suricata
app-layer-parser.c File Reference
#include "suricata-common.h"
#include "debug.h"
#include "util-unittest.h"
#include "decode.h"
#include "threads.h"
#include "util-print.h"
#include "util-pool.h"
#include "flow-util.h"
#include "flow-private.h"
#include "detect-engine-state.h"
#include "detect-engine-port.h"
#include "stream-tcp.h"
#include "stream-tcp-private.h"
#include "stream.h"
#include "stream-tcp-reassemble.h"
#include "app-layer.h"
#include "app-layer-protos.h"
#include "app-layer-parser.h"
#include "app-layer-dcerpc.h"
#include "app-layer-dcerpc-udp.h"
#include "app-layer-smb.h"
#include "app-layer-htp.h"
#include "app-layer-ftp.h"
#include "app-layer-ssl.h"
#include "app-layer-ssh.h"
#include "app-layer-smtp.h"
#include "app-layer-modbus.h"
#include "app-layer-enip.h"
#include "app-layer-dnp3.h"
#include "app-layer-nfs-tcp.h"
#include "app-layer-nfs-udp.h"
#include "app-layer-ntp.h"
#include "app-layer-tftp.h"
#include "app-layer-ikev2.h"
#include "app-layer-krb5.h"
#include "app-layer-snmp.h"
#include "app-layer-sip.h"
#include "app-layer-rfb.h"
#include "app-layer-mqtt.h"
#include "app-layer-template.h"
#include "app-layer-template-rust.h"
#include "app-layer-rdp.h"
#include "app-layer-http2.h"
#include "conf.h"
#include "util-spm.h"
#include "util-debug.h"
#include "decode-events.h"
#include "util-unittest-helper.h"
#include "util-validate.h"
#include "runmodes.h"
#include "rust.h"

Go to the source code of this file.

Data Structures

struct  AppLayerParserThreadCtx_
 
struct  AppLayerParserProtoCtx_
 App layer protocol parser context. More...
 
struct  AppLayerParserCtx_
 
struct  AppLayerParserState_
 
struct  TestState_
 

Macros

#define IS_DISRUPTED(flags)   ((flags) & (STREAM_DEPTH|STREAM_GAP))
 
#define BOTH_SET(a, b)   ((a) != NULL && (b) != NULL)
 
#define BOTH_SET_OR_BOTH_UNSET(a, b)   (((a) == NULL && (b) == NULL) || ((a) != NULL && (b) != NULL))
 
#define THREE_SET_OR_THREE_UNSET(a, b, c)   (((a) == NULL && (b) == NULL && (c) == NULL) || ((a) != NULL && (b) != NULL && (c) != NULL))
 
#define THREE_SET(a, b, c)   ((a) != NULL && (b) != NULL && (c) != NULL)
 

Typedefs

typedef struct AppLayerParserProtoCtx_ AppLayerParserProtoCtx
 App layer protocol parser context. More...
 
typedef struct AppLayerParserCtx_ AppLayerParserCtx
 
typedef struct TestState_ TestState
 

Functions

void UTHAppLayerParserStateGetIds (void *ptr, uint64_t *i1, uint64_t *i2, uint64_t *log, uint64_t *min)
 
int AppLayerParserProtoIsRegistered (uint8_t ipproto, AppProto alproto)
 
AppLayerParserStateAppLayerParserStateAlloc (void)
 
void AppLayerParserStateFree (AppLayerParserState *pstate)
 
int AppLayerParserSetup (void)
 
void AppLayerParserPostStreamSetup (void)
 
int AppLayerParserDeSetup (void)
 
AppLayerParserThreadCtxAppLayerParserThreadCtxAlloc (void)
 Gets a new app layer protocol's parser thread context. More...
 
void AppLayerParserThreadCtxFree (AppLayerParserThreadCtx *tctx)
 Destroys the app layer parser thread context obtained using AppLayerParserThreadCtxAlloc(). More...
 
int AppLayerParserConfParserEnabled (const char *ipproto, const char *alproto_name)
 check if a parser is enabled in the config Returns enabled always if: were running unittests More...
 
int AppLayerParserRegisterParser (uint8_t ipproto, AppProto alproto, uint8_t direction, AppLayerParserFPtr Parser)
 Register app layer parser for the protocol. More...
 
void AppLayerParserRegisterParserAcceptableDataDirection (uint8_t ipproto, AppProto alproto, uint8_t direction)
 
void AppLayerParserRegisterOptionFlags (uint8_t ipproto, AppProto alproto, uint32_t flags)
 
uint32_t AppLayerParserGetOptionFlags (uint8_t protomap, AppProto alproto)
 
void AppLayerParserRegisterStateFuncs (uint8_t ipproto, AppProto alproto, void *(*StateAlloc)(void *, AppProto), void(*StateFree)(void *))
 
void AppLayerParserRegisterLocalStorageFunc (uint8_t ipproto, AppProto alproto, void *(*LocalStorageAlloc)(void), void(*LocalStorageFree)(void *))
 
void AppLayerParserRegisterGetFilesFunc (uint8_t ipproto, AppProto alproto, FileContainer *(*StateGetFiles)(void *, uint8_t))
 
void AppLayerParserRegisterGetEventsFunc (uint8_t ipproto, AppProto alproto, AppLayerDecoderEvents *(*StateGetEvents)(void *))
 
