suricata
app-layer-parser.c File Reference
#include "suricata-common.h"
#include "debug.h"
#include "util-unittest.h"
#include "decode.h"
#include "threads.h"
#include "util-print.h"
#include "util-pool.h"
#include "flow-util.h"
#include "flow-private.h"
#include "detect-engine-state.h"
#include "detect-engine-port.h"
#include "stream-tcp.h"
#include "stream-tcp-private.h"
#include "stream.h"
#include "stream-tcp-reassemble.h"
#include "app-layer.h"
#include "app-layer-protos.h"
#include "app-layer-parser.h"
#include "app-layer-dcerpc.h"
#include "app-layer-dcerpc-udp.h"
#include "app-layer-smb.h"
#include "app-layer-htp.h"
#include "app-layer-ftp.h"
#include "app-layer-ssl.h"
#include "app-layer-ssh.h"
#include "app-layer-smtp.h"
#include "app-layer-modbus.h"
#include "app-layer-enip.h"
#include "app-layer-dnp3.h"
#include "app-layer-nfs-tcp.h"
#include "app-layer-nfs-udp.h"
#include "app-layer-ntp.h"
#include "app-layer-tftp.h"
#include "app-layer-ikev2.h"
#include "app-layer-krb5.h"
#include "app-layer-snmp.h"
#include "app-layer-sip.h"
#include "app-layer-rfb.h"
#include "app-layer-template.h"
#include "app-layer-template-rust.h"
#include "app-layer-rdp.h"
#include "conf.h"
#include "util-spm.h"
#include "util-debug.h"
#include "decode-events.h"
#include "util-unittest-helper.h"
#include "util-validate.h"
#include "runmodes.h"
#include "rust.h"
Include dependency graph for app-layer-parser.c:

Go to the source code of this file.

Data Structures

struct  AppLayerParserThreadCtx_
 
struct  AppLayerParserProtoCtx_
 App layer protocol parser context. More...
 
struct  AppLayerParserCtx_
 
struct  AppLayerParserState_
 
struct  TestState_
 

Macros

#define IS_DISRUPTED(flags)   ((flags) & (STREAM_DEPTH|STREAM_GAP))
 
#define BOTH_SET(a, b)   ((a) != NULL && (b) != NULL)
 
#define BOTH_SET_OR_BOTH_UNSET(a, b)   (((a) == NULL && (b) == NULL) || ((a) != NULL && (b) != NULL))
 
#define THREE_SET_OR_THREE_UNSET(a, b, c)   (((a) == NULL && (b) == NULL && (c) == NULL) || ((a) != NULL && (b) != NULL && (c) != NULL))
 
#define THREE_SET(a, b, c)   ((a) != NULL && (b) != NULL && (c) != NULL)
 

Typedefs

typedef struct AppLayerParserProtoCtx_ AppLayerParserProtoCtx
 App layer protocol parser context. More...
 
typedef struct AppLayerParserCtx_ AppLayerParserCtx
 
typedef struct TestState_ TestState
 

Functions

void UTHAppLayerParserStateGetIds (void *ptr, uint64_t *i1, uint64_t *i2, uint64_t *log, uint64_t *min)
 
int AppLayerParserProtoIsRegistered (uint8_t ipproto, AppProto alproto)
 
AppLayerParserStateAppLayerParserStateAlloc (void)
 
void AppLayerParserStateFree (AppLayerParserState *pstate)
 
int AppLayerParserSetup (void)
 
void AppLayerParserPostStreamSetup (void)
 
int AppLayerParserDeSetup (void)
 
AppLayerParserThreadCtxAppLayerParserThreadCtxAlloc (void)
 Gets a new app layer protocol's parser thread context. More...
 
void AppLayerParserThreadCtxFree (AppLayerParserThreadCtx *tctx)
 Destroys the app layer parser thread context obtained using AppLayerParserThreadCtxAlloc(). More...
 
int AppLayerParserConfParserEnabled (const char *ipproto, const char *alproto_name)
 check if a parser is enabled in the config Returns enabled always if: were running unittests More...
 
int AppLayerParserRegisterParser (uint8_t ipproto, AppProto alproto, uint8_t direction, AppLayerParserFPtr Parser)
 Register app layer parser for the protocol. More...
 
void AppLayerParserRegisterParserAcceptableDataDirection (uint8_t ipproto, AppProto alproto, uint8_t direction)
 
void AppLayerParserRegisterOptionFlags (uint8_t ipproto, AppProto alproto, uint32_t flags)
 
void AppLayerParserRegisterStateFuncs (uint8_t ipproto, AppProto alproto, void *(*StateAlloc)(void), void(*StateFree)(void *))
 
void AppLayerParserRegisterLocalStorageFunc (uint8_t ipproto, AppProto alproto, void *(*LocalStorageAlloc)(void), void(*LocalStorageFree)(void *))
 
void AppLayerParserRegisterGetFilesFunc (uint8_t ipproto, AppProto alproto, FileContainer *(*StateGetFiles)(void *, uint8_t))
 
void AppLayerParserRegisterGetEventsFunc (uint8_t ipproto, AppProto alproto, AppLayerDecoderEvents *(*StateGetEvents)(void *))
 
void AppLayerParserRegisterLoggerFuncs (uint8_t ipproto, AppProto alproto, LoggerId(*StateGetTxLogged)(void *, void *), void(*StateSetTxLogged)(void *, void *, LoggerId))
 
