suricata
app-layer-parser.c
Go to the documentation of this file.
1 /* Copyright (C) 2007-2020 Open Information Security Foundation
2  *
3  * You can copy, redistribute or modify this Program under the terms of
4  * the GNU General Public License version 2 as published by the Free
5  * Software Foundation.
6  *
7  * This program is distributed in the hope that it will be useful,
8  * but WITHOUT ANY WARRANTY; without even the implied warranty of
9  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
10  * GNU General Public License for more details.
11  *
12  * You should have received a copy of the GNU General Public License
13  * version 2 along with this program; if not, write to the Free Software
14  * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA
15  * 02110-1301, USA.
16  */
17 
18 /**
19  * \file
20  *
21  * \author Victor Julien <victor@inliniac.net>
22  *
23  * Generic App-layer parsing functions.
24  */
25 
26 #include "suricata-common.h"
27 #include "debug.h"
28 #include "util-unittest.h"
29 #include "decode.h"
30 #include "threads.h"
31 
32 #include "util-print.h"
33 #include "util-pool.h"
34 
35 #include "flow-util.h"
36 #include "flow-private.h"
37 
38 #include "detect-engine-state.h"
39 #include "detect-engine-port.h"
40 
41 #include "stream-tcp.h"
42 #include "stream-tcp-private.h"
43 #include "stream.h"
44 #include "stream-tcp-reassemble.h"
45 
46 #include "app-layer.h"
47 #include "app-layer-protos.h"
48 #include "app-layer-parser.h"
49 #include "app-layer-smb.h"
50 #include "app-layer-htp.h"
51 #include "app-layer-ftp.h"
52 #include "app-layer-ssl.h"
53 #include "app-layer-ssh.h"
54 #include "app-layer-smtp.h"
55 #include "app-layer-modbus.h"
56 #include "app-layer-enip.h"
57 #include "app-layer-dnp3.h"
58 #include "app-layer-nfs-tcp.h"
59 #include "app-layer-nfs-udp.h"
60 #include "app-layer-ntp.h"
61 #include "app-layer-tftp.h"
62 #include "app-layer-ike.h"
63 #include "app-layer-krb5.h"
64 #include "app-layer-snmp.h"
65 #include "app-layer-sip.h"
66 #include "app-layer-rfb.h"
67 #include "app-layer-mqtt.h"
68 #include "app-layer-template.h"
70 #include "app-layer-rdp.h"
71 #include "app-layer-http2.h"
72 
73 #include "conf.h"
74 #include "util-spm.h"
75 
76 #include "util-debug.h"
77 #include "decode-events.h"
78 #include "util-unittest-helper.h"
79 #include "util-validate.h"
80 
81 #include "runmodes.h"
82 
83 #include "rust.h"
84 
87 };
88 
89 
90 /**
91  * \brief App layer protocol parser context.
92  */
94 {
95  /* 0 - to_server, 1 - to_client. */
97  bool logger;
98  uint32_t logger_bits; /**< registered loggers for this proto */
99 
100  void *(*StateAlloc)(void *, AppProto);
101  void (*StateFree)(void *);
102  void (*StateTransactionFree)(void *, uint64_t);
103  void *(*LocalStorageAlloc)(void);
104  void (*LocalStorageFree)(void *);
105 
106  void (*Truncate)(void *, uint8_t);
107  FileContainer *(*StateGetFiles)(void *, uint8_t);
108 
109  int (*StateGetProgress)(void *alstate, uint8_t direction);
110  uint64_t (*StateGetTxCnt)(void *alstate);
111  void *(*StateGetTx)(void *alstate, uint64_t tx_id);
115  int (*StateGetEventInfoById)(int event_id, const char **event_name,
116  AppLayerEventType *event_type);
117  int (*StateGetEventInfo)(const char *event_name,
118  int *event_id, AppLayerEventType *event_type);
119 
120  AppLayerTxData *(*GetTxData)(void *tx);
121  bool (*ApplyTxConfig)(void *state, void *tx, int mode, AppLayerTxConfig);
122 
123  void (*SetStreamDepthFlag)(void *tx, uint8_t flags);
124 
125  /* each app-layer has its own value */
126  uint32_t stream_depth;
127 
128  /* Indicates the direction the parser is ready to see the data
129  * the first time for a flow. Values accepted -
130  * STREAM_TOSERVER, STREAM_TOCLIENT */
131  uint8_t first_data_dir;
132 
133  /* Option flags such as supporting gaps or not. */
134  uint32_t option_flags;
135  /* coccinelle: AppLayerParserProtoCtx:option_flags:APP_LAYER_PARSER_OPT_ */
136 
137  uint32_t internal_flags;
138  /* coccinelle: AppLayerParserProtoCtx:internal_flags:APP_LAYER_PARSER_INT_ */
139 
140 #ifdef UNITTESTS
141  void (*RegisterUnittests)(void);
142 #endif
144 
145 typedef struct AppLayerParserCtx_ {
148 
150  /* coccinelle: AppLayerParserState:flags:APP_LAYER_PARSER_ */
151  uint8_t flags;
152 
153  /* Indicates the current transaction that is being inspected.
154  * We have a var per direction. */
155  uint64_t inspect_id[2];
156  /* Indicates the current transaction being logged. Unlike inspect_id,
157  * we don't need a var per direction since we don't log a transaction
158  * unless we have the entire transaction. */
159  uint64_t log_id;
160 
161  uint64_t min_id;
162 
163  /* Used to store decoder events. */
165 };
166 
167 #ifdef UNITTESTS
168 void UTHAppLayerParserStateGetIds(void *ptr, uint64_t *i1, uint64_t *i2, uint64_t *log, uint64_t *min)
169 {
170  struct AppLayerParserState_ *s = ptr;
171  *i1 = s->inspect_id[0];
172  *i2 = s->inspect_id[1];
173  *log = s->log_id;
174  *min = s->min_id;
175 }
176 #endif
177 
178 /* Static global version of the parser context.
179  * Post 2.0 let's look at changing this to move it out to app-layer.c. */
180 static AppLayerParserCtx alp_ctx;
181 
182 int AppLayerParserProtoIsRegistered(uint8_t ipproto, AppProto alproto)
183 {
184  uint8_t ipproto_map = FlowGetProtoMapping(ipproto);
185 
186  return (alp_ctx.ctxs[ipproto_map][alproto].StateAlloc != NULL) ? 1 : 0;
187 }
188 
190 {
191  SCEnter();
192 
193  AppLayerParserState *pstate = (AppLayerParserState *)SCMalloc(sizeof(*pstate));
194  if (pstate == NULL)
195  goto end;
196  memset(pstate, 0, sizeof(*pstate));
197 
198  end:
199  SCReturnPtr(pstate, "AppLayerParserState");
200 }
201 
203 {
204  SCEnter();
205 
206  if (pstate->decoder_events != NULL)
208  SCFree(pstate);
209 
210  SCReturn;
211 }
212 
214 {
215  SCEnter();
216  memset(&alp_ctx, 0, sizeof(alp_ctx));
217  SCReturnInt(0);
218 }
219 
221 {
222  AppProto alproto = 0;
223  int flow_proto = 0;
224 
225  /* lets set a default value for stream_depth */
226  for (flow_proto = 0; flow_proto < FLOW_PROTO_DEFAULT; flow_proto++) {
227  for (alproto = 0; alproto < ALPROTO_MAX; alproto++) {
228  if (!(alp_ctx.ctxs[flow_proto][alproto].internal_flags &
230  alp_ctx.ctxs[flow_proto][alproto].stream_depth =
232  }
233  }
234  }
235 }
236 
238 {
239  SCEnter();
240 
243 
244  SCReturnInt(0);
245 }
246 
248 {
249  SCEnter();
250 
251  AppProto alproto = 0;
252  uint8_t flow_proto = 0;
254 
255  tctx = SCMalloc(sizeof(*tctx));
256  if (tctx == NULL)
257  goto end;
258  memset(tctx, 0, sizeof(*tctx));
259 
260  for (flow_proto = 0; flow_proto < FLOW_PROTO_DEFAULT; flow_proto++) {
261  for (alproto = 0; alproto < ALPROTO_MAX; alproto++) {
262  uint8_t ipproto = FlowGetReverseProtoMapping(flow_proto);
263 
264  tctx->alproto_local_storage[flow_proto][alproto] =
266  }
267  }
268 
269  end:
270  SCReturnPtr(tctx, "void *");
271 }
272 
274 {
275  SCEnter();
276 
277  AppProto alproto = 0;
278  uint8_t flow_proto = 0;
279 
280  for (flow_proto = 0; flow_proto < FLOW_PROTO_DEFAULT; flow_proto++) {
281  for (alproto = 0; alproto < ALPROTO_MAX; alproto++) {
282  uint8_t ipproto = FlowGetReverseProtoMapping(flow_proto);
283 
285  tctx->alproto_local_storage[flow_proto][alproto]);
286  }
287  }
288 
289  SCFree(tctx);
290  SCReturn;
291 }
292 
293 /** \brief check if a parser is enabled in the config
294  * Returns enabled always if: were running unittests
295  */
296 int AppLayerParserConfParserEnabled(const char *ipproto,
297  const char *alproto_name)
298 {
299  SCEnter();
300 
301  int enabled = 1;
302  char param[100];
303  ConfNode *node;
304  int r;
305 
306  if (RunmodeIsUnittests())
307  goto enabled;
308 
309  r = snprintf(param, sizeof(param), "%s%s%s", "app-layer.protocols.",
310  alproto_name, ".enabled");
311  if (r < 0) {
312  FatalError(SC_ERR_FATAL, "snprintf failure.");
313  } else if (r > (int)sizeof(param)) {
314  FatalError(SC_ERR_FATAL, "buffer not big enough to write param.");
315  }
316 
317  node = ConfGetNode(param);
318  if (node == NULL) {
319  SCLogDebug("Entry for %s not found.", param);
320  r = snprintf(param, sizeof(param), "%s%s%s%s%s", "app-layer.protocols.",
321  alproto_name, ".", ipproto, ".enabled");
322  if (r < 0) {
323  FatalError(SC_ERR_FATAL, "snprintf failure.");
324  } else if (r > (int)sizeof(param)) {
325  FatalError(SC_ERR_FATAL, "buffer not big enough to write param.");
326  }
327 
328  node = ConfGetNode(param);
329  if (node == NULL) {
330  SCLogDebug("Entry for %s not found.", param);
331  goto enabled;
332  }
333  }
334 
335  if (ConfValIsTrue(node->val)) {
336  goto enabled;
337  } else if (ConfValIsFalse(node->val)) {
338  goto disabled;
339  } else if (strcasecmp(node->val, "detection-only") == 0) {
340  goto disabled;
341  } else {
342  SCLogError(SC_ERR_FATAL, "Invalid value found for %s.", param);
343  exit(EXIT_FAILURE);
344  }
345 
346  disabled:
347  enabled = 0;
348  enabled:
349  SCReturnInt(enabled);
350 }
351 
352 /***** Parser related registration *****/
353 
354 int AppLayerParserRegisterParser(uint8_t ipproto, AppProto alproto,
355  uint8_t direction,
356  AppLayerParserFPtr Parser)
357 {
358  SCEnter();
359 
360  alp_ctx.ctxs[FlowGetProtoMapping(ipproto)][alproto].