void AppLayerParserRegisterLoggerBits (uint8_t ipproto, AppProto alproto, LoggerId bits)
 
void AppLayerParserRegisterLogger (uint8_t ipproto, AppProto alproto)
 
void AppLayerParserRegisterTruncateFunc (uint8_t ipproto, AppProto alproto, void(*Truncate)(void *, uint8_t))
 
void AppLayerParserRegisterGetStateProgressFunc (uint8_t ipproto, AppProto alproto, int(*StateGetProgress)(void *alstate, uint8_t direction))
 
void AppLayerParserRegisterTxFreeFunc (uint8_t ipproto, AppProto alproto, void(*StateTransactionFree)(void *, uint64_t))
 
void AppLayerParserRegisterGetTxCnt (uint8_t ipproto, AppProto alproto, uint64_t(*StateGetTxCnt)(void *alstate))
 
void AppLayerParserRegisterGetTx (uint8_t ipproto, AppProto alproto, void *(StateGetTx)(void *alstate, uint64_t tx_id))
 
void AppLayerParserRegisterGetTxIterator (uint8_t ipproto, AppProto alproto, AppLayerGetTxIteratorFunc Func)
 
void AppLayerParserRegisterGetStateProgressCompletionStatus (AppProto alproto, int(*StateGetProgressCompletionStatus)(uint8_t direction))
 
void AppLayerParserRegisterGetEventInfoById (uint8_t ipproto, AppProto alproto, int(*StateGetEventInfoById)(int event_id, const char **event_name, AppLayerEventType *event_type))
 
void AppLayerParserRegisterGetEventInfo (uint8_t ipproto, AppProto alproto, int(*StateGetEventInfo)(const char *event_name, int *event_id, AppLayerEventType *event_type))
 
void AppLayerParserRegisterDetectStateFuncs (uint8_t ipproto, AppProto alproto, DetectEngineState *(*GetTxDetectState)(void *tx), int(*SetTxDetectState)(void *tx, DetectEngineState *))
 
void AppLayerParserRegisterTxDataFunc (uint8_t ipproto, AppProto alproto, AppLayerTxData *(*GetTxData)(void *tx))
 
void AppLayerParserRegisterApplyTxConfigFunc (uint8_t ipproto, AppProto alproto, bool(*ApplyTxConfig)(void *state, void *tx, int mode, AppLayerTxConfig))
 
void AppLayerParserRegisterSetStreamDepthFlag (uint8_t ipproto, AppProto alproto, void(*SetStreamDepthFlag)(void *tx, uint8_t flags))
 
void * AppLayerParserGetProtocolParserLocalStorage (uint8_t ipproto, AppProto alproto)
 
void AppLayerParserDestroyProtocolParserLocalStorage (uint8_t ipproto, AppProto alproto, void *local_data)
 
AppLayerGetTxIteratorFunc AppLayerGetTxIterator (const uint8_t ipproto, const AppProto alproto)
 
uint64_t AppLayerParserGetTransactionLogId (AppLayerParserState *pstate)
 
void AppLayerParserSetTransactionLogId (AppLayerParserState *pstate, uint64_t tx_id)
 
uint64_t AppLayerParserGetTransactionInspectId (AppLayerParserState *pstate, uint8_t direction)
 
void AppLayerParserSetTransactionInspectId (const Flow *f, AppLayerParserState *pstate, void *alstate, const uint8_t flags, bool tag_txs_as_inspected)
 
AppLayerDecoderEventsAppLayerParserGetDecoderEvents (AppLayerParserState *pstate)
 
void AppLayerParserSetDecoderEvents (AppLayerParserState *pstate, AppLayerDecoderEvents *devents)
 
AppLayerDecoderEventsAppLayerParserGetEventsByTx (uint8_t ipproto, AppProto alproto, void *tx)
 
FileContainerAppLayerParserGetFiles (const Flow *f, const uint8_t direction)
 
void AppLayerParserTransactionsCleanup (Flow *f)
 remove obsolete (inspected and logged) transactions More...
 
int AppLayerParserGetStateProgress (uint8_t ipproto, AppProto alproto, void *alstate, uint8_t flags)
 get the progress value for a tx/protocol More...
 
uint64_t AppLayerParserGetTxCnt (const Flow *f, void *alstate)
 
void * AppLayerParserGetTx (uint8_t ipproto, AppProto alproto, void *alstate, uint64_t tx_id)
 
int AppLayerParserGetStateProgressCompletionStatus (AppProto alproto, uint8_t direction)
 
int AppLayerParserGetEventInfo (uint8_t ipproto, AppProto alproto, const char *event_name, int *event_id, AppLayerEventType *event_type)
 
int AppLayerParserGetEventInfoById (uint8_t ipproto, AppProto alproto, int event_id, const char **event_name, AppLayerEventType *event_type)
 
uint8_t AppLayerParserGetFirstDataDir (uint8_t ipproto, AppProto alproto)
 
uint64_t AppLayerParserGetTransactionActive (const Flow *f, AppLayerParserState *pstate, uint8_t direction)
 
int AppLayerParserSupportsFiles (uint8_t ipproto, AppProto alproto)
 
int AppLayerParserSupportsTxDetectState (uint8_t ipproto, AppProto alproto)
 