void AppLayerParserRegisterLoggerBits (uint8_t ipproto, AppProto alproto, LoggerId bits)
 
void AppLayerParserRegisterLogger (uint8_t ipproto, AppProto alproto)
 
void AppLayerParserRegisterTruncateFunc (uint8_t ipproto, AppProto alproto, void(*Truncate)(void *, uint8_t))
 
void AppLayerParserRegisterGetStateProgressFunc (uint8_t ipproto, AppProto alproto, int(*StateGetProgress)(void *alstate, uint8_t direction))
 
void AppLayerParserRegisterTxFreeFunc (uint8_t ipproto, AppProto alproto, void(*StateTransactionFree)(void *, uint64_t))
 
void AppLayerParserRegisterGetTxCnt (uint8_t ipproto, AppProto alproto, uint64_t(*StateGetTxCnt)(void *alstate))
 
void AppLayerParserRegisterGetTx (uint8_t ipproto, AppProto alproto, void *(StateGetTx)(void *alstate, uint64_t tx_id))
 
void AppLayerParserRegisterGetTxIterator (uint8_t ipproto, AppProto alproto, AppLayerGetTxIteratorFunc Func)
 
void AppLayerParserRegisterGetStateProgressCompletionStatus (AppProto alproto, int(*StateGetProgressCompletionStatus)(uint8_t direction))
 
void AppLayerParserRegisterGetEventInfoById (uint8_t ipproto, AppProto alproto, int(*StateGetEventInfoById)(int event_id, const char **event_name, AppLayerEventType *event_type))
 
void AppLayerParserRegisterGetEventInfo (uint8_t ipproto, AppProto alproto, int(*StateGetEventInfo)(const char *event_name, int *event_id, AppLayerEventType *event_type))
 
void AppLayerParserRegisterDetectStateFuncs (uint8_t ipproto, AppProto alproto, DetectEngineState *(*GetTxDetectState)(void *tx), int(*SetTxDetectState)(void *tx, DetectEngineState *))
 
void AppLayerParserRegisterDetectFlagsFuncs (uint8_t ipproto, AppProto alproto, uint64_t(*GetTxDetectFlags)(void *tx, uint8_t dir), void(*SetTxDetectFlags)(void *tx, uint8_t dir, uint64_t))
 
void AppLayerParserRegisterMpmIDsFuncs (uint8_t ipproto, AppProto alproto, uint64_t(*GetTxMpmIDs)(void *tx), int(*SetTxMpmIDs)(void *tx, uint64_t))
 
void AppLayerParserRegisterSetStreamDepthFlag (uint8_t ipproto, AppProto alproto, void(*SetStreamDepthFlag)(void *tx, uint8_t flags))
 
void * AppLayerParserGetProtocolParserLocalStorage (uint8_t ipproto, AppProto alproto)
 
void AppLayerParserDestroyProtocolParserLocalStorage (uint8_t ipproto, AppProto alproto, void *local_data)
 
AppLayerGetTxIteratorFunc AppLayerGetTxIterator (const uint8_t ipproto, const AppProto alproto)
 
void AppLayerParserSetTxLogged (uint8_t ipproto, AppProto alproto, void *alstate, void *tx, LoggerId logger)
 
LoggerId AppLayerParserGetTxLogged (const Flow *f, void *alstate, void *tx)
 
uint64_t AppLayerParserGetTransactionLogId (AppLayerParserState *pstate)
 
void AppLayerParserSetTransactionLogId (AppLayerParserState *pstate, uint64_t tx_id)
 
uint64_t AppLayerParserGetTransactionInspectId (AppLayerParserState *pstate, uint8_t direction)
 
void AppLayerParserSetTransactionInspectId (const Flow *f, AppLayerParserState *pstate, void *alstate, const uint8_t flags, bool tag_txs_as_inspected)
 
AppLayerDecoderEventsAppLayerParserGetDecoderEvents (AppLayerParserState *pstate)
 
void AppLayerParserSetDecoderEvents (AppLayerParserState *pstate, AppLayerDecoderEvents *devents)
 
AppLayerDecoderEventsAppLayerParserGetEventsByTx (uint8_t ipproto, AppProto alproto, void *tx)
 
FileContainerAppLayerParserGetFiles (const Flow *f, const uint8_t direction)
 
void AppLayerParserTransactionsCleanup (Flow *f)
 remove obsolete (inspected and logged) transactions More...
 
int AppLayerParserGetStateProgress (uint8_t ipproto, AppProto alproto, void *alstate, uint8_t flags)
 get the progress value for a tx/protocol More...
 
uint64_t AppLayerParserGetTxCnt (const Flow *f, void *alstate)
 
void * AppLayerParserGetTx (uint8_t ipproto, AppProto alproto, void *alstate, uint64_t tx_id)
 
int AppLayerParserGetStateProgressCompletionStatus (AppProto alproto, uint8_t direction)
 
int AppLayerParserGetEventInfo (uint8_t ipproto, AppProto alproto, const char *event_name, int *event_id, AppLayerEventType *event_type)
 
int AppLayerParserGetEventInfoById (uint8_t ipproto, AppProto alproto, int event_id, const char **event_name, AppLayerEventType *event_type)
 
uint8_t AppLayerParserGetFirstDataDir (uint8_t ipproto, AppProto alproto)
 
uint64_t AppLayerParserGetTransactionActive (const Flow *f, AppLayerParserState *pstate, uint8_t direction)
 
int AppLayerParserSupportsFiles (uint8_t ipproto, AppProto alproto)
 
int AppLayerParserSupportsTxDetectState (uint8_t ipproto, AppProto alproto)
 
