suricata
app-layer-parser.c File Reference
#include "suricata-common.h"
#include "debug.h"
#include "util-unittest.h"
#include "decode.h"
#include "threads.h"
#include "util-print.h"
#include "util-pool.h"
#include "flow-util.h"
#include "flow-private.h"
#include "detect-engine-state.h"
#include "detect-engine-port.h"
#include "stream-tcp.h"
#include "stream-tcp-private.h"
#include "stream.h"
#include "stream-tcp-reassemble.h"
#include "app-layer.h"
#include "app-layer-protos.h"
#include "app-layer-parser.h"
#include "app-layer-dcerpc.h"
#include "app-layer-dcerpc-udp.h"
#include "app-layer-smb.h"
#include "app-layer-htp.h"
#include "app-layer-ftp.h"
#include "app-layer-ssl.h"
#include "app-layer-ssh.h"
#include "app-layer-smtp.h"
#include "app-layer-dns-udp.h"
#include "app-layer-dns-tcp.h"
#include "app-layer-modbus.h"
#include "app-layer-enip.h"
#include "app-layer-dnp3.h"
#include "app-layer-nfs-tcp.h"
#include "app-layer-nfs-udp.h"
#include "app-layer-ntp.h"
#include "app-layer-tftp.h"
#include "app-layer-ikev2.h"
#include "app-layer-krb5.h"
#include "app-layer-dhcp.h"
#include "app-layer-template.h"
#include "app-layer-template-rust.h"
#include "conf.h"
#include "util-spm.h"
#include "util-debug.h"
#include "decode-events.h"
#include "util-unittest-helper.h"
#include "util-validate.h"
#include "runmodes.h"
Include dependency graph for app-layer-parser.c:

Go to the source code of this file.

Data Structures

struct  AppLayerParserThreadCtx_
 
struct  AppLayerParserProtoCtx_
 App layer protocol parser context. More...
 
struct  AppLayerParserCtx_
 
struct  AppLayerParserState_
 
struct  TestState_
 

Macros

#define IS_DISRUPTED(flags)   ((flags) & (STREAM_DEPTH|STREAM_GAP))
 
#define BOTH_SET(a, b)   ((a) != NULL && (b) != NULL)
 
#define BOTH_SET_OR_BOTH_UNSET(a, b)   (((a) == NULL && (b) == NULL) || ((a) != NULL && (b) != NULL))
 
#define THREE_SET_OR_THREE_UNSET(a, b, c)   (((a) == NULL && (b) == NULL && (c) == NULL) || ((a) != NULL && (b) != NULL && (c) != NULL))
 

Typedefs

typedef struct AppLayerParserProtoCtx_ AppLayerParserProtoCtx
 App layer protocol parser context. More...
 
typedef struct AppLayerParserCtx_ AppLayerParserCtx
 
typedef struct TestState_ TestState
 

Functions

void UTHAppLayerParserStateGetIds (void *ptr, uint64_t *i1, uint64_t *i2, uint64_t *log, uint64_t *min)
 
int AppLayerParserProtoIsRegistered (uint8_t ipproto, AppProto alproto)
 
AppLayerParserStateAppLayerParserStateAlloc (void)
 
void AppLayerParserStateFree (AppLayerParserState *pstate)
 
int AppLayerParserSetup (void)
 
void AppLayerParserPostStreamSetup (void)
 
int AppLayerParserDeSetup (void)
 
AppLayerParserThreadCtxAppLayerParserThreadCtxAlloc (void)
 Gets a new app layer protocol's parser thread context. More...
 
void AppLayerParserThreadCtxFree (AppLayerParserThreadCtx *tctx)
 Destroys the app layer parser thread context obtained using AppLayerParserThreadCtxAlloc(). More...
 
int AppLayerParserConfParserEnabled (const char *ipproto, const char *alproto_name)
 check if a parser is enabled in the config Returns enabled always if: were running unittests and when compiled with –enable-afl More...
 
int AppLayerParserRegisterParser (uint8_t ipproto, AppProto alproto, uint8_t direction, AppLayerParserFPtr Parser)
 Register app layer parser for the protocol. More...
 
void AppLayerParserRegisterParserAcceptableDataDirection (uint8_t ipproto, AppProto alproto, uint8_t direction)
 
void AppLayerParserRegisterOptionFlags (uint8_t ipproto, AppProto alproto, uint32_t flags)
 
void AppLayerParserRegisterStateFuncs (uint8_t ipproto, AppProto alproto, void *(*StateAlloc)(void), void(*StateFree)(void *))
 
void AppLayerParserRegisterLocalStorageFunc (uint8_t ipproto, AppProto alproto, void *(*LocalStorageAlloc)(void), void(*LocalStorageFree)(void *))
 
void AppLayerParserRegisterGetFilesFunc (uint8_t ipproto, AppProto alproto, FileContainer *(*StateGetFiles)(void *, uint8_t))
 
void AppLayerParserRegisterGetEventsFunc (uint8_t ipproto, AppProto alproto, AppLayerDecoderEvents *(*StateGetEvents)(void *, uint64_t))
 
void AppLayerParserRegisterLoggerFuncs (uint8_t ipproto, AppProto alproto, LoggerId(*StateGetTxLogged)(void *, void *), void(*StateSetTxLogged)(void *, void *, LoggerId))
 
void AppLayerParserRegisterLoggerBits (uint8_t ipproto, AppProto alproto, LoggerId bits)
 
void AppLayerParserRegisterLogger (uint8_t ipproto, AppProto alproto)
 
void AppLayerParserRegisterTruncateFunc (uint8_t ipproto, AppProto alproto, void(*Truncate)(void *, uint8_t))
 
void AppLayerParserRegisterGetStateProgressFunc (uint8_t ipproto, AppProto alproto, int(*StateGetProgress)(void *alstate, uint8_t direction))
 
