suricata
detect-app-layer-protocol.c
Go to the documentation of this file.
1 /* Copyright (C) 2007-2013 Open Information Security Foundation
2  *
3  * You can copy, redistribute or modify this Program under the terms of
4  * the GNU General Public License version 2 as published by the Free
5  * Software Foundation.
6  *
7  * This program is distributed in the hope that it will be useful,
8  * but WITHOUT ANY WARRANTY; without even the implied warranty of
9  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
10  * GNU General Public License for more details.
11  *
12  * You should have received a copy of the GNU General Public License
13  * version 2 along with this program; if not, write to the Free Software
14  * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA
15  * 02110-1301, USA.
16  */
17 
18 /**
19  * \file
20  *
21  * \author Anoop Saldanha <anoopsaldanha@gmail.com>
22  */
23 
24 #include "suricata-common.h"
25 #include "detect-engine.h"
28 #include "detect-parse.h"
30 #include "app-layer.h"
31 #include "app-layer-parser.h"
32 #include "util-debug.h"
33 #include "util-unittest.h"
34 #include "util-unittest-helper.h"
35 
36 static void DetectAppLayerProtocolRegisterTests(void);
37 
38 static int DetectAppLayerProtocolPacketMatch(
39  DetectEngineThreadCtx *det_ctx,
40  Packet *p, const Signature *s, const SigMatchCtx *ctx)
41 {
42  SCEnter();
43 
44  int r = 0;
45  const DetectAppLayerProtocolData *data = (const DetectAppLayerProtocolData *)ctx;
46 
47  /* if the sig is PD-only we only match when PD packet flags are set */
48  if ((s->flags & SIG_FLAG_PDONLY) &&
50  {
51  SCLogDebug("packet %"PRIu64": flags not set", p->pcap_cnt);
52  SCReturnInt(0);
53  }
54 
55  const Flow *f = p->flow;
56  if (f == NULL) {
57  SCLogDebug("packet %"PRIu64": no flow", p->pcap_cnt);
58  SCReturnInt(0);
59  }
60 
61  /* unknown means protocol detection isn't ready yet */
62 
64  {
65  SCLogDebug("toserver packet %"PRIu64": looking for %u/neg %u, got %u",
66  p->pcap_cnt, data->alproto, data->negated, f->alproto_ts);
67 
68  r = (data->negated) ? (f->alproto_ts != data->alproto) :
69  (f->alproto_ts == data->alproto);
70 
71  } else if ((f->alproto_tc != ALPROTO_UNKNOWN) && (p->flowflags & FLOW_PKT_TOCLIENT))
72  {
73  SCLogDebug("toclient packet %"PRIu64": looking for %u/neg %u, got %u",
74  p->pcap_cnt, data->alproto, data->negated, f->alproto_tc);
75 
76  r = (data->negated) ? (f->alproto_tc != data->alproto) :
77  (f->alproto_tc == data->alproto);
78  }
79  else {
80  SCLogDebug("packet %"PRIu64": default case: direction %02x, approtos %u/%u/%u",
81  p->pcap_cnt,
83  f->alproto, f->alproto_ts, f->alproto_tc);
84  }
85 
86  SCReturnInt(r);
87 }
88 
89 static DetectAppLayerProtocolData *DetectAppLayerProtocolParse(const char *arg, bool negate)
90 {
92  AppProto alproto = ALPROTO_UNKNOWN;
93 
94  if (strcmp(arg, "failed") == 0) {
95  alproto = ALPROTO_FAILED;
96  } else {