361  Parser[(direction & STREAM_TOSERVER) ? 0 : 1] = Parser;
362 
363  SCReturnInt(0);
364 }
365 
367  uint8_t direction)
368 {
369  SCEnter();
370 
371  alp_ctx.ctxs[FlowGetProtoMapping(ipproto)][alproto].first_data_dir |=
372  (direction & (STREAM_TOSERVER | STREAM_TOCLIENT));
373 
374  SCReturn;
375 }
376 
377 void AppLayerParserRegisterOptionFlags(uint8_t ipproto, AppProto alproto,
378  uint32_t flags)
379 {
380  SCEnter();
381 
382  alp_ctx.ctxs[FlowGetProtoMapping(ipproto)][alproto].option_flags |= flags;
383 
384  SCReturn;
385 }
386 
387 uint32_t AppLayerParserGetOptionFlags(uint8_t protomap, AppProto alproto)
388 {
389  SCEnter();
390  SCReturnUInt(alp_ctx.ctxs[protomap][alproto].option_flags);
391 }
392 
393 void AppLayerParserRegisterStateFuncs(uint8_t ipproto, AppProto alproto,
394  void *(*StateAlloc)(void *, AppProto), void (*StateFree)(void *))
395 {
396  SCEnter();
397 
398  alp_ctx.ctxs[FlowGetProtoMapping(ipproto)][alproto].StateAlloc =
399  StateAlloc;
400  alp_ctx.ctxs[FlowGetProtoMapping(ipproto)][alproto].StateFree =
401  StateFree;
402 
403  SCReturn;
404 }
405 
406 void AppLayerParserRegisterLocalStorageFunc(uint8_t ipproto, AppProto alproto,
407  void *(*LocalStorageAlloc)(void),
408  void (*LocalStorageFree)(void *))
409 {
410  SCEnter();
411 
412  alp_ctx.ctxs[FlowGetProtoMapping(ipproto)][alproto].LocalStorageAlloc =
413  LocalStorageAlloc;
414  alp_ctx.ctxs[FlowGetProtoMapping(ipproto)][alproto].LocalStorageFree =
415  LocalStorageFree;
416 
417  SCReturn;
418 }
419 
420 void AppLayerParserRegisterGetFilesFunc(uint8_t ipproto, AppProto alproto,
421  FileContainer *(*StateGetFiles)(void *, uint8_t))
422 {
423  SCEnter();
424 
425  alp_ctx.ctxs[FlowGetProtoMapping(ipproto)][alproto].StateGetFiles =
426  StateGetFiles;
427 
428  SCReturn;
429 }
430 
431 void AppLayerParserRegisterLoggerBits(uint8_t ipproto, AppProto alproto, LoggerId bits)
432 {
433  SCEnter();
434 
435  alp_ctx.ctxs[FlowGetProtoMapping(ipproto)][alproto].logger_bits = bits;
436 
437  SCReturn;
438 }
439 
440 void AppLayerParserRegisterLogger(uint8_t ipproto, AppProto alproto)
441 {
442  SCEnter();
443 
444  alp_ctx.ctxs[FlowGetProtoMapping(ipproto)][alproto].logger = true;
445 
446  SCReturn;
447 }
448 
449 void AppLayerParserRegisterTruncateFunc(uint8_t ipproto, AppProto alproto,
450  void (*Truncate)(void *, uint8_t))
451 {
452  SCEnter();
453 
454  alp_ctx.ctxs[FlowGetProtoMapping(ipproto)][alproto].Truncate = Truncate;
455 
456  SCReturn;
457 }
458 
460  int (*StateGetProgress)(void *alstate, uint8_t direction))
461 {
462  SCEnter();
463 
464  alp_ctx.ctxs[FlowGetProtoMapping(ipproto)][alproto].
465  StateGetProgress = StateGetProgress;
466 
467  SCReturn;
468 }
469 
470 void AppLayerParserRegisterTxFreeFunc(uint8_t ipproto, AppProto alproto,
471  void (*StateTransactionFree)(void *, uint64_t))
472 {
473  SCEnter();
474 
475  alp_ctx.ctxs[FlowGetProtoMapping(ipproto)][alproto].
476  StateTransactionFree = StateTransactionFree;
477 
478  SCReturn;
479 }
480 
481 void AppLayerParserRegisterGetTxCnt(uint8_t ipproto, AppProto alproto,
482  uint64_t (*StateGetTxCnt)(void *alstate))
483 {
484  SCEnter();
485 
486  alp_ctx.ctxs[FlowGetProtoMapping(ipproto)][alproto].
487  StateGetTxCnt = StateGetTxCnt;
488 
489  SCReturn;
490 }
491 
492 void AppLayerParserRegisterGetTx(uint8_t ipproto, AppProto alproto,
493  void *(StateGetTx)(void *alstate, uint64_t tx_id))
494 {
495  SCEnter();
496 
497  alp_ctx.ctxs[FlowGetProtoMapping(ipproto)][alproto].
498  StateGetTx = StateGetTx;
499 
500  SCReturn;
501 }
502 
503 void AppLayerParserRegisterGetTxIterator(uint8_t ipproto, AppProto alproto,
505 {
506  SCEnter();
507  alp_ctx.ctxs[FlowGetProtoMapping(ipproto)][alproto].StateGetTxIterator = Func;
508  SCReturn;
509 }
510 
512  AppProto alproto, const int ts, const int tc)
513 {
514  BUG_ON(ts == 0);
515  BUG_ON(tc == 0);
516  BUG_ON(!AppProtoIsValid(alproto));
517  BUG_ON(alp_ctx.ctxs[FLOW_PROTO_DEFAULT][alproto].complete_ts != 0 &&
518  alp_ctx.ctxs[FLOW_PROTO_DEFAULT][alproto].complete_ts != ts);
519  BUG_ON(alp_ctx.ctxs[FLOW_PROTO_DEFAULT][alproto].complete_tc != 0 &&
520  alp_ctx.ctxs[FLOW_PROTO_DEFAULT][alproto].complete_tc != tc);
521 
522  alp_ctx.ctxs[FLOW_PROTO_DEFAULT][alproto].complete_ts = ts;
523  alp_ctx.ctxs[FLOW_PROTO_DEFAULT][alproto].complete_tc = tc;
524 }
525 
526 void AppLayerParserRegisterGetEventInfoById(uint8_t ipproto, AppProto alproto,
527  int (*StateGetEventInfoById)(int event_id, const char **event_name,
528  AppLayerEventType *event_type))
529 {
530  SCEnter();
531 
532  alp_ctx.ctxs[FlowGetProtoMapping(ipproto)][alproto].
533  StateGetEventInfoById = StateGetEventInfoById;
534 
535  SCReturn;
536 }
537 
538 void AppLayerParserRegisterGetEventInfo(uint8_t ipproto, AppProto alproto,
539  int (*StateGetEventInfo)(const char *event_name, int *event_id,
540  AppLayerEventType *event_type))
541 {
542  SCEnter();
543 
544  alp_ctx.ctxs[FlowGetProtoMapping(ipproto)][alproto].
545  StateGetEventInfo = StateGetEventInfo;
546 
547  SCReturn;
548 }
549 
550 void AppLayerParserRegisterTxDataFunc(uint8_t ipproto, AppProto alproto,
551  AppLayerTxData *(*GetTxData)(void *tx))
552 {
553  SCEnter();
554 
555  alp_ctx.ctxs[FlowGetProtoMapping(ipproto)][alproto].GetTxData = GetTxData;
556 
557  SCReturn;
558 }
559 
560 void AppLayerParserRegisterApplyTxConfigFunc(uint8_t ipproto, AppProto alproto,
561  bool (*ApplyTxConfig)(void *state, void *tx, int mode, AppLayerTxConfig))
562 {
563  SCEnter();
564 
565  alp_ctx.ctxs[FlowGetProtoMapping(ipproto)][alproto].ApplyTxConfig = ApplyTxConfig;
566 
567  SCReturn;
568 }
569 
571  void (*SetStreamDepthFlag)(void *tx, uint8_t flags))
572 {
573  SCEnter();
574 
575  alp_ctx.ctxs[FlowGetProtoMapping(ipproto)][alproto].SetStreamDepthFlag = SetStreamDepthFlag;
576 
577  SCReturn;
578 }
579 
580 /***** Get and transaction functions *****/
581 
583 {
584  SCEnter();
585  void * r = NULL;
586 
587  if (alp_ctx.ctxs[FlowGetProtoMapping(ipproto)][alproto].
588  LocalStorageAlloc != NULL)
589  {
590  r = alp_ctx.ctxs[FlowGetProtoMapping(ipproto)][alproto].
591  LocalStorageAlloc();
592  }
593 
594  SCReturnPtr(r, "void *");
595 }
596 
598  void *local_data)
599 {
600  SCEnter();
601 
602  if (alp_ctx.ctxs[FlowGetProtoMapping(ipproto)][alproto].
603  LocalStorageFree != NULL)
604  {
605  alp_ctx.ctxs[FlowGetProtoMapping(ipproto)][alproto].
606  LocalStorageFree(local_data);
607  }
608 
609  SCReturn;
610 }
611 
612 /** \brief default tx iterator
613  *
614  * Used if the app layer parser doesn't register its own iterator.
615  * Simply walks the tx_id space until it finds a tx. Uses 'state' to
616  * keep track of where it left off.
