suricata
detect-app-layer-protocol.c
Go to the documentation of this file.
1 /* Copyright (C) 2007-2022 Open Information Security Foundation
2  *
3  * You can copy, redistribute or modify this Program under the terms of
4  * the GNU General Public License version 2 as published by the Free
5  * Software Foundation.
6  *
7  * This program is distributed in the hope that it will be useful,
8  * but WITHOUT ANY WARRANTY; without even the implied warranty of
9  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
10  * GNU General Public License for more details.
11  *
12  * You should have received a copy of the GNU General Public License
13  * version 2 along with this program; if not, write to the Free Software
14  * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA
15  * 02110-1301, USA.
16  */
17 
18 /**
19  * \file
20  *
21  * \author Anoop Saldanha <anoopsaldanha@gmail.com>
22  */
23 
24 #include "suricata-common.h"
25 #include "detect-engine.h"
26 #include "detect-engine-build.h"
29 #include "detect-parse.h"
31 #include "app-layer.h"
32 #include "app-layer-parser.h"
33 #include "util-debug.h"
34 #include "util-unittest.h"
35 #include "util-unittest-helper.h"
36 
37 #ifdef UNITTESTS
38 static void DetectAppLayerProtocolRegisterTests(void);
39 #endif
40 
43  uint8_t negated;
45 
46 static int DetectAppLayerProtocolPacketMatch(
47  DetectEngineThreadCtx *det_ctx,
48  Packet *p, const Signature *s, const SigMatchCtx *ctx)
49 {
50  SCEnter();
51 
52  bool r = false;
53  const DetectAppLayerProtocolData *data = (const DetectAppLayerProtocolData *)ctx;
54 
55  /* if the sig is PD-only we only match when PD packet flags are set */
56  if ((s->flags & SIG_FLAG_PDONLY) &&
58  {
59  SCLogDebug("packet %"PRIu64": flags not set", p->pcap_cnt);
60  SCReturnInt(0);
61  }
62 
63  const Flow *f = p->flow;
64  if (f == NULL) {
65  SCLogDebug("packet %"PRIu64": no flow", p->pcap_cnt);
66  SCReturnInt(0);
67  }
68 
69  /* unknown means protocol detection isn't ready yet */
70 
72  {
73  SCLogDebug("toserver packet %"PRIu64": looking for %u/neg %u, got %u",
74  p->pcap_cnt, data->alproto, data->negated, f->alproto_ts);
75 
76  r = AppProtoEquals(data->alproto, f->alproto_ts);
77 
78  } else if ((f->alproto_tc != ALPROTO_UNKNOWN) && (p->flowflags & FLOW_PKT_TOCLIENT))
79  {
80  SCLogDebug("toclient packet %"PRIu64": looking for %u/neg %u, got %u",
81  p->pcap_cnt, data->alproto, data->negated, f->alproto_tc);
82 
83  r = AppProtoEquals(data->alproto, f->alproto_tc);
84  }
85  else {
86  SCLogDebug("packet %"PRIu64": default case: direction %02x, approtos %u/%u/%u",
87  p->pcap_cnt,
89  f->alproto, f->alproto_ts, f->alproto_tc);
90  }
91  r = r ^ data->negated;
92  if (r) {
93  SCReturnInt(1);
94  }
95  SCReturnInt(0);
96 }
97 
98 static DetectAppLayerProtocolData *DetectAppLayerProtocolParse(const char *arg, bool negate)
99 {
101  AppProto alproto = ALPROTO_UNKNOWN;
102 
103  if (strcmp(arg, "failed") == 0) {