97  alproto = AppLayerGetProtoByName((char *)arg);
98  if (alproto == ALPROTO_UNKNOWN) {
99  SCLogError(SC_ERR_INVALID_SIGNATURE, "app-layer-protocol "
100  "keyword supplied with unknown protocol \"%s\"", arg);
101  return NULL;
102  }
103  }
104 
105  data = SCMalloc(sizeof(DetectAppLayerProtocolData));
106  if (unlikely(data == NULL))
107  return NULL;
108  data->alproto = alproto;
109  data->negated = negate;
110 
111  return data;
112 }
113 
114 static bool HasConflicts(const DetectAppLayerProtocolData *us,
115  const DetectAppLayerProtocolData *them)
116 {
117  /* mixing negated and non negated is illegal */
118  if (them->negated ^ us->negated)
119  return TRUE;
120  /* multiple non-negated is illegal */
121  if (!us->negated)
122  return TRUE;
123  /* duplicate option */
124  if (us->alproto == them->alproto)
125  return TRUE;
126 
127  /* all good */
128  return FALSE;
129 }
130 
131 static int DetectAppLayerProtocolSetup(DetectEngineCtx *de_ctx,
132  Signature *s, const char *arg)
133 {
134  DetectAppLayerProtocolData *data = NULL;
135  SigMatch *sm = NULL;
136 
137  if (s->alproto != ALPROTO_UNKNOWN) {
138  SCLogError(SC_ERR_CONFLICTING_RULE_KEYWORDS, "Either we already "
139  "have the rule match on an app layer protocol set through "
140  "other keywords that match on this protocol, or have "
141  "already seen a non-negated app-layer-protocol.");
142  goto error;
143  }
144 
145  data = DetectAppLayerProtocolParse(arg, s->init_data->negated);
146  if (data == NULL)
147  goto error;
148 
150  for ( ; tsm != NULL; tsm = tsm->next) {
151  if (tsm->type == DETECT_AL_APP_LAYER_PROTOCOL) {
152  const DetectAppLayerProtocolData *them = (const DetectAppLayerProtocolData *)tsm->ctx;
153 
154  if (HasConflicts(data, them)) {
156  "positive app-layer-protocol match with negated "
157  "match or match for 'failed'.");
158  goto error;
159  }
160  }
161  }
162 
163  sm = SigMatchAlloc();
164  if (sm == NULL)
165  goto error;
166 
168  sm->ctx = (void *)data;
169 
171  return 0;
172 
173 error:
174  if (data != NULL)
175  SCFree(data);
176  return -1;
177 }
178 
179 static void DetectAppLayerProtocolFree(DetectEngineCtx *de_ctx, void *ptr)
180 {
181  SCFree(ptr);
182  return;
183 }
184 
185 /** \internal
186  * \brief prefilter function for protocol detect matching
187  */
188 static void
189 PrefilterPacketAppProtoMatch(DetectEngineThreadCtx *det_ctx, Packet *p, const void *pectx)
190 {
191  const PrefilterPacketHeaderCtx *ctx = pectx;
192 
193  if (PrefilterPacketHeaderExtraMatch(ctx, p) == FALSE) {
194  SCLogDebug("packet %"PRIu64": extra match failed", p->pcap_cnt);
195  SCReturn;
196  }
197 
198  if (p->flow == NULL) {
199  SCLogDebug("packet %"PRIu64": no flow, no alproto", p->pcap_cnt);
200  SCReturn;
201  }
202 
204  SCLogDebug("packet %"PRIu64": flags not set", p->pcap_cnt);
205  SCReturn;
206  }
207 
209  {
210  int r = (ctx->v1.u16[0] == p->flow->alproto_ts) ^ ctx->v1.u8[2];
211  if (r) {