void AppLayerParserRegisterTxFreeFunc (uint8_t ipproto, AppProto alproto, void(*StateTransactionFree)(void *, uint64_t))
 
void AppLayerParserRegisterGetTxCnt (uint8_t ipproto, AppProto alproto, uint64_t(*StateGetTxCnt)(void *alstate))
 
void AppLayerParserRegisterGetTx (uint8_t ipproto, AppProto alproto, void *(StateGetTx)(void *alstate, uint64_t tx_id))
 
void AppLayerParserRegisterGetTxIterator (uint8_t ipproto, AppProto alproto, AppLayerGetTxIteratorFunc Func)
 
void AppLayerParserRegisterGetStateProgressCompletionStatus (AppProto alproto, int(*StateGetProgressCompletionStatus)(uint8_t direction))
 
void AppLayerParserRegisterGetEventInfo (uint8_t ipproto, AppProto alproto, int(*StateGetEventInfo)(const char *event_name, int *event_id, AppLayerEventType *event_type))
 
void AppLayerParserRegisterDetectStateFuncs (uint8_t ipproto, AppProto alproto, DetectEngineState *(*GetTxDetectState)(void *tx), int(*SetTxDetectState)(void *tx, DetectEngineState *))
 
void AppLayerParserRegisterDetectFlagsFuncs (uint8_t ipproto, AppProto alproto, uint64_t(*GetTxDetectFlags)(void *tx, uint8_t dir), void(*SetTxDetectFlags)(void *tx, uint8_t dir, uint64_t))
 
void AppLayerParserRegisterMpmIDsFuncs (uint8_t ipproto, AppProto alproto, uint64_t(*GetTxMpmIDs)(void *tx), int(*SetTxMpmIDs)(void *tx, uint64_t))
 
void * AppLayerParserGetProtocolParserLocalStorage (uint8_t ipproto, AppProto alproto)
 
void AppLayerParserDestroyProtocolParserLocalStorage (uint8_t ipproto, AppProto alproto, void *local_data)
 
AppLayerGetTxIteratorFunc AppLayerGetTxIterator (const uint8_t ipproto, const AppProto alproto)
 
void AppLayerParserSetTxLogged (uint8_t ipproto, AppProto alproto, void *alstate, void *tx, LoggerId logger)
 
LoggerId AppLayerParserGetTxLogged (const Flow *f, void *alstate, void *tx)
 
uint64_t AppLayerParserGetTransactionLogId (AppLayerParserState *pstate)
 
void AppLayerParserSetTransactionLogId (AppLayerParserState *pstate, uint64_t tx_id)
 
uint64_t AppLayerParserGetTransactionInspectId (AppLayerParserState *pstate, uint8_t direction)
 
void AppLayerParserSetTransactionInspectId (const Flow *f, AppLayerParserState *pstate, void *alstate, const uint8_t flags, bool tag_txs_as_inspected)
 
AppLayerDecoderEventsAppLayerParserGetDecoderEvents (AppLayerParserState *pstate)
 
void AppLayerParserSetDecoderEvents (AppLayerParserState *pstate, AppLayerDecoderEvents *devents)
 
AppLayerDecoderEventsAppLayerParserGetEventsByTx (uint8_t ipproto, AppProto alproto, void *alstate, uint64_t tx_id)
 
FileContainerAppLayerParserGetFiles (uint8_t ipproto, AppProto alproto, void *alstate, uint8_t direction)
 
void AppLayerParserTransactionsCleanup (Flow *f)
 remove obsolete (inspected and logged) transactions More...
 
int AppLayerParserGetStateProgress (uint8_t ipproto, AppProto alproto, void *alstate, uint8_t flags)
 get the progress value for a tx/protocol More...
 
uint64_t AppLayerParserGetTxCnt (const Flow *f, void *alstate)
 
void * AppLayerParserGetTx (uint8_t ipproto, AppProto alproto, void *alstate, uint64_t tx_id)
 
int AppLayerParserGetStateProgressCompletionStatus (AppProto alproto, uint8_t direction)
 
int AppLayerParserGetEventInfo (uint8_t ipproto, AppProto alproto, const char *event_name, int *event_id, AppLayerEventType *event_type)
 
uint8_t AppLayerParserGetFirstDataDir (uint8_t ipproto, AppProto alproto)
 
uint64_t AppLayerParserGetTransactionActive (const Flow *f, AppLayerParserState *pstate, uint8_t direction)
 
int AppLayerParserSupportsFiles (uint8_t ipproto, AppProto alproto)
 
int AppLayerParserSupportsTxDetectState (uint8_t ipproto, AppProto alproto)
 
DetectEngineStateAppLayerParserGetTxDetectState (uint8_t ipproto, AppProto alproto, void *tx)
 
int AppLayerParserSetTxDetectState (const Flow *f, void *tx, DetectEngineState *s)
 
uint64_t AppLayerParserGetTxDetectFlags (uint8_t ipproto, AppProto alproto, void *tx, uint8_t dir)
 
void AppLayerParserSetTxDetectFlags (uint8_t ipproto, AppProto alproto, void *tx, uint8_t dir, uint64_t flags)
 
int AppLayerParserParse (ThreadVars *tv, AppLayerParserThreadCtx *alp_tctx, Flow *f, AppProto alproto, uint8_t flags, uint8_t *input, uint32_t input_len)
 
void AppLayerParserSetEOF (AppLayerParserState *pstate)
 
bool AppLayerParserHasDecoderEvents (AppLayerParserState *pstate)
 
int AppLayerParserIsTxAware (AppProto alproto)
 simpler way to globally test if a alproto is registered and fully enabled in the configuration. More...
 
int AppLayerParserProtocolIsTxAware (uint8_t ipproto, AppProto alproto)
 
int AppLayerParserProtocolIsTxEventAware (uint8_t ipproto, AppProto alproto)
 
int AppLayerParserProtocolSupportsTxs (uint8_t ipproto, AppProto alproto)
 
int AppLayerParserProtocolHasLogger (uint8_t ipproto, AppProto alproto)
 