104  alproto = ALPROTO_FAILED;
105  } else {
106  alproto = AppLayerGetProtoByName((char *)arg);
107  if (alproto == ALPROTO_UNKNOWN) {
108  SCLogError("app-layer-protocol "
109  "keyword supplied with unknown protocol \"%s\"",
110  arg);
111  return NULL;
112  }
113  }
114 
115  data = SCMalloc(sizeof(DetectAppLayerProtocolData));
116  if (unlikely(data == NULL))
117  return NULL;
118  data->alproto = alproto;
119  data->negated = negate;
120 
121  return data;
122 }
123 
124 static bool HasConflicts(const DetectAppLayerProtocolData *us,
125  const DetectAppLayerProtocolData *them)
126 {
127  /* mixing negated and non negated is illegal */
128  if (them->negated ^ us->negated)
129  return true;
130  /* multiple non-negated is illegal */
131  if (!us->negated)
132  return true;
133  /* duplicate option */
134  if (us->alproto == them->alproto)
135  return true;
136 
137  /* all good */
138  return false;
139 }
140 
141 static int DetectAppLayerProtocolSetup(DetectEngineCtx *de_ctx,
142  Signature *s, const char *arg)
143 {
144  DetectAppLayerProtocolData *data = NULL;
145  SigMatch *sm = NULL;
146 
147  if (s->alproto != ALPROTO_UNKNOWN) {
148  SCLogError("Either we already "
149  "have the rule match on an app layer protocol set through "
150  "other keywords that match on this protocol, or have "
151  "already seen a non-negated app-layer-protocol.");
152  goto error;
153  }
154 
155  data = DetectAppLayerProtocolParse(arg, s->init_data->negated);
156  if (data == NULL)
157  goto error;
158 
160  for ( ; tsm != NULL; tsm = tsm->next) {
161  if (tsm->type == DETECT_AL_APP_LAYER_PROTOCOL) {
162  const DetectAppLayerProtocolData *them = (const DetectAppLayerProtocolData *)tsm->ctx;
163 
164  if (HasConflicts(data, them)) {
165  SCLogError("can't mix "
166  "positive app-layer-protocol match with negated "
167  "match or match for 'failed'.");
168  goto error;
169  }
170  }
171  }
172 
173  sm = SigMatchAlloc();
174  if (sm == NULL)
175  goto error;
176 
178  sm->ctx = (void *)data;
179 
181  return 0;
182 
183 error:
184  if (data != NULL)
185  SCFree(data);
186  return -1;
187 }
188 
189 static void DetectAppLayerProtocolFree(DetectEngineCtx *de_ctx, void *ptr)
190 {
191  SCFree(ptr);
192  return;
193 }
194 
195 /** \internal
196  * \brief prefilter function for protocol detect matching
197  */
198 static void
199 PrefilterPacketAppProtoMatch(DetectEngineThreadCtx *det_ctx, Packet *p, const void *pectx)
200 {
201  const PrefilterPacketHeaderCtx *ctx = pectx;
202 
203  if (!PrefilterPacketHeaderExtraMatch(ctx, p)) {
204  SCLogDebug("packet %"PRIu64": extra match failed", p->pcap_cnt);
205  SCReturn;
206  }
207 
208  if (p->flow == NULL) {
209  SCLogDebug("packet %"PRIu64": no flow, no alproto", p->pcap_cnt);
210  SCReturn;
211  }
212 
214  SCLogDebug("packet %"PRIu64": flags not set", p->pcap_cnt);
215  SCReturn;
216  }
217 
219  {
220  int r = (ctx->v1.u16[0] == p->flow->alproto_ts) ^ ctx->v1.u8[2];