212  PrefilterAddSids(&det_ctx->pmq, ctx->sigs_array, ctx->sigs_cnt);
213  }
214  } else if ((p->flags & PKT_PROTO_DETECT_TC_DONE) && (p->flowflags & FLOW_PKT_TOCLIENT))
215  {
216  int r = (ctx->v1.u16[0] == p->flow->alproto_tc) ^ ctx->v1.u8[2];
217  if (r) {
218  PrefilterAddSids(&det_ctx->pmq, ctx->sigs_array, ctx->sigs_cnt);
219  }
220  }
221 }
222 
223 static void
224 PrefilterPacketAppProtoSet(PrefilterPacketHeaderValue *v, void *smctx)
225 {
226  const DetectAppLayerProtocolData *a = smctx;
227  v->u16[0] = a->alproto;
228  v->u8[2] = (uint8_t)a->negated;
229 }
230 
231 static bool
232 PrefilterPacketAppProtoCompare(PrefilterPacketHeaderValue v, void *smctx)
233 {
234  const DetectAppLayerProtocolData *a = smctx;
235  if (v.u16[0] == a->alproto &&
236  v.u8[2] == (uint8_t)a->negated)
237  return TRUE;
238  return FALSE;
239 }
240 
241 static int PrefilterSetupAppProto(DetectEngineCtx *de_ctx, SigGroupHead *sgh)
242 {
244  PrefilterPacketAppProtoSet,
245  PrefilterPacketAppProtoCompare,
246  PrefilterPacketAppProtoMatch);
247 }
248 
249 static bool PrefilterAppProtoIsPrefilterable(const Signature *s)
250 {
251  if (s->flags & SIG_FLAG_PDONLY) {
252  SCLogDebug("prefilter on PD %u", s->id);
253  return TRUE;
254  }
255  return FALSE;
256 }
257 
259 {
260  sigmatch_table[DETECT_AL_APP_LAYER_PROTOCOL].name = "app-layer-protocol";
261  sigmatch_table[DETECT_AL_APP_LAYER_PROTOCOL].desc = "match on the detected app-layer protocol";
262  sigmatch_table[DETECT_AL_APP_LAYER_PROTOCOL].url = "/rules/app-layer.html#app-layer-protocol";
264  DetectAppLayerProtocolPacketMatch;
266  DetectAppLayerProtocolSetup;
268  DetectAppLayerProtocolFree;
270  DetectAppLayerProtocolRegisterTests;
273 
275  PrefilterSetupAppProto;
277  PrefilterAppProtoIsPrefilterable;
278  return;
279 }
280 
281 /**********************************Unittests***********************************/
282 
283 #ifdef UNITTESTS
284 
285 static int DetectAppLayerProtocolTest01(void)
286 {
287  DetectAppLayerProtocolData *data = DetectAppLayerProtocolParse("http", false);
288  FAIL_IF_NULL(data);
289  FAIL_IF(data->alproto != ALPROTO_HTTP);
290  FAIL_IF(data->negated != 0);
291  DetectAppLayerProtocolFree(NULL, data);
292  PASS;
293 }
294 
295 static int DetectAppLayerProtocolTest02(void)
296 {
297  DetectAppLayerProtocolData *data = DetectAppLayerProtocolParse("http", true);
298  FAIL_IF_NULL(data);
299  FAIL_IF(data->alproto != ALPROTO_HTTP);
300  FAIL_IF(data->negated == 0);
301  DetectAppLayerProtocolFree(NULL, data);
302  PASS;
303 }
304 
305 static int DetectAppLayerProtocolTest03(void)
306 {
307  Signature *s = NULL;
308  DetectAppLayerProtocolData *data = NULL;
311  de_ctx->flags |= DE_QUIET;
312 
313  s = DetectEngineAppendSig(de_ctx, "alert tcp any any -> any any "
314  "(app-layer-protocol:http; sid:1;)");
315  FAIL_IF_NULL(s);
316 
318 
319  FAIL_IF_NULL(s->sm_lists[DETECT_SM_LIST_MATCH]);
320  FAIL_IF_NULL(s->sm_lists[DETECT_SM_LIST_MATCH]->ctx);