LoggerId AppLayerParserProtocolGetLoggerBits (uint8_t ipproto, AppProto alproto)
 
void AppLayerParserTriggerRawStreamReassembly (Flow *f, int direction)
 
void AppLayerParserSetStreamDepth (uint8_t ipproto, AppProto alproto, uint32_t stream_depth)
 
uint32_t AppLayerParserGetStreamDepth (const Flow *f)
 
void AppLayerParserStateCleanup (const Flow *f, void *alstate, AppLayerParserState *pstate)
 
void AppLayerParserRegisterProtocolParsers (void)
 
void AppLayerParserStateSetFlag (AppLayerParserState *pstate, uint8_t flag)
 
int AppLayerParserStateIssetFlag (AppLayerParserState *pstate, uint8_t flag)
 
void AppLayerParserStreamTruncated (uint8_t ipproto, AppProto alproto, void *alstate, uint8_t direction)
 
void AppLayerParserRegisterProtocolUnittests (uint8_t ipproto, AppProto alproto, void(*RegisterUnittests)(void))
 
void AppLayerParserBackupParserTable (void)
 
void AppLayerParserRestoreParserTable (void)
 
void AppLayerParserRegisterUnittests (void)
 

Detailed Description

Author
Victor Julien victo.nosp@m.r@in.nosp@m.linia.nosp@m.c.ne.nosp@m.t

Generic App-layer parsing functions.

Definition in file app-layer-parser.c.

Macro Definition Documentation

#define BOTH_SET (   a,
 
)    ((a) != NULL && (b) != NULL)

Definition at line 1412 of file app-layer-parser.c.

#define BOTH_SET_OR_BOTH_UNSET (   a,
 
)    (((a) == NULL && (b) == NULL) || ((a) != NULL && (b) != NULL))

Definition at line 1413 of file app-layer-parser.c.

#define IS_DISRUPTED (   flags)    ((flags) & (STREAM_DEPTH|STREAM_GAP))

Definition at line 988 of file app-layer-parser.c.

Referenced by AppLayerParserGetStateProgress().

#define THREE_SET_OR_THREE_UNSET (   a,
  b,
 
)    (((a) == NULL && (b) == NULL && (c) == NULL) || ((a) != NULL && (b) != NULL && (c) != NULL))

Definition at line 1414 of file app-layer-parser.c.

Typedef Documentation

App layer protocol parser context.

typedef struct TestState_ TestState

Function Documentation

AppLayerGetTxIteratorFunc AppLayerGetTxIterator ( const uint8_t  ipproto,
const AppProto  alproto 
)

Definition at line 662 of file app-layer-parser.c.

References AppLayerParserCtx_::ctxs, FlowGetProtoMapping(), and AppLayerParserProtoCtx_::StateGetTxIterator.

Referenced by AppLayerParserSetTransactionInspectId(), AppLayerParserTransactionsCleanup(), and OutputRegisterTxLogger().

Here is the call graph for this function:

Here is the caller graph for this function:

void AppLayerParserBackupParserTable ( void  )

Definition at line 1991 of file app-layer-parser.c.

References SCEnter, and SCReturn.

Referenced by AppLayerParserRestoreParserTable().

Here is the caller graph for this function:

int AppLayerParserConfParserEnabled ( const char *  ipproto,
const char *  alproto_name 
)

check if a parser is enabled in the config Returns enabled always if: were running unittests and when compiled with –enable-afl

Given a protocol name, checks if the parser is enabled in the conf file.

Definition at line 295 of file app-layer-parser.c.

References ConfGetNode(), ConfValIsFalse(), ConfValIsTrue(), RunmodeIsUnittests(), SC_ERR_FATAL, SCEnter, SCLogDebug, SCLogError, SCReturnInt, and ConfNode_::val.

Referenced by HTPFreeConfig(), RegisterDCERPCParsers(), RegisterDCERPCUDPParsers(), RegisterDNP3Parsers(), RegisterENIPTCPParsers(), RegisterENIPUDPParsers(), RegisterFTPParsers(), RegisterHTPParsers(), RegisterModbusParsers(), RegisterNFSTCPParsers(), RegisterNFSUDPParsers(), RegisterSMBParsers(), RegisterSMTPParsers(), RegisterSSHParsers(), RegisterSSLParsers(), RegisterTemplateParsers(), and RegisterTFTPParsers().

Here is the call graph for this function:

Here is the caller graph for this function:

int AppLayerParserDeSetup ( void  )

Definition at line 236 of file app-layer-parser.c.

References SCEnter, SCReturnInt, and SMTPParserCleanup().

Referenced by AppLayerDeSetup().

Here is the call graph for this function:

Here is the caller graph for this function:

void AppLayerParserDestroyProtocolParserLocalStorage ( uint8_t  ipproto,
AppProto  alproto,
void *  local_data 
)

Definition at line 612 of file app-layer-parser.c.

References AppLayerParserGetTx(), AppLayerParserCtx_::ctxs, FlowGetProtoMapping(), AppLayerGetTxIterTuple::has_next, MAX, SCEnter, SCLogDebug, SCReturn, AppLayerGetTxIterTuple::tx_id, tx_id, and AppLayerGetTxIterTuple::tx_ptr.

Referenced by AppLayerParserThreadCtxFree().

Here is the call graph for this function:

Here is the caller graph for this function:

AppLayerDecoderEvents* AppLayerParserGetDecoderEvents ( AppLayerParserState pstate)

Definition at line 818 of file app-layer-parser.c.

References AppLayerParserState_::decoder_events, SCEnter, and SCReturnPtr.

Referenced by AppLayerDecoderEventsSetEvent(), AppLayerParserHasDecoderEvents(), and HtpConfigRestoreBackup().