221  if (r) {
222  PrefilterAddSids(&det_ctx->pmq, ctx->sigs_array, ctx->sigs_cnt);
223  }
224  } else if ((p->flags & PKT_PROTO_DETECT_TC_DONE) && (p->flowflags & FLOW_PKT_TOCLIENT))
225  {
226  int r = (ctx->v1.u16[0] == p->flow->alproto_tc) ^ ctx->v1.u8[2];
227  if (r) {
228  PrefilterAddSids(&det_ctx->pmq, ctx->sigs_array, ctx->sigs_cnt);
229  }
230  }
231 }
232 
233 static void
234 PrefilterPacketAppProtoSet(PrefilterPacketHeaderValue *v, void *smctx)
235 {
236  const DetectAppLayerProtocolData *a = smctx;
237  v->u16[0] = a->alproto;
238  v->u8[2] = (uint8_t)a->negated;
239 }
240 
241 static bool
242 PrefilterPacketAppProtoCompare(PrefilterPacketHeaderValue v, void *smctx)
243 {
244  const DetectAppLayerProtocolData *a = smctx;
245  if (v.u16[0] == a->alproto &&
246  v.u8[2] == (uint8_t)a->negated)
247  return true;
248  return false;
249 }
250 
251 static int PrefilterSetupAppProto(DetectEngineCtx *de_ctx, SigGroupHead *sgh)
252 {
254  PrefilterPacketAppProtoSet,
255  PrefilterPacketAppProtoCompare,
256  PrefilterPacketAppProtoMatch);
257 }
258 
259 static bool PrefilterAppProtoIsPrefilterable(const Signature *s)
260 {
261  if (s->flags & SIG_FLAG_PDONLY) {
262  SCLogDebug("prefilter on PD %u", s->id);
263  return true;
264  }
265  return false;
266 }
267 
269 {
270  sigmatch_table[DETECT_AL_APP_LAYER_PROTOCOL].name = "app-layer-protocol";
271  sigmatch_table[DETECT_AL_APP_LAYER_PROTOCOL].desc = "match on the detected app-layer protocol";
272  sigmatch_table[DETECT_AL_APP_LAYER_PROTOCOL].url = "/rules/app-layer.html#app-layer-protocol";
274  DetectAppLayerProtocolPacketMatch;
276  DetectAppLayerProtocolSetup;
278  DetectAppLayerProtocolFree;
279 #ifdef UNITTESTS
281  DetectAppLayerProtocolRegisterTests;
282 #endif
285 
287  PrefilterSetupAppProto;
289  PrefilterAppProtoIsPrefilterable;
290  return;
291 }
292 
293 /**********************************Unittests***********************************/
294 
295 #ifdef UNITTESTS
296 
297 static int DetectAppLayerProtocolTest01(void)
298 {
299  DetectAppLayerProtocolData *data = DetectAppLayerProtocolParse("http", false);
300  FAIL_IF_NULL(data);
301  FAIL_IF(data->alproto != ALPROTO_HTTP);
302  FAIL_IF(data->negated != 0);
303  DetectAppLayerProtocolFree(NULL, data);
304  PASS;
305 }
306 
307 static int DetectAppLayerProtocolTest02(void)
308 {
309  DetectAppLayerProtocolData *data = DetectAppLayerProtocolParse("http", true);
310  FAIL_IF_NULL(data);
311  FAIL_IF(data->alproto != ALPROTO_HTTP);
312  FAIL_IF(data->negated == 0);
313  DetectAppLayerProtocolFree(NULL, data);
314  PASS;
315 }
316 
317 static int DetectAppLayerProtocolTest03(void)
318 {
319  Signature *s = NULL;
320  DetectAppLayerProtocolData *data = NULL;
323  de_ctx->flags |= DE_QUIET;
324 
325  s = DetectEngineAppendSig(de_ctx, "alert tcp any any -> any any "
326  "(app-layer-protocol:http; sid:1;)");
327  FAIL_IF_NULL(s);
328 
330 
