Go to the documentation of this file.
46 #define FTP_MPM mpm_default_matcher
48 static MpmCtx *ftp_mpm_ctx = NULL;
116 static void FTPParseMemcap(
void)
118 const char *conf_val;
121 if ((
ConfGet(
"app-layer.protocols.ftp.memcap", &conf_val)) == 1)
125 "from conf file - %s. Killing engine",
138 if ((
ConfGet(
"app-layer.protocols.ftp.max-tx", &conf_val)) == 1) {
141 "from conf file - %s.",
147 if ((
ConfGet(
"app-layer.protocols.ftp.max-line-length", &conf_val)) == 1) {
149 SCLogError(
"Error parsing ftp.max-line-length from conf file - %s.", conf_val);
155 static void FTPIncrMemuse(uint64_t size)
160 static void FTPDecrMemuse(uint64_t size)
183 static int FTPCheckMemcap(uint64_t size)
191 static void *FTPCalloc(
size_t n,
size_t size)
193 if (FTPCheckMemcap((uint32_t)(n * size)) == 0) {
205 FTPIncrMemuse((uint64_t)(n * size));
209 static void *FTPRealloc(
void *ptr,
size_t orig_size,
size_t size)
213 if (FTPCheckMemcap((uint32_t)(size - orig_size)) == 0) {
224 if (size > orig_size) {
225 FTPIncrMemuse(size - orig_size);
227 FTPDecrMemuse(orig_size - size);
233 static void FTPFree(
void *ptr,
size_t size)
237 FTPDecrMemuse((uint64_t)size);
248 FTPFree(
str->str,
str->len);
254 static void *FTPLocalStorageAlloc(
void)
263 if (td->
pmq == NULL) {
276 static void FTPLocalStorageFree(
void *ptr)
280 if (td->
pmq != NULL) {
311 SCLogDebug(
"new transaction %p (state tx cnt %"PRIu64
")", tx, state->
tx_cnt);
319 if (tx->
tx_data.de_state != NULL) {
337 FTPFree(tx,
sizeof(*tx));
347 static AppLayerResult FTPGetLineForDirection(
356 uint8_t *lf_idx = memchr(input->
buf + input->
consumed, 0x0a, input->
len);
358 if (lf_idx == NULL) {
360 *current_line_truncated =
true;
368 }
else if (*current_line_truncated) {
370 *current_line_truncated =
false;
380 uint32_t o_consumed = input->
consumed;
381 input->
consumed = (uint32_t)(lf_idx - input->
buf + 1);
386 line->
buf = input->
buf + o_consumed;
388 *current_line_truncated =
true;
413 static int FTPParseRequestCommand(
428 *cmd_descriptor = NULL;
443 static void FtpTransferCmdFree(
void *data)
448 if (
cmd->file_name) {
449 FTPFree(
cmd->file_name,
cmd->file_len + 1);
454 static uint32_t CopyCommandLine(uint8_t **dest,
FtpLineState *line)
457 uint8_t *where = FTPCalloc(line->
len + 1,
sizeof(
char));
461 memcpy(where, line->
buf, line->
len);
464 while (line->
len && isspace((
unsigned char)where[line->
len - 1])) {
468 where[line->
len] =
'\0';
472 return line->
len ? line->
len + 1 : 0;
485 StreamSlice stream_slice,
void *local_data)
495 const uint8_t *input = StreamSliceGetData(&stream_slice);
496 uint32_t input_len = StreamSliceGetDataLen(&stream_slice);
500 }
else if (input == NULL || input_len == 0) {
504 FtpInput ftpi = { .
buf = input, .len = input_len, .orig_len = input_len, .consumed = 0 };
505 FtpLineState line = { .
buf = NULL, .len = 0, .delim_len = 0, .lf_found =
false };
511 if (res.status == 1) {
513 }
else if (res.status == -1) {
518 if (!FTPParseRequestCommand(thread_data, &line, &cmd_descriptor)) {
584 data->
DFree = FtpTransferCmdFree;
590 #if SC_FILENAME_MAX > UINT16_MAX
591 #error SC_FILENAME_MAX is greater than UINT16_MAX
593 data->
file_name = FTPCalloc(file_name_len + 1,
sizeof(
char));
595 FtpTransferCmdFree(data);
599 data->
file_len = (uint16_t)file_name_len;
607 FtpTransferCmdFree(data);
611 SCLogDebug(
"Expectation created [direction: %s, dynamic port %"PRIu16
"].",
612 state->
active ?