DetectEngineStateAppLayerParserGetTxDetectState (uint8_t ipproto, AppProto alproto, void *tx)
 
int AppLayerParserSetTxDetectState (const Flow *f, void *tx, DetectEngineState *s)
 
bool AppLayerParserSupportsTxDetectFlags (AppProto alproto)
 
uint64_t AppLayerParserGetTxDetectFlags (uint8_t ipproto, AppProto alproto, void *tx, uint8_t dir)
 
void AppLayerParserSetTxDetectFlags (uint8_t ipproto, AppProto alproto, void *tx, uint8_t dir, uint64_t flags)
 
int AppLayerParserParse (ThreadVars *tv, AppLayerParserThreadCtx *alp_tctx, Flow *f, AppProto alproto, uint8_t flags, const uint8_t *input, uint32_t input_len)
 
void AppLayerParserSetEOF (AppLayerParserState *pstate)
 
bool AppLayerParserHasDecoderEvents (AppLayerParserState *pstate)
 
int AppLayerParserIsEnabled (AppProto alproto)
 simple way to globally test if a alproto is registered and fully enabled in the configuration. More...
 
int AppLayerParserProtocolIsTxEventAware (uint8_t ipproto, AppProto alproto)
 
int AppLayerParserProtocolHasLogger (uint8_t ipproto, AppProto alproto)
 
LoggerId AppLayerParserProtocolGetLoggerBits (uint8_t ipproto, AppProto alproto)
 
void AppLayerParserTriggerRawStreamReassembly (Flow *f, int direction)
 
void AppLayerParserSetStreamDepth (uint8_t ipproto, AppProto alproto, uint32_t stream_depth)
 
uint32_t AppLayerParserGetStreamDepth (const Flow *f)
 
void AppLayerParserSetStreamDepthFlag (uint8_t ipproto, AppProto alproto, void *state, uint64_t tx_id, uint8_t flags)
 
void AppLayerParserStateCleanup (const Flow *f, void *alstate, AppLayerParserState *pstate)
 
void AppLayerParserRegisterProtocolParsers (void)
 
void AppLayerParserStateSetFlag (AppLayerParserState *pstate, uint8_t flag)
 
int AppLayerParserStateIssetFlag (AppLayerParserState *pstate, uint8_t flag)
 
void AppLayerParserStreamTruncated (uint8_t ipproto, AppProto alproto, void *alstate, uint8_t direction)
 
void AppLayerParserRegisterProtocolUnittests (uint8_t ipproto, AppProto alproto, void(*RegisterUnittests)(void))
 
void AppLayerParserBackupParserTable (void)
 
void AppLayerParserRestoreParserTable (void)
 
void AppLayerParserRegisterUnittests (void)
 

Detailed Description

Author
Victor Julien victo.nosp@m.r@in.nosp@m.linia.nosp@m.c.ne.nosp@m.t

Generic App-layer parsing functions.

Definition in file app-layer-parser.c.

Macro Definition Documentation

◆ BOTH_SET

#define BOTH_SET (   a,
 
)    ((a) != NULL && (b) != NULL)

Definition at line 1491 of file app-layer-parser.c.

◆ BOTH_SET_OR_BOTH_UNSET

#define BOTH_SET_OR_BOTH_UNSET (   a,
 
)    (((a) == NULL && (b) == NULL) || ((a) != NULL && (b) != NULL))

Definition at line 1492 of file app-layer-parser.c.

◆ IS_DISRUPTED

#define IS_DISRUPTED (   flags)    ((flags) & (STREAM_DEPTH|STREAM_GAP))

Definition at line 1015 of file app-layer-parser.c.

◆ THREE_SET

#define THREE_SET (   a,
  b,
 
)    ((a) != NULL && (b) != NULL && (c) != NULL)

Definition at line 1494 of file app-layer-parser.c.

◆ THREE_SET_OR_THREE_UNSET

#define THREE_SET_OR_THREE_UNSET (   a,
  b,
 
)    (((a) == NULL && (b) == NULL && (c) == NULL) || ((a) != NULL && (b) != NULL && (c) != NULL))

Definition at line 1493 of file app-layer-parser.c.

Typedef Documentation

◆ AppLayerParserCtx

◆ AppLayerParserProtoCtx

App layer protocol parser context.

◆ TestState

typedef struct TestState_ TestState

Function Documentation

◆ AppLayerGetTxIterator()

AppLayerGetTxIteratorFunc AppLayerGetTxIterator ( const uint8_t  ipproto,
const AppProto  alproto 
)

Definition at line 688 of file app-layer-parser.c.

Referenced by AppLayerParserSetTransactionInspectId().

Here is the caller graph for this function:

◆ AppLayerParserBackupParserTable()

void AppLayerParserBackupParserTable ( void  )

Definition at line 1726 of file app-layer-parser.c.

References SCEnter.

◆ AppLayerParserConfParserEnabled()

int AppLayerParserConfParserEnabled ( const char *  ipproto,
const char *  alproto_name 
)

check if a parser is enabled in the config Returns enabled always if: were running unittests

Given a protocol name, checks if the parser is enabled in the conf file.

Definition at line 302 of file app-layer-parser.c.

