Application Layer Expectation

Handling of dynamic parallel connection for application layer similar to FTP. More...


file  app-layer-expectation.c

Data Structures

struct  Expectation_
struct  ExpectationData_




typedef struct Expectation_ Expectation
typedef struct ExpectationData_ ExpectationData


 SC_ATOMIC_DECLARE (uint32_t, expectation_count)
uint64_t ExpectationGetCounter (void)
void AppLayerExpectationSetup (void)
int AppLayerExpectationCreate (Flow *f, int direction, Port src, Port dst, AppProto alproto, void *data)
int AppLayerExpectationGetDataId (void)
AppProto AppLayerExpectationHandle (Flow *f, int direction)

Detailed Description

Handling of dynamic parallel connection for application layer similar to FTP.

Some protocols like FTP create dynamic parallel flow (called expectation). In order to assign a application layer protocol to these expectation, Suricata needs to parse message of the initial protocol and create and maintain a list of expected flow.

Application layers must use the here described API to implement this mechanism.

When parsing a application layer message describing a parallel flow, the application layer can call AppLayerExpectationCreate() to declare an expectation. By doing that the next flow coming with corresponding IP parameters will be assigned the specified application layer. The resulting Flow will also have a Flow storage set that can be retrieved at index AppLayerExpectationGetDataId():

This storage can be used to store information that are only available in the parent connection and could be useful in the parent connection. For instance this is used by the FTP protocol to propagate information such as file name and ftp operation to the FTP data connection.

Macro Definition Documentation



Definition at line 70 of file app-layer-expectation.c.

Typedef Documentation

◆ Expectation

typedef struct Expectation_ Expectation

◆ ExpectationData

Function Documentation

◆ AppLayerExpectationCreate()

int AppLayerExpectationCreate ( Flow f,
int  direction,
Port  src,
Port  dst,
AppProto  alproto,
void *  data 

Create an entry in expectation list

Create a expectation from an existing Flow. Currently, only Flow between the two original IP addresses are supported.

fa pointer to the original Flow
directionthe direction of the data in the expectation flow
srcsource port of the expected flow, use 0 for any
dstdestination port of the expected flow, use 0 for any
alprotothe protocol that need to be set on the expected flow
datapointer to data that will be attached to the expected flow
-1 if error
0 if success

Definition at line 176 of file app-layer-expectation.c.

References Expectation_::alproto, Expectation_::data, Expectation_::direction, Expectation_::dp, dst, Flow_::lastts, SCCalloc, Expectation_::sp, src, and Expectation_::ts.

◆ AppLayerExpectationGetDataId()

int AppLayerExpectationGetDataId ( void  )

Return Flow storage identifier corresponding to expectation data

expectation data identifier

Definition at line 221 of file app-layer-expectation.c.

◆ AppLayerExpectationHandle()

AppProto AppLayerExpectationHandle ( Flow f,
int  direction 

Function doing a lookup in expectation list and updating Flow if needed.

This function lookup for a existing expectation that could match the Flow. If found and if the expectation contains data it store the data in the expectation storage of the Flow.

an AppProto value if found
ALPROTO_UNKNOWN if not found

Definition at line 272 of file app-layer-expectation.c.


◆ AppLayerExpectationSetup()

void AppLayerExpectationSetup ( void  )

Definition at line 124 of file app-layer-expectation.c.

◆ ExpectationGetCounter()

uint64_t ExpectationGetCounter ( void  )

Definition at line 118 of file app-layer-expectation.c.

References SC_ATOMIC_GET.

Referenced by AppLayerRegisterGlobalCounters().

Here is the caller graph for this function:


SC_ATOMIC_DECLARE ( uint32_t  ,
int AppLayerExpectationGetDataId(void)
Definition: app-layer-expectation.c:221
void * FlowGetStorageById(Flow *f, int id)
Definition: flow-storage.c:39