321 
322  data = (DetectAppLayerProtocolData *)s->sm_lists[DETECT_SM_LIST_MATCH]->ctx;
323  FAIL_IF(data->alproto != ALPROTO_HTTP);
324  FAIL_IF(data->negated);
326  PASS;
327 }
328 
329 static int DetectAppLayerProtocolTest04(void)
330 {
331  Signature *s = NULL;
332  DetectAppLayerProtocolData *data = NULL;
335  de_ctx->flags |= DE_QUIET;
336 
337  s = DetectEngineAppendSig(de_ctx, "alert tcp any any -> any any "
338  "(app-layer-protocol:!http; sid:1;)");
339  FAIL_IF_NULL(s);
342 
343  FAIL_IF_NULL(s->sm_lists[DETECT_SM_LIST_MATCH]);
344  FAIL_IF_NULL(s->sm_lists[DETECT_SM_LIST_MATCH]->ctx);
345 
346  data = (DetectAppLayerProtocolData*)s->sm_lists[DETECT_SM_LIST_MATCH]->ctx;
347  FAIL_IF_NULL(data);
348  FAIL_IF(data->alproto != ALPROTO_HTTP);
349  FAIL_IF(data->negated == 0);
350 
352  PASS;
353 }
354 
355 static int DetectAppLayerProtocolTest05(void)
356 {
357  Signature *s = NULL;
358  DetectAppLayerProtocolData *data = NULL;
361  de_ctx->flags |= DE_QUIET;
362 
363  s = DetectEngineAppendSig(de_ctx, "alert tcp any any -> any any "
364  "(app-layer-protocol:!http; app-layer-protocol:!smtp; sid:1;)");
365  FAIL_IF_NULL(s);
368 
369  FAIL_IF_NULL(s->sm_lists[DETECT_SM_LIST_MATCH]);
370  FAIL_IF_NULL(s->sm_lists[DETECT_SM_LIST_MATCH]->ctx);
371 
372  data = (DetectAppLayerProtocolData*)s->sm_lists[DETECT_SM_LIST_MATCH]->ctx;
373  FAIL_IF_NULL(data);
374  FAIL_IF(data->alproto != ALPROTO_HTTP);
375  FAIL_IF(data->negated == 0);
376 
377  data = (DetectAppLayerProtocolData*)s->sm_lists[DETECT_SM_LIST_MATCH]->next->ctx;
378  FAIL_IF_NULL(data);
379  FAIL_IF(data->alproto != ALPROTO_SMTP);
380  FAIL_IF(data->negated == 0);
381 
383  PASS;
384 }
385 
386 static int DetectAppLayerProtocolTest06(void)
387 {
388  Signature *s = NULL;
391  de_ctx->flags |= DE_QUIET;
392 
393  s = DetectEngineAppendSig(de_ctx, "alert http any any -> any any "
394  "(app-layer-protocol:smtp; sid:1;)");
395  FAIL_IF_NOT_NULL(s);
397  PASS;
398 }
399 
400 static int DetectAppLayerProtocolTest07(void)
401 {
402  Signature *s = NULL;
405  de_ctx->flags |= DE_QUIET;
406 
407  s = DetectEngineAppendSig(de_ctx, "alert http any any -> any any "
408  "(app-layer-protocol:!smtp; sid:1;)");
409  FAIL_IF_NOT_NULL(s);
411  PASS;
412 }
413 
414 static int DetectAppLayerProtocolTest08(void)
415 {
416  Signature *s = NULL;
419  de_ctx->flags |= DE_QUIET;
420 
421  s = DetectEngineAppendSig(de_ctx, "alert tcp any any -> any any "
422  "(app-layer-protocol:!smtp; app-layer-protocol:http; sid:1;)");
423  FAIL_IF_NOT_NULL(s);
425  PASS;
426 }
427 
428 static int DetectAppLayerProtocolTest09(void)
429 {
430  Signature *s = NULL;
433  de_ctx->flags |= DE_QUIET;
434 
435  s = DetectEngineAppendSig(de_ctx, "alert tcp any any -> any any "
436  "(app-layer-protocol:http; app-layer-protocol:!smtp; sid:1;)");
437  FAIL_IF_NOT_NULL(s);
439  PASS;
440 }
441 
442 static int DetectAppLayerProtocolTest10(void)
443 {
444  Signature *s = NULL;