References ConfGetNode(), ConfValIsFalse(), ConfValIsTrue(), RunmodeIsUnittests(), SC_ERR_FATAL, SCEnter, SCLogDebug, SCLogError, SCReturnInt, and ConfNode_::val.

Referenced by HTPFreeConfig().

Here is the call graph for this function:
Here is the caller graph for this function:

◆ AppLayerParserDeSetup()

int AppLayerParserDeSetup ( void  )

Definition at line 243 of file app-layer-parser.c.

References FTPParserCleanup(), SCEnter, SCReturnInt, and SMTPParserCleanup().

Referenced by AppLayerDeSetup().

Here is the call graph for this function:
Here is the caller graph for this function:

◆ AppLayerParserDestroyProtocolParserLocalStorage()

void AppLayerParserDestroyProtocolParserLocalStorage ( uint8_t  ipproto,
AppProto  alproto,
void *  local_data 
)

Definition at line 638 of file app-layer-parser.c.

References SCEnter.

Referenced by AppLayerParserThreadCtxFree().

Here is the caller graph for this function:

◆ AppLayerParserGetDecoderEvents()

AppLayerDecoderEvents* AppLayerParserGetDecoderEvents ( AppLayerParserState pstate)

Definition at line 844 of file app-layer-parser.c.

References AppLayerParserState_::decoder_events, SCEnter, and SCReturnPtr.

Referenced by AppLayerDecoderEventsSetEvent(), and AppLayerParserHasDecoderEvents().

Here is the caller graph for this function:

◆ AppLayerParserGetEventInfo()

int AppLayerParserGetEventInfo ( uint8_t  ipproto,
AppProto  alproto,
const char *  event_name,
int *  event_id,
AppLayerEventType event_type 
)

Definition at line 1065 of file app-layer-parser.c.

References FlowGetProtoMapping(), and SCEnter.

Here is the call graph for this function:

◆ AppLayerParserGetEventInfoById()

int AppLayerParserGetEventInfoById ( uint8_t  ipproto,
AppProto  alproto,
int  event_id,
const char **  event_name,
AppLayerEventType event_type 
)

Definition at line 1075 of file app-layer-parser.c.

References FlowGetProtoMapping(), and SCEnter.

Here is the call graph for this function:

◆ AppLayerParserGetEventsByTx()

AppLayerDecoderEvents* AppLayerParserGetEventsByTx ( uint8_t  ipproto,
AppProto  alproto,
void *  tx 
)

Definition at line 857 of file app-layer-parser.c.

References SCEnter.

◆ AppLayerParserGetFiles()

FileContainer* AppLayerParserGetFiles ( const Flow f,
const uint8_t  direction 
)

Definition at line 874 of file app-layer-parser.c.

References SCEnter.

Referenced by DetectFileInspectGeneric(), and FileDisableStoringForTransaction().

Here is the caller graph for this function:

◆ AppLayerParserGetFirstDataDir()

uint8_t AppLayerParserGetFirstDataDir ( uint8_t  ipproto,
AppProto  alproto 
)

Definition at line 1086 of file app-layer-parser.c.

References SCEnter.

◆ AppLayerParserGetProtocolParserLocalStorage()

void* AppLayerParserGetProtocolParserLocalStorage ( uint8_t  ipproto,
AppProto  alproto 
)

Definition at line 623 of file app-layer-parser.c.

References SCEnter.

Referenced by AppLayerParserThreadCtxAlloc().

Here is the caller graph for this function:

◆ AppLayerParserGetStateProgress()

int AppLayerParserGetStateProgress ( uint8_t  ipproto,
AppProto  alproto,
void *  alstate,
uint8_t  flags 
)

get the progress value for a tx/protocol

If the stream is disrupted, we return the 'completion' value.

Definition at line 1023 of file app-layer-parser.c.

References flags, IS_DISRUPTED, SCEnter, and unlikely.

Referenced by AppLayerParserSetTransactionInspectId(), and DetectEngineInspectBufferGeneric().

Here is the caller graph for this function:

◆ AppLayerParserGetStateProgressCompletionStatus()

int AppLayerParserGetStateProgressCompletionStatus ( AppProto  alproto,
uint8_t  direction 
)

Definition at line 1056 of file app-layer-parser.c.

References SCEnter.

Referenced by AppLayerParserSetTransactionInspectId(), and OutputRegisterTxLogger().

Here is the caller graph for this function:

◆ AppLayerParserGetStreamDepth()

uint32_t AppLayerParserGetStreamDepth ( const Flow f)

Definition at line 1430 of file app-layer-parser.c.

References SCReturnInt.

◆ AppLayerParserGetTransactionActive()

uint64_t AppLayerParserGetTransactionActive ( const Flow f,
AppLayerParserState pstate,
uint8_t  direction 
)

Definition at line 1095 of file app-layer-parser.c.

References AppLayerParserState_::inspect_id, AppLayerParserState_::log_id, SCEnter, and STREAM_TOSERVER.

Referenced by FlowForceReassemblyNeedReassembly().

Here is the caller graph for this function:

◆ AppLayerParserGetTransactionInspectId()

uint64_t AppLayerParserGetTransactionInspectId ( AppLayerParserState pstate,
uint8_t  direction 
)

Definition at line 741 of file app-layer-parser.c.

References AppLayerParserState_::inspect_id, SCEnter, SCReturnCT, and STREAM_TOSERVER.

Referenced by AppLayerParserSetTransactionInspectId().