331  FAIL_IF_NULL(s->sm_lists[DETECT_SM_LIST_MATCH]);
332  FAIL_IF_NULL(s->sm_lists[DETECT_SM_LIST_MATCH]->ctx);
333 
334  data = (DetectAppLayerProtocolData *)s->sm_lists[DETECT_SM_LIST_MATCH]->ctx;
335  FAIL_IF(data->alproto != ALPROTO_HTTP);
336  FAIL_IF(data->negated);
338  PASS;
339 }
340 
341 static int DetectAppLayerProtocolTest04(void)
342 {
343  Signature *s = NULL;
344  DetectAppLayerProtocolData *data = NULL;
347  de_ctx->flags |= DE_QUIET;
348 
349  s = DetectEngineAppendSig(de_ctx, "alert tcp any any -> any any "
350  "(app-layer-protocol:!http; sid:1;)");
351  FAIL_IF_NULL(s);
354 
355  FAIL_IF_NULL(s->sm_lists[DETECT_SM_LIST_MATCH]);
356  FAIL_IF_NULL(s->sm_lists[DETECT_SM_LIST_MATCH]->ctx);
357 
358  data = (DetectAppLayerProtocolData*)s->sm_lists[DETECT_SM_LIST_MATCH]->ctx;
359  FAIL_IF_NULL(data);
360  FAIL_IF(data->alproto != ALPROTO_HTTP);
361  FAIL_IF(data->negated == 0);
362 
364  PASS;
365 }
366 
367 static int DetectAppLayerProtocolTest05(void)
368 {
369  Signature *s = NULL;
370  DetectAppLayerProtocolData *data = NULL;
373  de_ctx->flags |= DE_QUIET;
374 
375  s = DetectEngineAppendSig(de_ctx, "alert tcp any any -> any any "
376  "(app-layer-protocol:!http; app-layer-protocol:!smtp; sid:1;)");
377  FAIL_IF_NULL(s);
380 
381  FAIL_IF_NULL(s->sm_lists[DETECT_SM_LIST_MATCH]);
382  FAIL_IF_NULL(s->sm_lists[DETECT_SM_LIST_MATCH]->ctx);
383 
384  data = (DetectAppLayerProtocolData*)s->sm_lists[DETECT_SM_LIST_MATCH]->ctx;
385  FAIL_IF_NULL(data);
386  FAIL_IF(data->alproto != ALPROTO_HTTP);
387  FAIL_IF(data->negated == 0);
388 
389  data = (DetectAppLayerProtocolData*)s->sm_lists[DETECT_SM_LIST_MATCH]->next->ctx;
390  FAIL_IF_NULL(data);
391  FAIL_IF(data->alproto != ALPROTO_SMTP);
392  FAIL_IF(data->negated == 0);
393 
395  PASS;
396 }
397 
398 static int DetectAppLayerProtocolTest06(void)
399 {
400  Signature *s = NULL;
403  de_ctx->flags |= DE_QUIET;
404 
405  s = DetectEngineAppendSig(de_ctx, "alert http any any -> any any "
406  "(app-layer-protocol:smtp; sid:1;)");
407  FAIL_IF_NOT_NULL(s);
409  PASS;
410 }
411 
412 static int DetectAppLayerProtocolTest07(void)
413 {
414  Signature *s = NULL;
417  de_ctx->flags |= DE_QUIET;
418 
419  s = DetectEngineAppendSig(de_ctx, "alert http any any -> any any "
420  "(app-layer-protocol:!smtp; sid:1;)");
421  FAIL_IF_NOT_NULL(s);
423  PASS;
424 }
425 
426 static int DetectAppLayerProtocolTest08(void)
427 {
428  Signature *s = NULL;
431  de_ctx->flags |= DE_QUIET;
432 
433  s = DetectEngineAppendSig(de_ctx, "alert tcp any any -> any any "
434  "(app-layer-protocol:!smtp; app-layer-protocol:http; sid:1;)");
435  FAIL_IF_NOT_NULL(s);
437  PASS;
438 }
439 
440 static int DetectAppLayerProtocolTest09(void)
441 {
442  Signature *s = NULL;
445  de_ctx->flags |= DE_QUIET;
446 
447  s = DetectEngineAppendSig(de_ctx, "alert tcp any any -> any any "
448  "(app-layer-protocol:http; app-layer-protocol:!smtp; sid:1;)");
449  FAIL_IF_NOT_NULL(s);
451  PASS;
452 }