"to server" :
"to client",
633 static int FTPParsePassiveResponse(
FtpState *state,
const uint8_t *input, uint32_t input_len)
635 uint16_t dyn_port = rs_ftp_pasv_response(input, input_len);
639 SCLogDebug(
"FTP passive mode (v4): dynamic port %"PRIu16
"", dyn_port);
648 static int FTPParsePassiveResponseV6(
FtpState *state,
const uint8_t *input, uint32_t input_len)
650 uint16_t dyn_port = rs_ftp_epsv_response(input, input_len);
654 SCLogDebug(
"FTP passive mode (v6): dynamic port %"PRIu16
"", dyn_port);
671 static inline bool FTPIsPPR(
const uint8_t *input, uint32_t input_len)
673 return input_len >= 4 && isdigit(input[0]) && input[0] ==
'1' &&
674 isdigit(input[1]) && isdigit(input[2]) && isspace(input[3]);
687 StreamSlice stream_slice,
void *local_data)
691 const uint8_t *input = StreamSliceGetData(&stream_slice);
692 uint32_t input_len = StreamSliceGetDataLen(&stream_slice);
697 FtpInput ftpi = { .
buf = input, .len = input_len, .orig_len = input_len, .consumed = 0 };
698 FtpLineState line = { .
buf = NULL, .len = 0, .delim_len = 0, .lf_found =
false };
704 if (res.status == 1) {
706 }
else if (res.status == -1) {
711 tx = FTPTransactionCreate(state);
740 SCLogDebug(
"FTP active mode (v6): dynamic port %" PRIu16
"", dyn_port);
752 SCLogDebug(
"FTP active mode (v4): dynamic port %" PRIu16
"", dyn_port);
757 FTPParsePassiveResponse(ftp_state, line.
buf, line.
len);
763 FTPParsePassiveResponseV6(ftp_state, line.
buf, line.
len);
773 response->
len = CopyCommandLine(&response->
str, &line);
777 &tx->
tx_data.events, FtpEventResponseCommandTooLong);
787 if (FTPIsPPR(line.
buf, line.
len)) {
805 static uint64_t ftp_state_memuse = 0;
806 static uint64_t ftp_state_memcnt = 0;
809 static void *FTPStateAlloc(
void *orig_state,
AppProto proto_orig)
811 void *s = FTPCalloc(1,
sizeof(
FtpState));
827 static void FTPStateFree(
void *s)
836 SCLogDebug(
"[%s] state %p id %" PRIu64
", Freeing %d bytes at %p",
839 FTPTransactionFree(tx);
862 SCLogDebug(
"NULL state object; no transactions available");
879 SCLogDebug(
"Returning OLDEST tx %p id %"PRIu64, lasttx, lasttx->
tx_id);
883 static void *FTPGetTx(
void *state, uint64_t tx_id)
889 if (ftp_state->
curr_tx == NULL)
895 if (tx->
tx_id == tx_id)
908 static AppLayerStateData *FTPGetStateData(
void *vstate)
914 static void FTPStateTransactionFree(
void *state, uint64_t tx_id)
919 if (tx_id < tx->tx_id)
