suricata
Application Layer Expectation

Files

file  app-layer-expectation.c
 

Data Structures

struct  Expectation_
 
struct  ExpectationData_
 

Macros

#define EXPECTATION_TIMEOUT   30
 

Typedefs

typedef struct Expectation_ Expectation
 
typedef struct ExpectationData_ ExpectationData
 

Functions

 SC_ATOMIC_DECLARE (uint32_t, expectation_count)
 
uint64_t ExpectationGetCounter (void)
 
void AppLayerExpectationSetup (void)
 
int AppLayerExpectationCreate (Flow *f, int direction, Port src, Port dst, AppProto alproto, void *data)
 
int AppLayerExpectationGetDataId (void)
 
AppProto AppLayerExpectationHandle (Flow *f, int direction)
 

Detailed Description

Handling of dynamic parallel connection for application layer similar to FTP.

Some protocols like FTP create dynamic parallel flow (called expectation). In order to assign a application layer protocol to these expectation, Suricata needs to parse message of the initial protocol and create and maintain a list of expected flow.

Application layers must use the here described API to implement this mechanism.

When parsing a application layer message describing a parallel flow, the application layer can call AppLayerExpectationCreate() to declare an expectation. By doing that the next flow coming with corresponding IP parameters will be assigned the specified application layer. The resulting Flow will also have a Flow storage set that can be retrieved at index AppLayerExpectationGetDataId():

This storage can be used to store information that are only available in the parent connection and could be useful in the parent connection. For instance this is used by the FTP protocol to propagate information such as file name and ftp operation to the FTP data connection.

Macro Definition Documentation

#define EXPECTATION_TIMEOUT   30

Definition at line 70 of file app-layer-expectation.c.

Referenced by AppLayerExpectationHandle().

Typedef Documentation

typedef struct Expectation_ Expectation

Function Documentation

int AppLayerExpectationCreate ( Flow f,
int  direction,
Port  src,
Port  dst,
AppProto  alproto,
void *  data 
)

Create an entry in expectation list

Create a expectation from an existing Flow. Currently, only Flow between the two original IP addresses are supported.

Parameters
fa pointer to the original Flow
directionthe direction of the data in the expectation flow
srcsource port of the expected flow, use 0 for any
dstdestination port of the expected flow, use 0 for any
alprotothe protocol that need to be set on the expected flow
datapointer to data that will be attached to the expected flow
Returns
-1 if error
0 if success

Definition at line 176 of file app-layer-expectation.c.

References Expectation_::alproto, Expectation_::data, Expectation_::direction, Expectation_::dp, dst, ip_dst, ip_src, IPPairGetIPPairFromHash(), IPPairGetStorageById(), IPPairSetStorageById(), IPPairUnlock(), Flow_::lastts, Expectation_::next, SC_ATOMIC_ADD, SCCalloc, SCFree, Expectation_::sp, src, and Expectation_::ts.

Here is the call graph for this function:

int AppLayerExpectationGetDataId ( void  )

Return Flow storage identifier corresponding to expectation data

Returns
expectation data identifier

Definition at line 221 of file app-layer-expectation.c.

References Expectation_::data, ExpectationData_::DFree, IPPairDecrUsecnt, IPPairSetStorageById(), Expectation_::next, SC_ATOMIC_SUB, and SCFree.

Here is the call graph for this function:

AppProto AppLayerExpectationHandle ( Flow f,
int  direction 
)

Function doing a lookup in expectation list and updating Flow if needed.

This function lookup for a existing expectation that could match the Flow. If found and if the expectation contains data it store the data in the expectation storage of the Flow.

Returns
an AppProto value if found
ALPROTO_UNKNOWN if not found

Definition at line 272 of file app-layer-expectation.c.

References Expectation_::alproto, Flow_::alproto_tc, Flow_::alproto_ts, ALPROTO_UNKNOWN, Expectation_::data, Expectation_::direction, Expectation_::dp, Flow_::dp, EXPECTATION_TIMEOUT, FlowGetStorageById(), FlowSetStorageById(), IPPairRelease(), Flow_::lastts, Expectation_::next, SC_ATOMIC_GET, SCLogDebug, Expectation_::sp, Flow_::sp, and Expectation_::ts.

Here is the call graph for this function:

void AppLayerExpectationSetup ( void  )
uint64_t ExpectationGetCounter ( void  )

Definition at line 118 of file app-layer-expectation.c.

References SC_ATOMIC_GET.

Referenced by AppLayerRegisterGlobalCounters().

Here is the caller graph for this function:

SC_ATOMIC_DECLARE ( uint32_t  ,
expectation_count   
)