453 
454 static int DetectAppLayerProtocolTest10(void)
455 {
456  Signature *s = NULL;
459  de_ctx->flags |= DE_QUIET;
460 
461  s = DetectEngineAppendSig(de_ctx, "alert tcp any any -> any any "
462  "(app-layer-protocol:smtp; app-layer-protocol:!http; sid:1;)");
463  FAIL_IF_NOT_NULL(s);
465  PASS;
466 }
467 
468 static int DetectAppLayerProtocolTest11(void)
469 {
470  DetectAppLayerProtocolData *data = DetectAppLayerProtocolParse("failed", false);
471  FAIL_IF_NULL(data);
472  FAIL_IF(data->alproto != ALPROTO_FAILED);
473  FAIL_IF(data->negated != 0);
474  DetectAppLayerProtocolFree(NULL, data);
475  PASS;
476 }
477 
478 static int DetectAppLayerProtocolTest12(void)
479 {
480  DetectAppLayerProtocolData *data = DetectAppLayerProtocolParse("failed", true);
481  FAIL_IF_NULL(data);
482  FAIL_IF(data->alproto != ALPROTO_FAILED);
483  FAIL_IF(data->negated == 0);
484  DetectAppLayerProtocolFree(NULL, data);
485  PASS;
486 }
487 
488 static int DetectAppLayerProtocolTest13(void)
489 {
490  Signature *s = NULL;
491  DetectAppLayerProtocolData *data = NULL;
494  de_ctx->flags |= DE_QUIET;
495 
496  s = DetectEngineAppendSig(de_ctx, "alert tcp any any -> any any "
497  "(app-layer-protocol:failed; sid:1;)");
498  FAIL_IF_NULL(s);
499 
501 
502  FAIL_IF_NULL(s->sm_lists[DETECT_SM_LIST_MATCH]);
503  FAIL_IF_NULL(s->sm_lists[DETECT_SM_LIST_MATCH]->ctx);
504 
505  data = (DetectAppLayerProtocolData *)s->sm_lists[DETECT_SM_LIST_MATCH]->ctx;
506  FAIL_IF(data->alproto != ALPROTO_FAILED);
507  FAIL_IF(data->negated);
509  PASS;
510 }
511 
512 static int DetectAppLayerProtocolTest14(void)
513 {
514  DetectAppLayerProtocolData *data = NULL;
517  de_ctx->flags |= DE_QUIET;
518 
519  Signature *s1 = DetectEngineAppendSig(de_ctx, "alert tcp any any -> any any "
520  "(app-layer-protocol:http; flowbits:set,blah; sid:1;)");
521  FAIL_IF_NULL(s1);
523  FAIL_IF_NULL(s1->sm_lists[DETECT_SM_LIST_MATCH]);
524  FAIL_IF_NULL(s1->sm_lists[DETECT_SM_LIST_MATCH]->ctx);
525  data = (DetectAppLayerProtocolData *)s1->sm_lists[DETECT_SM_LIST_MATCH]->ctx;
526  FAIL_IF(data->alproto != ALPROTO_HTTP);
527  FAIL_IF(data->negated);
528 
529  Signature *s2 = DetectEngineAppendSig(de_ctx, "alert tcp any any -> any any "
530  "(app-layer-protocol:http; flow:to_client; sid:2;)");
531  FAIL_IF_NULL(s2);
533  FAIL_IF_NULL(s2->sm_lists[DETECT_SM_LIST_MATCH]);
534  FAIL_IF_NULL(s2->sm_lists[DETECT_SM_LIST_MATCH]->ctx);
535  data = (DetectAppLayerProtocolData *)s2->sm_lists[DETECT_SM_LIST_MATCH]->ctx;
536  FAIL_IF(data->alproto != ALPROTO_HTTP);
537  FAIL_IF(data->negated);
538 
539  /* flow:established and other options not supported for PD-only */
540  Signature *s3 = DetectEngineAppendSig(de_ctx, "alert tcp any any -> any any "
541  "(app-layer-protocol:http; flow:to_client,established; sid:3;)");
542  FAIL_IF_NULL(s3);
544  FAIL_IF_NULL(s3->sm_lists[DETECT_SM_LIST_MATCH]);
545  FAIL_IF_NULL(s3->sm_lists[DETECT_SM_LIST_MATCH]->ctx);