Here is the caller graph for this function:

◆ AppLayerParserGetTransactionLogId()

uint64_t AppLayerParserGetTransactionLogId ( AppLayerParserState pstate)

Definition at line 724 of file app-layer-parser.c.

References AppLayerParserState_::log_id, SCEnter, and SCReturnCT.

◆ AppLayerParserGetTx()

void* AppLayerParserGetTx ( uint8_t  ipproto,
AppProto  alproto,
void *  alstate,
uint64_t  tx_id 
)

◆ AppLayerParserGetTxCnt()

uint64_t AppLayerParserGetTxCnt ( const Flow f,
void *  alstate 
)

Definition at line 1038 of file app-layer-parser.c.

References SCEnter.

Referenced by AppLayerParserSetTransactionInspectId(), FlowForceReassemblyNeedReassembly(), HttpXFFGetIP(), and HttpXFFGetIPFromTx().

Here is the caller graph for this function:

◆ AppLayerParserGetTxDetectFlags()

uint64_t AppLayerParserGetTxDetectFlags ( uint8_t  ipproto,
AppProto  alproto,
void *  tx,
uint8_t  dir 
)

Definition at line 1157 of file app-layer-parser.c.

References flags, and SCEnter.

Referenced by AppLayerParserSetTransactionInspectId().

Here is the caller graph for this function:

◆ AppLayerParserGetTxDetectState()

DetectEngineState* AppLayerParserGetTxDetectState ( uint8_t  ipproto,
AppProto  alproto,
void *  tx 
)

Definition at line 1127 of file app-layer-parser.c.

References SCEnter.

Referenced by DetectRunStoreStateTx().

Here is the caller graph for this function:

◆ AppLayerParserGetTxLogged()

LoggerId AppLayerParserGetTxLogged ( const Flow f,
void *  alstate,
void *  tx 
)

Definition at line 710 of file app-layer-parser.c.

References SCEnter.

◆ AppLayerParserHasDecoderEvents()

bool AppLayerParserHasDecoderEvents ( AppLayerParserState pstate)

Definition at line 1360 of file app-layer-parser.c.

References AppLayerParserGetDecoderEvents(), AppLayerDecoderEvents_::cnt, AppLayerParserState_::decoder_events, and SCEnter.

Here is the call graph for this function:

◆ AppLayerParserIsEnabled()

int AppLayerParserIsEnabled ( AppProto  alproto)

simple way to globally test if a alproto is registered and fully enabled in the configuration.

Definition at line 1378 of file app-layer-parser.c.

Referenced by DetectAppLayerInspectEngineRegister(), and OutputRegisterTxLogger().

Here is the caller graph for this function:

◆ AppLayerParserParse()

int AppLayerParserParse ( ThreadVars tv,
AppLayerParserThreadCtx alp_tctx,
Flow f,
AppProto  alproto,
uint8_t  flags,
const uint8_t *  input,
uint32_t  input_len 
)
Return values
int-1 in case of unrecoverable error. App-layer tracking stops for this flow.
int0 ok: we did not update app_progress
int1 ok: we updated app_progress

Definition at line 1181 of file app-layer-parser.c.

References BUG_ON, FlowGetProtoMapping(), Flow_::proto, Flow_::protomap, and SCEnter.

Referenced by AppLayerHandleTCPData(), and LLVMFuzzerTestOneInput().

Here is the call graph for this function:
Here is the caller graph for this function:

◆ AppLayerParserPostStreamSetup()

void AppLayerParserPostStreamSetup ( void  )

Definition at line 226 of file app-layer-parser.c.

References ALPROTO_MAX, and FLOW_PROTO_DEFAULT.

Referenced by PreRunInit().

Here is the caller graph for this function:

◆ AppLayerParserProtocolGetLoggerBits()

LoggerId AppLayerParserProtocolGetLoggerBits ( uint8_t  ipproto,
AppProto  alproto 
)

Definition at line 1400 of file app-layer-parser.c.

References FlowGetProtoMapping(), and SCEnter.

Here is the call graph for this function:

◆ AppLayerParserProtocolHasLogger()

int AppLayerParserProtocolHasLogger ( uint8_t  ipproto,
AppProto  alproto 
)

Definition at line 1392 of file app-layer-parser.c.

References FlowGetProtoMapping(), and SCEnter.

Here is the call graph for this function:

◆ AppLayerParserProtocolIsTxEventAware()

int AppLayerParserProtocolIsTxEventAware ( uint8_t  ipproto,
AppProto  alproto 
)

Definition at line 1384 of file app-layer-parser.c.

References FlowGetProtoMapping(), and SCEnter.

Here is the call graph for this function:

◆ AppLayerParserProtoIsRegistered()

int AppLayerParserProtoIsRegistered ( uint8_t  ipproto,
AppProto  alproto 
)

Definition at line 188 of file app-layer-parser.c.

References FlowGetProtoMapping().

Referenced by AppLayerSetupCounters().

Here is the call graph for this function:
Here is the caller graph for this function:

◆ AppLayerParserRegisterDetectFlagsFuncs()

void AppLayerParserRegisterDetectFlagsFuncs ( uint8_t  ipproto,
AppProto  alproto,
uint64_t(*)(void *tx, uint8_t dir)  GetTxDetectFlags,
void(*)(void *tx, uint8_t dir, uint64_t)  SetTxDetectFlags 
)

Definition at line 589 of file app-layer-parser.c.

References SCEnter.