617  *
618  * \retval txptr or NULL if no more txs in list
619  */
620 static AppLayerGetTxIterTuple AppLayerDefaultGetTxIterator(
621  const uint8_t ipproto, const AppProto alproto,
622  void *alstate, uint64_t min_tx_id, uint64_t max_tx_id,
623  AppLayerGetTxIterState *state)
624 {
625  uint64_t ustate = *(uint64_t *)state;
626  uint64_t tx_id = MAX(min_tx_id, ustate);
627  for ( ; tx_id < max_tx_id; tx_id++) {
628  void *tx_ptr = AppLayerParserGetTx(ipproto, alproto, alstate, tx_id);
629  if (tx_ptr != NULL) {
630  ustate = tx_id + 1;
631  *state = *(AppLayerGetTxIterState *)&ustate;
632  AppLayerGetTxIterTuple tuple = {
633  .tx_ptr = tx_ptr,
634  .tx_id = tx_id,
635  .has_next = (tx_id + 1 < max_tx_id),
636  };
637  SCLogDebug("tuple: %p/%"PRIu64"/%s", tuple.tx_ptr, tuple.tx_id,
638  tuple.has_next ? "true" : "false");
639  return tuple;
640  }
641  }
642 
643  AppLayerGetTxIterTuple no_tuple = { NULL, 0, false };
644  return no_tuple;
645 }
646 
648  const AppProto alproto)
649 {
651  alp_ctx.ctxs[FlowGetProtoMapping(ipproto)][alproto].StateGetTxIterator;
652  return Func ? Func : AppLayerDefaultGetTxIterator;
653 }
654 
656 {
657  SCEnter();
658 
659  SCReturnCT((pstate == NULL) ? 0 : pstate->log_id, "uint64_t");
660 }
661 
663 {
664  SCEnter();
665 
666  if (pstate != NULL)
667  pstate->log_id = tx_id;
668 
669  SCReturn;
670 }
671 
672 uint64_t AppLayerParserGetTransactionInspectId(AppLayerParserState *pstate, uint8_t direction)
673 {
674  SCEnter();
675 
676  if (pstate == NULL)
677  SCReturnCT(0ULL, "uint64_t");
678 
679  SCReturnCT(pstate->inspect_id[direction & STREAM_TOSERVER ? 0 : 1], "uint64_t");
680 }
681 
682 static inline uint64_t GetTxDetectFlags(AppLayerTxData *txd, const uint8_t dir)
683 {
684  uint64_t detect_flags =
685  (dir & STREAM_TOSERVER) ? txd->detect_flags_ts : txd->detect_flags_tc;
686  return detect_flags;
687 }
688 
689 static inline void SetTxDetectFlags(AppLayerTxData *txd, const uint8_t dir, const uint64_t detect_flags)
690 {
691  if (dir & STREAM_TOSERVER) {
692  txd->detect_flags_ts = detect_flags;
693  } else {
694  txd->detect_flags_tc = detect_flags;
695  }
696 }
697 
698 static inline uint32_t GetTxLogged(AppLayerTxData *txd)
699 {
700  return txd->logged.flags;
701 }
702 
704  void *alstate, const uint8_t flags,
705  bool tag_txs_as_inspected)
706 {
707  SCEnter();
708 
709  const int direction = (flags & STREAM_TOSERVER) ? 0 : 1;
710  const uint64_t total_txs = AppLayerParserGetTxCnt(f, alstate);
711  uint64_t idx = AppLayerParserGetTransactionInspectId(pstate, flags);
712  const int state_done_progress = AppLayerParserGetStateProgressCompletionStatus(f->alproto, flags);
713  const uint8_t ipproto = f->proto;
714  const AppProto alproto = f->alproto;
715 
716  AppLayerGetTxIteratorFunc IterFunc = AppLayerGetTxIterator(ipproto, alproto);
718  memset(&state, 0, sizeof(state));
719 
720  SCLogDebug("called: %s, tag_txs_as_inspected %s",direction==0?"toserver":"toclient",
721  tag_txs_as_inspected?"true":"false");
722 
723  /* mark all txs as inspected if the applayer progress is
724  * at the 'end state'. */
725  while (1) {
726  AppLayerGetTxIterTuple ires = IterFunc(ipproto, alproto, alstate, idx, total_txs, &state);
727  if (ires.tx_ptr == NULL)
728  break;
729 
730  void *tx = ires.tx_ptr;
731  idx = ires.tx_id;
732 
733  int state_progress = AppLayerParserGetStateProgress(ipproto, alproto, tx, flags);
734  if (state_progress < state_done_progress)
735  break;
736 
737  AppLayerTxData *txd = AppLayerParserGetTxData(ipproto, alproto, tx);
738  if (txd && tag_txs_as_inspected) {
739  uint64_t detect_flags = GetTxDetectFlags(txd, flags);
740  if ((detect_flags & APP_LAYER_TX_INSPECTED_FLAG) == 0) {
741  detect_flags |= APP_LAYER_TX_INSPECTED_FLAG;
742  SetTxDetectFlags(txd, flags, detect_flags);
743  SCLogDebug("%p/%"PRIu64" in-order tx is done for direction %s. Flag %016"PRIx64,
744  tx, idx, flags & STREAM_TOSERVER ? "toserver" : "toclient", detect_flags);
745  }
746  }
747  idx++;
748  if (!ires.has_next)
749  break;
750  }
751  pstate->inspect_id[direction] = idx;
752  SCLogDebug("inspect_id now %"PRIu64, pstate->inspect_id[direction]);
753 
754  /* if necessary we flag all txs that are complete as 'inspected'
755  * also move inspect_id forward. */
756  if (tag_txs_as_inspected) {
757  /* continue at idx */
758  while (1) {
759  AppLayerGetTxIterTuple ires = IterFunc(ipproto, alproto, alstate, idx, total_txs, &state);
760  if (ires.tx_ptr == NULL)
761  break;
762 
763  void *tx = ires.tx_ptr;
764  /* if we got a higher id than the minimum we requested, we
765  * skipped a bunch of 'null-txs'. Lets see if we can up the
766  * inspect tracker */
767  if (ires.tx_id > idx && pstate->inspect_id[direction] == idx) {
768  pstate->inspect_id[direction] = ires.tx_id;
769  }
770  idx = ires.tx_id;
771 
772  const int state_progress = AppLayerParserGetStateProgress(ipproto, alproto, tx, flags);
773  if (state_progress < state_done_progress)
774  break;
775 
776  /* txd can be NULL for HTTP sessions where the user data alloc failed */
777  AppLayerTxData *txd = AppLayerParserGetTxData(ipproto, alproto, tx);
778  if (likely(txd)) {
779  uint64_t detect_flags = GetTxDetectFlags(txd, flags);
780  if ((detect_flags & APP_LAYER_TX_INSPECTED_FLAG) == 0) {
781  detect_flags |= APP_LAYER_TX_INSPECTED_FLAG;
782  SetTxDetectFlags(txd, flags, detect_flags);
783  SCLogDebug("%p/%"PRIu64" out of order tx is done for direction %s. Flag %016"PRIx64,
784  tx, idx, flags & STREAM_TOSERVER ? "toserver" : "toclient", detect_flags);
785 
786  SCLogDebug("%p/%"PRIu64" out of order tx. Update inspect_id? %"PRIu64,
787  tx, idx, pstate->inspect_id[direction]);
788  if (pstate->inspect_id[direction]+1 == idx)
789  pstate->inspect_id[direction] = idx;
790  }
791  } else {
792  if (pstate->inspect_id[direction]+1 == idx)
793  pstate->inspect_id[direction] = idx;
794  }
795  if (!ires.has_next)
796  break;
797  idx++;
798  }
799  }
800 
801  SCReturn;
802 }
803 
805 {
806  SCEnter();
807 
808  SCReturnPtr(pstate->decoder_events,
809  "AppLayerDecoderEvents *");
810 }
811 
813 {
814  pstate->decoder_events = devents;
815 }
816 
818  void *tx)
819 {
820  SCEnter();
821 
822  AppLayerDecoderEvents *ptr = NULL;
823 
824  /* Access events via the tx_data. */
825  AppLayerTxData *txd = AppLayerParserGetTxData(ipproto, alproto, tx);
826  if (txd != NULL && txd->events != NULL) {
827  ptr = txd->events;
828  }
829 
830  SCReturnPtr(ptr, "AppLayerDecoderEvents *");
831 }
832 
833 FileContainer *AppLayerParserGetFiles(const Flow *f, const uint8_t direction)
834 {
835  SCEnter();
836 
837  FileContainer *ptr = NULL;
838 
839  if (alp_ctx.ctxs[f->protomap][f->alproto].StateGetFiles != NULL)
840  {
841  ptr = alp_ctx.ctxs[f->protomap][f->alproto].
842  StateGetFiles(f->alstate, direction);
843  }
844 
845  SCReturnPtr(ptr, "FileContainer *");
846 }
847 
848 #define IS_DISRUPTED(flags) ((flags) & (STREAM_DEPTH | STREAM_GAP))
849 
850 extern int g_detect_disabled;
851 extern bool g_file_logger_enabled;
852 extern bool g_filedata_logger_enabled;
853 
854 /**
855  * \brief remove obsolete (inspected and logged) transactions
856  */
858 {
859  SCEnter();
861 
862  AppLayerParserProtoCtx *p = &alp_ctx.ctxs[f->protomap][f->alproto];
863  if (unlikely(p->StateTransactionFree == NULL))
864  SCReturn;
865 
866  const bool has_tx_detect_flags = !g_detect_disabled;
867  const uint8_t ipproto = f->proto;
868  const AppProto alproto = f->alproto;
869  void * const alstate = f->alstate;
870  AppLayerParserState * const alparser = f->alparser;
871 
872  if (alstate == NULL || alparser == NULL)
873  SCReturn;
874 
875  const uint64_t min = alparser->min_id;
876  const uint64_t total_txs = AppLayerParserGetTxCnt(f, alstate);
877  const LoggerId logger_expectation = AppLayerParserProtocolGetLoggerBits(ipproto, alproto);
878  const int tx_end_state_ts = AppLayerParserGetStateProgressCompletionStatus(alproto, STREAM_TOSERVER);
879  const int tx_end_state_tc = AppLayerParserGetStateProgressCompletionStatus(alproto, STREAM_TOCLIENT);
880  const uint8_t ts_disrupt_flags = FlowGetDisruptionFlags(f, STREAM_TOSERVER);
881  const uint8_t tc_disrupt_flags = FlowGetDisruptionFlags(f, STREAM_TOCLIENT);
882 
883  AppLayerGetTxIteratorFunc IterFunc = AppLayerGetTxIterator(ipproto, alproto);
885  memset(&state, 0, sizeof(state));
886  uint64_t i = min;
887  uint64_t new_min = min;
888  SCLogDebug("start min %"PRIu64, min);
889  bool skipped = false;
890  const bool is_unidir =
892 
893  while (1) {
894  AppLayerGetTxIterTuple ires = IterFunc(ipproto, alproto, alstate, i, total_txs, &state);
895  if (ires.tx_ptr == NULL)
896  break;
897 
898  bool tx_skipped = false;
899  void *tx = ires.tx_ptr;
900  i = ires.tx_id; // actual tx id for the tx the IterFunc returned
901 
902  SCLogDebug("%p/%"PRIu64" checking", tx, i);
903 
904  const int tx_progress_tc =
905  AppLayerParserGetStateProgress(ipproto, alproto, tx, tc_disrupt_flags);
906  if (tx_progress_tc < tx_end_state_tc) {
907  SCLogDebug("%p/%"PRIu64" skipping: tc parser not done", tx, i);
908  skipped = true;
909  goto next;
910  }
911  const int tx_progress_ts =
912  AppLayerParserGetStateProgress(ipproto, alproto, tx, ts_disrupt_flags);
913  if (tx_progress_ts < tx_end_state_ts) {
914  SCLogDebug("%p/%"PRIu64" skipping: ts parser not done", tx, i);
915  skipped = true;
916  goto next;
917  }
918 
919  AppLayerTxData *txd = AppLayerParserGetTxData(ipproto, alproto, tx);
920  bool inspected = false;
921  if (txd && has_tx_detect_flags) {
922  if (!IS_DISRUPTED(ts_disrupt_flags) && f->sgh_toserver != NULL) {
923  uint64_t detect_flags_ts = GetTxDetectFlags(txd, STREAM_TOSERVER);
924  if (!(detect_flags_ts & APP_LAYER_TX_INSPECTED_FLAG)) {
925  SCLogDebug("%p/%"PRIu64" skipping: TS inspect not done: ts:%"PRIx64,
926  tx, i, detect_flags_ts);
927  tx_skipped = true;
928  } else {
929  inspected = true;
930  }
931  }
932  if (!IS_DISRUPTED(tc_disrupt_flags) && f->sgh_toclient != NULL) {
933  uint64_t detect_flags_tc = GetTxDetectFlags(txd, STREAM_TOCLIENT);
934  if (!(detect_flags_tc & APP_LAYER_TX_INSPECTED_FLAG)) {
935  SCLogDebug("%p/%"PRIu64" skipping: TC inspect not done: tc:%"PRIx64,
936  tx, i, detect_flags_tc);
937  tx_skipped = true;
938  } else {
939  inspected = true;
940  }
941  }
942  }
943 
944  // If not a unidirectional transaction both sides are required to have
945  // been inspected.