447  de_ctx->flags |= DE_QUIET;
448 
449  s = DetectEngineAppendSig(de_ctx, "alert tcp any any -> any any "
450  "(app-layer-protocol:smtp; app-layer-protocol:!http; sid:1;)");
451  FAIL_IF_NOT_NULL(s);
453  PASS;
454 }
455 
456 static int DetectAppLayerProtocolTest11(void)
457 {
458  DetectAppLayerProtocolData *data = DetectAppLayerProtocolParse("failed", false);
459  FAIL_IF_NULL(data);
460  FAIL_IF(data->alproto != ALPROTO_FAILED);
461  FAIL_IF(data->negated != 0);
462  DetectAppLayerProtocolFree(NULL, data);
463  PASS;
464 }
465 
466 static int DetectAppLayerProtocolTest12(void)
467 {
468  DetectAppLayerProtocolData *data = DetectAppLayerProtocolParse("failed", true);
469  FAIL_IF_NULL(data);
470  FAIL_IF(data->alproto != ALPROTO_FAILED);
471  FAIL_IF(data->negated == 0);
472  DetectAppLayerProtocolFree(NULL, data);
473  PASS;
474 }
475 
476 static int DetectAppLayerProtocolTest13(void)
477 {
478  Signature *s = NULL;
479  DetectAppLayerProtocolData *data = NULL;
482  de_ctx->flags |= DE_QUIET;
483 
484  s = DetectEngineAppendSig(de_ctx, "alert tcp any any -> any any "
485  "(app-layer-protocol:failed; sid:1;)");
486  FAIL_IF_NULL(s);
487 
489 
490  FAIL_IF_NULL(s->sm_lists[DETECT_SM_LIST_MATCH]);
491  FAIL_IF_NULL(s->sm_lists[DETECT_SM_LIST_MATCH]->ctx);
492 
493  data = (DetectAppLayerProtocolData *)s->sm_lists[DETECT_SM_LIST_MATCH]->ctx;
494  FAIL_IF(data->alproto != ALPROTO_FAILED);
495  FAIL_IF(data->negated);
497  PASS;
498 }
499 
500 static int DetectAppLayerProtocolTest14(void)
501 {
502  DetectAppLayerProtocolData *data = NULL;
505  de_ctx->flags |= DE_QUIET;
506 
507  Signature *s1 = DetectEngineAppendSig(de_ctx, "alert tcp any any -> any any "
508  "(app-layer-protocol:http; flowbits:set,blah; sid:1;)");
509  FAIL_IF_NULL(s1);
511  FAIL_IF_NULL(s1->sm_lists[DETECT_SM_LIST_MATCH]);
512  FAIL_IF_NULL(s1->sm_lists[DETECT_SM_LIST_MATCH]->ctx);
513  data = (DetectAppLayerProtocolData *)s1->sm_lists[DETECT_SM_LIST_MATCH]->ctx;
514  FAIL_IF(data->alproto != ALPROTO_HTTP);
515  FAIL_IF(data->negated);
516 
517  Signature *s2 = DetectEngineAppendSig(de_ctx, "alert tcp any any -> any any "
518  "(app-layer-protocol:http; flow:to_client; sid:2;)");
519  FAIL_IF_NULL(s2);
521  FAIL_IF_NULL(s2->sm_lists[DETECT_SM_LIST_MATCH]);
522  FAIL_IF_NULL(s2->sm_lists[DETECT_SM_LIST_MATCH]->ctx);
523  data = (DetectAppLayerProtocolData *)s2->sm_lists[DETECT_SM_LIST_MATCH]->ctx;
524  FAIL_IF(data->alproto != ALPROTO_HTTP);
525  FAIL_IF(data->negated);
526 
527  /* flow:established and other options not supported for PD-only */
528  Signature *s3 = DetectEngineAppendSig(de_ctx, "alert tcp any any -> any any "
529  "(app-layer-protocol:http; flow:to_client,established; sid:3;)");
530  FAIL_IF_NULL(s3);
532  FAIL_IF_NULL(s3->sm_lists[DETECT_SM_LIST_MATCH]);
533  FAIL_IF_NULL(s3->sm_lists[DETECT_SM_LIST_MATCH]->ctx);
534  data = (DetectAppLayerProtocolData *)s3->sm_lists[DETECT_SM_LIST_MATCH]->ctx;