DetectEngineStateAppLayerParserGetTxDetectState (uint8_t ipproto, AppProto alproto, void *tx)
 
int AppLayerParserSetTxDetectState (const Flow *f, void *tx, DetectEngineState *s)
 
bool AppLayerParserSupportsTxDetectFlags (AppProto alproto)
 
AppLayerTxData * AppLayerParserGetTxData (uint8_t ipproto, AppProto alproto, void *tx)
 
void AppLayerParserApplyTxConfig (uint8_t ipproto, AppProto alproto, void *state, void *tx, enum ConfigAction mode, AppLayerTxConfig config)
 
int AppLayerParserParse (ThreadVars *tv, AppLayerParserThreadCtx *alp_tctx, Flow *f, AppProto alproto, uint8_t flags, const uint8_t *input, uint32_t input_len)
 
void AppLayerParserSetEOF (AppLayerParserState *pstate)
 
bool AppLayerParserHasDecoderEvents (AppLayerParserState *pstate)
 
int AppLayerParserIsEnabled (AppProto alproto)
 simple way to globally test if a alproto is registered and fully enabled in the configuration. More...
 
int AppLayerParserProtocolIsTxEventAware (uint8_t ipproto, AppProto alproto)
 
int AppLayerParserProtocolHasLogger (uint8_t ipproto, AppProto alproto)
 
LoggerId AppLayerParserProtocolGetLoggerBits (uint8_t ipproto, AppProto alproto)
 
void AppLayerParserTriggerRawStreamReassembly (Flow *f, int direction)
 
void AppLayerParserSetStreamDepth (uint8_t ipproto, AppProto alproto, uint32_t stream_depth)
 
uint32_t AppLayerParserGetStreamDepth (const Flow *f)
 
void AppLayerParserSetStreamDepthFlag (uint8_t ipproto, AppProto alproto, void *state, uint64_t tx_id, uint8_t flags)
 
void AppLayerParserStateProtoCleanup (uint8_t protomap, AppProto alproto, void *alstate, AppLayerParserState *pstate)
 
void AppLayerParserStateCleanup (const Flow *f, void *alstate, AppLayerParserState *pstate)
 
void AppLayerParserRegisterProtocolParsers (void)
 
void AppLayerParserStateSetFlag (AppLayerParserState *pstate, uint8_t flag)
 
int AppLayerParserStateIssetFlag (AppLayerParserState *pstate, uint8_t flag)
 
void AppLayerParserStreamTruncated (uint8_t ipproto, AppProto alproto, void *alstate, uint8_t direction)
 
void AppLayerParserRegisterProtocolUnittests (uint8_t ipproto, AppProto alproto, void(*RegisterUnittests)(void))
 
void AppLayerParserBackupParserTable (void)
 
void AppLayerParserRestoreParserTable (void)
 
void AppLayerParserRegisterUnittests (void)
 

Detailed Description

Author
Victor Julien victo.nosp@m.r@in.nosp@m.linia.nosp@m.c.ne.nosp@m.t

Generic App-layer parsing functions.

Definition in file app-layer-parser.c.

Macro Definition Documentation

◆ BOTH_SET

#define BOTH_SET (   a,
 
)    ((a) != NULL && (b) != NULL)

Definition at line 1498 of file app-layer-parser.c.

◆ BOTH_SET_OR_BOTH_UNSET

#define BOTH_SET_OR_BOTH_UNSET (   a,
 
)    (((a) == NULL && (b) == NULL) || ((a) != NULL && (b) != NULL))

Definition at line 1499 of file app-layer-parser.c.

◆ IS_DISRUPTED

#define IS_DISRUPTED (   flags)    ((flags) & (STREAM_DEPTH|STREAM_GAP))

Definition at line 1001 of file app-layer-parser.c.

◆ THREE_SET

#define THREE_SET (   a,
  b,
 
)    ((a) != NULL && (b) != NULL && (c) != NULL)

Definition at line 1501 of file app-layer-parser.c.

◆ THREE_SET_OR_THREE_UNSET

#define THREE_SET_OR_THREE_UNSET (   a,
  b,
 
)    (((a) == NULL && (b) == NULL && (c) == NULL) || ((a) != NULL && (b) != NULL && (c) != NULL))

Definition at line 1500 of file app-layer-parser.c.

Typedef Documentation

◆ AppLayerParserCtx

◆ AppLayerParserProtoCtx

App layer protocol parser context.

◆ TestState

typedef struct TestState_ TestState

Function Documentation

◆ AppLayerGetTxIterator()

AppLayerGetTxIteratorFunc AppLayerGetTxIterator ( const uint8_t  ipproto,
const AppProto  alproto 
)

Definition at line 671 of file app-layer-parser.c.

Referenced by AppLayerParserSetTransactionInspectId().

Here is the caller graph for this function:

◆ AppLayerParserApplyTxConfig()

void AppLayerParserApplyTxConfig ( uint8_t  ipproto,
AppProto  alproto,
void *  state,
void *  tx,
enum ConfigAction  mode,
AppLayerTxConfig  config 
)

Definition at line 1152 of file app-layer-parser.c.

References SCEnter.

◆ AppLayerParserBackupParserTable()

void AppLayerParserBackupParserTable ( void  )

Definition at line 1730 of file app-layer-parser.c.

References SCEnter.