946  if (!is_unidir && tx_skipped) {
947  SCLogDebug("%p/%" PRIu64 " !is_unidir && tx_skipped", tx, i);
948  skipped = true;
949  goto next;
950  }
951 
952  // If this is a unidirectional transaction require only one side to be
953  // inspected, which the inspected flag tells us. This is also guarded
954  // with skip to limit this check to transactions that actually had the
955  // tx inspected flag checked.
956  if (is_unidir && tx_skipped && !inspected) {
957  SCLogDebug("%p/%" PRIu64 " is_unidir && tx_skipped && !inspected", tx, i);
958  skipped = true;
959  goto next;
960  }
961 
962  if (txd && logger_expectation != 0) {
963  LoggerId tx_logged = GetTxLogged(txd);
964  if (tx_logged != logger_expectation) {
965  SCLogDebug("%p/%"PRIu64" skipping: logging not done: want:%"PRIx32", have:%"PRIx32,
966  tx, i, logger_expectation, tx_logged);
967  skipped = true;
968  goto next;
969  }
970  }
971 
972  /* if file logging is enabled, we keep a tx active while some of the files aren't
973  * logged yet. */
974  if (txd && txd->files_opened) {
975  if (g_file_logger_enabled && txd->files_opened != txd->files_logged) {
976  skipped = true;
977  goto next;
978  }
979  if (g_filedata_logger_enabled && txd->files_opened != txd->files_stored) {
980  skipped = true;
981  goto next;
982  }
983  }
984 
985  /* if we are here, the tx can be freed. */
986  p->StateTransactionFree(alstate, i);
987  SCLogDebug("%p/%"PRIu64" freed", tx, i);
988 
989  /* if we didn't skip any tx so far, up the minimum */
990  SCLogDebug("skipped? %s i %"PRIu64", new_min %"PRIu64, skipped ? "true" : "false", i, new_min);
991  if (!skipped)
992  new_min = i + 1;
993  SCLogDebug("final i %"PRIu64", new_min %"PRIu64, i, new_min);
994 
995 next:
996  if (!ires.has_next) {
997  /* this was the last tx. See if we skipped any. If not
998  * we removed all and can update the minimum to the max
999  * id. */
1000  SCLogDebug("no next: cur tx i %"PRIu64", total %"PRIu64, i, total_txs);
1001  if (!skipped) {
1002  new_min = total_txs;
1003  SCLogDebug("no next: cur tx i %"PRIu64", total %"PRIu64": "
1004  "new_min updated to %"PRIu64, i, total_txs, new_min);
1005  }
1006  break;
1007  }
1008  i++;
1009  }
1010 
1011  /* see if we need to bring all trackers up to date. */
1012  SCLogDebug("update f->alparser->min_id? %"PRIu64" vs %"PRIu64, new_min, alparser->min_id);
1013  if (new_min > alparser->min_id) {
1014  const uint64_t next_id = new_min;
1015  alparser->min_id = next_id;
1016  alparser->inspect_id[0] = MAX(alparser->inspect_id[0], next_id);
1017  alparser->inspect_id[1] = MAX(alparser->inspect_id[1], next_id);
1018  alparser->log_id = MAX(alparser->log_id, next_id);
1019  SCLogDebug("updated f->alparser->min_id %"PRIu64, alparser->min_id);
1020  }
1021  SCReturn;
1022 }
1023 
1024 static inline int StateGetProgressCompletionStatus(const AppProto alproto, const uint8_t flags)
1025 {
1026  if (flags & STREAM_TOSERVER) {
1027  return alp_ctx.ctxs[FLOW_PROTO_DEFAULT][alproto].complete_ts;
1028  } else if (flags & STREAM_TOCLIENT) {
1029  return alp_ctx.ctxs[FLOW_PROTO_DEFAULT][alproto].complete_tc;
1030  } else {
1032  return 0;
1033  }
1034 }
1035 
1036 /**
1037  * \brief get the progress value for a tx/protocol
1038  *
1039  * If the stream is disrupted, we return the 'completion' value.
1040  */
1041 int AppLayerParserGetStateProgress(uint8_t ipproto, AppProto alproto,
1042  void *alstate, uint8_t flags)
1043 {
1044  SCEnter();
1045  int r;
1046  if (unlikely(IS_DISRUPTED(flags))) {
1047  r = StateGetProgressCompletionStatus(alproto, flags);
1048  } else {
1049  r = alp_ctx.ctxs[FlowGetProtoMapping(ipproto)][alproto].
1050  StateGetProgress(alstate, flags);
1051  }
1052  SCReturnInt(r);
1053 }
1054 
1055 uint64_t AppLayerParserGetTxCnt(const Flow *f, void *alstate)
1056 {
1057  SCEnter();
1058  uint64_t r = alp_ctx.ctxs[f->protomap][f->alproto].StateGetTxCnt(alstate);
1059  SCReturnCT(r, "uint64_t");
1060 }
1061 
1062 void *AppLayerParserGetTx(uint8_t ipproto, AppProto alproto, void *alstate, uint64_t tx_id)
1063 {
1064  SCEnter();
1065  void *r = alp_ctx.ctxs[FlowGetProtoMapping(ipproto)][alproto].StateGetTx(alstate, tx_id);
1066  SCReturnPtr(r, "void *");
1067 }
1068 
1070  uint8_t direction)
1071 {
1072  SCEnter();
1073  int r = StateGetProgressCompletionStatus(alproto, direction);
1074  SCReturnInt(r);
1075 }
1076 
1077 int AppLayerParserGetEventInfo(uint8_t ipproto, AppProto alproto, const char *event_name,
1078  int *event_id, AppLayerEventType *event_type)
1079 {
1080  SCEnter();
1081  const int ipproto_map = FlowGetProtoMapping(ipproto);
1082  int r = (alp_ctx.ctxs[ipproto_map][alproto].StateGetEventInfo == NULL) ?
1083  -1 : alp_ctx.ctxs[ipproto_map][alproto].StateGetEventInfo(event_name, event_id, event_type);
1084  SCReturnInt(r);
1085 }
1086 
1087 int AppLayerParserGetEventInfoById(uint8_t ipproto, AppProto alproto, int event_id,
1088  const char **event_name, AppLayerEventType *event_type)
1089 {
1090  SCEnter();
1091  const int ipproto_map = FlowGetProtoMapping(ipproto);
1092  *event_name = (const char *)NULL;
1093  int r = (alp_ctx.ctxs[ipproto_map][alproto].StateGetEventInfoById == NULL) ?
1094  -1 : alp_ctx.ctxs[ipproto_map][alproto].StateGetEventInfoById(event_id, event_name, event_type);
1095  SCReturnInt(r);
1096 }
1097 
1098 uint8_t AppLayerParserGetFirstDataDir(uint8_t ipproto, AppProto alproto)
1099 {
1100  SCEnter();
1101  uint8_t r = alp_ctx.ctxs[FlowGetProtoMapping(ipproto)][alproto].first_data_dir;
1102  SCReturnCT(r, "uint8_t");
1103 }
1104 
1106  AppLayerParserState *pstate, uint8_t direction)
1107 {
1108  SCEnter();
1109 
1110  uint64_t active_id;
1111  uint64_t log_id = pstate->log_id;
1112  uint64_t inspect_id = pstate->inspect_id[direction & STREAM_TOSERVER ? 0 : 1];
1113  if (alp_ctx.ctxs[f->protomap][f->alproto].logger == true) {
1114  active_id = MIN(log_id, inspect_id);
1115  } else {
1116  active_id = inspect_id;
1117  }
1118 
1119  SCReturnCT(active_id, "uint64_t");
1120 }
1121 
1122 int AppLayerParserSupportsFiles(uint8_t ipproto, AppProto alproto)
1123 {
1124  // Custom case for only signature-only protocol so far
1125  if (alproto == ALPROTO_HTTP) {
1126  return AppLayerParserSupportsFiles(ipproto, ALPROTO_HTTP1) ||
1128  }
1129  if (alp_ctx.ctxs[FlowGetProtoMapping(ipproto)][alproto].StateGetFiles != NULL)
1130  return TRUE;
1131  return FALSE;
1132 }
1133 
1134 AppLayerTxData *AppLayerParserGetTxData(uint8_t ipproto, AppProto alproto, void *tx)
1135 {
1136  SCEnter();
1137  AppLayerTxData *d = alp_ctx.ctxs[FlowGetProtoMapping(ipproto)][alproto].GetTxData(tx);
1138  SCReturnPtr(d, "AppLayerTxData");
1139 }
1140 
1141 void AppLayerParserApplyTxConfig(uint8_t ipproto, AppProto alproto,
1142  void *state, void *tx, enum ConfigAction mode, AppLayerTxConfig config)
1143 {
1144  SCEnter();
1145  const int ipproto_map = FlowGetProtoMapping(ipproto);
1146  if (alp_ctx.ctxs[ipproto_map][alproto].ApplyTxConfig) {
1147  alp_ctx.ctxs[ipproto_map][alproto].ApplyTxConfig(state, tx, mode, config);
1148  }
1149  SCReturn;
1150 }
1151 
1152 /***** General *****/
1153 
1154 static inline void SetEOFFlags(AppLayerParserState *pstate, const uint8_t flags)
1155 {
1156  if ((flags & (STREAM_EOF|STREAM_TOSERVER)) == (STREAM_EOF|STREAM_TOSERVER)) {
1157  SCLogDebug("setting APP_LAYER_PARSER_EOF_TS");
1159  } else if ((flags & (STREAM_EOF|STREAM_TOCLIENT)) == (STREAM_EOF|STREAM_TOCLIENT)) {
1160  SCLogDebug("setting APP_LAYER_PARSER_EOF_TC");
1162  }
1163 }
1164 
1165 static void Setup(Flow *f, const uint8_t direction, const uint8_t *input, uint32_t input_len,
1166  const uint8_t flags, StreamSlice *as)
1167 {
1168  memset(as, 0, sizeof(*as));
1169  as->input = input;
1170  as->input_len = input_len;
1171  as->flags = flags;
1172 
1173  if (f->proto == IPPROTO_TCP && f->protoctx != NULL) {
1174  TcpSession *ssn = f->protoctx;
1175  TcpStream *stream = (direction & STREAM_TOSERVER) ? &ssn->client : &ssn->server;
1176  as->offset = STREAM_APP_PROGRESS(stream);
1177  }
1178 }
1179 
1180 /** \retval int -1 in case of unrecoverable error. App-layer tracking stops for this flow.