535  FAIL_IF(data->alproto != ALPROTO_HTTP);
536  FAIL_IF(data->negated);
537 
541  FAIL_IF(s3->flags & SIG_FLAG_PDONLY); // failure now
542 
544  PASS;
545 }
546 
547 #endif /* UNITTESTS */
548 
549 static void DetectAppLayerProtocolRegisterTests(void)
550 {
551 #ifdef UNITTESTS /* UNITTESTS */
552  UtRegisterTest("DetectAppLayerProtocolTest01",
553  DetectAppLayerProtocolTest01);
554  UtRegisterTest("DetectAppLayerProtocolTest02",
555  DetectAppLayerProtocolTest02);
556  UtRegisterTest("DetectAppLayerProtocolTest03",
557  DetectAppLayerProtocolTest03);
558  UtRegisterTest("DetectAppLayerProtocolTest04",
559  DetectAppLayerProtocolTest04);
560  UtRegisterTest("DetectAppLayerProtocolTest05",
561  DetectAppLayerProtocolTest05);
562  UtRegisterTest("DetectAppLayerProtocolTest06",
563  DetectAppLayerProtocolTest06);
564  UtRegisterTest("DetectAppLayerProtocolTest07",
565  DetectAppLayerProtocolTest07);
566  UtRegisterTest("DetectAppLayerProtocolTest08",
567  DetectAppLayerProtocolTest08);
568  UtRegisterTest("DetectAppLayerProtocolTest09",
569  DetectAppLayerProtocolTest09);
570  UtRegisterTest("DetectAppLayerProtocolTest10",
571  DetectAppLayerProtocolTest10);
572  UtRegisterTest("DetectAppLayerProtocolTest11",
573  DetectAppLayerProtocolTest11);
574  UtRegisterTest("DetectAppLayerProtocolTest12",
575  DetectAppLayerProtocolTest12);
576  UtRegisterTest("DetectAppLayerProtocolTest13",
577  DetectAppLayerProtocolTest13);
578  UtRegisterTest("DetectAppLayerProtocolTest14",
579  DetectAppLayerProtocolTest14);
580 #endif /* UNITTESTS */
581 
582  return;
583 }
SigTableElmt_::url
const char * url
Definition: detect.h:1212
detect-engine.h
detect-app-layer-protocol.h
FAIL_IF_NULL
#define FAIL_IF_NULL(expr)
Fail a test if expression evaluates to NULL.
Definition: util-unittest.h:89
SigTableElmt_::desc
const char * desc
Definition: detect.h:1211
SigTableElmt_::Free
void(* Free)(DetectEngineCtx *, void *)
Definition: detect.h:1200
SIG_FLAG_PDONLY
#define SIG_FLAG_PDONLY
Definition: detect.h:247
SigTableElmt_::name
const char * name
Definition: detect.h:1209
SigGroupHead_
Container for matching data for a signature group.
Definition: detect.h:1345
unlikely
#define unlikely(expr)
Definition: util-optimize.h:35
UtRegisterTest
void UtRegisterTest(const char *name, int(*TestFn)(void))
Register unit test.
Definition: util-unittest.c:103
Signature_::alproto
AppProto alproto
Definition: detect.h:531
SCLogDebug
#define SCLogDebug(...)
Definition: util-debug.h:298
Packet_::pcap_cnt
uint64_t pcap_cnt
Definition: decode.h:564
SIGMATCH_QUOTES_OPTIONAL
#define SIGMATCH_QUOTES_OPTIONAL
Definition: detect.h:1390
DetectAppLayerProtocolData_
Definition: detect-app-layer-protocol.h:27
AppProto
uint16_t AppProto
Definition: app-layer-protos.h:71
Packet_::flags
uint32_t flags
Definition: decode.h:446
DetectAppLayerProtocolData_::negated
uint8_t negated
Definition: detect-app-layer-protocol.h:29
Flow_
Flow data structure.