546  data = (DetectAppLayerProtocolData *)s3->sm_lists[DETECT_SM_LIST_MATCH]->ctx;
547  FAIL_IF(data->alproto != ALPROTO_HTTP);
548  FAIL_IF(data->negated);
549 
553  FAIL_IF(s3->flags & SIG_FLAG_PDONLY); // failure now
554 
556  PASS;
557 }
558 
559 
560 static void DetectAppLayerProtocolRegisterTests(void)
561 {
562  UtRegisterTest("DetectAppLayerProtocolTest01",
563  DetectAppLayerProtocolTest01);
564  UtRegisterTest("DetectAppLayerProtocolTest02",
565  DetectAppLayerProtocolTest02);
566  UtRegisterTest("DetectAppLayerProtocolTest03",
567  DetectAppLayerProtocolTest03);
568  UtRegisterTest("DetectAppLayerProtocolTest04",
569  DetectAppLayerProtocolTest04);
570  UtRegisterTest("DetectAppLayerProtocolTest05",
571  DetectAppLayerProtocolTest05);
572  UtRegisterTest("DetectAppLayerProtocolTest06",
573  DetectAppLayerProtocolTest06);
574  UtRegisterTest("DetectAppLayerProtocolTest07",
575  DetectAppLayerProtocolTest07);
576  UtRegisterTest("DetectAppLayerProtocolTest08",
577  DetectAppLayerProtocolTest08);
578  UtRegisterTest("DetectAppLayerProtocolTest09",
579  DetectAppLayerProtocolTest09);
580  UtRegisterTest("DetectAppLayerProtocolTest10",
581  DetectAppLayerProtocolTest10);
582  UtRegisterTest("DetectAppLayerProtocolTest11",
583  DetectAppLayerProtocolTest11);
584  UtRegisterTest("DetectAppLayerProtocolTest12",
585  DetectAppLayerProtocolTest12);
586  UtRegisterTest("DetectAppLayerProtocolTest13",
587  DetectAppLayerProtocolTest13);
588  UtRegisterTest("DetectAppLayerProtocolTest14",
589  DetectAppLayerProtocolTest14);
590 }
591 #endif /* UNITTESTS */
SigTableElmt_::url
const char * url
Definition: detect.h:1241
detect-engine.h
detect-app-layer-protocol.h
FAIL_IF_NULL
#define FAIL_IF_NULL(expr)
Fail a test if expression evaluates to NULL.
Definition: util-unittest.h:89
SigTableElmt_::desc
const char * desc
Definition: detect.h:1240
SigTableElmt_::Free
void(* Free)(DetectEngineCtx *, void *)
Definition: detect.h:1228
SIG_FLAG_PDONLY
#define SIG_FLAG_PDONLY
Definition: detect.h:239
SigTableElmt_::name
const char * name
Definition: detect.h:1238
SigGroupHead_
Container for matching data for a signature group.
Definition: detect.h:1395
unlikely
#define unlikely(expr)
Definition: util-optimize.h:35
UtRegisterTest
void UtRegisterTest(const char *name, int(*TestFn)(void))
Register unit test.
Definition: util-unittest.c:103
Signature_::alproto
AppProto alproto
Definition: detect.h:544
SCLogDebug
#define SCLogDebug(...)
Definition: util-debug.h:269
Packet_::pcap_cnt
uint64_t pcap_cnt
Definition: decode.h:594
SIGMATCH_QUOTES_OPTIONAL
#define SIGMATCH_QUOTES_OPTIONAL
Definition: detect.h:1435
DetectAppLayerProtocolData_
Definition: detect-app-layer-protocol.c:41
AppProto
uint16_t AppProto
Definition: app-layer-protos.h:80
Packet_::flags
uint32_t flags
Definition: decode.h:463
DetectAppLayerProtocolData_::negated
uint8_t negated
Definition: detect-app-layer-protocol.c:43
Flow_
Flow data structure.