Here is the caller graph for this function:

int AppLayerParserGetEventInfo ( uint8_t  ipproto,
AppProto  alproto,
const char *  event_name,
int *  event_id,
AppLayerEventType event_type 
)

Definition at line 1039 of file app-layer-parser.c.

References AppLayerParserCtx_::ctxs, FlowGetProtoMapping(), SCEnter, SCReturnInt, and AppLayerParserProtoCtx_::StateGetEventInfo.

Referenced by DetectAppLayerEventRegister().

Here is the call graph for this function:

Here is the caller graph for this function:

AppLayerDecoderEvents* AppLayerParserGetEventsByTx ( uint8_t  ipproto,
AppProto  alproto,
void *  alstate,
uint64_t  tx_id 
)

Definition at line 831 of file app-layer-parser.c.

References AppLayerParserCtx_::ctxs, FlowGetProtoMapping(), SCEnter, and SCReturnPtr.

Referenced by DetectAppLayerEventRegister(), HtpConfigRestoreBackup(), and HTPFileClose().

Here is the call graph for this function:

Here is the caller graph for this function:

FileContainer* AppLayerParserGetFiles ( uint8_t  ipproto,
AppProto  alproto,
void *  alstate,
uint8_t  direction 
)
uint8_t AppLayerParserGetFirstDataDir ( uint8_t  ipproto,
AppProto  alproto 
)

Definition at line 1049 of file app-layer-parser.c.

References AppLayerParserCtx_::ctxs, FlowGetProtoMapping(), SCEnter, and SCReturnCT.

Referenced by AppLayerIncTxCounter().

Here is the call graph for this function:

Here is the caller graph for this function:

void* AppLayerParserGetProtocolParserLocalStorage ( uint8_t  ipproto,
AppProto  alproto 
)

Definition at line 597 of file app-layer-parser.c.

References AppLayerParserCtx_::ctxs, FlowGetProtoMapping(), SCEnter, and SCReturnPtr.

Referenced by AppLayerParserThreadCtxAlloc().

Here is the call graph for this function:

Here is the caller graph for this function:

int AppLayerParserGetStateProgress ( uint8_t  ipproto,
AppProto  alproto,
void *  alstate,
uint8_t  flags 
)

get the progress value for a tx/protocol

If the stream is disrupted, we return the 'completion' value.

Definition at line 996 of file app-layer-parser.c.

References AppLayerParserCtx_::ctxs, FLOW_PROTO_DEFAULT, FlowGetProtoMapping(), IS_DISRUPTED, SCEnter, SCReturnInt, and unlikely.

Referenced by AppLayerParserSetTransactionInspectId(), AppLayerParserTransactionsCleanup(), DetectAppLayerEventRegister(), DetectEngineInspectBufferGeneric(), DetectHttpClientBodyRegister(), DetectHttpResponseLineRegister(), and OutputRegisterTxLogger().

Here is the call graph for this function:

Here is the caller graph for this function:

int AppLayerParserGetStateProgressCompletionStatus ( AppProto  alproto,
uint8_t  direction 
)
uint32_t AppLayerParserGetStreamDepth ( const Flow f)

Definition at line 1366 of file app-layer-parser.c.

References Flow_::alproto, AppLayerParserCtx_::ctxs, Flow_::protomap, SCReturnInt, and AppLayerParserProtoCtx_::stream_depth.

Referenced by AppLayerIncTxCounter().

Here is the caller graph for this function:

uint64_t AppLayerParserGetTransactionActive ( const Flow f,
AppLayerParserState pstate,
uint8_t  direction 
)
uint64_t AppLayerParserGetTransactionInspectId ( AppLayerParserState pstate,
uint8_t  direction 
)
uint64_t AppLayerParserGetTransactionLogId ( AppLayerParserState pstate)

Definition at line 698 of file app-layer-parser.c.

References AppLayerParserState_::log_id, SCEnter, and SCReturnCT.

Referenced by OutputRegisterTxLogger().

Here is the caller graph for this function:

void* AppLayerParserGetTx ( uint8_t  ipproto,
AppProto  alproto,
void *  alstate,
uint64_t  tx_id 
)
uint64_t AppLayerParserGetTxDetectFlags ( uint8_t  ipproto,
AppProto  alproto,
void *  tx,
uint8_t  dir 
)

Definition at line 1109 of file app-layer-parser.c.

References AppLayerParserCtx_::ctxs, flags, FlowGetProtoMapping(), AppLayerParserProtoCtx_::GetTxDetectFlags, SCEnter, and SCReturnUInt.

Referenced by AppLayerParserSetTransactionInspectId(), and AppLayerParserTransactionsCleanup().

Here is the call graph for this function:

Here is the caller graph for this function:

DetectEngineState* AppLayerParserGetTxDetectState ( uint8_t  ipproto,
AppProto  alproto,
void *  tx 
)

Definition at line 1090 of file app-layer-parser.c.

References AppLayerParserCtx_::ctxs, FlowGetProtoMapping(), AppLayerParserProtoCtx_::GetTxDetectState, SCEnter, and SCReturnPtr.

Referenced by DetectEngineStateResetTxs(), and DetectRunStoreStateTx().

Here is the call graph for this function:

Here is the caller graph for this function:

LoggerId AppLayerParserGetTxLogged ( const Flow f,
void *  alstate,
void *  tx 
)
bool AppLayerParserHasDecoderEvents ( AppLayerParserState pstate)

Definition at line 1280 of file app-layer-parser.c.

References AppLayerParserGetDecoderEvents(), AppLayerDecoderEvents_::cnt, AppLayerParserState_::decoder_events, and SCEnter.

Referenced by SigMatchSignaturesGetSgh().

Here is the call graph for this function:

Here is the caller graph for this function:

int AppLayerParserIsTxAware ( AppProto  alproto)

simpler way to globally test if a alproto is registered and fully enabled in the configuration.