Definition: flow.h:343
DetectEngineThreadCtx_::pmq
PrefilterRuleStore pmq
Definition: detect.h:1110
SigTableElmt_::flags
uint16_t flags
Definition: detect.h:1203
DetectEngineCtx_
main detection engine ctx
Definition: detect.h:766
SC_ERR_INVALID_SIGNATURE
@ SC_ERR_INVALID_SIGNATURE
Definition: util-error.h:69
PrefilterPacketHeaderCtx_::sigs_array
SigIntId * sigs_array
Definition: detect-engine-prefilter-common.h:41
DetectEngineCtxFree
void DetectEngineCtxFree(DetectEngineCtx *)
Free a DetectEngineCtx::
Definition: detect-engine.c:2092
PrefilterPacketHeaderValue::u8
uint8_t u8[16]
Definition: detect-engine-prefilter-common.h:22
FLOW_PKT_TOSERVER
#define FLOW_PKT_TOSERVER
Definition: flow.h:218
DE_QUIET
#define DE_QUIET
Definition: detect.h:293
PrefilterPacketHeaderCtx_::sigs_cnt
uint32_t sigs_cnt
Definition: detect-engine-prefilter-common.h:40
Packet_::flowflags
uint8_t flowflags
Definition: decode.h:442
SigTableElmt_::Setup
int(* Setup)(DetectEngineCtx *, Signature *, const char *)
Definition: detect.h:1195
PrefilterPacketHeaderValue::u16
uint16_t u16[8]
Definition: detect-engine-prefilter-common.h:23
detect-engine-prefilter.h
util-unittest.h
AppLayerGetProtoByName
AppProto AppLayerGetProtoByName(char *alproto_name)
Given a protocol string, returns the corresponding internal protocol id.
Definition: app-layer.c:769
util-unittest-helper.h
FAIL_IF_NOT
#define FAIL_IF_NOT(expr)
Fail a test if expression to true.
Definition: util-unittest.h:82
PKT_PROTO_DETECT_TS_DONE
#define PKT_PROTO_DETECT_TS_DONE
Definition: decode.h:1111
SIG_FLAG_APPLAYER
#define SIG_FLAG_APPLAYER
Definition: detect.h:218
SigTableElmt_::SetupPrefilter
int(* SetupPrefilter)(DetectEngineCtx *de_ctx, struct SigGroupHead_ *sgh)
Definition: detect.h:1198
Signature_::next
struct Signature_ * next
Definition: detect.h:599
PrefilterPacketHeaderCtx_
Definition: detect-engine-prefilter-common.h:33
FAIL_IF_NOT_NULL
#define FAIL_IF_NOT_NULL(expr)
Fail a test if expression evaluates to non-NULL.
Definition: util-unittest.h:96
util-debug.h
PASS
#define PASS
Pass the test.
Definition: util-unittest.h:105
de_ctx
DetectEngineCtx * de_ctx
Definition: fuzz_siginit.c:17
DetectEngineThreadCtx_
Definition: detect.h:1009
ALPROTO_SMTP
@ ALPROTO_SMTP
Definition: app-layer-protos.h:32
SCEnter
#define SCEnter(...)
Definition: util-debug.h:300
SigMatch_::next
struct SigMatch_ * next
Definition: detect.h:323
DETECT_SM_LIST_MATCH
@ DETECT_SM_LIST_MATCH
Definition: detect.h:89
app-layer-parser.h
TRUE
#define TRUE
Definition: suricata-common.h:33
SigMatch_::ctx
SigMatchCtx * ctx
Definition: detect.h:322
FALSE
#define FALSE
Definition: suricata-common.h:34
SCReturn
#define SCReturn
Definition: util-debug.h:302
Signature_::flags
uint32_t flags
Definition: detect.h:528
Packet_
Definition: decode.h:411
DETECT_AL_APP_LAYER_PROTOCOL
@ DETECT_AL_APP_LAYER_PROTOCOL
Definition: detect-engine-register.h:35
SIGMATCH_HANDLE_NEGATION
#define SIGMATCH_HANDLE_NEGATION
Definition: detect.h:1398
Signature_::init_data
SignatureInitData * init_data
Definition: detect.h:596
DetectAppLayerProtocolData_::alproto
AppProto alproto
Definition: detect-app-layer-protocol.h:28
SignatureInitData_::negated
bool negated
Definition: detect.h:484
SigTableElmt_::Match
int(* Match)(DetectEngineThreadCtx *, Packet *, const Signature *, const SigMatchCtx *)
Definition: detect.h:1178
SignatureInitData_::smlists
struct SigMatch_ ** smlists
Definition: detect.h:521
FLOW_PKT_TOCLIENT
#define FLOW_PKT_TOCLIENT
Definition: flow.h:219
SigMatchAlloc
SigMatch * SigMatchAlloc(void)
Definition: detect-parse.c:235
SigGroupBuild
int SigGroupBuild(DetectEngineCtx *de_ctx)
Convert the signature list into the runtime match structure.