◆ AppLayerParserConfParserEnabled()

int AppLayerParserConfParserEnabled ( const char *  ipproto,
const char *  alproto_name 
)

check if a parser is enabled in the config Returns enabled always if: were running unittests

Given a protocol name, checks if the parser is enabled in the conf file.

Definition at line 301 of file app-layer-parser.c.

References ConfGetNode(), ConfValIsFalse(), ConfValIsTrue(), FatalError, RunmodeIsUnittests(), SC_ERR_FATAL, SCEnter, SCLogDebug, SCLogError, SCReturnInt, and ConfNode_::val.

Referenced by HTPFreeConfig(), and RegisterMQTTParsers().

Here is the call graph for this function:
Here is the caller graph for this function:

◆ AppLayerParserDeSetup()

int AppLayerParserDeSetup ( void  )

Definition at line 242 of file app-layer-parser.c.

References FTPParserCleanup(), SCEnter, SCReturnInt, and SMTPParserCleanup().

Referenced by AppLayerDeSetup().

Here is the call graph for this function:
Here is the caller graph for this function:

◆ AppLayerParserDestroyProtocolParserLocalStorage()

void AppLayerParserDestroyProtocolParserLocalStorage ( uint8_t  ipproto,
AppProto  alproto,
void *  local_data 
)

Definition at line 621 of file app-layer-parser.c.

References SCEnter.

Referenced by AppLayerParserThreadCtxFree().

Here is the caller graph for this function:

◆ AppLayerParserGetDecoderEvents()

AppLayerDecoderEvents* AppLayerParserGetDecoderEvents ( AppLayerParserState pstate)

Definition at line 828 of file app-layer-parser.c.

References AppLayerParserState_::decoder_events, SCEnter, and SCReturnPtr.

Referenced by AppLayerDecoderEventsSetEvent(), and AppLayerParserHasDecoderEvents().

Here is the caller graph for this function:

◆ AppLayerParserGetEventInfo()

int AppLayerParserGetEventInfo ( uint8_t  ipproto,
AppProto  alproto,
const char *  event_name,
int *  event_id,
AppLayerEventType event_type 
)

Definition at line 1050 of file app-layer-parser.c.

References FlowGetProtoMapping(), and SCEnter.

Here is the call graph for this function:

◆ AppLayerParserGetEventInfoById()

int AppLayerParserGetEventInfoById ( uint8_t  ipproto,
AppProto  alproto,
int  event_id,
const char **  event_name,
AppLayerEventType event_type 
)

Definition at line 1060 of file app-layer-parser.c.

References FlowGetProtoMapping(), and SCEnter.

Here is the call graph for this function:

◆ AppLayerParserGetEventsByTx()

AppLayerDecoderEvents* AppLayerParserGetEventsByTx ( uint8_t  ipproto,
AppProto  alproto,
void *  tx 
)

Definition at line 841 of file app-layer-parser.c.

References SCEnter.

◆ AppLayerParserGetFiles()

FileContainer* AppLayerParserGetFiles ( const Flow f,
const uint8_t  direction 
)

Definition at line 858 of file app-layer-parser.c.

References SCEnter.

Referenced by DetectFileInspectGeneric(), and FileDisableStoringForTransaction().

Here is the caller graph for this function:

◆ AppLayerParserGetFirstDataDir()

uint8_t AppLayerParserGetFirstDataDir ( uint8_t  ipproto,
AppProto  alproto 
)

Definition at line 1071 of file app-layer-parser.c.

References SCEnter.

◆ AppLayerParserGetOptionFlags()

uint32_t AppLayerParserGetOptionFlags ( uint8_t  protomap,
AppProto  alproto 
)

Definition at line 392 of file app-layer-parser.c.

References SCEnter, and SCReturnUInt.

◆ AppLayerParserGetProtocolParserLocalStorage()

void* AppLayerParserGetProtocolParserLocalStorage ( uint8_t  ipproto,
AppProto  alproto 
)

Definition at line 606 of file app-layer-parser.c.

References SCEnter.

Referenced by AppLayerParserThreadCtxAlloc().

Here is the caller graph for this function:

◆ AppLayerParserGetStateProgress()

int AppLayerParserGetStateProgress ( uint8_t  ipproto,
AppProto  alproto,
void *  alstate,
uint8_t  flags 
)

get the progress value for a tx/protocol

If the stream is disrupted, we return the 'completion' value.

Definition at line 1008 of file app-layer-parser.c.

References flags, IS_DISRUPTED, SCEnter, and unlikely.

Referenced by AppLayerParserSetTransactionInspectId(), and DetectEngineInspectBufferGeneric().

Here is the caller graph for this function:

◆ AppLayerParserGetStateProgressCompletionStatus()

int AppLayerParserGetStateProgressCompletionStatus ( AppProto  alproto,
uint8_t  direction 
)

Definition at line 1041 of file app-layer-parser.c.

References SCEnter.

Referenced by AppLayerParserSetTransactionInspectId(), and OutputRegisterTxLogger().

Here is the caller graph for this function:

◆ AppLayerParserGetStreamDepth()

uint32_t AppLayerParserGetStreamDepth ( const Flow f)

Definition at line 1431 of file app-layer-parser.c.

References SCReturnInt.

◆ AppLayerParserGetTransactionActive()

uint64_t AppLayerParserGetTransactionActive ( const Flow f,
AppLayerParserState pstate,
uint8_t  direction 
)

Definition at line 1080 of file app-layer-parser.c.