Definition at line 1298 of file app-layer-parser.c.

References AppLayerParserCtx_::ctxs, FLOW_PROTO_DEFAULT, and AppLayerParserProtoCtx_::StateGetProgressCompletionStatus.

Referenced by OutputRegisterTxLogger().

Here is the caller graph for this function:

int AppLayerParserParse ( ThreadVars tv,
AppLayerParserThreadCtx alp_tctx,
Flow f,
AppProto  alproto,
uint8_t  flags,
uint8_t *  input,
uint32_t  input_len 
)

Definition at line 1130 of file app-layer-parser.c.

References Flow_::alparser, Flow_::alproto, AppLayerParserThreadCtx_::alproto_local_storage, Flow_::alstate, APP_LAYER_PARSER_BYPASS_READY, APP_LAYER_PARSER_EOF, APP_LAYER_PARSER_NO_INSPECTION, APP_LAYER_PARSER_NO_INSPECTION_PAYLOAD, APP_LAYER_PARSER_NO_REASSEMBLY, APP_LAYER_PARSER_OPT_ACCEPT_GAPS, AppLayerGetProtoName(), AppLayerIncTxCounter(), AppLayerParserGetTxCnt(), AppLayerParserProtocolIsTxAware(), AppLayerParserSetEOF(), AppLayerParserStateAlloc(), AppLayerParserStateSetFlag(), AppLayerParserStreamTruncated(), BUG_ON, AppLayerParserCtx_::ctxs, AppLayerParserState_::flags, Flow_::flags, FLOW_NOPAYLOAD_INSPECTION, FlowGetProtoMapping(), likely, AppLayerParserProtoCtx_::option_flags, AppLayerParserProtoCtx_::Parser, Flow_::proto, Flow_::protoctx, Flow_::protomap, SCEnter, SCLogDebug, SCReturnInt, AppLayerParserProtoCtx_::StateAlloc, STREAM_DEPTH, STREAM_EOF, STREAM_GAP, STREAM_TOCLIENT, STREAM_TOSERVER, StreamTcpDisableAppLayer(), StreamTcpSetDisableRawReassemblyFlag(), StreamTcpSetSessionBypassFlag(), and StreamTcpSetSessionNoReassemblyFlag().

Referenced by AppLayerHandleTCPData(), AppLayerHandleUdp(), AppLayerIncTxCounter(), AppLayerParserRestoreParserTable(), AppLayerParserStreamTruncated(), DetectBypassRegister(), DetectDceIfaceRegister(), DetectDceOpnumRegister(), DetectDceStubDataRegister(), DetectDNP3Register(), DetectDnsQueryRegister(), DetectEngineInspectENIP(), DetectEngineInspectModbus(), DetectEngineStateResetTxs(), DetectFtpbounceRegister(), DetectHttpRequestLineRegister(), DetectHttpResponseLineRegister(), DetectLuaRegister(), DetectPcrePayloadMatch(), DetectSshSoftwareVersionRegister(), DetectSshVersionRegister(), DetectSslStateRegister(), DetectSslVersionRegister(), DetectTemplateRustBufferRegister(), DetectTlsFingerprintRegister(), DetectTlsIssuerRegister(), DetectTlsJa3HashRegister(), DetectTlsJa3StringRegister(), DetectTlsSerialRegister(), DetectTlsSniRegister(), DetectTlsSubjectRegister(), DetectTlsValidityRegister(), DetectTlsVersionRegister(), DetectUricontentRegister(), DetectUrilenValidateContent(), FTPAtExitPrintStats(), HtpConfigRestoreBackup(), HTPFileClose(), RegisterDCERPCParsers(), RegisterDCERPCUDPParsers(), RegisterDNP3Parsers(), RegisterENIPTCPParsers(), RegisterModbusParsers(), RegisterSMBParsers(), RegisterSSHParsers(), RegisterSSLParsers(), and SMTPParserCleanup().

Here is the call graph for this function:

Here is the caller graph for this function:

void AppLayerParserPostStreamSetup ( void  )
LoggerId AppLayerParserProtocolGetLoggerBits ( uint8_t  ipproto,
AppProto  alproto 
)

Definition at line 1336 of file app-layer-parser.c.

References AppLayerParserCtx_::ctxs, FlowGetProtoMapping(), AppLayerParserProtoCtx_::logger_bits, SCEnter, and SCReturnUInt.

Referenced by AppLayerParserTransactionsCleanup(), and OutputRegisterTxLogger().

Here is the call graph for this function:

Here is the caller graph for this function:

int AppLayerParserProtocolHasLogger ( uint8_t  ipproto,
AppProto  alproto 
)

Definition at line 1328 of file app-layer-parser.c.

References AppLayerParserCtx_::ctxs, FlowGetProtoMapping(), AppLayerParserProtoCtx_::logger, SCEnter, and SCReturnInt.

Referenced by OutputRegisterTxLogger(), and RunModeInitializeOutputs().

Here is the call graph for this function:

Here is the caller graph for this function:

int AppLayerParserProtocolIsTxAware ( uint8_t  ipproto,
AppProto  alproto 
)

Definition at line 1304 of file app-layer-parser.c.

References AppLayerParserCtx_::ctxs, FlowGetProtoMapping(), SCEnter, SCReturnInt, and AppLayerParserProtoCtx_::StateGetTx.

Referenced by AppLayerParserParse(), AppLayerRegisterThreadCounters(), AppLayerSetupCounters(), and OutputRegisterTxLogger().

Here is the call graph for this function:

Here is the caller graph for this function:

int AppLayerParserProtocolIsTxEventAware ( uint8_t  ipproto,
AppProto  alproto 
)

Definition at line 1312 of file app-layer-parser.c.

References AppLayerParserCtx_::ctxs, FlowGetProtoMapping(), SCEnter, SCReturnInt, and AppLayerParserProtoCtx_::StateGetEvents.