921 else if (tx_id > tx->
tx_id)
927 FTPTransactionFree(tx);
932 static uint64_t FTPGetTxCnt(
void *state)
943 static int FTPGetAlstateProgress(
void *vtx, uint8_t
direction)
958 static AppProto FTPUserProbingParser(
959 Flow *f, uint8_t
direction,
const uint8_t *input, uint32_t
len, uint8_t *rdir)
968 static AppProto FTPServerProbingParser(
969 Flow *f, uint8_t
direction,
const uint8_t *input, uint32_t
len, uint8_t *rdir)
976 if (input[0] !=
'2' || input[1] !=
'2' || input[2] !=
'0') {
980 if (input[3] !=
' ' && input[3] !=
'-') {
986 if (memchr(input + 4,
'\n',
len - 4) != NULL) {
993 static int FTPRegisterPatternsForProtocolDetection(
void)
996 IPPROTO_TCP,
ALPROTO_FTP,
"220 (", 5, 0, STREAM_TOCLIENT) < 0) {
1000 IPPROTO_TCP,
ALPROTO_FTP,
"FEAT", 4, 0, STREAM_TOSERVER) < 0) {
1004 STREAM_TOSERVER, FTPUserProbingParser, 5, 5) < 0) {
1008 IPPROTO_TCP,
ALPROTO_FTP,
"PASS ", 5, 0, STREAM_TOSERVER) < 0) {
1012 IPPROTO_TCP,
ALPROTO_FTP,
"PORT ", 5, 0, STREAM_TOSERVER) < 0) {
1018 "tcp", IPPROTO_TCP,
"ftp",
ALPROTO_FTP, 0, 5, NULL, FTPServerProbingParser)) {
1022 FTPServerProbingParser);
1040 const uint8_t *input = StreamSliceGetData(&stream_slice);
1041 uint32_t input_len = StreamSliceGetDataLen(&stream_slice);
1042 const bool eof = (
direction & STREAM_TOSERVER)
1046 SCTxDataUpdateFileFlags(&ftpdata_state->
tx_data, ftpdata_state->
state_data.file_flags);
1047 if (ftpdata_state->
tx_data.file_tx == 0)
1048 ftpdata_state->
tx_data.file_tx =
direction & (STREAM_TOSERVER | STREAM_TOCLIENT);
1055 (
direction & STREAM_TOSERVER) ?
"toserver" :
"toclient", eof ?
"true" :
"false");
1058 if (input_len && ftpdata_state->
files == NULL) {
1068 SCLogDebug(
"input %u not for our direction (%s): %s/%s", input_len,
1069 (
direction & STREAM_TOSERVER) ?
"toserver" :
"toclient",
1071 (data->
direction & STREAM_TOSERVER) ?
"toserver" :
"toclient");
1076 if (ftpdata_state->
files == NULL) {
1087 switch (data->
cmd) {
1091 (ftpdata_state->
direction & STREAM_TOSERVER) ?
"toserver" :
"toclient");
1096 (ftpdata_state->
direction & STREAM_TOSERVER) ?
"toserver" :
"toclient");
1105 0ULL, (uint8_t *) ftpdata_state->
file_name,
1107 input, input_len,
flags) != 0) {
1112 ftpdata_state->
tx_data.files_opened = 1;
1123 SCLogDebug(
"input %u not for us (%s): %s/%s", input_len,
1124 (
direction & STREAM_TOSERVER) ?
"toserver" :
"toclient",
1126 (ftpdata_state->
direction & STREAM_TOSERVER) ?