References AppLayerParserState_::inspect_id, AppLayerParserState_::log_id, SCEnter, and STREAM_TOSERVER.

Referenced by FlowForceReassemblyNeedReassembly().

Here is the caller graph for this function:

◆ AppLayerParserGetTransactionInspectId()

uint64_t AppLayerParserGetTransactionInspectId ( AppLayerParserState pstate,
uint8_t  direction 
)

Definition at line 696 of file app-layer-parser.c.

References AppLayerParserState_::inspect_id, SCEnter, SCReturnCT, and STREAM_TOSERVER.

Referenced by AppLayerParserSetTransactionInspectId().

Here is the caller graph for this function:

◆ AppLayerParserGetTransactionLogId()

uint64_t AppLayerParserGetTransactionLogId ( AppLayerParserState pstate)

Definition at line 679 of file app-layer-parser.c.

References AppLayerParserState_::log_id, SCEnter, and SCReturnCT.

◆ AppLayerParserGetTx()

◆ AppLayerParserGetTxCnt()

uint64_t AppLayerParserGetTxCnt ( const Flow f,
void *  alstate 
)

Definition at line 1023 of file app-layer-parser.c.

References SCEnter.

Referenced by AppLayerParserSetTransactionInspectId(), FlowForceReassemblyNeedReassembly(), HttpXFFGetIP(), and HttpXFFGetIPFromTx().

Here is the caller graph for this function:

◆ AppLayerParserGetTxData()

AppLayerTxData* AppLayerParserGetTxData ( uint8_t  ipproto,
AppProto  alproto,
void *  tx 
)

Definition at line 1142 of file app-layer-parser.c.

References SCEnter.

Referenced by AppLayerParserSetTransactionInspectId().

Here is the caller graph for this function:

◆ AppLayerParserGetTxDetectState()

DetectEngineState* AppLayerParserGetTxDetectState ( uint8_t  ipproto,
AppProto  alproto,
void *  tx 
)

Definition at line 1112 of file app-layer-parser.c.

References SCEnter.

Referenced by DetectRunStoreStateTx().

Here is the caller graph for this function:

◆ AppLayerParserHasDecoderEvents()

bool AppLayerParserHasDecoderEvents ( AppLayerParserState pstate)

Definition at line 1361 of file app-layer-parser.c.

References AppLayerParserGetDecoderEvents(), AppLayerDecoderEvents_::cnt, AppLayerParserState_::decoder_events, and SCEnter.

Here is the call graph for this function:

◆ AppLayerParserIsEnabled()

int AppLayerParserIsEnabled ( AppProto  alproto)

simple way to globally test if a alproto is registered and fully enabled in the configuration.

Definition at line 1379 of file app-layer-parser.c.

Referenced by DetectAppLayerInspectEngineRegister(), and OutputRegisterTxLogger().

Here is the caller graph for this function:

◆ AppLayerParserParse()

int AppLayerParserParse ( ThreadVars tv,
AppLayerParserThreadCtx alp_tctx,
Flow f,
AppProto  alproto,
uint8_t  flags,
const uint8_t *  input,
uint32_t  input_len 
)
Return values
int-1 in case of unrecoverable error. App-layer tracking stops for this flow.
int0 ok: we did not update app_progress
int1 ok: we updated app_progress

Definition at line 1178 of file app-layer-parser.c.

References Flow_::alparser, BUG_ON, FlowGetProtoMapping(), Flow_::proto, Flow_::protomap, and SCEnter.

Referenced by AppLayerHandleTCPData(), and LLVMFuzzerTestOneInput().

Here is the call graph for this function:
Here is the caller graph for this function:

◆ AppLayerParserPostStreamSetup()

void AppLayerParserPostStreamSetup ( void  )

Definition at line 225 of file app-layer-parser.c.

References ALPROTO_MAX, and FLOW_PROTO_DEFAULT.

Referenced by PreRunInit().

Here is the caller graph for this function:

◆ AppLayerParserProtocolGetLoggerBits()

LoggerId AppLayerParserProtocolGetLoggerBits ( uint8_t  ipproto,
AppProto  alproto 
)

Definition at line 1401 of file app-layer-parser.c.

References FlowGetProtoMapping(), and SCEnter.

Here is the call graph for this function:

◆ AppLayerParserProtocolHasLogger()

int AppLayerParserProtocolHasLogger ( uint8_t  ipproto,
AppProto  alproto 
)

Definition at line 1393 of file app-layer-parser.c.

References FlowGetProtoMapping(), and SCEnter.

Here is the call graph for this function:

◆ AppLayerParserProtocolIsTxEventAware()

int AppLayerParserProtocolIsTxEventAware ( uint8_t  ipproto,
AppProto  alproto 
)

Definition at line 1385 of file app-layer-parser.c.

References FlowGetProtoMapping(), and SCEnter.

Here is the call graph for this function:

◆ AppLayerParserProtoIsRegistered()

int AppLayerParserProtoIsRegistered ( uint8_t  ipproto,
AppProto  alproto 
)

Definition at line 187 of file app-layer-parser.c.

References FlowGetProtoMapping().

