suricata
app-layer-register.c
Go to the documentation of this file.
1/* Copyright (C) 2017-2020 Open Information Security Foundation
2 *
3 * You can copy, redistribute or modify this Program under the terms of
4 * the GNU General Public License version 2 as published by the Free
5 * Software Foundation.
6 *
7 * This program is distributed in the hope that it will be useful,
8 * but WITHOUT ANY WARRANTY; without even the implied warranty of
9 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
10 * GNU General Public License for more details.
11 *
12 * You should have received a copy of the GNU General Public License
13 * version 2 along with this program; if not, write to the Free Software
14 * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA
15 * 02110-1301, USA.
16 */
17
18/**
19 * \file
20 *
21 * \author Pierre Chifflier <chifflier@wzdftpd.net>
22 *
23 * Parser registration functions.
24 */
25
26#include "suricata-common.h"
27#include "suricata.h"
28#include "stream.h"
29#include "conf.h"
30#include "rust.h"
31
33#include "app-layer-parser.h"
34
35#include "app-layer-register.h"
36
37static const char * IpProtoToString(int ip_proto);
38
39AppProto AppLayerRegisterProtocolDetection(const struct AppLayerParser *p, int enable_default)
40{
41 AppProto alproto;
42 const char *ip_proto_str = NULL;
43
44 if (p == NULL)
45 FatalError("Call to %s with NULL pointer.", __FUNCTION__);
46
47 alproto = StringToAppProto(p->name);
48 if (alproto == ALPROTO_UNKNOWN || alproto == ALPROTO_FAILED)
49 FatalError("Unknown or invalid AppProto '%s'.", p->name);
50
51 BUG_ON(strcmp(p->name, AppProtoToString(alproto)) != 0);
52
53 ip_proto_str = IpProtoToString(p->ip_proto);
54 if (ip_proto_str == NULL)
55 FatalError("Unknown or unsupported ip_proto field in parser '%s'", p->name);
56
57 SCLogDebug("%s %s protocol detection enabled.", ip_proto_str, p->name);
58
60
61 if (p->ProbeTS == NULL && p->ProbeTC == NULL) {
62 BUG_ON(p->default_port != NULL);
63 return alproto;
64 }
65
66 if (RunmodeIsUnittests()) {
67
68 SCLogDebug("Unittest mode, registering default configuration.");
70 p->max_depth, STREAM_TOSERVER, p->ProbeTS, p->ProbeTC);
71
72 }
73 else {
74
75 if (!SCAppLayerProtoDetectPPParseConfPorts(ip_proto_str, p->ip_proto, p->name, alproto,
76 p->min_depth, p->max_depth, p->ProbeTS, p->ProbeTC)) {
77 if (enable_default != 0) {
78 SCLogDebug("No %s app-layer configuration, enabling %s"
79 " detection %s detection on port %s.",
80 p->name, p->name, ip_proto_str, p->default_port);
82 p->max_depth, STREAM_TOSERVER, p->ProbeTS, p->ProbeTC);
83 } else {
84 SCLogDebug("No %s app-layer configuration for detection port (%s).",
85 p->name, ip_proto_str);
86 }
87 }
88 }
89
90 return alproto;
91}
92
93int AppLayerRegisterParser(const struct AppLayerParser *p, AppProto alproto)
94{
95 const char *ip_proto_str = NULL;
96
97 if (p == NULL)
98 FatalError("Call to %s with NULL pointer.", __FUNCTION__);
99
100 if (!AppProtoIsValid(alproto))
101 FatalError("Unknown or invalid AppProto '%s'.", p->name);
102
103 BUG_ON(strcmp(p->name, AppProtoToString(alproto)) != 0);
104
105 ip_proto_str = IpProtoToString(p->ip_proto);
106 if (ip_proto_str == NULL)
107 FatalError("Unknown or unsupported ip_proto field in parser '%s'", p->name);
108
109 SCLogDebug("Registering %s protocol parser.", p->name);
110
111 /* Register functions for state allocation and freeing. A
112 * state is allocated for every new flow. */
114 p->StateAlloc, p->StateFree);
115
116 /* Register request parser for parsing frame from server to server. */
118 STREAM_TOSERVER, p->ParseTS);