"toserver" :
"toclient");
1129 if (input_len != 0) {
1133 SCLogDebug(
"FileAppendData() - file no longer being extracted");
1135 }
else if (ret < 0) {
1136 SCLogDebug(
"FileAppendData() failed: %d", ret);
1147 SCLogDebug(
"closed because of eof: state now FTPDATA_STATE_FINISHED");
1157 StreamSlice stream_slice,
void *local_data)
1159 return FTPDataParse(f, ftp_state, pstate, stream_slice, local_data, STREAM_TOSERVER);
1163 StreamSlice stream_slice,
void *local_data)
1165 return FTPDataParse(f, ftp_state, pstate, stream_slice, local_data, STREAM_TOCLIENT);
1170 static uint64_t ftpdata_state_memuse = 0;
1171 static uint64_t ftpdata_state_memcnt = 0;
1174 static void *FTPDataStateAlloc(
void *orig_state,
AppProto proto_orig)
1185 ftpdata_state_memcnt++;
1192 static void FTPDataStateFree(
void *s)
1196 if (fstate->
tx_data.de_state != NULL) {
1208 ftpdata_state_memcnt--;
1220 static AppLayerStateData *FTPDataGetStateData(
void *vstate)
1226 static void FTPDataStateTransactionFree(
void *state, uint64_t tx_id)
1231 static void *FTPDataGetTx(
void *state, uint64_t tx_id)
1237 static uint64_t FTPDataGetTxCnt(
void *state)
1243 static int FTPDataGetAlstateProgress(
void *tx, uint8_t
direction)
1247 return ftpdata_state->
state;
1252 static AppLayerGetFileState FTPDataStateGetTxFiles(
void *tx, uint8_t
direction)
1255 AppLayerGetFileState files = { .fc = NULL, .cfg = &sbcfg };
1258 files.fc = ftpdata_state->
files;
1263 static void FTPSetMpmState(
void)
1266 if (
unlikely(ftp_mpm_ctx == NULL)) {
1274 if (
cmd->command_length == 0)
1278 (uint8_t *)
cmd->command_name,
1279 cmd->command_length,
1288 static void FTPFreeMpmState(
void)
1290 if (ftp_mpm_ctx != NULL) {
1301 static AppLayerGetTxIterTuple FTPGetTxIterator(
const uint8_t ipproto,
const AppProto alproto,
1305 AppLayerGetTxIterTuple no_tuple = { NULL, 0,
false };
1308 if (state->
un.
ptr == NULL) {
1314 while (tx_ptr->
tx_id < min_tx_id) {
1320 if (tx_ptr->
tx_id >= max_tx_id) {
1324 AppLayerGetTxIterTuple tuple = {
1327 .has_next = (state->
un.
ptr != NULL),
1337 const char *proto_name =
"ftp";
1338 const char *proto_data_name =
"ftp-data";
1343 if (FTPRegisterPatternsForProtocolDetection() < 0 )
1364 FTPLocalStorageFree);
1374 FTPDataParseRequest);
1376 FTPDataParseResponse);
1401 sbcfg.
Calloc = FTPCalloc;
1403 sbcfg.
Free = FTPFree;
1407 SCLogInfo(
"Parser disabled for %s protocol. Protocol detection still on.", proto_name);
1436 if (!buffer || *buffer ==
'\0') {
1440 char *c = strchr(buffer,
'\n');
1441 return c == NULL ?
len : (uint16_t)(c - buffer + 1);
1447 jb_open_object(jb,
"ftp_data");
1450 jb_set_string_from_bytes(jb,
"filename", ftp_state->
file_name, ftp_state->
file_len);
1479 static int FTPParserTest01(
void)
1482 uint8_t ftpbuf[] =
"PORT 192,168,1,1,0,80\r\n";
1483 uint32_t ftplen =
sizeof(ftpbuf) - 1;
1487 memset(&f, 0,
sizeof(f));
1488 memset(&ssn, 0,
sizeof(ssn));
1491 f.
proto = IPPROTO_TCP;
1497 STREAM_TOSERVER | STREAM_EOF, ftpbuf, ftplen);
1510 static int FTPParserTest11(
void)
1513 uint8_t ftpbuf1[] =
"PORT 192,168,1,1,0,80\r\n";
1514 uint8_t ftpbuf2[] =
"RETR\r\n";
1515 uint8_t ftpbuf3[] =
"227 OK\r\n";
1520 memset(&f, 0,
sizeof(f));
1521 memset(&ssn, 0,
sizeof(ssn));
1524 f.
proto = IPPROTO_TCP;
1530 STREAM_TOSERVER | STREAM_START, ftpbuf1,
1531 sizeof(ftpbuf1) - 1);
1538 sizeof(ftpbuf3) - 1);
1542 STREAM_TOSERVER, ftpbuf2,
1543 sizeof(ftpbuf2) - 1);
1557 static int FTPParserTest12(
void)
1560 uint8_t ftpbuf1[] =
"PORT 192,168,1,1,0,80\r\n";
1561 uint8_t ftpbuf2[] =
"STOR\r\n";
1562 uint8_t ftpbuf3[] =
"227 OK\r\n";
1567 memset(&f, 0,
sizeof(f));
1568 memset(&ssn, 0,
sizeof(ssn));
1571 f.