Definition: detect-engine-build.c:1878
SigMatch_::type
uint8_t type
Definition: detect.h:320
PrefilterPacketHeaderCtx_::v1
PrefilterPacketHeaderValue v1
Definition: detect-engine-prefilter-common.h:34
SigMatchCtx_
Used to start a pointer to SigMatch context Should never be dereferenced without casting to something...
Definition: detect.h:314
DetectEngineAppendSig
Signature * DetectEngineAppendSig(DetectEngineCtx *de_ctx, const char *sigstr)
Parse and append a Signature into the Detection Engine Context signature list.
Definition: detect-parse.c:2340
Packet_::flow
struct Flow_ * flow
Definition: decode.h:448
FAIL_IF
#define FAIL_IF(expr)
Fail a test if expression evaluates to false.
Definition: util-unittest.h:71
suricata-common.h
sigmatch_table
SigTableElmt sigmatch_table[DETECT_TBLSIZE]
Definition: detect-parse.c:73
SCLogError
#define SCLogError(err_code,...)
Macro used to log ERROR messages.
Definition: util-debug.h:257
PKT_PROTO_DETECT_TC_DONE
#define PKT_PROTO_DETECT_TC_DONE
Definition: decode.h:1112
PrefilterSetupPacketHeader
int PrefilterSetupPacketHeader(DetectEngineCtx *de_ctx, SigGroupHead *sgh, int sm_type, void(*Set)(PrefilterPacketHeaderValue *v, void *), bool(*Compare)(PrefilterPacketHeaderValue v, void *), void(*Match)(DetectEngineThreadCtx *det_ctx, Packet *p, const void *pectx))
Definition: detect-engine-prefilter-common.c:407
SCMalloc
#define SCMalloc(sz)
Definition: util-mem.h:47
SCFree
#define SCFree(p)
Definition: util-mem.h:61
Flow_::alproto_ts
AppProto alproto_ts
Definition: flow.h:426
SigTableElmt_::SupportsPrefilter
bool(* SupportsPrefilter)(const Signature *s)
Definition: detect.h:1197
Signature_::id
uint32_t id
Definition: detect.h:560
detect-parse.h
Signature_
Signature container.
Definition: detect.h:527
SigMatch_
a single match condition for a signature
Definition: detect.h:319
ALPROTO_HTTP
@ ALPROTO_HTTP
Definition: app-layer-protos.h:30
ALPROTO_UNKNOWN
@ ALPROTO_UNKNOWN
Definition: app-layer-protos.h:29
ALPROTO_FAILED
@ ALPROTO_FAILED
Definition: app-layer-protos.h:61
DetectEngineCtxInit
DetectEngineCtx * DetectEngineCtxInit(void)
Definition: detect-engine.c:2047
DetectAppLayerProtocolRegister
void DetectAppLayerProtocolRegister(void)
Definition: detect-app-layer-protocol.c:258
PrefilterPacketHeaderValue
Definition: detect-engine-prefilter-common.h:21
DetectEngineCtx_::flags
uint8_t flags
Definition: detect.h:767
detect-engine-prefilter-common.h
Flow_::alproto_tc
AppProto alproto_tc
Definition: flow.h:427
Flow_::alproto
AppProto alproto
application level protocol
Definition: flow.h:425
SCReturnInt
#define SCReturnInt(x)
Definition: util-debug.h:304
SigMatchAppendSMToList
void SigMatchAppendSMToList(Signature *s, SigMatch *new, int list)
Append a SigMatch to the list type.
Definition: detect-parse.c:349
SigTableElmt_::RegisterTests
void(* RegisterTests)(void)
Definition: detect.h:1201
app-layer.h
SC_ERR_CONFLICTING_RULE_KEYWORDS
@ SC_ERR_CONFLICTING_RULE_KEYWORDS
Definition: util-error.h:171