Definition: flow.h:357
DetectEngineThreadCtx_::pmq
PrefilterRuleStore pmq
Definition: detect.h:1134
SigTableElmt_::flags
uint16_t flags
Definition: detect.h:1232
DetectEngineCtx_
main detection engine ctx
Definition: detect.h:785
PrefilterPacketHeaderCtx_::sigs_array
SigIntId * sigs_array
Definition: detect-engine-prefilter-common.h:43
DetectEngineCtxFree
void DetectEngineCtxFree(DetectEngineCtx *)
Free a DetectEngineCtx::
Definition: detect-engine.c:2442
PrefilterPacketHeaderValue::u8
uint8_t u8[16]
Definition: detect-engine-prefilter-common.h:24
FLOW_PKT_TOSERVER
#define FLOW_PKT_TOSERVER
Definition: flow.h:227
DE_QUIET
#define DE_QUIET
Definition: detect.h:287
PrefilterPacketHeaderCtx_::sigs_cnt
uint32_t sigs_cnt
Definition: detect-engine-prefilter-common.h:42
DetectEngineAppendSig
Signature * DetectEngineAppendSig(DetectEngineCtx *, const char *)
Parse and append a Signature into the Detection Engine Context signature list.
Definition: detect-parse.c:2434
Packet_::flowflags
uint8_t flowflags
Definition: decode.h:459
SigTableElmt_::Setup
int(* Setup)(DetectEngineCtx *, Signature *, const char *)
Definition: detect.h:1223
PrefilterPacketHeaderValue::u16
uint16_t u16[8]
Definition: detect-engine-prefilter-common.h:25
detect-engine-prefilter.h
util-unittest.h
AppLayerGetProtoByName
AppProto AppLayerGetProtoByName(char *alproto_name)
Given a protocol string, returns the corresponding internal protocol id.
Definition: app-layer.c:932
util-unittest-helper.h
FAIL_IF_NOT
#define FAIL_IF_NOT(expr)
Fail a test if expression evaluates to false.
Definition: util-unittest.h:82
PKT_PROTO_DETECT_TS_DONE
#define PKT_PROTO_DETECT_TS_DONE
Definition: decode.h:1036
SIG_FLAG_APPLAYER
#define SIG_FLAG_APPLAYER
Definition: detect.h:207
SigTableElmt_::SetupPrefilter
int(* SetupPrefilter)(DetectEngineCtx *de_ctx, struct SigGroupHead_ *sgh)
Definition: detect.h:1226
Signature_::next
struct Signature_ * next
Definition: detect.h:614
PrefilterPacketHeaderCtx_
Definition: detect-engine-prefilter-common.h:35
FAIL_IF_NOT_NULL
#define FAIL_IF_NOT_NULL(expr)
Fail a test if expression evaluates to non-NULL.
Definition: util-unittest.h:96
util-debug.h
PASS
#define PASS
Pass the test.
Definition: util-unittest.h:105
de_ctx
DetectEngineCtx * de_ctx
Definition: fuzz_siginit.c:17
DetectEngineThreadCtx_
Definition: detect.h:1025
ALPROTO_SMTP
@ ALPROTO_SMTP
Definition: app-layer-protos.h:32
SCEnter
#define SCEnter(...)
Definition: util-debug.h:271
SigMatch_::next
struct SigMatch_ * next
Definition: detect.h:317
DETECT_SM_LIST_MATCH
@ DETECT_SM_LIST_MATCH
Definition: detect.h:78
DetectAppLayerProtocolData
struct DetectAppLayerProtocolData_ DetectAppLayerProtocolData
app-layer-parser.h
SigMatch_::ctx
SigMatchCtx * ctx
Definition: detect.h:316
SCReturn
#define SCReturn
Definition: util-debug.h:273
Signature_::flags
uint32_t flags
Definition: detect.h:541
Packet_
Definition: decode.h:428
detect-engine-build.h
DETECT_AL_APP_LAYER_PROTOCOL
@ DETECT_AL_APP_LAYER_PROTOCOL
Definition: detect-engine-register.h:35
SIGMATCH_HANDLE_NEGATION
#define SIGMATCH_HANDLE_NEGATION
Definition: detect.h:1443
Signature_::init_data
SignatureInitData * init_data
Definition: detect.h:611
DetectAppLayerProtocolData_::alproto
AppProto alproto
Definition: detect-app-layer-protocol.c:42
SignatureInitData_::negated
bool negated
Definition: detect.h:495
SigTableElmt_::Match
int(* Match)(DetectEngineThreadCtx *, Packet *, const Signature *, const SigMatchCtx *)
Definition: detect.h:1206
SignatureInitData_::smlists
struct SigMatch_ ** smlists
Definition: detect.h:534
FLOW_PKT_TOCLIENT
#define FLOW_PKT_TOCLIENT
Definition: flow.h:228
SigMatchAlloc
SigMatch * SigMatchAlloc(void)
Definition: detect-parse.c:239
SigGroupBuild
int SigGroupBuild(DetectEngineCtx *de_ctx)
Convert the signature list into the runtime match structure.