proto = IPPROTO_TCP;
1577 STREAM_TOSERVER | STREAM_START, ftpbuf1,
1578 sizeof(ftpbuf1) - 1);
1585 sizeof(ftpbuf3) - 1);
1589 STREAM_TOSERVER, ftpbuf2,
1590 sizeof(ftpbuf2) - 1);
void MpmInitThreadCtx(MpmThreadCtx *mpm_thread_ctx, uint16_t matcher)
void PmqReset(PrefilterRuleStore *pmq)
Reset a Pmq for reusage. Meant to be called after a single search.
void AppLayerParserRegisterGetStateProgressFunc(uint8_t ipproto, AppProto alproto, int(*StateGetProgress)(void *alstate, uint8_t direction))
const FtpCommand * command_descriptor
int AppLayerProtoDetectPPParseConfPorts(const char *ipproto_name, uint8_t ipproto, const char *alproto_name, AppProto alproto, uint16_t min_depth, uint16_t max_depth, ProbingParserFPtr ProbingParserTs, ProbingParserFPtr ProbingParserTc)
#define FAIL_IF_NULL(expr)
Fail a test if expression evaluates to NULL.
int AppLayerProtoDetectPMRegisterPatternCI(uint8_t ipproto, AppProto alproto, const char *pattern, uint16_t depth, uint16_t offset, uint8_t direction)
Registers a case-insensitive pattern for protocol detection.
@ FTPDATA_STATE_IN_PROGRESS
void AppLayerParserRegisterLocalStorageFunc(uint8_t ipproto, AppProto alproto, void *(*LocalStorageAlloc)(void), void(*LocalStorageFree)(void *))
#define SC_ATOMIC_INIT(name)
wrapper for initializing an atomic variable.
const FtpCommand FtpCommands[FTP_COMMAND_MAX+1]
FileContainer * FileContainerAlloc(void)
allocate a FileContainer
void *(* Calloc)(size_t n, size_t size)
struct FtpState_ FtpState
bool AppLayerRequestProtocolTLSUpgrade(Flow *f)
request applayer to wrap up this protocol and rerun protocol detection with expectation of TLS....
void UtRegisterTest(const char *name, int(*TestFn)(void))
Register unit test.
FlowStorageId AppLayerExpectationGetFlowId(void)
structure for storing potential rule matches
int ParseSizeStringU64(const char *size, uint64_t *res)
struct HtpBodyChunk_ * next
FtpRequestCommand command
int AppLayerParserConfParserEnabled(const char *ipproto, const char *alproto_name)
check if a parser is enabled in the config Returns enabled always if: were running unittests
#define STREAMING_BUFFER_CONFIG_INITIALIZER
void FileContainerFree(FileContainer *ffc, const StreamingBufferConfig *cfg)
Free a FileContainer.
#define SC_ATOMIC_ADD(name, val)
add a value to our atomic variable
void AppLayerParserRegisterStateProgressCompletionStatus(AppProto alproto, const int ts, const int tc)
void AppLayerParserRegisterParserAcceptableDataDirection(uint8_t ipproto, AppProto alproto, uint8_t direction)
bool current_line_truncated_tc
void AppLayerParserRegisterTxFreeFunc(uint8_t ipproto, AppProto alproto, void(*StateTransactionFree)(void *, uint64_t))
#define TAILQ_FOREACH(var, head, field)
FtpRequestCommand command
uint64_t FTPMemuseGlobalCounter(void)
void AppLayerParserThreadCtxFree(AppLayerParserThreadCtx *tctx)
Destroys the app layer parser thread context obtained using AppLayerParserThreadCtxAlloc().
void AppLayerDecoderEventsFreeEvents(AppLayerDecoderEvents **events)
FtpRequestCommand command
#define SCMUTEX_INITIALIZER
const char * command_name
#define TAILQ_INSERT_TAIL(head, elm, field)
#define APP_LAYER_PARSER_EOF_TS
SC_ATOMIC_DECLARE(uint64_t, ftp_memuse)
void FTPParserCleanup(void)
Free memory allocated for global FTP parser state.