1181  * \retval int 0 ok: we did not update app_progress
1182  * \retval int 1 ok: we updated app_progress */
1184  uint8_t flags, const uint8_t *input, uint32_t input_len)
1185 {
1186  SCEnter();
1187 #ifdef DEBUG_VALIDATION
1189 #endif
1190  AppLayerParserState *pstate = f->alparser;
1191  AppLayerParserProtoCtx *p = &alp_ctx.ctxs[f->protomap][alproto];
1192  StreamSlice stream_slice;
1193  void *alstate = NULL;
1194  uint64_t p_tx_cnt = 0;
1195  uint32_t consumed = input_len;
1196  const int direction = (flags & STREAM_TOSERVER) ? 0 : 1;
1197 
1198  /* we don't have the parser registered for this protocol */
1199  if (p->StateAlloc == NULL)
1200  goto end;
1201 
1202  if (flags & STREAM_GAP) {
1204  SCLogDebug("app-layer parser does not accept gaps");
1205  if (f->alstate != NULL && !FlowChangeProto(f)) {
1207  flags);
1208  }
1209  goto error;
1210  }
1211  }
1212 
1213  /* Get the parser state (if any) */
1214  if (pstate == NULL) {
1215  f->alparser = pstate = AppLayerParserStateAlloc();
1216  if (pstate == NULL)
1217  goto error;
1218  }
1219 
1220  SetEOFFlags(pstate, flags);
1221 
1222  alstate = f->alstate;
1223  if (alstate == NULL || FlowChangeProto(f)) {
1224  f->alstate = alstate = p->StateAlloc(alstate, f->alproto_orig);
1225  if (alstate == NULL)
1226  goto error;
1227  SCLogDebug("alloced new app layer state %p (name %s)",
1228  alstate, AppLayerGetProtoName(f->alproto));
1229  } else {
1230  SCLogDebug("using existing app layer state %p (name %s))",
1231  alstate, AppLayerGetProtoName(f->alproto));
1232  }
1233 
1234  p_tx_cnt = AppLayerParserGetTxCnt(f, f->alstate);
1235 
1236  /* invoke the recursive parser, but only on data. We may get empty msgs on EOF */
1237  if (input_len > 0 || (flags & STREAM_EOF)) {
1238  Setup(f, flags & (STREAM_TOSERVER | STREAM_TOCLIENT), input, input_len, flags,
1239  &stream_slice);
1240  /* invoke the parser */
1241  AppLayerResult res = p->Parser[direction](f, alstate, pstate, stream_slice,
1242  alp_tctx->alproto_local_storage[f->protomap][alproto]);
1243  if (res.status < 0) {
1244  goto error;
1245  } else if (res.status > 0) {
1246  DEBUG_VALIDATE_BUG_ON(res.consumed > input_len);
1247  DEBUG_VALIDATE_BUG_ON(res.needed + res.consumed < input_len);
1248  DEBUG_VALIDATE_BUG_ON(res.needed == 0);
1249  /* incomplete is only supported for TCP */
1250  DEBUG_VALIDATE_BUG_ON(f->proto != IPPROTO_TCP);
1251 
1252  /* put protocol in error state on improper use of the
1253  * return codes. */
1254  if (res.consumed > input_len || res.needed + res.consumed < input_len) {
1255  goto error;
1256  }
1257 
1258  if (f->proto == IPPROTO_TCP && f->protoctx != NULL) {
1259  TcpSession *ssn = f->protoctx;
1260  SCLogDebug("direction %d/%s", direction,
1261  (flags & STREAM_TOSERVER) ? "toserver" : "toclient");
1262  if (direction == 0) {
1263  /* parser told us how much data it needs on top of what it
1264  * consumed. So we need tell stream engine how much we need
1265  * before the next call */
1266  ssn->client.data_required = res.needed;
1267  SCLogDebug("setting data_required %u", ssn->client.data_required);
1268  } else {
1269  /* parser told us how much data it needs on top of what it
1270  * consumed. So we need tell stream engine how much we need
1271  * before the next call */
1272  ssn->server.data_required = res.needed;
1273  SCLogDebug("setting data_required %u", ssn->server.data_required);
1274  }
1275  }
1276  consumed = res.consumed;
1277  }
1278  }
1279 
1280  /* set the packets to no inspection and reassembly if required */
1281  if (pstate->flags & APP_LAYER_PARSER_NO_INSPECTION) {
1282  AppLayerParserSetEOF(pstate);
1283  FlowSetNoPayloadInspectionFlag(f);
1284 
1285  if (f->proto == IPPROTO_TCP) {
1287 
1288  /* Set the no reassembly flag for both the stream in this TcpSession */
1289  if (pstate->flags & APP_LAYER_PARSER_NO_REASSEMBLY) {
1290  /* Used only if it's TCP */
1291  TcpSession *ssn = f->protoctx;
1292  if (ssn != NULL) {
1295  }
1296  }
1297  /* Set the bypass flag for both the stream in this TcpSession */
1298  if (pstate->flags & APP_LAYER_PARSER_BYPASS_READY) {
1299  /* Used only if it's TCP */
1300  TcpSession *ssn = f->protoctx;
1301  if (ssn != NULL) {
1303  }
1304  }
1305  }
1306  }
1307 
1308  /* In cases like HeartBleed for TLS we need to inspect AppLayer but not Payload */
1310  FlowSetNoPayloadInspectionFlag(f);
1311  /* Set the no reassembly flag for both the stream in this TcpSession */
1312  if (f->proto == IPPROTO_TCP) {
1313  /* Used only if it's TCP */
1314  TcpSession *ssn = f->protoctx;
1315  if (ssn != NULL) {
1318  }
1319  }
1320  }
1321 
1322  /* get the diff in tx cnt for stats keeping */
1323  uint64_t cur_tx_cnt = AppLayerParserGetTxCnt(f, f->alstate);
1324  if (cur_tx_cnt > p_tx_cnt && tv) {
1325  AppLayerIncTxCounter(tv, f, cur_tx_cnt - p_tx_cnt);
1326  }
1327 
1328  /* stream truncated, inform app layer */
1329  if (flags & STREAM_DEPTH)
1330  AppLayerParserStreamTruncated(f->proto, alproto, alstate, flags);
1331 
1332  end:
1333  /* update app progress */
1334  if (consumed != input_len && f->proto == IPPROTO_TCP && f->protoctx != NULL) {
1335  TcpSession *ssn = f->protoctx;
1336  StreamTcpUpdateAppLayerProgress(ssn, direction, consumed);
1337  SCReturnInt(1);
1338  }
1339 
1340  SCReturnInt(0);
1341  error:
1342  /* Set the no app layer inspection flag for both
1343  * the stream in this Flow */
1344  if (f->proto == IPPROTO_TCP) {
1346  }
1347  AppLayerParserSetEOF(pstate);
1348  SCReturnInt(-1);
1349 }
1350 
1352 {
1353  SCEnter();
1354 
1355  if (pstate == NULL)
1356  goto end;
1357 
1358  SCLogDebug("setting APP_LAYER_PARSER_EOF_TC and APP_LAYER_PARSER_EOF_TS");
1360 
1361  end:
1362  SCReturn;
1363 }
1364 
1365 /* return true if there are app parser decoder events. These are
1366  * only the ones that are set during protocol detection. */
1368 {
1369  SCEnter();
1370 
1371  if (pstate == NULL)
1372  return false;
1373 
1376  return true;
1377 
1378  /* if we have reached here, we don't have events */
1379  return false;
1380 }
1381 
1382 /** \brief simple way to globally test if a alproto is registered
1383  * and fully enabled in the configuration.