◆ AppLayerParserRegisterDetectStateFuncs()

void AppLayerParserRegisterDetectStateFuncs ( uint8_t  ipproto,
AppProto  alproto,
DetectEngineState *(*)(void *tx)  GetTxDetectState,
int(*)(void *tx, DetectEngineState *)  SetTxDetectState 
)

Definition at line 577 of file app-layer-parser.c.

References SCEnter.

◆ AppLayerParserRegisterGetEventInfo()

void AppLayerParserRegisterGetEventInfo ( uint8_t  ipproto,
AppProto  alproto,
int(*)(const char *event_name, int *event_id, AppLayerEventType *event_type)  StateGetEventInfo 
)

Definition at line 565 of file app-layer-parser.c.

References SCEnter.

◆ AppLayerParserRegisterGetEventInfoById()

void AppLayerParserRegisterGetEventInfoById ( uint8_t  ipproto,
AppProto  alproto,
int(*)(int event_id, const char **event_name, AppLayerEventType *event_type)  StateGetEventInfoById 
)

Definition at line 553 of file app-layer-parser.c.

References SCEnter.

◆ AppLayerParserRegisterGetEventsFunc()

void AppLayerParserRegisterGetEventsFunc ( uint8_t  ipproto,
AppProto  alproto,
AppLayerDecoderEvents *(*)(void *)  StateGetEvents 
)

Definition at line 436 of file app-layer-parser.c.

References SCEnter.

◆ AppLayerParserRegisterGetFilesFunc()

void AppLayerParserRegisterGetFilesFunc ( uint8_t  ipproto,
AppProto  alproto,
FileContainer *(*)(void *, uint8_t)  StateGetFiles 
)

Definition at line 425 of file app-layer-parser.c.

References SCEnter.

◆ AppLayerParserRegisterGetStateProgressCompletionStatus()

void AppLayerParserRegisterGetStateProgressCompletionStatus ( AppProto  alproto,
int(*)(uint8_t direction)  StateGetProgressCompletionStatus 
)

Definition at line 542 of file app-layer-parser.c.

References SCEnter.

◆ AppLayerParserRegisterGetStateProgressFunc()

void AppLayerParserRegisterGetStateProgressFunc ( uint8_t  ipproto,
AppProto  alproto,
int(*)(void *alstate, uint8_t direction)  StateGetProgress 
)

Definition at line 490 of file app-layer-parser.c.

References SCEnter.

◆ AppLayerParserRegisterGetTx()

void AppLayerParserRegisterGetTx ( uint8_t  ipproto,
AppProto  alproto,
void *  StateGetTx)(void *alstate, uint64_t tx_id 
)

Definition at line 523 of file app-layer-parser.c.

References SCEnter.

◆ AppLayerParserRegisterGetTxCnt()

void AppLayerParserRegisterGetTxCnt ( uint8_t  ipproto,
AppProto  alproto,
uint64_t(*)(void *alstate)  StateGetTxCnt 
)

Definition at line 512 of file app-layer-parser.c.

References SCEnter.

◆ AppLayerParserRegisterGetTxIterator()

void AppLayerParserRegisterGetTxIterator ( uint8_t  ipproto,
AppProto  alproto,
AppLayerGetTxIteratorFunc  Func 
)

Definition at line 534 of file app-layer-parser.c.

References SCEnter.

◆ AppLayerParserRegisterLocalStorageFunc()

void AppLayerParserRegisterLocalStorageFunc ( uint8_t  ipproto,
AppProto  alproto,
void *(*)(void)  LocalStorageAlloc,
void(*)(void *)  LocalStorageFree 
)

Definition at line 411 of file app-layer-parser.c.

References SCEnter.

◆ AppLayerParserRegisterLogger()

void AppLayerParserRegisterLogger ( uint8_t  ipproto,
AppProto  alproto 
)

Definition at line 471 of file app-layer-parser.c.

References SCEnter.

◆ AppLayerParserRegisterLoggerBits()

void AppLayerParserRegisterLoggerBits ( uint8_t  ipproto,
AppProto  alproto,
LoggerId  bits 
)

Definition at line 462 of file app-layer-parser.c.

References SCEnter.

◆ AppLayerParserRegisterLoggerFuncs()

void AppLayerParserRegisterLoggerFuncs ( uint8_t  ipproto,
AppProto  alproto,
LoggerId(*)(void *, void *)  StateGetTxLogged,
void(*)(void *, void *, LoggerId StateSetTxLogged 
)

Definition at line 447 of file app-layer-parser.c.

References SCEnter.

◆ AppLayerParserRegisterMpmIDsFuncs()

void AppLayerParserRegisterMpmIDsFuncs ( uint8_t  ipproto,
AppProto  alproto,
uint64_t(*)(void *tx)  GetTxMpmIDs,
int(*)(void *tx, uint64_t)  SetTxMpmIDs 
)

Definition at line 601 of file app-layer-parser.c.

References AppProtoToString(), SC_WARN_DEPRECATED, SCEnter, SCLogWarning, and SCReturn.

Here is the call graph for this function:

◆ AppLayerParserRegisterOptionFlags()

void AppLayerParserRegisterOptionFlags ( uint8_t  ipproto,
AppProto  alproto,
uint32_t  flags 
)

Definition at line 387 of file app-layer-parser.c.

References SCEnter.

◆ AppLayerParserRegisterParser()

int AppLayerParserRegisterParser ( uint8_t  ipproto,
AppProto  alproto,
uint8_t  direction,
AppLayerParserFPtr  Parser 
)

Register app layer parser for the protocol.