Here is the call graph for this function:

int AppLayerParserProtocolSupportsTxs ( uint8_t  ipproto,
AppProto  alproto 
)

Definition at line 1320 of file app-layer-parser.c.

References AppLayerParserCtx_::ctxs, FlowGetProtoMapping(), SCEnter, SCReturnInt, and AppLayerParserProtoCtx_::StateTransactionFree.

Referenced by DetectSignatureApplyActions(), FlowForceReassemblyNeedReassembly(), and SigMatchSignaturesGetSgh().

Here is the call graph for this function:

Here is the caller graph for this function:

int AppLayerParserProtoIsRegistered ( uint8_t  ipproto,
AppProto  alproto 
)

Definition at line 181 of file app-layer-parser.c.

References AppLayerParserCtx_::ctxs, FlowGetProtoMapping(), and AppLayerParserProtoCtx_::StateAlloc.

Referenced by AppLayerSetupCounters().

Here is the call graph for this function:

Here is the caller graph for this function:

void AppLayerParserRegisterDetectFlagsFuncs ( uint8_t  ipproto,
AppProto  alproto,
uint64_t(*)(void *tx, uint8_t dir)  GetTxDetectFlags,
void(*)(void *tx, uint8_t dir, uint64_t)  SetTxDetectFlags 
)
void AppLayerParserRegisterGetEventInfo ( uint8_t  ipproto,
AppProto  alproto,
int(*)(const char *event_name, int *event_id, AppLayerEventType *event_type StateGetEventInfo 
)
void AppLayerParserRegisterGetEventsFunc ( uint8_t  ipproto,
AppProto  alproto,
AppLayerDecoderEvents *(*)(void *, uint64_t)  StateGetEvents 
)
void AppLayerParserRegisterGetFilesFunc ( uint8_t  ipproto,
AppProto  alproto,
FileContainer *(*)(void *, uint8_t)  StateGetFiles 
)
void AppLayerParserRegisterGetStateProgressFunc ( uint8_t  ipproto,
AppProto  alproto,
int(*)(void *alstate, uint8_t direction)  StateGetProgress 
)
void AppLayerParserRegisterGetTx ( uint8_t  ipproto,
AppProto  alproto,
void *  StateGetTx)(void *alstate, uint64_t tx_id 
)
void AppLayerParserRegisterGetTxIterator ( uint8_t  ipproto,
AppProto  alproto,
AppLayerGetTxIteratorFunc  Func 
)

Definition at line 530 of file app-layer-parser.c.

References AppLayerParserCtx_::ctxs, FlowGetProtoMapping(), SCEnter, SCReturn, and AppLayerParserProtoCtx_::StateGetTxIterator.

Referenced by AppLayerRegisterParser(), RegisterNFSTCPParsers(), RegisterNFSUDPParsers(), and RegisterSMBParsers().

Here is the call graph for this function:

Here is the caller graph for this function:

void AppLayerParserRegisterLocalStorageFunc ( uint8_t  ipproto,
AppProto  alproto,
void *(*)(void)  LocalStorageAlloc,
void(*)(void *)  LocalStorageFree 
)

Definition at line 407 of file app-layer-parser.c.

References AppLayerParserCtx_::ctxs, FlowGetProtoMapping(), AppLayerParserProtoCtx_::LocalStorageAlloc, AppLayerParserProtoCtx_::LocalStorageFree, SCEnter, and SCReturn.

Referenced by AppLayerRegisterParser(), and RegisterSMTPParsers().

Here is the call graph for this function:

Here is the caller graph for this function:

void AppLayerParserRegisterLogger ( uint8_t  ipproto,
AppProto  alproto 
)

Definition at line 467 of file app-layer-parser.c.

References AppLayerParserCtx_::ctxs, FlowGetProtoMapping(), AppLayerParserProtoCtx_::logger, SCEnter, and SCReturn.

Referenced by LogHttpLogInitCtx(), and TLSGetIPInformations().

Here is the call graph for this function:

Here is the caller graph for this function:

void AppLayerParserRegisterLoggerBits ( uint8_t  ipproto,
AppProto  alproto,
LoggerId  bits 
)

Definition at line 458 of file app-layer-parser.c.

References AppLayerParserCtx_::ctxs, FlowGetProtoMapping(), AppLayerParserProtoCtx_::logger_bits, SCEnter, and SCReturn.

Referenced by RunModeInitializeOutputs().

Here is the call graph for this function:

Here is the caller graph for this function:

void AppLayerParserRegisterLoggerFuncs ( uint8_t  ipproto,
AppProto  alproto,
LoggerId(*)(void *, void *)  StateGetTxLogged,
void(*)(void *, void *, LoggerId StateSetTxLogged 
)
void AppLayerParserRegisterMpmIDsFuncs ( uint8_t  ipproto,
AppProto  alproto,
uint64_t(*)(void *tx)  GetTxMpmIDs,
int(*)(void *tx, uint64_t)  SetTxMpmIDs 
)

Definition at line 585 of file app-layer-parser.c.

References AppProtoToString(), SC_WARN_DEPRECATED, SCEnter, SCLogWarning, and SCReturn.

Referenced by AppLayerRegisterParser().

Here is the call graph for this function:

Here is the caller graph for this function:

void AppLayerParserRegisterOptionFlags ( uint8_t  ipproto,
AppProto  alproto,
uint32_t  flags 
)

Definition at line 383 of file app-layer-parser.c.

References AppLayerParserCtx_::ctxs, flags, FlowGetProtoMapping(), AppLayerParserProtoCtx_::option_flags, SCEnter, and SCReturn.

Referenced by RegisterENIPTCPParsers(), RegisterNFSTCPParsers(), and RegisterSMBParsers().