bool EveFTPDataAddMetadata(void *vtx, JsonBuilder *jb)
void MpmInitCtx(MpmCtx *mpm_ctx, uint8_t matcher)
void AppLayerProtoDetectPPRegister(uint8_t ipproto, const char *portstr, AppProto alproto, uint16_t min_depth, uint16_t max_depth, uint8_t direction, ProbingParserFPtr ProbingParser1, ProbingParserFPtr ProbingParser2)
register parser at a port
uint32_t ftp_max_line_len
int ConfGet(const char *name, const char **vptr)
Retrieve the value of a configuration node.
void StreamTcpInitConfig(bool)
To initialize the stream global configuration data.
#define APP_LAYER_INCOMPLETE(c, n)
#define TAILQ_REMOVE(head, elm, field)
void MpmDestroyThreadCtx(MpmThreadCtx *mpm_thread_ctx, const uint16_t matcher)
#define JB_SET_STRING(jb, key, val)
#define TAILQ_FIRST(head)
#define PASS
Pass the test.
#define SCMutexUnlock(mut)
AppLayerStateData state_data
AppLayerParserThreadCtx * alp_tctx
void AppLayerParserRegisterLogger(uint8_t ipproto, AppProto alproto)
void AppLayerParserRegisterStateFuncs(uint8_t ipproto, AppProto alproto, void *(*StateAlloc)(void *, AppProto), void(*StateFree)(void *))
int AppLayerProtoDetectPMRegisterPatternCSwPP(uint8_t ipproto, AppProto alproto, const char *pattern, uint16_t depth, uint16_t offset, uint8_t direction, ProbingParserFPtr PPFunc, uint16_t pp_min_depth, uint16_t pp_max_depth)
AppLayerStateData state_data
#define SC_ATOMIC_SUB(name, val)
sub a value from our atomic variable
void FTPParserRegisterTests(void)
void RegisterFTPParsers(void)
void AppLayerParserRegisterProtocolUnittests(uint8_t ipproto, AppProto alproto, void(*RegisterUnittests)(void))
int AppLayerExpectationCreate(Flow *f, int direction, Port src, Port dst, AppProto alproto, void *data)
#define APP_LAYER_PARSER_EOF_TC
uint64_t ftp_config_memcap
void AppLayerRegisterExpectationProto(uint8_t proto, AppProto alproto)
int(* Prepare)(struct MpmCtx_ *)
void AppLayerParserRegisterGetEventInfo(uint8_t ipproto, AppProto alproto, int(*StateGetEventInfo)(const char *event_name, int *event_id, AppLayerEventType *event_type))
int FileOpenFileWithId(FileContainer *ffc, const StreamingBufferConfig *sbcfg, uint32_t track_id, const uint8_t *name, uint16_t name_len, const uint8_t *data, uint32_t data_len, uint16_t flags)
Open a new File.
void AppLayerParserRegisterGetTxFilesFunc(uint8_t ipproto, AppProto alproto, AppLayerGetFileState(*GetTxFiles)(void *, uint8_t))
void AppLayerProtoDetectRegisterProtocol(AppProto alproto, const char *alproto_name)
Registers a protocol for protocol detection phase.
struct FtpDataState_ FtpDataState
int FileAppendData(FileContainer *ffc, const StreamingBufferConfig *sbcfg, const uint8_t *data, uint32_t data_len)
Store/handle a chunk of file data in the File structure The last file in the FileContainer will be us...
uint64_t FTPMemcapGlobalCounter(void)
uint32_t(* Search)(const struct MpmCtx_ *, struct MpmThreadCtx_ *, PrefilterRuleStore *, const uint8_t *, uint32_t)
struct FtpInput_ FtpInput
#define SCLogInfo(...)