Return values
0On success.
-1On failure.

Definition at line 364 of file app-layer-parser.c.

References SCEnter.

◆ AppLayerParserRegisterParserAcceptableDataDirection()

void AppLayerParserRegisterParserAcceptableDataDirection ( uint8_t  ipproto,
AppProto  alproto,
uint8_t  direction 
)

Definition at line 376 of file app-layer-parser.c.

References SCEnter.

◆ AppLayerParserRegisterProtocolParsers()

◆ AppLayerParserRegisterProtocolUnittests()

void AppLayerParserRegisterProtocolUnittests ( uint8_t  ipproto,
AppProto  alproto,
void(*)(void)  RegisterUnittests 
)

Definition at line 1717 of file app-layer-parser.c.

Referenced by RegisterKRB5Parsers(), RegisterNTPParsers(), RegisterSIPParsers(), and RegisterTemplateRustParsers().

Here is the caller graph for this function:

◆ AppLayerParserRegisterSetStreamDepthFlag()

void AppLayerParserRegisterSetStreamDepthFlag ( uint8_t  ipproto,
AppProto  alproto,
void(*)(void *tx, uint8_t flags SetStreamDepthFlag 
)

Definition at line 611 of file app-layer-parser.c.

References SCEnter.

◆ AppLayerParserRegisterStateFuncs()

void AppLayerParserRegisterStateFuncs ( uint8_t  ipproto,
AppProto  alproto,
void *(*)(void)  StateAlloc,
void(*)(void *)  StateFree 
)

Definition at line 397 of file app-layer-parser.c.

References SCEnter.

◆ AppLayerParserRegisterTruncateFunc()

void AppLayerParserRegisterTruncateFunc ( uint8_t  ipproto,
AppProto  alproto,
void(*)(void *, uint8_t)  Truncate 
)

Definition at line 480 of file app-layer-parser.c.

References SCEnter.

◆ AppLayerParserRegisterTxFreeFunc()

void AppLayerParserRegisterTxFreeFunc ( uint8_t  ipproto,
AppProto  alproto,
void(*)(void *, uint64_t)  StateTransactionFree 
)

Definition at line 501 of file app-layer-parser.c.

References SCEnter.

◆ AppLayerParserRegisterUnittests()

void AppLayerParserRegisterUnittests ( void  )

Definition at line 1854 of file app-layer-parser.c.

References ALPROTO_MAX, FLOW_PROTO_DEFAULT, and SCEnter.

◆ AppLayerParserRestoreParserTable()

void AppLayerParserRestoreParserTable ( void  )

Definition at line 1734 of file app-layer-parser.c.

References SCEnter.

◆ AppLayerParserSetDecoderEvents()

void AppLayerParserSetDecoderEvents ( AppLayerParserState pstate,
AppLayerDecoderEvents devents 
)

Definition at line 852 of file app-layer-parser.c.

References AppLayerParserState_::decoder_events.

Referenced by AppLayerDecoderEventsSetEvent().

Here is the caller graph for this function:

◆ AppLayerParserSetEOF()

void AppLayerParserSetEOF ( AppLayerParserState pstate)

Definition at line 1345 of file app-layer-parser.c.

References APP_LAYER_PARSER_EOF, AppLayerParserStateSetFlag(), SCEnter, and SCReturn.

Here is the call graph for this function:

◆ AppLayerParserSetStreamDepth()

void AppLayerParserSetStreamDepth ( uint8_t  ipproto,
AppProto  alproto,
uint32_t  stream_depth 
)

Definition at line 1419 of file app-layer-parser.c.

◆ AppLayerParserSetStreamDepthFlag()

void AppLayerParserSetStreamDepthFlag ( uint8_t  ipproto,
AppProto  alproto,
void *  state,
uint64_t  tx_id,
uint8_t  flags 
)

Definition at line 1435 of file app-layer-parser.c.

References AppLayerParserGetTx(), and SCEnter.

Here is the call graph for this function:

◆ AppLayerParserSetTransactionInspectId()

void AppLayerParserSetTransactionInspectId ( const Flow f,
AppLayerParserState pstate,
void *  alstate,
const uint8_t  flags,
bool  tag_txs_as_inspected 
)

◆ AppLayerParserSetTransactionLogId()

void AppLayerParserSetTransactionLogId ( AppLayerParserState pstate,
uint64_t  tx_id 
)

Definition at line 731 of file app-layer-parser.c.

References AppLayerParserState_::log_id, SCEnter, and SCReturn.

◆ AppLayerParserSetTxDetectFlags()

void AppLayerParserSetTxDetectFlags ( uint8_t  ipproto,
AppProto  alproto,
void *  tx,
uint8_t  dir,
uint64_t  flags 
)

Definition at line 1167 of file app-layer-parser.c.

References SCEnter.

Referenced by AppLayerParserSetTransactionInspectId().

Here is the caller graph for this function:

◆ AppLayerParserSetTxDetectState()

int AppLayerParserSetTxDetectState ( const Flow f,
void *  tx,
DetectEngineState s 
)

Definition at line 1135 of file app-layer-parser.c.

References SCEnter.

Referenced by DetectRunStoreStateTx().

Here is the caller graph for this function:

◆ AppLayerParserSetTxLogged()

void AppLayerParserSetTxLogged ( uint8_t  ipproto,
AppProto  alproto,
void *  alstate,
void *  tx,
LoggerId  logger 
)

Definition at line 696 of file app-layer-parser.c.