Here is the call graph for this function:

Here is the caller graph for this function:

int AppLayerParserRegisterParser ( uint8_t  ipproto,
AppProto  alproto,
uint8_t  direction,
AppLayerParserFPtr  Parser 
)
void AppLayerParserRegisterParserAcceptableDataDirection ( uint8_t  ipproto,
AppProto  alproto,
uint8_t  direction 
)
void AppLayerParserRegisterTruncateFunc ( uint8_t  ipproto,
AppProto  alproto,
void(*)(void *, uint8_t)  Truncate 
)

Definition at line 476 of file app-layer-parser.c.

References AppLayerParserCtx_::ctxs, FlowGetProtoMapping(), SCEnter, SCReturn, and AppLayerParserProtoCtx_::Truncate.

Referenced by RegisterHTPParsers(), RegisterSMBParsers(), and RegisterSMTPParsers().

Here is the call graph for this function:

Here is the caller graph for this function:

void AppLayerParserRegisterTxFreeFunc ( uint8_t  ipproto,
AppProto  alproto,
void(*)(void *, uint64_t)  StateTransactionFree 
)
void AppLayerParserRegisterUnittests ( void  )

Definition at line 2113 of file app-layer-parser.c.

References ALPROTO_MAX, AppLayerParserCtx_::ctxs, FLOW_PROTO_DEFAULT, AppLayerParserProtoCtx_::RegisterUnittests, SCEnter, SCReturn, and UtRegisterTest().

Here is the call graph for this function:

void AppLayerParserSetDecoderEvents ( AppLayerParserState pstate,
AppLayerDecoderEvents devents 
)

Definition at line 826 of file app-layer-parser.c.

References AppLayerParserState_::decoder_events.

Referenced by AppLayerDecoderEventsSetEvent().

Here is the caller graph for this function:

void AppLayerParserSetEOF ( AppLayerParserState pstate)

Definition at line 1265 of file app-layer-parser.c.

References APP_LAYER_PARSER_EOF, AppLayerParserStateSetFlag(), SCEnter, and SCReturn.

Referenced by AppLayerParserParse().

Here is the call graph for this function:

Here is the caller graph for this function:

void AppLayerParserSetStreamDepth ( uint8_t  ipproto,
AppProto  alproto,
uint32_t  stream_depth 
)

Definition at line 1355 of file app-layer-parser.c.

References APP_LAYER_PARSER_INT_STREAM_DEPTH_SET, AppLayerParserCtx_::ctxs, FlowGetProtoMapping(), AppLayerParserProtoCtx_::internal_flags, SCEnter, SCReturn, and AppLayerParserProtoCtx_::stream_depth.

Referenced by RegisterModbusParsers(), and RegisterSMBParsers().

Here is the call graph for this function:

Here is the caller graph for this function:

void AppLayerParserSetTransactionLogId ( AppLayerParserState pstate,
uint64_t  tx_id 
)

Definition at line 705 of file app-layer-parser.c.

References AppLayerParserState_::log_id, SCEnter, SCReturn, and tx_id.

Referenced by OutputRegisterTxLogger().

Here is the caller graph for this function:

void AppLayerParserSetTxDetectFlags ( uint8_t  ipproto,
AppProto  alproto,
void *  tx,
uint8_t  dir,
uint64_t  flags 
)

Definition at line 1119 of file app-layer-parser.c.

References AppLayerParserCtx_::ctxs, FlowGetProtoMapping(), SCEnter, SCReturn, and AppLayerParserProtoCtx_::SetTxDetectFlags.

Referenced by AppLayerParserSetTransactionInspectId().

Here is the call graph for this function:

Here is the caller graph for this function:

int AppLayerParserSetTxDetectState ( const Flow f,
void *  tx,
DetectEngineState s 
)
void AppLayerParserSetTxLogged ( uint8_t  ipproto,
AppProto  alproto,
void *  alstate,
void *  tx,
LoggerId  logger 
)

Definition at line 670 of file app-layer-parser.c.

References AppLayerParserCtx_::ctxs, FlowGetProtoMapping(), SCEnter, and SCReturn.

Referenced by OutputRegisterTxLogger().

Here is the call graph for this function:

Here is the caller graph for this function:

int AppLayerParserSetup ( void  )

Definition at line 212 of file app-layer-parser.c.

References SCEnter, and SCReturnInt.

Referenced by AppLayerSetup(), and RegisterAllModules().

Here is the caller graph for this function:

AppLayerParserState* AppLayerParserStateAlloc ( void  )

Definition at line 188 of file app-layer-parser.c.

References SCEnter, SCMalloc, and SCReturnPtr.

Referenced by AppLayerParserParse(), and HtpConfigRestoreBackup().

Here is the caller graph for this function:

void AppLayerParserStateFree ( AppLayerParserState pstate)

Definition at line 201 of file app-layer-parser.c.

References AppLayerDecoderEventsFreeEvents(), AppLayerParserState_::decoder_events, SCEnter, SCFree, and SCReturn.

Referenced by AppLayerParserStateCleanup().

Here is the call graph for this function:

Here is the caller graph for this function:

int AppLayerParserStateIssetFlag ( AppLayerParserState pstate,
uint8_t  flag 
)

Definition at line 1545 of file app-layer-parser.c.

References AppLayerParserState_::flags, SCEnter, and SCReturnInt.

Referenced by DCERPCParser(), OutputRegisterTxLogger(), RegisterSSHParsers(), RegisterTFTPParsers(), SMTPProcessDataChunk(), and SSLVersionToString().

Here is the caller graph for this function:

void AppLayerParserStateSetFlag ( AppLayerParserState pstate,
uint8_t  flag 
)

Definition at line 1538 of file app-layer-parser.c.

References AppLayerParserState_::flags, SCEnter, and SCReturn.

Referenced by AppLayerParserParse(), AppLayerParserSetEOF(), and SSLVersionToString().