Here is the call graph for this function:

◆ AppLayerParserRegisterApplyTxConfigFunc()

void AppLayerParserRegisterApplyTxConfigFunc ( uint8_t  ipproto,
AppProto  alproto,
bool(*)(void *state, void *tx, int mode, AppLayerTxConfig)  ApplyTxConfig 
)

Definition at line 584 of file app-layer-parser.c.

References SCEnter.

◆ AppLayerParserRegisterDetectStateFuncs()

void AppLayerParserRegisterDetectStateFuncs ( uint8_t  ipproto,
AppProto  alproto,
DetectEngineState *(*)(void *tx)  GetTxDetectState,
int(*)(void *tx, DetectEngineState *)  SetTxDetectState 
)

Definition at line 562 of file app-layer-parser.c.

References SCEnter.

◆ AppLayerParserRegisterGetEventInfo()

void AppLayerParserRegisterGetEventInfo ( uint8_t  ipproto,
AppProto  alproto,
int(*)(const char *event_name, int *event_id, AppLayerEventType *event_type)  StateGetEventInfo 
)

Definition at line 550 of file app-layer-parser.c.

References SCEnter.

◆ AppLayerParserRegisterGetEventInfoById()

void AppLayerParserRegisterGetEventInfoById ( uint8_t  ipproto,
AppProto  alproto,
int(*)(int event_id, const char **event_name, AppLayerEventType *event_type)  StateGetEventInfoById 
)

Definition at line 538 of file app-layer-parser.c.

References SCEnter.

◆ AppLayerParserRegisterGetEventsFunc()

void AppLayerParserRegisterGetEventsFunc ( uint8_t  ipproto,
AppProto  alproto,
AppLayerDecoderEvents *(*)(void *)  StateGetEvents 
)

Definition at line 436 of file app-layer-parser.c.

References SCEnter.

◆ AppLayerParserRegisterGetFilesFunc()

void AppLayerParserRegisterGetFilesFunc ( uint8_t  ipproto,
AppProto  alproto,
FileContainer *(*)(void *, uint8_t)  StateGetFiles 
)

Definition at line 425 of file app-layer-parser.c.

References SCEnter.

◆ AppLayerParserRegisterGetStateProgressCompletionStatus()

void AppLayerParserRegisterGetStateProgressCompletionStatus ( AppProto  alproto,
int(*)(uint8_t direction)  StateGetProgressCompletionStatus 
)

Definition at line 527 of file app-layer-parser.c.

References SCEnter.

◆ AppLayerParserRegisterGetStateProgressFunc()

void AppLayerParserRegisterGetStateProgressFunc ( uint8_t  ipproto,
AppProto  alproto,
int(*)(void *alstate, uint8_t direction)  StateGetProgress 
)

Definition at line 475 of file app-layer-parser.c.

References SCEnter.

◆ AppLayerParserRegisterGetTx()

void AppLayerParserRegisterGetTx ( uint8_t  ipproto,
AppProto  alproto,
void *  StateGetTx)(void *alstate, uint64_t tx_id 
)

Definition at line 508 of file app-layer-parser.c.

References SCEnter.

◆ AppLayerParserRegisterGetTxCnt()

void AppLayerParserRegisterGetTxCnt ( uint8_t  ipproto,
AppProto  alproto,
uint64_t(*)(void *alstate)  StateGetTxCnt 
)

Definition at line 497 of file app-layer-parser.c.

References SCEnter.

◆ AppLayerParserRegisterGetTxIterator()

void AppLayerParserRegisterGetTxIterator ( uint8_t  ipproto,
AppProto  alproto,
AppLayerGetTxIteratorFunc  Func 
)

Definition at line 519 of file app-layer-parser.c.

References SCEnter.

◆ AppLayerParserRegisterLocalStorageFunc()

void AppLayerParserRegisterLocalStorageFunc ( uint8_t  ipproto,
AppProto  alproto,
void *(*)(void)  LocalStorageAlloc,
void(*)(void *)  LocalStorageFree 
)

Definition at line 411 of file app-layer-parser.c.

References SCEnter.

◆ AppLayerParserRegisterLogger()

void AppLayerParserRegisterLogger ( uint8_t  ipproto,
AppProto  alproto 
)

Definition at line 456 of file app-layer-parser.c.

References SCEnter.

◆ AppLayerParserRegisterLoggerBits()

void AppLayerParserRegisterLoggerBits ( uint8_t  ipproto,
AppProto  alproto,
LoggerId  bits 
)

Definition at line 447 of file app-layer-parser.c.

References SCEnter.

◆ AppLayerParserRegisterOptionFlags()

void AppLayerParserRegisterOptionFlags ( uint8_t  ipproto,
AppProto  alproto,
uint32_t  flags 
)

Definition at line 382 of file app-layer-parser.c.

References SCEnter.

◆ AppLayerParserRegisterParser()

int AppLayerParserRegisterParser ( uint8_t  ipproto,
AppProto  alproto,
uint8_t  direction,
AppLayerParserFPtr  Parser 
)

Register app layer parser for the protocol.

Return values
0On success.
-1On failure.

Definition at line 359 of file app-layer-parser.c.

References SCEnter.

◆ AppLayerParserRegisterParserAcceptableDataDirection()

void AppLayerParserRegisterParserAcceptableDataDirection ( uint8_t  ipproto,
AppProto  alproto,
uint8_t  direction 
)

Definition at line 371 of file app-layer-parser.c.

References SCEnter.