1384  */
1386 {
1387  for (int i = 0; i < FLOW_PROTO_APPLAYER_MAX; i++) {
1388  if (alp_ctx.ctxs[i][alproto].StateGetProgress != NULL) {
1389  return 1;
1390  }
1391  }
1392  return 0;
1393 }
1394 
1395 int AppLayerParserProtocolHasLogger(uint8_t ipproto, AppProto alproto)
1396 {
1397  SCEnter();
1398  int ipproto_map = FlowGetProtoMapping(ipproto);
1399  int r = (alp_ctx.ctxs[ipproto_map][alproto].logger == false) ? 0 : 1;
1400  SCReturnInt(r);
1401 }
1402 
1404 {
1405  SCEnter();
1406  const int ipproto_map = FlowGetProtoMapping(ipproto);
1407  LoggerId r = alp_ctx.ctxs[ipproto_map][alproto].logger_bits;
1408  SCReturnUInt(r);
1409 }
1410 
1412 {
1413  SCEnter();
1414 
1415  SCLogDebug("f %p tcp %p direction %d", f, f ? f->protoctx : NULL, direction);
1416  if (f != NULL && f->protoctx != NULL)
1418 
1419  SCReturn;
1420 }
1421 
1422 void AppLayerParserSetStreamDepth(uint8_t ipproto, AppProto alproto, uint32_t stream_depth)
1423 {
1424  SCEnter();
1425 
1426  alp_ctx.ctxs[FlowGetProtoMapping(ipproto)][alproto].stream_depth = stream_depth;
1427  alp_ctx.ctxs[FlowGetProtoMapping(ipproto)][alproto].internal_flags |=
1429 
1430  SCReturn;
1431 }
1432 
1434 {
1435  SCReturnInt(alp_ctx.ctxs[f->protomap][f->alproto].stream_depth);
1436 }
1437 
1438 void AppLayerParserSetStreamDepthFlag(uint8_t ipproto, AppProto alproto, void *state, uint64_t tx_id, uint8_t flags)
1439 {
1440  SCEnter();
1441  void *tx = NULL;
1442  if (state != NULL) {
1443  if ((tx = AppLayerParserGetTx(ipproto, alproto, state, tx_id)) != NULL) {
1444  if (alp_ctx.ctxs[FlowGetProtoMapping(ipproto)][alproto].SetStreamDepthFlag != NULL) {
1445  alp_ctx.ctxs[FlowGetProtoMapping(ipproto)][alproto].SetStreamDepthFlag(tx, flags);
1446  }
1447  }
1448  }
1449  SCReturn;
1450 }
1451 
1452 /***** Cleanup *****/
1453 
1455  uint8_t protomap, AppProto alproto, void *alstate, AppLayerParserState *pstate)
1456 {
1457  SCEnter();
1458 
1459  AppLayerParserProtoCtx *ctx = &alp_ctx.ctxs[protomap][alproto];
1460 
1461  if (ctx->StateFree != NULL && alstate != NULL)
1462  ctx->StateFree(alstate);
1463 
1464  /* free the app layer parser api state */
1465  if (pstate != NULL)
1466  AppLayerParserStateFree(pstate);
1467 
1468  SCReturn;
1469 }
1470 
1471 void AppLayerParserStateCleanup(const Flow *f, void *alstate, AppLayerParserState *pstate)
1472 {
1473  AppLayerParserStateProtoCleanup(f->protomap, f->alproto, alstate, pstate);
1474 }
1475 
1476 static void ValidateParserProtoDump(AppProto alproto, uint8_t ipproto)
1477 {
1478  uint8_t map = FlowGetProtoMapping(ipproto);
1479  const AppLayerParserProtoCtx *ctx = &alp_ctx.ctxs[map][alproto];
1480  printf("ERROR: incomplete app-layer registration\n");
1481  printf("AppLayer protocol %s ipproto %u\n", AppProtoToString(alproto), ipproto);
1482  printf("- option flags %"PRIx32"\n", ctx->option_flags);
1483  printf("- first_data_dir %"PRIx8"\n", ctx->first_data_dir);
1484  printf("Mandatory:\n");
1485  printf("- Parser[0] %p Parser[1] %p\n", ctx->Parser[0], ctx->Parser[1]);
1486  printf("- StateAlloc %p StateFree %p\n", ctx->StateAlloc, ctx->StateFree);
1487  printf("- StateGetTx %p StateGetTxCnt %p StateTransactionFree %p\n",
1488  ctx->StateGetTx, ctx->StateGetTxCnt, ctx->StateTransactionFree);
1489  printf("- GetTxData %p\n", ctx->GetTxData);
1490  printf("- StateGetProgress %p\n", ctx->StateGetProgress);
1491  printf("Optional:\n");
1492  printf("- LocalStorageAlloc %p LocalStorageFree %p\n", ctx->LocalStorageAlloc, ctx->LocalStorageFree);
1493  printf("- StateGetEventInfo %p StateGetEventInfoById %p\n", ctx->StateGetEventInfo,
1494  ctx->StateGetEventInfoById);
1495 }
1496 
1497 #define BOTH_SET(a, b) ((a) != NULL && (b) != NULL)
1498 #define BOTH_SET_OR_BOTH_UNSET(a, b) (((a) == NULL && (b) == NULL) || ((a) != NULL && (b) != NULL))
1499 #define THREE_SET_OR_THREE_UNSET(a, b, c) (((a) == NULL && (b) == NULL && (c) == NULL) || ((a) != NULL && (b) != NULL && (c) != NULL))
1500 #define THREE_SET(a, b, c) ((a) != NULL && (b) != NULL && (c) != NULL)
1502 static void ValidateParserProto(AppProto alproto, uint8_t ipproto)
1503 {
1504  uint8_t map = FlowGetProtoMapping(ipproto);
1505  const AppLayerParserProtoCtx *ctx = &alp_ctx.ctxs[map][alproto];
1506 
1507  if (ctx->Parser[0] == NULL && ctx->Parser[1] == NULL)
1508  return;
1509 
1510  if (!(BOTH_SET(ctx->Parser[0], ctx->Parser[1]))) {
1511  goto bad;
1512  }
1513  if (!(BOTH_SET(ctx->StateFree, ctx->StateAlloc))) {
1514  goto bad;
1515  }
1516  if (!(THREE_SET(ctx->StateGetTx, ctx->StateGetTxCnt, ctx->StateTransactionFree))) {
1517  goto bad;
1518  }
1519  if (ctx->StateGetProgress == NULL) {
1520  goto bad;
1521  }
1522  /* local storage is optional, but needs both set if used */
1524  goto bad;
1525  }
1526  if (ctx->GetTxData == NULL) {
1527  goto bad;
1528  }
1529  return;
1530 bad:
1531  ValidateParserProtoDump(alproto, ipproto);
1532  exit(EXIT_FAILURE);
1533 }
1534 #undef BOTH_SET
1535 #undef BOTH_SET_OR_BOTH_UNSET
1536 #undef THREE_SET_OR_THREE_UNSET
1537 #undef THREE_SET
1538 
1539 static void ValidateParser(AppProto alproto)
1540 {
1541  ValidateParserProto(alproto, IPPROTO_TCP);
1542  ValidateParserProto(alproto, IPPROTO_UDP);
1543 }
1544 
1545 static void ValidateParsers(void)
1546 {
1547  AppProto p = 0;
1548  for ( ; p < ALPROTO_MAX; p++) {
1549  ValidateParser(p);
1550  }
1551 }
1552 
1554 {
1555  SCEnter();
1556 
1559  rs_dcerpc_register_parser();
1560  rs_dcerpc_udp_register_parser();
1565  rs_dns_udp_register_parser();
1566  rs_dns_tcp_register_parser();
1577  rs_dhcp_register_parser();
1586 
1587  /** IMAP */
1589  if (AppLayerProtoDetectConfProtoDetectionEnabled("tcp", "imap")) {
1591  "1|20|capability", 12, 0, STREAM_TOSERVER) < 0)
1592  {
1593  SCLogInfo("imap proto registration failure");
1594  exit(EXIT_FAILURE);
1595  }
1596  } else {
1597  SCLogInfo("Protocol detection and parser disabled for %s protocol.",
1598  "imap");
1599  }
1600 
1601  ValidateParsers();
1602  return;
1603 }
1604 
1605 
1606 /* coccinelle: AppLayerParserStateSetFlag():2,2:APP_LAYER_PARSER_ */
1608 {
1609  SCEnter();
1610  pstate->flags |= flag;
1611  SCReturn;
1612 }
1613 
1614 /* coccinelle: AppLayerParserStateIssetFlag():2,2:APP_LAYER_PARSER_ */
1616 {
1617  SCEnter();
1618  SCReturnInt(pstate->flags & flag);
1619 }
1620 
1621 
1622 void AppLayerParserStreamTruncated(uint8_t ipproto, AppProto alproto, void *alstate,
1623  uint8_t direction)
1624 {
1625  SCEnter();
1626 
1627  if (alp_ctx.ctxs[FlowGetProtoMapping(ipproto)][alproto].Truncate != NULL)
1628  alp_ctx.ctxs[FlowGetProtoMapping(ipproto)][alproto].Truncate(alstate, direction);
1629 
1630  SCReturn;
1631 }
1632 
1633 #ifdef DEBUG
1634 void AppLayerParserStatePrintDetails(AppLayerParserState *pstate)
1635 {
1636  SCEnter();
1637 
1638  if (pstate == NULL)
1639  SCReturn;
1640 
1641  AppLayerParserState *p = pstate;
1642  SCLogDebug("AppLayerParser parser state information for parser state p(%p). "
1643  "p->inspect_id[0](%"PRIu64"), "
1644  "p->inspect_id[1](%"PRIu64"), "
1645  "p->log_id(%"PRIu64"), "
1646  "p->decoder_events(%p).",
1647  pstate, p->inspect_id[0], p->inspect_id[1], p->log_id,
1648  p->decoder_events);
1649 
1650  SCReturn;
1651 }
1652 #endif
1653 
1654 /***** Unittests *****/
1655 
1656 #ifdef UNITTESTS
1657 
1658 static AppLayerParserCtx alp_ctx_backup_unittest;
1659 
1660 typedef struct TestState_ {
1661  uint8_t test;
1663 
1664 /**
1665  * \brief Test parser function to test the memory deallocation of app layer
1666  * parser of occurence of an error.
1667  */
1668 static AppLayerResult TestProtocolParser(Flow *f, void *test_state, AppLayerParserState *pstate,
1669  StreamSlice stream_slice, void *local_data)
1670 {
1671  SCEnter();
1673 }
1674 
1675 /** \brief Function to allocates the Test protocol state memory
1676  */
1677 static void *TestProtocolStateAlloc(void *orig_state, AppProto proto_orig)
1678 {
1679  SCEnter();
1680  void *s = SCMalloc(sizeof(TestState));
1681  if (unlikely(s == NULL))
1682  goto end;
1683  memset(s, 0, sizeof(TestState));
1684  end:
1685  SCReturnPtr(s, "TestState");
1686 }
1687 
1688 /** \brief Function to free the Test Protocol state memory
1689  */
1690 static void TestProtocolStateFree(void *s)
1691 {
1692  SCFree(s);
1693 }
1694 
1695 static uint64_t TestGetTxCnt(void *state)
1696 {
1697  /* single tx */
1698  return 1;
1699 }
1700 
1701 static void TestStateTransactionFree(void *state, uint64_t tx_id)
1702 {
1703  /* do nothing */
1704 }
1705 
1706 static void *TestGetTx(void *state, uint64_t tx_id)
1707 {
1708  TestState *test_state = (TestState *)state;
1709  return test_state;
1710 }
1711 
1713  void (*RegisterUnittests)(void))
1714 {
1715  SCEnter();
1716  alp_ctx.ctxs[FlowGetProtoMapping(ipproto)][alproto].
1717  RegisterUnittests = RegisterUnittests;
1718  SCReturn;
1719 }
1720 
1722 {
1723  SCEnter();
1724  alp_ctx_backup_unittest = alp_ctx;
1725  memset(&alp_ctx, 0, sizeof(alp_ctx));
1726  SCReturn;
1727 }
1728 
1730 {
1731  SCEnter();
1732  alp_ctx = alp_ctx_backup_unittest;
1733  memset(&alp_ctx_backup_unittest, 0, sizeof(alp_ctx_backup_unittest));
1734  SCReturn;
1735 }
1736 
1737 /**
1738  * \test Test the deallocation of app layer parser memory on occurance of
1739  * error in the parsing process.