119
120 /* Register response parser for parsing frames from server to client. */
122 STREAM_TOCLIENT, p->ParseTC);
123
124 /* Register a function to be called by the application layer
125 * when a transaction is to be freed. */
128
129 /* Register a function to return the current transaction count. */
131 p->StateGetTxCnt);
132
133 /* Transaction handling. */
135
139 p->StateGetTx);
140
141 if (p->StateGetEventInfo) {
144 }
145 if (p->StateGetEventInfoById) {
148 }
149 if (p->LocalStorageAlloc && p->LocalStorageFree) {
152 }
153 if (p->GetTxFiles) {
155 }
156
157 if (p->GetTxIterator) {
159 p->GetTxIterator);
160 }
161
162 if (p->GetTxData) {
164 p->GetTxData);
165 }
166
167 if (p->GetStateData) {
169 }
170
171 if (p->ApplyTxConfig) {
173 p->ApplyTxConfig);
174 }
175
176 if (p->flags) {
178 p->flags);
179
180 }
181
182 if (p->GetFrameIdByName && p->GetFrameNameById) {
184 p->ip_proto, alproto, p->GetFrameIdByName, p->GetFrameNameById);
185 }
186
187 if (p->GetStateIdByName && p->GetStateNameById) {
189 p->ip_proto, alproto, p->GetStateIdByName, p->GetStateNameById);
190 }
191
192 return 0;
193}
194
195int AppLayerRegisterParserAlias(const char *proto_name, const char *proto_alias)
196{
197 AppLayerProtoDetectRegisterAlias(proto_name, proto_alias);
198
199 return 0;
200}
201
202static const char * IpProtoToString(int ip_proto)
203{
204 switch (ip_proto) {
205 case IPPROTO_TCP:
206 return "tcp";
207 case IPPROTO_UDP:
208 return "udp";
209 default:
210 return NULL;
211 };
212
213}
void AppLayerProtoDetectRegisterProtocol(AppProto alproto, const char *alproto_name)
Registers a protocol for protocol detection phase.
int SCAppLayerProtoDetectPPParseConfPorts(const char *ipproto_name, uint8_t ipproto, const char *alproto_name, AppProto alproto, uint16_t min_depth, uint16_t max_depth, ProbingParserFPtr ProbingParserTs, ProbingParserFPtr ProbingParserTc)
void SCAppLayerProtoDetectPPRegister(uint8_t ipproto, const char *portstr, AppProto alproto, uint16_t min_depth, uint16_t max_depth, uint8_t direction, ProbingParserFPtr ProbingParser1, ProbingParserFPtr ProbingParser2)
register parser at a port
void AppLayerProtoDetectRegisterAlias(const char *proto_name, const char *proto_alias)
void AppLayerParserRegisterGetTxCnt(uint8_t ipproto, AppProto alproto, uint64_t(*StateGetTxCnt)(void *alstate))
void AppLayerParserRegisterTxFreeFunc(uint8_t ipproto, AppProto alproto, void(*StateTransactionFree)(void *, uint64_t))
void AppLayerParserRegisterTxDataFunc(uint8_t ipproto, AppProto alproto, AppLayerTxData *(*GetTxData)(void *tx))
void AppLayerParserRegisterOptionFlags(uint8_t ipproto, AppProto alproto, uint32_t flags)
void AppLayerParserRegisterStateProgressCompletionStatus(AppProto alproto, const int ts, const int tc)
void AppLayerParserRegisterApplyTxConfigFunc(uint8_t ipproto, AppProto alproto, bool(*ApplyTxConfig)(void *state, void *tx, int mode, AppLayerTxConfig))
void AppLayerParserRegisterGetTxFilesFunc(uint8_t ipproto, AppProto alproto, AppLayerGetFileState(*GetTxFiles)(void *, uint8_t))
void AppLayerParserRegisterStateDataFunc(uint8_t ipproto, AppProto alproto, AppLayerStateData *(*GetStateData)(void *state))
void AppLayerParserRegisterGetTxIterator(uint8_t ipproto, AppProto alproto, AppLayerGetTxIteratorFunc Func)
void AppLayerParserRegisterLocalStorageFunc(uint8_t ipproto, AppProto alproto, void *(*LocalStorageAlloc)(void), void(*LocalStorageFree)(void *))
int AppLayerParserRegisterParser(uint8_t ipproto, AppProto alproto, uint8_t direction, AppLayerParserFPtr Parser)
Register app layer parser for the protocol.
void AppLayerParserRegisterGetTx(uint8_t ipproto, AppProto alproto, void *(StateGetTx)(void *alstate, uint64_t tx_id))
void AppLayerParserRegisterGetEventInfo(uint8_t ipproto, AppProto alproto, int(*StateGetEventInfo)(const char *event_name, uint8_t *event_id, AppLayerEventType *event_type))
void AppLayerParserRegisterGetStateProgressFunc(uint8_t ipproto, AppProto alproto, int(*StateGetProgress)(void *alstate, uint8_t direction))
void AppLayerParserRegisterStateFuncs(uint8_t ipproto, AppProto alproto, void *(*StateAlloc)(void *, AppProto), void(*StateFree)(void *))
void AppLayerParserRegisterGetEventInfoById(uint8_t ipproto, AppProto alproto, int(*StateGetEventInfoById)(uint8_t event_id, const char **event_name, AppLayerEventType *event_type))
void AppLayerParserRegisterGetStateFuncs(uint8_t ipproto, AppProto alproto, AppLayerParserGetStateIdByNameFn GetIdByNameFunc, AppLayerParserGetStateNameByIdFn GetNameByIdFunc)
void AppLayerParserRegisterGetFrameFuncs(uint8_t ipproto, AppProto alproto, AppLayerParserGetFrameIdByNameFn GetIdByNameFunc, AppLayerParserGetFrameNameByIdFn GetNameByIdFunc)
const char * AppProtoToString(AppProto alproto)
Maps the ALPROTO_*, to its string equivalent.
AppProto StringToAppProto(const char *proto_name)
Maps a string to its ALPROTO_* equivalent.
uint16_t AppProto
@ ALPROTO_FAILED
@ ALPROTO_UNKNOWN
int AppLayerRegisterParserAlias(const char *proto_name, const char *proto_alias)
int AppLayerRegisterParser(const struct AppLayerParser *p, AppProto alproto)
App layer protocol registration function.
AppProto AppLayerRegisterProtocolDetection(const struct AppLayerParser *p, int enable_default)
App layer protocol detection function.
ProbingParserFPtr ProbeTS
AppLayerParserGetStateNameByIdFn GetStateNameById
AppLayerParserFPtr ParseTS
bool(* ApplyTxConfig)(void *state, void *tx, int mode, AppLayerTxConfig)
void(* StateFree)(void *)
AppLayerTxData *(* GetTxData)(void *tx)
int(* StateGetProgress)(void *alstate, uint8_t direction)
int(* StateGetEventInfo)(const char *event_name, uint8_t *event_id, AppLayerEventType *event_type)
AppLayerStateData *(* GetStateData)(void *state)
const char * default_port
AppLayerGetTxIterTuple(* GetTxIterator)(const uint8_t ipproto, const AppProto alproto, void *alstate, uint64_t min_tx_id, uint64_t max_tx_id, AppLayerGetTxIterState *istate)
void *(* StateAlloc)(void *, AppProto)
void *(* LocalStorageAlloc)(void)
AppLayerParserGetFrameIdByNameFn GetFrameIdByName
AppLayerParserGetFrameNameByIdFn GetFrameNameById
ProbingParserFPtr ProbeTC
int(* StateGetEventInfoById)(uint8_t event_id, const char **event_name, AppLayerEventType *event_type)
AppLayerParserFPtr ParseTC
AppLayerParserGetStateIdByNameFn GetStateIdByName
uint64_t(* StateGetTxCnt)(void *alstate)
void *(* StateGetTx)(void *alstate, uint64_t tx_id)
void(* StateTransactionFree)(void *, uint64_t)
void(* LocalStorageFree)(void *)
AppLayerGetFileState(* GetTxFiles)(void *, uint8_t)
#define BUG_ON(x)
int RunmodeIsUnittests(void)
Definition suricata.c:270
#define FatalError(...)
Definition util-debug.h:510
#define SCLogDebug(...)
Definition util-debug.h:275