References SCEnter.

◆ AppLayerParserSetup()

int AppLayerParserSetup ( void  )

Definition at line 219 of file app-layer-parser.c.

References SCEnter.

Referenced by AppLayerSetup(), and LLVMFuzzerTestOneInput().

Here is the caller graph for this function:

◆ AppLayerParserStateAlloc()

AppLayerParserState* AppLayerParserStateAlloc ( void  )

Definition at line 195 of file app-layer-parser.c.

References SCEnter, SCMalloc, and SCReturnPtr.

◆ AppLayerParserStateCleanup()

void AppLayerParserStateCleanup ( const Flow f,
void *  alstate,
AppLayerParserState pstate 
)

Definition at line 1451 of file app-layer-parser.c.

References SCEnter.

Referenced by AppLayerProtoDetectReset(), and FlowCleanupAppLayer().

Here is the caller graph for this function:

◆ AppLayerParserStateFree()

void AppLayerParserStateFree ( AppLayerParserState pstate)

Definition at line 208 of file app-layer-parser.c.

References AppLayerDecoderEventsFreeEvents(), AppLayerParserState_::decoder_events, SCEnter, SCFree, and SCReturn.

Here is the call graph for this function:

◆ AppLayerParserStateIssetFlag()

int AppLayerParserStateIssetFlag ( AppLayerParserState pstate,
uint8_t  flag 
)

Definition at line 1619 of file app-layer-parser.c.

References AppLayerParserState_::flags, SCEnter, and SCReturnInt.

◆ AppLayerParserStateSetFlag()

void AppLayerParserStateSetFlag ( AppLayerParserState pstate,
uint8_t  flag 
)

Definition at line 1611 of file app-layer-parser.c.

References AppLayerParserState_::flags, SCEnter, and SCReturn.

Referenced by AppLayerParserSetEOF().

Here is the caller graph for this function:

◆ AppLayerParserStreamTruncated()

void AppLayerParserStreamTruncated ( uint8_t  ipproto,
AppProto  alproto,
void *  alstate,
uint8_t  direction 
)

Definition at line 1626 of file app-layer-parser.c.

References SCEnter.

◆ AppLayerParserSupportsFiles()

int AppLayerParserSupportsFiles ( uint8_t  ipproto,
AppProto  alproto 
)

Definition at line 1113 of file app-layer-parser.c.

◆ AppLayerParserSupportsTxDetectFlags()

bool AppLayerParserSupportsTxDetectFlags ( AppProto  alproto)

Definition at line 1146 of file app-layer-parser.c.

References FLOW_PROTO_APPLAYER_MAX, and SCEnter.

Referenced by DetectAppLayerInspectEngineRegister().

Here is the caller graph for this function:

◆ AppLayerParserSupportsTxDetectState()

int AppLayerParserSupportsTxDetectState ( uint8_t  ipproto,
AppProto  alproto 
)

Definition at line 1120 of file app-layer-parser.c.

◆ AppLayerParserThreadCtxAlloc()

AppLayerParserThreadCtx* AppLayerParserThreadCtxAlloc ( void  )

Gets a new app layer protocol's parser thread context.

Return values
Non-NULLpointer on success. NULL pointer on failure.

Definition at line 253 of file app-layer-parser.c.

References AppLayerParserThreadCtx_::alproto_local_storage, ALPROTO_MAX, AppLayerParserGetProtocolParserLocalStorage(), FLOW_PROTO_DEFAULT, FlowGetReverseProtoMapping(), SCEnter, SCMalloc, and SCReturnPtr.

Referenced by AppLayerGetCtxThread(), and LLVMFuzzerTestOneInput().

Here is the call graph for this function:
Here is the caller graph for this function:

◆ AppLayerParserThreadCtxFree()

void AppLayerParserThreadCtxFree ( AppLayerParserThreadCtx tctx)

Destroys the app layer parser thread context obtained using AppLayerParserThreadCtxAlloc().

Parameters
tctxPointer to the thread context to be destroyed.

Definition at line 279 of file app-layer-parser.c.

References AppLayerParserThreadCtx_::alproto_local_storage, ALPROTO_MAX, AppLayerParserDestroyProtocolParserLocalStorage(), FLOW_PROTO_DEFAULT, FlowGetReverseProtoMapping(), SCEnter, SCFree, and SCReturn.

Referenced by AppLayerDestroyCtxThread().

Here is the call graph for this function:
Here is the caller graph for this function:

◆ AppLayerParserTransactionsCleanup()

void AppLayerParserTransactionsCleanup ( Flow f)

remove obsolete (inspected and logged) transactions

Definition at line 892 of file app-layer-parser.c.

References DEBUG_ASSERT_FLOW_LOCKED, and SCEnter.

◆ AppLayerParserTriggerRawStreamReassembly()

void AppLayerParserTriggerRawStreamReassembly ( Flow f,
int  direction 
)

Definition at line 1408 of file app-layer-parser.c.

References Flow_::protoctx, SCEnter, SCLogDebug, SCReturn, and StreamTcpReassembleTriggerRawReassembly().

Here is the call graph for this function:

◆ UTHAppLayerParserStateGetIds()

void UTHAppLayerParserStateGetIds ( void *  ptr,
uint64_t *  i1,
uint64_t *  i2,
uint64_t *  log,
uint64_t *  min 
)