1740  */
1741 static int AppLayerParserTest01(void)
1742 {
1744 
1745  Flow *f = NULL;
1746  uint8_t testbuf[] = { 0x11 };
1747  uint32_t testlen = sizeof(testbuf);
1748  TcpSession ssn;
1750 
1751  memset(&ssn, 0, sizeof(ssn));
1752 
1753  /* Register the Test protocol state and parser functions */
1754  AppLayerParserRegisterParser(IPPROTO_TCP, ALPROTO_TEST, STREAM_TOSERVER, TestProtocolParser);
1756  TestProtocolStateAlloc, TestProtocolStateFree);
1757  AppLayerParserRegisterTxFreeFunc(IPPROTO_TCP, ALPROTO_TEST, TestStateTransactionFree);
1758  AppLayerParserRegisterGetTx(IPPROTO_TCP, ALPROTO_TEST, TestGetTx);
1759  AppLayerParserRegisterGetTxCnt(IPPROTO_TCP, ALPROTO_TEST, TestGetTxCnt);
1760 
1761  f = UTHBuildFlow(AF_INET, "1.2.3.4", "4.3.2.1", 20, 40);
1762  FAIL_IF_NULL(f);
1763  f->protoctx = &ssn;
1764  f->alproto = ALPROTO_TEST;
1765  f->proto = IPPROTO_TCP;
1766 
1767  StreamTcpInitConfig(true);
1768 
1769  int r = AppLayerParserParse(NULL, alp_tctx, f, ALPROTO_TEST,
1770  STREAM_TOSERVER | STREAM_EOF, testbuf,
1771  testlen);
1772  FAIL_IF(r != -1);
1773 
1775 
1777  StreamTcpFreeConfig(true);
1778  UTHFreeFlow(f);
1779  PASS;
1780 }
1781 
1782 /**
1783  * \test Test the deallocation of app layer parser memory on occurance of
1784  * error in the parsing process for UDP.
1785  */
1786 static int AppLayerParserTest02(void)
1787 {
1789 
1790  Flow *f = NULL;
1791  uint8_t testbuf[] = { 0x11 };
1792  uint32_t testlen = sizeof(testbuf);
1794 
1795  /* Register the Test protocol state and parser functions */
1796  AppLayerParserRegisterParser(IPPROTO_UDP, ALPROTO_TEST, STREAM_TOSERVER,
1797  TestProtocolParser);
1799  TestProtocolStateAlloc, TestProtocolStateFree);
1800  AppLayerParserRegisterTxFreeFunc(IPPROTO_UDP, ALPROTO_TEST, TestStateTransactionFree);
1801  AppLayerParserRegisterGetTx(IPPROTO_UDP, ALPROTO_TEST, TestGetTx);
1802  AppLayerParserRegisterGetTxCnt(IPPROTO_UDP, ALPROTO_TEST, TestGetTxCnt);
1803 
1804  f = UTHBuildFlow(AF_INET, "1.2.3.4", "4.3.2.1", 20, 40);
1805  FAIL_IF_NULL(f);
1806  f->alproto = ALPROTO_TEST;
1807  f->proto = IPPROTO_UDP;
1809 
1810  StreamTcpInitConfig(true);
1811 
1812  int r = AppLayerParserParse(NULL, alp_tctx, f, ALPROTO_TEST,
1813  STREAM_TOSERVER | STREAM_EOF, testbuf,
1814  testlen);
1815  FAIL_IF(r != -1);
1816 
1818  StreamTcpFreeConfig(true);
1819  UTHFreeFlow(f);
1820  PASS;
1821 }
1822 
1823 
1825 {
1826  SCEnter();
1827 
1828  int ip;
1829  AppProto alproto;
1831 
1832  for (ip = 0; ip < FLOW_PROTO_DEFAULT; ip++) {
1833  for (alproto = 0; alproto < ALPROTO_MAX; alproto++) {
1834  ctx = &alp_ctx.ctxs[ip][alproto];
1835  if (ctx->RegisterUnittests == NULL)
1836  continue;
1837  ctx->RegisterUnittests();
1838  }
1839  }
1840 
1841  UtRegisterTest("AppLayerParserTest01", AppLayerParserTest01);
1842  UtRegisterTest("AppLayerParserTest02", AppLayerParserTest02);
1843 
1844  SCReturn;
1845 }
1846 
1847 #endif
AppLayerParserProtoCtx_::Truncate
void(* Truncate)(void *, uint8_t)
Definition: app-layer-parser.c:106
app-layer-nfs-udp.h
ALPROTO_TEST
@ ALPROTO_TEST
Definition: app-layer-protos.h:69
AppLayerParserRegisterGetStateProgressFunc
void AppLayerParserRegisterGetStateProgressFunc(uint8_t ipproto, AppProto alproto, int(*StateGetProgress)(void *alstate, uint8_t direction))
Definition: app-layer-parser.c:459
AppLayerParserDeSetup
int AppLayerParserDeSetup(void)
Definition: app-layer-parser.c:237
TcpStream_
Definition: stream-tcp-private.h:94
FileContainer_
Definition: util-file.h:110
ts
uint64_t ts
Definition: source-erf-file.c:54
RegisterNTPParsers
void RegisterNTPParsers(void)
Definition: app-layer-ntp.c:38
AppLayerParserProtoCtx_::StateGetTxCnt
uint64_t(* StateGetTxCnt)(void *alstate)
Definition: app-layer-parser.c:110
AppLayerParserProtoCtx_::logger_bits
uint32_t logger_bits
Definition: app-layer-parser.c:98
AppLayerParserProtoCtx_::complete_tc
int complete_tc
Definition: app-layer-parser.c:114
AppLayerParserProtoCtx_::GetTxData
AppLayerTxData *(* GetTxData)(void *tx)
Definition: app-layer-parser.c:120
FAIL_IF_NULL
#define FAIL_IF_NULL(expr)
Fail a test if expression evaluates to NULL.
Definition: util-unittest.h:89
RegisterTemplateRustParsers
void RegisterTemplateRustParsers(void)
Definition: app-layer-template-rust.c:48
app-layer-tftp.h
AppLayerParserCtx_::ctxs
AppLayerParserProtoCtx ctxs[FLOW_PROTO_MAX][ALPROTO_MAX]
Definition: app-layer-parser.c:146
AppLayerParserState_::log_id
uint64_t log_id
Definition: app-layer-parser.c:159
RegisterSMBParsers
void RegisterSMBParsers(void)
Definition: app-layer-smb.c:41
app-layer-ssh.h
RegisterIKEParsers
void RegisterIKEParsers(void)
Definition: app-layer-ike.c:40
AppLayerParserIsEnabled
int AppLayerParserIsEnabled(AppProto alproto)
simple way to globally test if a alproto is registered and fully enabled in the configuration.
Definition: app-layer-parser.c:1385
AppLayerParserRegisterLocalStorageFunc
void AppLayerParserRegisterLocalStorageFunc(uint8_t ipproto, AppProto alproto, void *(*LocalStorageAlloc)(void), void(*LocalStorageFree)(void *))
Definition: app-layer-parser.c:406
BOTH_SET
#define BOTH_SET(a, b)
Definition: app-layer-parser.c:1497
AppLayerParserProtocolHasLogger
int AppLayerParserProtocolHasLogger(uint8_t ipproto, AppProto alproto)
Definition: app-layer-parser.c:1395
AppLayerParserRegisterOptionFlags
void AppLayerParserRegisterOptionFlags(uint8_t ipproto, AppProto alproto, uint32_t flags)
Definition: app-layer-parser.c:377
flow-util.h
AppLayerParserSetStreamDepthFlag
void AppLayerParserSetStreamDepthFlag(uint8_t ipproto, AppProto alproto, void *state, uint64_t tx_id, uint8_t flags)
Definition: app-layer-parser.c:1438
AppLayerParserSetTransactionLogId
void AppLayerParserSetTransactionLogId(AppLayerParserState *pstate, uint64_t tx_id)
Definition: app-layer-parser.c:662
g_filedata_logger_enabled
bool g_filedata_logger_enabled
Definition: output-filedata.c:38
AppLayerParserSetStreamDepth
void AppLayerParserSetStreamDepth(uint8_t ipproto, AppProto alproto, uint32_t stream_depth)
Definition: app-layer-parser.c:1422
ConfNode_::val
char * val
Definition: conf.h:34
stream-tcp.h
AppLayerParserApplyTxConfig
void AppLayerParserApplyTxConfig(uint8_t ipproto, AppProto alproto, void *state, void *tx, enum ConfigAction mode, AppLayerTxConfig config)
Definition: app-layer-parser.c:1141
unlikely
#define unlikely(expr)
Definition: util-optimize.h:35
AppLayerParserGetProtocolParserLocalStorage
void * AppLayerParserGetProtocolParserLocalStorage(uint8_t ipproto, AppProto alproto)
Definition: app-layer-parser.c:582
UtRegisterTest
void UtRegisterTest(const char *name, int(*TestFn)(void))
Register unit test.
Definition: util-unittest.c:103
AppLayerParserProtoCtx_::LocalStorageFree
void(* LocalStorageFree)(void *)
Definition: app-layer-parser.c:104
AppLayerParserProtoCtx_
App layer protocol parser context.
Definition: app-layer-parser.c:94
RegisterSSHParsers
void RegisterSSHParsers(void)
Function to register the SSH protocol parsers and other functions.
Definition: app-layer-ssh.c:81
AppLayerParserProtoCtx_::StateGetTx
void *(* StateGetTx)(void *alstate, uint64_t tx_id)
Definition: app-layer-parser.c:111
SCLogDebug
#define SCLogDebug(...)
Definition: util-debug.h:298
AppLayerParserSetTransactionInspectId
void AppLayerParserSetTransactionInspectId(const Flow *f, AppLayerParserState *pstate, void *alstate, const uint8_t flags, bool tag_txs_as_inspected)
Definition: app-layer-parser.c:703
APP_LAYER_PARSER_BYPASS_READY
#define APP_LAYER_PARSER_BYPASS_READY
Definition: app-layer-parser.h:40
AppLayerParserGetEventsByTx
AppLayerDecoderEvents * AppLayerParserGetEventsByTx(uint8_t ipproto, AppProto alproto, void *tx)
Definition: app-layer-parser.c:817
AppLayerGetTxIterator
AppLayerGetTxIteratorFunc AppLayerGetTxIterator(const uint8_t ipproto, const AppProto alproto)
Definition: app-layer-parser.c:647
next
struct HtpBodyChunk_ * next
Definition: app-layer-htp.h:0
RegisterModbusParsers
void RegisterModbusParsers(void)
Function to register the Modbus protocol parser.