◆ AppLayerParserRegisterProtocolParsers()

◆ AppLayerParserRegisterProtocolUnittests()

void AppLayerParserRegisterProtocolUnittests ( uint8_t  ipproto,
AppProto  alproto,
void(*)(void)  RegisterUnittests 
)

Definition at line 1721 of file app-layer-parser.c.

Referenced by RegisterKRB5Parsers(), RegisterMQTTParsers(), RegisterNTPParsers(), and RegisterTemplateRustParsers().

Here is the caller graph for this function:

◆ AppLayerParserRegisterSetStreamDepthFlag()

void AppLayerParserRegisterSetStreamDepthFlag ( uint8_t  ipproto,
AppProto  alproto,
void(*)(void *tx, uint8_t flags SetStreamDepthFlag 
)

Definition at line 594 of file app-layer-parser.c.

References SCEnter.

◆ AppLayerParserRegisterStateFuncs()

void AppLayerParserRegisterStateFuncs ( uint8_t  ipproto,
AppProto  alproto,
void *(*)(void *, AppProto StateAlloc,
void(*)(void *)  StateFree 
)

Definition at line 398 of file app-layer-parser.c.

References SCEnter.

◆ AppLayerParserRegisterTruncateFunc()

void AppLayerParserRegisterTruncateFunc ( uint8_t  ipproto,
AppProto  alproto,
void(*)(void *, uint8_t)  Truncate 
)

Definition at line 465 of file app-layer-parser.c.

References SCEnter.

◆ AppLayerParserRegisterTxDataFunc()

void AppLayerParserRegisterTxDataFunc ( uint8_t  ipproto,
AppProto  alproto,
AppLayerTxData *(*)(void *tx)  GetTxData 
)

Definition at line 574 of file app-layer-parser.c.

References SCEnter.

◆ AppLayerParserRegisterTxFreeFunc()

void AppLayerParserRegisterTxFreeFunc ( uint8_t  ipproto,
AppProto  alproto,
void(*)(void *, uint64_t)  StateTransactionFree 
)

Definition at line 486 of file app-layer-parser.c.

References SCEnter.

◆ AppLayerParserRegisterUnittests()

void AppLayerParserRegisterUnittests ( void  )

Definition at line 1858 of file app-layer-parser.c.

References ALPROTO_MAX, FLOW_PROTO_DEFAULT, and SCEnter.

◆ AppLayerParserRestoreParserTable()

void AppLayerParserRestoreParserTable ( void  )

Definition at line 1738 of file app-layer-parser.c.

References SCEnter.

◆ AppLayerParserSetDecoderEvents()

void AppLayerParserSetDecoderEvents ( AppLayerParserState pstate,
AppLayerDecoderEvents devents 
)

Definition at line 836 of file app-layer-parser.c.

References AppLayerParserState_::decoder_events.

Referenced by AppLayerDecoderEventsSetEvent().

Here is the caller graph for this function:

◆ AppLayerParserSetEOF()

void AppLayerParserSetEOF ( AppLayerParserState pstate)

Definition at line 1345 of file app-layer-parser.c.

References APP_LAYER_PARSER_EOF_TC, APP_LAYER_PARSER_EOF_TS, AppLayerParserStateSetFlag(), SCEnter, SCLogDebug, and SCReturn.

Here is the call graph for this function:

◆ AppLayerParserSetStreamDepth()

void AppLayerParserSetStreamDepth ( uint8_t  ipproto,
AppProto  alproto,
uint32_t  stream_depth 
)

Definition at line 1420 of file app-layer-parser.c.

◆ AppLayerParserSetStreamDepthFlag()

void AppLayerParserSetStreamDepthFlag ( uint8_t  ipproto,
AppProto  alproto,
void *  state,
uint64_t  tx_id,
uint8_t  flags 
)

Definition at line 1436 of file app-layer-parser.c.

References AppLayerParserGetTx(), and SCEnter.

Here is the call graph for this function:

◆ AppLayerParserSetTransactionInspectId()

void AppLayerParserSetTransactionInspectId ( const Flow f,
AppLayerParserState pstate,
void *  alstate,
const uint8_t  flags,
bool  tag_txs_as_inspected 
)

◆ AppLayerParserSetTransactionLogId()

void AppLayerParserSetTransactionLogId ( AppLayerParserState pstate,
uint64_t  tx_id 
)

Definition at line 686 of file app-layer-parser.c.

References AppLayerParserState_::log_id, SCEnter, and SCReturn.

◆ AppLayerParserSetTxDetectState()

int AppLayerParserSetTxDetectState ( const Flow f,
void *  tx,
DetectEngineState s 
)

Definition at line 1120 of file app-layer-parser.c.

References SCEnter.

Referenced by DetectRunStoreStateTx().

Here is the caller graph for this function:

◆ AppLayerParserSetup()

int AppLayerParserSetup ( void  )

Definition at line 218 of file app-layer-parser.c.

References SCEnter.

Referenced by AppLayerSetup(), and LLVMFuzzerTestOneInput().

Here is the caller graph for this function:

◆ AppLayerParserStateAlloc()

AppLayerParserState* AppLayerParserStateAlloc ( void  )

Definition at line 194 of file app-layer-parser.c.

References SCEnter, SCMalloc, and SCReturnPtr.

◆ AppLayerParserStateCleanup()

void AppLayerParserStateCleanup ( const Flow f,
void *  alstate,
AppLayerParserState pstate 
)

Definition at line 1469 of file app-layer-parser.c.

References Flow_::alproto, AppLayerParserStateProtoCleanup(), and Flow_::protomap.

Referenced by FlowCleanupAppLayer().

Here is the call graph for this function:
Here is the caller graph for this function:

◆ AppLayerParserStateFree()

void AppLayerParserStateFree ( AppLayerParserState pstate)

Definition at line 207 of file app-layer-parser.c.

References AppLayerDecoderEventsFreeEvents(), AppLayerParserState_::decoder_events, SCEnter, SCFree, and SCReturn.

Here is the call graph for this function:

◆ AppLayerParserStateIssetFlag()

int AppLayerParserStateIssetFlag ( AppLayerParserState pstate,
uint8_t  flag 
)

Definition at line 1623 of file app-layer-parser.c.

References AppLayerParserState_::flags, SCEnter, and SCReturnInt.

Referenced by LLVMFuzzerTestOneInput().

Here is the caller graph for this function:

◆ AppLayerParserStateProtoCleanup()

void AppLayerParserStateProtoCleanup ( uint8_t  protomap,
AppProto  alproto,
void *  alstate,
AppLayerParserState pstate 
)

Definition at line 1452 of file app-layer-parser.c.

References SCEnter.

Referenced by AppLayerParserStateCleanup().

Here is the caller graph for this function:

◆ AppLayerParserStateSetFlag()

void AppLayerParserStateSetFlag ( AppLayerParserState pstate,
uint8_t  flag 
)

Definition at line 1615 of file app-layer-parser.c.

References AppLayerParserState_::flags, SCEnter, and SCReturn.

Referenced by AppLayerParserSetEOF(), and StreamTcpDisableAppLayer().

Here is the caller graph for this function:

◆ AppLayerParserStreamTruncated()

void AppLayerParserStreamTruncated ( uint8_t  ipproto,
AppProto  alproto,
void *  alstate,
uint8_t  direction 
)

Definition at line 1630 of file app-layer-parser.c.

References SCEnter.

◆ AppLayerParserSupportsFiles()

int AppLayerParserSupportsFiles ( uint8_t  ipproto,
AppProto  alproto 
)

Definition at line 1098 of file app-layer-parser.c.

◆ AppLayerParserSupportsTxDetectFlags()

bool AppLayerParserSupportsTxDetectFlags ( AppProto  alproto)

Definition at line 1131 of file app-layer-parser.c.

References FLOW_PROTO_APPLAYER_MAX, and SCEnter.

Referenced by DetectAppLayerInspectEngineRegister().

Here is the caller graph for this function:

◆ AppLayerParserSupportsTxDetectState()

int AppLayerParserSupportsTxDetectState ( uint8_t  ipproto,
AppProto  alproto 
)

Definition at line 1105 of file app-layer-parser.c.

◆ AppLayerParserThreadCtxAlloc()

AppLayerParserThreadCtx* AppLayerParserThreadCtxAlloc ( void  )

Gets a new app layer protocol's parser thread context.

Return values
Non-NULLpointer on success. NULL pointer on failure.

Definition at line 252 of file app-layer-parser.c.

References AppLayerParserThreadCtx_::alproto_local_storage, ALPROTO_MAX, AppLayerParserGetProtocolParserLocalStorage(), FLOW_PROTO_DEFAULT, FlowGetReverseProtoMapping(), SCEnter, SCMalloc, and SCReturnPtr.

Referenced by AppLayerGetCtxThread(), and LLVMFuzzerTestOneInput().

Here is the call graph for this function:
Here is the caller graph for this function:

◆ AppLayerParserThreadCtxFree()

void AppLayerParserThreadCtxFree ( AppLayerParserThreadCtx tctx)

Destroys the app layer parser thread context obtained using AppLayerParserThreadCtxAlloc().

Parameters
tctxPointer to the thread context to be destroyed.

Definition at line 278 of file app-layer-parser.c.

References AppLayerParserThreadCtx_::alproto_local_storage, ALPROTO_MAX, AppLayerParserDestroyProtocolParserLocalStorage(), FLOW_PROTO_DEFAULT, FlowGetReverseProtoMapping(), SCEnter, SCFree, and SCReturn.

Referenced by AppLayerDestroyCtxThread().

Here is the call graph for this function:
Here is the caller graph for this function:

◆ AppLayerParserTransactionsCleanup()

void AppLayerParserTransactionsCleanup ( Flow f)

remove obsolete (inspected and logged) transactions

Definition at line 876 of file app-layer-parser.c.

References DEBUG_ASSERT_FLOW_LOCKED, and SCEnter.

◆ AppLayerParserTriggerRawStreamReassembly()

void AppLayerParserTriggerRawStreamReassembly ( Flow f,
int  direction 
)

Definition at line 1409 of file app-layer-parser.c.

References Flow_::protoctx, SCEnter, SCLogDebug, SCReturn, and StreamTcpReassembleTriggerRawReassembly().

Here is the call graph for this function:

◆ UTHAppLayerParserStateGetIds()

void UTHAppLayerParserStateGetIds ( void *  ptr,
uint64_t *  i1,
uint64_t *  i2,
uint64_t *  log,
uint64_t *  min 
)