/* Copyright (C) 2013 Open Information Security Foundation * * You can copy, redistribute or modify this Program under the terms of * the GNU General Public License version 2 as published by the Free * Software Foundation. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. * * You should have received a copy of the GNU General Public License * version 2 along with this program; if not, write to the Free Software * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA * 02110-1301, USA. */ /** \file * * \author Eric Leblond */ #include "suricata-common.h" #include "app-layer-detect-proto.h" #include "app-layer.h" #include "app-layer-parser.h" #include "detect-engine.h" #include "detect-parse.h" #include "util-unittest.h" #include "util-debug.h" #include "conf-yaml-loader.h" #include "util-running-modes.h" int ListKeywords(const char *keyword_info) { EngineModeSetIDS(); SCLogLoadConfig(0, 0, 0, 0); MpmTableSetup(); SpmTableSetup(); AppLayerSetup(); SigTableInit(); SigTableSetup(); /* load the rule keywords */ return SigTableList(keyword_info); } int ListAppLayerProtocols(const char *conf_filename) { EngineModeSetIDS(); if (SCConfYamlLoadFile(conf_filename) != -1) SCLogLoadConfig(0, 0, 0, 0); MpmTableSetup(); SpmTableSetup(); AppLayerSetup(); AppLayerListSupportedProtocols(); return TM_ECODE_DONE; } int ListRuleProtocols(const char *conf_filename) { EngineModeSetIDS(); if (SCConfYamlLoadFile(conf_filename) != -1) SCLogLoadConfig(0, 0, 0, 0); MpmTableSetup(); SpmTableSetup(); AppLayerSetup(); DetectListSupportedProtocols(); return TM_ECODE_DONE; } static bool IsBuiltIn(const char *n) { return strcmp(n, "request_started") == 0 || strcmp(n, "response_started") == 0 || strcmp(n, "request_complete") == 0 || strcmp(n, "response_complete") == 0; } int ListAppLayerHooks(const char *conf_filename) { EngineModeSetIDS(); if (SCConfYamlLoadFile(conf_filename) != -1) SCLogLoadConfig(0, 0, 0, 0); MpmTableSetup(); SpmTableSetup(); AppLayerSetup(); AppProto alprotos[g_alproto_max]; AppLayerProtoDetectSupportedAppProtocols(alprotos); printf("=========Supported App Layer Hooks=========\n"); for (AppProto a = 0; a < g_alproto_max; a++) { if (alprotos[a] != 1) continue; if (AppLayerParserSupportsSubStates(a)) { const uint8_t max_sub_state = AppLayerParserGetMaxSubState(a); for (uint8_t sub_state = 1; sub_state <= max_sub_state; sub_state++) { const char *sub_state_name = AppLayerParserGetSubStateName(a, sub_state); const uint8_t max_progress = AppLayerParserGetSubStateCompletion(a, sub_state); for (uint8_t state = 0; state <= max_progress; state++) { const char *name = AppLayerParserGetSubStateProgressName( a, sub_state, state, STREAM_TOSERVER); if (name != NULL) { printf("%s:%s:%s\n", AppProtoToString(a), sub_state_name, name); } } for (uint8_t state = 0; state <= max_progress; state++) { const char *name = AppLayerParserGetSubStateProgressName( a, sub_state, state, STREAM_TOCLIENT); if (name != NULL) { printf("%s:%s:%s\n", AppProtoToString(a), sub_state_name, name); } } } } else { const char *alproto_name = AppProtoToStringRaw(a); SCLogDebug("alproto %u/%s", a, alproto_name); const int max_progress_ts = AppLayerParserGetStateProgressCompletionStatus(a, STREAM_TOSERVER); const int max_progress_tc = AppLayerParserGetStateProgressCompletionStatus(a, STREAM_TOCLIENT); printf("%s:%s\n", alproto_name, "request_started"); for (int p = 0; p <= max_progress_ts; p++) { const char *name = AppLayerParserGetStateNameById( IPPROTO_TCP /* TODO no ipproto */, a, p, STREAM_TOSERVER); if (name != NULL && !IsBuiltIn(name)) { printf("%s:%s\n", alproto_name, name); } } printf("%s:%s\n", alproto_name, "request_complete"); printf("%s:%s\n", alproto_name, "response_started"); for (int p = 0; p <= max_progress_tc; p++) { const char *name = AppLayerParserGetStateNameById( IPPROTO_TCP /* TODO no ipproto */, a, p, STREAM_TOCLIENT); if (name != NULL && !IsBuiltIn(name)) { printf("%s:%s\n", alproto_name, name); } } printf("%s:%s\n", alproto_name, "response_complete"); } } return TM_ECODE_DONE; } int ListAppLayerFrames(const char *conf_filename) { EngineModeSetIDS(); if (SCConfYamlLoadFile(conf_filename) != -1) SCLogLoadConfig(0, 0, 0, 0); MpmTableSetup(); SpmTableSetup(); AppLayerSetup(); AppProto alprotos[g_alproto_max]; AppLayerProtoDetectSupportedAppProtocols(alprotos); printf("=========Supported App Layer Frames=========\n"); for (AppProto a = 0; a < g_alproto_max; a++) { if (alprotos[a] != 1) continue; const char *alproto_name = AppProtoToStringRaw(a); SCLogDebug("alproto %u/%s", a, alproto_name); bool tcp_stream_once = false; for (uint32_t i = 0; i < 255; i++) { const char *name = AppLayerParserGetFrameNameById(IPPROTO_TCP, a, (uint8_t)i); if (name == NULL) break; if (!tcp_stream_once) { printf("tcp: %s.stream\n", alproto_name); tcp_stream_once = true; } printf("tcp: %s.%s\n", alproto_name, name); } for (uint32_t i = 0; i < 255; i++) { const char *name = AppLayerParserGetFrameNameById(IPPROTO_UDP, a, (uint8_t)i); if (name == NULL) break; printf("udp: %s.%s\n", alproto_name, name); } } return TM_ECODE_DONE; }