Definition: detect-engine-build.c:1951
PrefilterPacketHeaderCtx_::v1
PrefilterPacketHeaderValue v1
Definition: detect-engine-prefilter-common.h:36
SigMatchCtx_
Used to start a pointer to SigMatch context Should never be dereferenced without casting to something...
Definition: detect.h:308
Packet_::flow
struct Flow_ * flow
Definition: decode.h:465
FAIL_IF
#define FAIL_IF(expr)
Fail a test if expression evaluates to true.
Definition: util-unittest.h:71
suricata-common.h
SigMatch_::type
uint16_t type
Definition: detect.h:314
sigmatch_table
SigTableElmt sigmatch_table[DETECT_TBLSIZE]
Definition: detect-parse.c:76
PKT_PROTO_DETECT_TC_DONE
#define PKT_PROTO_DETECT_TC_DONE
Definition: decode.h:1037
PrefilterSetupPacketHeader
int PrefilterSetupPacketHeader(DetectEngineCtx *de_ctx, SigGroupHead *sgh, int sm_type, void(*Set)(PrefilterPacketHeaderValue *v, void *), bool(*Compare)(PrefilterPacketHeaderValue v, void *), void(*Match)(DetectEngineThreadCtx *det_ctx, Packet *p, const void *pectx))
Definition: detect-engine-prefilter-common.c:417
SCMalloc
#define SCMalloc(sz)
Definition: util-mem.h:47
SCLogError
#define SCLogError(...)
Macro used to log ERROR messages.
Definition: util-debug.h:261
SCFree
#define SCFree(p)
Definition: util-mem.h:61
Flow_::alproto_ts
AppProto alproto_ts
Definition: flow.h:457
SigTableElmt_::SupportsPrefilter
bool(* SupportsPrefilter)(const Signature *s)
Definition: detect.h:1225
Signature_::id
uint32_t id
Definition: detect.h:574
detect-parse.h
Signature_
Signature container.
Definition: detect.h:540
SigMatch_
a single match condition for a signature
Definition: detect.h:313
ALPROTO_HTTP
@ ALPROTO_HTTP
Definition: app-layer-protos.h:66
ALPROTO_UNKNOWN
@ ALPROTO_UNKNOWN
Definition: app-layer-protos.h:29
ALPROTO_FAILED
@ ALPROTO_FAILED
Definition: app-layer-protos.h:70
DetectEngineCtxInit
DetectEngineCtx * DetectEngineCtxInit(void)
Definition: detect-engine.c:2403
DetectAppLayerProtocolRegister
void DetectAppLayerProtocolRegister(void)
Definition: detect-app-layer-protocol.c:268
PrefilterPacketHeaderValue
Definition: detect-engine-prefilter-common.h:23
DetectEngineCtx_::flags
uint8_t flags
Definition: detect.h:786
detect-engine-prefilter-common.h
Flow_::alproto_tc
AppProto alproto_tc
Definition: flow.h:458
Flow_::alproto
AppProto alproto
application level protocol
Definition: flow.h:456
SCReturnInt
#define SCReturnInt(x)
Definition: util-debug.h:275
SigMatchAppendSMToList
void SigMatchAppendSMToList(Signature *s, SigMatch *new, int list)
Append a SigMatch to the list type.
Definition: detect-parse.c:354
SigTableElmt_::RegisterTests
void(* RegisterTests)(void)
Definition: detect.h:1230
app-layer.h