Macro used to log INFORMATIONAL messages.
void * FlowGetStorageById(const Flow *f, FlowStorageId id)
int AppLayerParserRegisterParser(uint8_t ipproto, AppProto alproto, uint8_t direction, AppLayerParserFPtr Parser)
Register app layer parser for the protocol.
void DetectEngineStateFree(DetectEngineState *state)
Frees a DetectEngineState object.
#define SCRealloc(ptr, sz)
AppLayerParserThreadCtx * AppLayerParserThreadCtxAlloc(void)
Gets a new app layer protocol's parser thread context.
void AppLayerParserRegisterGetTx(uint8_t ipproto, AppProto alproto, void *(StateGetTx)(void *alstate, uint64_t tx_id))
struct AppLayerTxData AppLayerTxData
#define SCReturnStruct(x)
#define FAIL_IF(expr)
Fail a test if expression evaluates to true.
void StreamTcpFreeConfig(bool quiet)
int AppLayerParserParse(ThreadVars *tv, AppLayerParserThreadCtx *alp_tctx, Flow *f, AppProto alproto, uint8_t flags, const uint8_t *input, uint32_t input_len)
uint32_t ftp_config_maxtx
void AppLayerDecoderEventsSetEventRaw(AppLayerDecoderEvents **sevents, uint8_t event)
Set an app layer decoder event.
#define TAILQ_NEXT(elm, field)
void AppLayerParserRegisterStateDataFunc(uint8_t ipproto, AppProto alproto, AppLayerStateData *(*GetStateData)(void *state))
void AppLayerParserRegisterTxDataFunc(uint8_t ipproto, AppProto alproto, AppLayerTxData *(*GetTxData)(void *tx))
int ParseSizeStringU32(const char *size, uint32_t *res)
struct SCLogConfig_ SCLogConfig
Holds the config state used by the logging api.
void AppLayerParserRegisterGetTxIterator(uint8_t ipproto, AppProto alproto, AppLayerGetTxIteratorFunc Func)
#define SCLogError(...)
Macro used to log ERROR messages.
void(* DestroyCtx)(struct MpmCtx_ *)
void FlowFreeStorageById(Flow *f, FlowStorageId id)
int FileCloseFile(FileContainer *ffc, const StreamingBufferConfig *sbcfg, const uint8_t *data, uint32_t data_len, uint16_t flags)
Close a File.
void(* Free)(void *ptr, size_t size)
void AppLayerParserRegisterGetEventInfoById(uint8_t ipproto, AppProto alproto, int(*StateGetEventInfoById)(int event_id, const char **event_name, AppLayerEventType *event_type))
bool current_line_truncated_ts
thread_local SCError sc_errno
MpmTableElmt mpm_table[MPM_TABLE_SIZE]
void AppLayerParserRegisterGetTxCnt(uint8_t ipproto, AppProto alproto, uint64_t(*StateGetTxCnt)(void *alstate))
void PmqFree(PrefilterRuleStore *pmq)
Cleanup and free a Pmq.
#define SC_ATOMIC_GET(name)
Get the value from the atomic variable.
uint16_t JsonGetNextLineFromBuffer(const char *buffer, const uint16_t len)
uint16_t FileFlowFlagsToFlags(const uint16_t flow_file_flags, uint8_t direction)
struct FTPThreadCtx_ FTPThreadCtx
uint16_t AppLayerParserStateIssetFlag(AppLayerParserState *pstate, uint16_t flag)
AppProto alproto
application level protocol
union AppLayerGetTxIterState::@11 un
int MpmAddPatternCI(struct MpmCtx_ *mpm_ctx, uint8_t *pat, uint16_t patlen, uint16_t offset, uint16_t depth, uint32_t pid, SigIntId sid, uint8_t flags)
#define SCMemcmp(a, b, c)
int AppLayerProtoDetectConfProtoDetectionEnabled(const char *ipproto, const char *alproto)
Given a protocol name, checks if proto detection is enabled in the conf file.
MpmThreadCtx * ftp_mpm_thread_ctx
#define DEBUG_VALIDATE_BUG_ON(exp)
int PmqSetup(PrefilterRuleStore *pmq)
Setup a pmq.
void *(* Realloc)(void *ptr, size_t orig_size, size_t size)