Here is the caller graph for this function:

int AppLayerParserSupportsFiles ( uint8_t  ipproto,
AppProto  alproto 
)

Definition at line 1076 of file app-layer-parser.c.

References AppLayerParserCtx_::ctxs, FALSE, FlowGetProtoMapping(), and TRUE.

Referenced by SigMatchList2DataArray().

Here is the call graph for this function:

Here is the caller graph for this function:

int AppLayerParserSupportsTxDetectState ( uint8_t  ipproto,
AppProto  alproto 
)

Definition at line 1083 of file app-layer-parser.c.

References AppLayerParserCtx_::ctxs, FALSE, FlowGetProtoMapping(), and TRUE.

Here is the call graph for this function:

AppLayerParserThreadCtx* AppLayerParserThreadCtxAlloc ( void  )

Gets a new app layer protocol's parser thread context.

Return values
Non-NULLpointer on success. NULL pointer on failure.

Definition at line 245 of file app-layer-parser.c.

References AppLayerParserThreadCtx_::alproto_local_storage, ALPROTO_MAX, AppLayerParserGetProtocolParserLocalStorage(), FLOW_PROTO_DEFAULT, FlowGetReverseProtoMapping(), SCEnter, SCMalloc, and SCReturnPtr.

Referenced by AppLayerGetCtxThread(), AppLayerParserRestoreParserTable(), AppLayerParserStreamTruncated(), DetectBypassRegister(), DetectDceIfaceRegister(), DetectDceOpnumRegister(), DetectDceStubDataRegister(), DetectDNP3Register(), DetectDnsQueryRegister(), DetectEngineInspectENIP(), DetectEngineInspectModbus(), DetectEngineStateResetTxs(), DetectFtpbounceRegister(), DetectHttpRequestLineRegister(), DetectHttpResponseLineRegister(), DetectLuaRegister(), DetectPcrePayloadMatch(), DetectSshSoftwareVersionRegister(), DetectSshVersionRegister(), DetectSslStateRegister(), DetectSslVersionRegister(), DetectTemplateRustBufferRegister(), DetectTlsFingerprintRegister(), DetectTlsIssuerRegister(), DetectTlsJa3HashRegister(), DetectTlsJa3StringRegister(), DetectTlsSerialRegister(), DetectTlsSniRegister(), DetectTlsSubjectRegister(), DetectTlsValidityRegister(), DetectTlsVersionRegister(), DetectUricontentRegister(), DetectUrilenValidateContent(), FTPAtExitPrintStats(), HtpConfigRestoreBackup(), HTPFileClose(), RegisterDCERPCParsers(), RegisterDCERPCUDPParsers(), RegisterDNP3Parsers(), RegisterENIPTCPParsers(), RegisterModbusParsers(), RegisterSMBParsers(), RegisterSSHParsers(), RegisterSSLParsers(), and SMTPParserCleanup().

Here is the call graph for this function:

Here is the caller graph for this function:

void AppLayerParserThreadCtxFree ( AppLayerParserThreadCtx tctx)

Destroys the app layer parser thread context obtained using AppLayerParserThreadCtxAlloc().

Parameters
tctxPointer to the thread context to be destroyed.

Definition at line 271 of file app-layer-parser.c.

References AppLayerParserThreadCtx_::alproto_local_storage, ALPROTO_MAX, AppLayerParserDestroyProtocolParserLocalStorage(), FLOW_PROTO_DEFAULT, FlowGetReverseProtoMapping(), SCEnter, SCFree, and SCReturn.

Referenced by AppLayerDestroyCtxThread(), AppLayerParserStreamTruncated(), DetectDceIfaceRegister(), DetectDceOpnumRegister(), DetectDceStubDataRegister(), DetectDNP3Register(), DetectDnsQueryRegister(), DetectEngineInspectENIP(), DetectEngineInspectModbus(), DetectEngineStateResetTxs(), DetectFtpbounceRegister(), DetectHttpRequestLineRegister(), DetectHttpResponseLineRegister(), DetectLuaRegister(), DetectPcrePayloadMatch(), DetectSshSoftwareVersionRegister(), DetectSshVersionRegister(), DetectSslStateRegister(), DetectSslVersionRegister(), DetectTemplateRustBufferRegister(), DetectTlsFingerprintRegister(), DetectTlsIssuerRegister(), DetectTlsJa3HashRegister(), DetectTlsJa3StringRegister(), DetectTlsSerialRegister(), DetectTlsSniRegister(), DetectTlsSubjectRegister(), DetectTlsValidityRegister(), DetectTlsVersionRegister(), DetectUricontentRegister(), DetectUrilenValidateContent(), FTPAtExitPrintStats(), HtpConfigRestoreBackup(), HTPFileClose(), RegisterDCERPCParsers(), RegisterDCERPCUDPParsers(), RegisterDNP3Parsers(), RegisterENIPTCPParsers(), RegisterModbusParsers(), RegisterSMBParsers(), RegisterSSHParsers(), RegisterSSLParsers(), and SMTPParserCleanup().

Here is the call graph for this function:

Here is the caller graph for this function:

void AppLayerParserTriggerRawStreamReassembly ( Flow f,
int  direction 
)

Definition at line 1344 of file app-layer-parser.c.

References Flow_::protoctx, SCEnter, SCLogDebug, SCReturn, and StreamTcpReassembleTriggerRawReassembly().

Referenced by HTPFreeConfig(), and SSLVersionToString().

Here is the call graph for this function:

Here is the caller graph for this function:

void UTHAppLayerParserStateGetIds ( void *  ptr,
uint64_t *  i1,
uint64_t *  i2,
uint64_t *  log,
uint64_t *  min 
)

Definition at line 167 of file app-layer-parser.c.

References AppLayerParserState_::inspect_id, AppLayerParserState_::log_id, and AppLayerParserState_::min_id.

Referenced by HtpConfigRestoreBackup(), and RegisterSMBParsers().

Here is the caller graph for this function: