproto)
Maps the ALPROTO_*, to its string equivalent.
Definition: app-layer-protos.c:40
AppLayerParser::ProbeTS
ProbingParserFPtr ProbeTS
Definition: app-layer-register.h:34
AppLayerParserRegisterStateProgressCompletionStatus
void AppLayerParserRegisterStateProgressCompletionStatus(AppProto alproto, const int ts, const int tc)
Definition: app-layer-parser.c:548
AppLayerParserRegisterTxFreeFunc
void AppLayerParserRegisterTxFreeFunc(uint8_t ipproto, AppProto alproto, void(*StateTransactionFree)(void *, uint64_t))
Definition: app-layer-parser.c:510
rust.h
AppLayerParser::LocalStorageAlloc
void *(* LocalStorageAlloc)(void)
Definition: app-layer-register.h:59
AppLayerParserRegisterGetStateFuncs
void AppLayerParserRegisterGetStateFuncs(uint8_t ipproto, AppProto alproto, AppLayerParserGetStateIdByNameFn GetIdByNameFunc, AppLayerParserGetStateNameByIdFn GetNameByIdFunc)
Definition: app-layer-parser.c:575
AppLayerParser::StateAlloc
void *(* StateAlloc)(void *, AppProto)
Definition: app-layer-register.h:40
AppLayerParser::ParseTS
AppLayerParserFPtr ParseTS
Definition: app-layer-register.h:43
AppLayerParser::StateFree
void(* StateFree)(void *)
Definition: app-layer-register.h:41
AppLayerParser::GetTxData
AppLayerTxData *(* GetTxData)(void *tx)
Definition: app-layer-register.h:69
app-layer-detect-proto.h
AppLayerParser::StateGetProgress
int(* StateGetProgress)(void *alstate, uint8_t direction)
Definition: app-layer-register.h:52
AppLayerParser
Definition: app-layer-register.h:29
AppLayerParser::GetFrameNameById
AppLayerParserGetFrameNameByIdFn GetFrameNameById
Definition: app-layer-register.h:75
AppLayerParser::StateTransactionFree
void(* StateTransactionFree)(void *, uint64_t)
Definition: app-layer-register.h:48
AppLayerParser::min_depth
uint16_t min_depth
Definition: app-layer-register.h:37
StringToAppProto
AppProto StringToAppProto(const char *proto_name)
Maps a string to its ALPROTO_* equivalent.
Definition: app-layer-protos.c:60
AppLayerParserRegisterGetFrameFuncs
void AppLayerParserRegisterGetFrameFuncs(uint8_t ipproto, AppProto alproto, AppLayerParserGetFrameIdByNameFn GetIdByNameFunc, AppLayerParserGetFrameNameByIdFn GetNameByIdFunc)
Definition: app-layer-parser.c:585
AppLayerParser::ProbeTC
ProbingParserFPtr ProbeTC
Definition: app-layer-register.h:35
AppLayerParserRegisterStateFuncs
void AppLayerParserRegisterStateFuncs(uint8_t ipproto, AppProto alproto, void *(*StateAlloc)(void *, AppProto), void(*StateFree)(void *))
Definition: app-layer-parser.c:435
app-layer-parser.h
BUG_ON
#define BUG_ON(x)
Definition: suricata-common.h:317
AppLayerParser::LocalStorageFree
void(* LocalStorageFree)(void *)
Definition: app-layer-register.h:60
AppLayerParserRegisterGetEventInfo
void AppLayerParserRegisterGetEventInfo(uint8_t ipproto, AppProto alproto, int(*StateGetEventInfo)(const char *event_name, uint8_t *event_id, AppLayerEventType *event_type))
Definition: app-layer-parser.c:595
AppLayerParser::GetStateIdByName
AppLayerParserGetStateIdByNameFn GetStateIdByName
Definition: app-layer-register.h:77
stream.h
conf.h
AppLayerParserRegisterGetTxFilesFunc
void AppLayerParserRegisterGetTxFilesFunc(uint8_t ipproto, AppProto alproto, AppLayerGetFileState(*GetTxFiles)(void *, uint8_t))
Definition: app-layer-parser.c:472
AppLayerProtoDetectRegisterProtocol
void AppLayerProtoDetectRegisterProtocol(AppProto alproto, const char *alproto_name)
Registers a protocol for protocol detection phase.
Definition: app-layer-detect-proto.c:1742
AppLayerParser::StateGetEventInfoById
int(* StateGetEventInfoById)(uint8_t event_id, const char **event_name, AppLayerEventType *event_type)
Definition: app-layer-register.h:56
RunmodeIsUnittests
int RunmodeIsUnittests(void)
Definition: suricata.c:270
AppLayerParserRegisterParser
int AppLayerParserRegisterParser(uint8_t ipproto, AppProto alproto, uint8_t direction, AppLayerParserFPtr Parser)
Register app layer parser for the protocol.
Definition: app-layer-parser.c:402
SCAppLayerProtoDetectPPRegister
void SCAppLayerProtoDetectPPRegister(uint8_t ipproto, const char *portstr, AppProto alproto, uint16_t min_depth, uint16_t max_depth, uint8_t direction, ProbingParserFPtr ProbingParser1, ProbingParserFPtr ProbingParser2)
register parser at a port
Definition: app-layer-detect-proto.c:1527
AppLayerParserRegisterGetTx
void AppLayerParserRegisterGetTx(uint8_t ipproto, AppProto alproto, void *(StateGetTx)(void *alstate, uint64_t tx_id))
Definition: app-layer-parser.c:530
suricata-common.h
AppLayerParser::name
const char * name
Definition: app-layer-register.h:30
AppLayerParser::GetStateNameById
AppLayerParserGetStateNameByIdFn GetStateNameById
Definition: app-layer-register.h:78
AppLayerParserRegisterApplyTxConfigFunc
void AppLayerParserRegisterApplyTxConfigFunc(uint8_t ipproto, AppProto alproto, bool(*ApplyTxConfig)(void *state, void *tx, int mode, AppLayerTxConfig))
Definition: app-layer-parser.c:626
AppLayerParser::ParseTC
AppLayerParserFPtr ParseTC
Definition: app-layer-register.h:44
AppLayerParserRegisterStateDataFunc
void AppLayerParserRegisterStateDataFunc(uint8_t ipproto, AppProto alproto, AppLayerStateData *(*GetStateData)(void *state))
Definition: app-layer-parser.c:616
FatalError
#define FatalError(...)
Definition: util-debug.h:510
AppLayerParserRegisterTxDataFunc
void AppLayerParserRegisterTxDataFunc(uint8_t ipproto, AppProto alproto, AppLayerTxData *(*GetTxData)(void *tx))
Definition: app-layer-parser.c:606
AppLayerParser::StateGetEventInfo
int(* StateGetEventInfo)(const char *event_name, uint8_t *event_id, AppLayerEventType *event_type)
Definition: app-layer-register.h:54
AppLayerRegisterProtocolDetection
AppProto AppLayerRegisterProtocolDetection(const struct AppLayerParser *p, int enable_default)
App layer protocol detection function.
Definition: app-layer-register.c:39
AppLayerParserRegisterGetTxIterator
void AppLayerParserRegisterGetTxIterator(uint8_t ipproto, AppProto alproto, AppLayerGetTxIteratorFunc Func)
Definition: app-layer-parser.c:540
SCAppLayerProtoDetectPPParseConfPorts
int SCAppLayerProtoDetectPPParseConfPorts(const char *ipproto_name, uint8_t ipproto, const char *alproto_name, AppProto alproto, uint16_t min_depth, uint16_t max_depth, ProbingParserFPtr ProbingParserTs, ProbingParserFPtr ProbingParserTc)
Definition: app-layer-detect-proto.c:1563
AppLayerParser::StateGetTxCnt
uint64_t(* StateGetTxCnt)(void *alstate)
Definition: app-layer-register.h:46
ALPROTO_UNKNOWN
@ ALPROTO_UNKNOWN
Definition: app-layer-protos.h:29
ALPROTO_FAILED
@ ALPROTO_FAILED
Definition: app-layer-protos.h:33
AppLayerRegisterParser
int AppLayerRegisterParser(const struct AppLayerParser *p, AppProto alproto)
App layer protocol registration function.
Definition: app-layer-register.c:93
AppLayerProtoDetectRegisterAlias
void AppLayerProtoDetectRegisterAlias(const char *proto_name, const char *proto_alias)
Definition: app-layer-detect-proto.c:1762
suricata.h
AppLayerParser::complete_tc
const int complete_tc
Definition: app-layer-register.h:51
AppLayerParserRegisterGetTxCnt
void AppLayerParserRegisterGetTxCnt(uint8_t ipproto, AppProto alproto, uint64_t(*StateGetTxCnt)(void *alstate))
Definition: app-layer-parser.c:520
AppLayerParser::GetTxIterator
AppLayerGetTxIterTuple(* GetTxIterator)(const uint8_t ipproto, const AppProto alproto, void *alstate, uint64_t min_tx_id, uint64_t max_tx_id, AppLayerGetTxIterState *istate)
Definition: app-layer-register.h:64
AppLayerParserRegisterGetEventInfoById
void AppLayerParserRegisterGetEventInfoById(uint8_t ipproto, AppProto alproto, int(*StateGetEventInfoById)(uint8_t event_id, const char **event_name, AppLayerEventType *event_type))
Definition: app-layer-parser.c:563
AppLayerParser::ApplyTxConfig
bool(* ApplyTxConfig)(void *state, void *tx, int mode, AppLayerTxConfig)
Definition: app-layer-register.h:70
AppLayerRegisterParserAlias
int AppLayerRegisterParserAlias(const char *proto_name, const char *proto_alias)
Definition: app-layer-register.c:195
AppLayerParser::GetStateData
AppLayerStateData *(* GetStateData)(void *state)
Definition: app-layer-register.h:68
AppLayerParser::flags
uint32_t flags
Definition: app-layer-register.h:72
AppLayerParser::complete_ts
const int complete_ts
Definition: app-layer-register.h:50
AppLayerParser::GetFrameIdByName
AppLayerParserGetFrameIdByNameFn GetFrameIdByName
Definition: app-layer-register.h:74
AppLayerParser::GetTxFiles
AppLayerGetFileState(* GetTxFiles)(void *, uint8_t)
Definition: app-layer-register.h:62
AppLayerParser::StateGetTx
void *(* StateGetTx)(void *alstate, uint64_t tx_id)
Definition: app-layer-register.h:47