Definition: app-layer-modbus.c:49
Flow_::proto
uint8_t proto
Definition: flow.h:375
AppProto
uint16_t AppProto
Definition: app-layer-protos.h:77
StreamTcpSetDisableRawReassemblyFlag
void StreamTcpSetDisableRawReassemblyFlag(TcpSession *, char)
Set the No reassembly flag for the given direction in given TCP session.
Definition: stream-tcp.c:6010
AppLayerParserConfParserEnabled
int AppLayerParserConfParserEnabled(const char *ipproto, const char *alproto_name)
check if a parser is enabled in the config Returns enabled always if: were running unittests
Definition: app-layer-parser.c:296
AppLayerParserGetStateProgress
int AppLayerParserGetStateProgress(uint8_t ipproto, AppProto alproto, void *alstate, uint8_t flags)
get the progress value for a tx/protocol
Definition: app-layer-parser.c:1041
AppLayerParserTriggerRawStreamReassembly
void AppLayerParserTriggerRawStreamReassembly(Flow *f, int direction)
Definition: app-layer-parser.c:1411
ConfGetNode
ConfNode * ConfGetNode(const char *name)
Get a ConfNode by name.
Definition: conf.c:175
threads.h
TcpStreamCnf_::reassembly_depth
uint32_t reassembly_depth
Definition: stream-tcp.h:60
flow-private.h
Flow_
Flow data structure.
Definition: flow.h:353
APP_LAYER_PARSER_INT_STREAM_DEPTH_SET
#define APP_LAYER_PARSER_INT_STREAM_DEPTH_SET
Definition: app-layer-parser.h:48
AppLayerEventType
enum AppLayerEventType_ AppLayerEventType
StreamTcpReassembleTriggerRawReassembly
void StreamTcpReassembleTriggerRawReassembly(TcpSession *ssn, int direction)
Trigger RAW stream reassembly.
Definition: stream-tcp-reassemble.c:1946
LoggerId
LoggerId
Definition: suricata-common.h:436
Flow_::protomap
uint8_t protomap
Definition: flow.h:455
AppLayerParserGetTransactionLogId
uint64_t AppLayerParserGetTransactionLogId(AppLayerParserState *pstate)
Definition: app-layer-parser.c:655
AppProtoToString
const char * AppProtoToString(AppProto alproto)
Maps the ALPROTO_*, to its string equivalent.
Definition: app-layer-protos.c:30
AppLayerParserRegisterTruncateFunc
void AppLayerParserRegisterTruncateFunc(uint8_t ipproto, AppProto alproto, void(*Truncate)(void *, uint8_t))
Definition: app-layer-parser.c:449
AppLayerParserRegisterStateProgressCompletionStatus
void AppLayerParserRegisterStateProgressCompletionStatus(AppProto alproto, const int ts, const int tc)
Definition: app-layer-parser.c:511
AppLayerParserRegisterParserAcceptableDataDirection
void AppLayerParserRegisterParserAcceptableDataDirection(uint8_t ipproto, AppProto alproto, uint8_t direction)
Definition: app-layer-parser.c:366
AppLayerParserGetStateProgressCompletionStatus
int AppLayerParserGetStateProgressCompletionStatus(AppProto alproto, uint8_t direction)
Definition: app-layer-parser.c:1069
AppLayerParserGetFirstDataDir
uint8_t AppLayerParserGetFirstDataDir(uint8_t ipproto, AppProto alproto)
Definition: app-layer-parser.c:1098
AppLayerParserProtoIsRegistered
int AppLayerParserProtoIsRegistered(uint8_t ipproto, AppProto alproto)
Definition: app-layer-parser.c:182
AppLayerParserRegisterTxFreeFunc
void AppLayerParserRegisterTxFreeFunc(uint8_t ipproto, AppProto alproto, void(*StateTransactionFree)(void *, uint64_t))
Definition: app-layer-parser.c:470
FLOW_NOPAYLOAD_INSPECTION
#define FLOW_NOPAYLOAD_INSPECTION
Definition: flow.h:65
AppLayerParserSupportsFiles
int AppLayerParserSupportsFiles(uint8_t ipproto, AppProto alproto)
Definition: app-layer-parser.c:1122
Flow_::alproto_orig
AppProto alproto_orig
Definition: flow.h:466
AppLayerParserStateProtoCleanup
void AppLayerParserStateProtoCleanup(uint8_t protomap, AppProto alproto, void *alstate, AppLayerParserState *pstate)
Definition: app-layer-parser.c:1454
AppLayerParserProtoCtx_::StateGetTxIterator
AppLayerGetTxIteratorFunc StateGetTxIterator
Definition: app-layer-parser.c:112
AppLayerParserThreadCtxFree
void AppLayerParserThreadCtxFree(AppLayerParserThreadCtx *tctx)
Destroys the app layer parser thread context obtained using AppLayerParserThreadCtxAlloc().
Definition: app-layer-parser.c:273
rust.h
MIN
#define MIN(x, y)
Definition: suricata-common.h:372
AppLayerDecoderEventsFreeEvents
void AppLayerDecoderEventsFreeEvents(AppLayerDecoderEvents **events)
Definition: app-layer-events.c:148
StreamTcpUpdateAppLayerProgress
void StreamTcpUpdateAppLayerProgress(TcpSession *ssn, char direction, const uint32_t progress)
update reassembly progress
Definition: stream-tcp.c:5976
AppLayerParserGetFiles
FileContainer * AppLayerParserGetFiles(const Flow *f, const uint8_t direction)
Definition: app-layer-parser.c:833
APP_LAYER_TX_INSPECTED_FLAG
#define APP_LAYER_TX_INSPECTED_FLAG
Definition: app-layer-parser.h:79
stream-tcp-reassemble.h
AppLayerParserGetOptionFlags
uint32_t AppLayerParserGetOptionFlags(uint8_t protomap, AppProto alproto)
Definition: app-layer-parser.c:387
TestState
struct TestState_ TestState
app-layer-http2.h
RegisterSIPParsers
void RegisterSIPParsers(void)
Definition: app-layer-sip.c:30
app-layer-ftp.h
stream_config
TcpStreamCnf stream_config
Definition: stream-tcp.c:119
MAX
#define MAX(x, y)
Definition: suricata-common.h:376
APP_LAYER_PARSER_EOF_TS
#define APP_LAYER_PARSER_EOF_TS
Definition: app-layer-parser.h:41
ALPROTO_MAX
@ ALPROTO_MAX
Definition: app-layer-protos.h:72
Flow_::protoctx
void * protoctx
Definition: flow.h:451
TcpStream_::data_required
uint32_t data_required
Definition: stream-tcp-private.h:120
AppLayerParserRegisterUnittests
void AppLayerParserRegisterUnittests(void)
Definition: app-layer-parser.c:1824
AppLayerParserGetTransactionInspectId
uint64_t AppLayerParserGetTransactionInspectId(AppLayerParserState *pstate, uint8_t direction)
Definition: app-layer-parser.c:672
RegisterKRB5Parsers
void RegisterKRB5Parsers(void)
Definition: app-layer-krb5.c:38
AppLayerDecoderEvents_
Data structure to store app layer decoder events.
Definition: app-layer-events.h:34
util-unittest.h
AppLayerParserProtoCtx_::ApplyTxConfig
bool(* ApplyTxConfig)(void *state, void *tx, int mode, AppLayerTxConfig)
Definition: app-layer-parser.c:121
FlowGetReverseProtoMapping
uint8_t FlowGetReverseProtoMapping(uint8_t rproto)
Definition: flow-util.c:109
RegisterDNP3Parsers
void RegisterDNP3Parsers(void)
Register the DNP3 application protocol parser.
Definition: app-layer-dnp3.c:1564
ConfValIsTrue
int ConfValIsTrue(const char *val)
Check if a value is true.
Definition: conf.c:565
util-unittest-helper.h
FTPParserCleanup
void FTPParserCleanup(void)
Free memory allocated for global FTP parser state.
Definition: app-layer-ftp.c:1389
TcpSession_::flags
uint16_t flags
Definition: stream-tcp-private.h:269
AppLayerParserGetEventInfoById
int AppLayerParserGetEventInfoById(uint8_t ipproto, AppProto alproto, int event_id, const char **event_name, AppLayerEventType *event_type)
Definition: app-layer-parser.c:1087
Flow_::sgh_toserver
const struct SigGroupHead_ * sgh_toserver
Definition: flow.h:493
AppLayerParserRestoreParserTable
void AppLayerParserRestoreParserTable(void)
Definition: app-layer-parser.c:1729
AppLayerParserState_::inspect_id
uint64_t inspect_id[2]
Definition: app-layer-parser.c:155
AppLayerParserFPtr
AppLayerResult(* AppLayerParserFPtr)(Flow *f, void *protocol_state, AppLayerParserState *pstate, StreamSlice stream_slice, void *local_storage)
Prototype for parsing functions.
Definition: app-layer-parser.h:139
AppLayerParserCtx
struct AppLayerParserCtx_ AppLayerParserCtx
Flow_::alparser
AppLayerParserState * alparser
Definition: flow.h:485
AppLayerParserRegisterProtocolParsers
void AppLayerParserRegisterProtocolParsers(void)
Definition: app-layer-parser.c:1553
app-layer-krb5.h
RegisterRFBParsers
void RegisterRFBParsers(void)
Definition: app-layer-rfb.c:54
StreamTcpInitConfig
void StreamTcpInitConfig(bool)
To initialize the stream global configuration data.
Definition: stream-tcp.c:365
UTHBuildFlow
Flow * UTHBuildFlow(int family, const char *src, const char *dst, Port sp, Port dp)
Definition: util-unittest-helper.c:521
app-layer-htp.h
AppLayerParserStateIssetFlag
int AppLayerParserStateIssetFlag(AppLayerParserState *pstate, uint8_t flag)
Definition: app-layer-parser.c:1615
AppLayerParserProtoCtx_::stream_depth
uint32_t stream_depth
Definition: app-layer-parser.c:126
decode.h
util-debug.h
AppLayerParserState_
Definition: app-layer-parser.c:149
PASS
#define PASS
Pass the test.
Definition: util-unittest.h:105
AppLayerParserGetTransactionActive
uint64_t AppLayerParserGetTransactionActive(const Flow *f, AppLayerParserState *pstate, uint8_t direction)
Definition: app-layer-parser.c:1105
AppLayerParserProtoCtx_::logger
bool logger
Definition: app-layer-parser.c:97
app-layer-ike.h
app-layer-dnp3.h
AppLayerParserStreamTruncated
void AppLayerParserStreamTruncated(uint8_t ipproto, AppProto alproto, void *alstate, uint8_t direction)
Definition: app-layer-parser.c:1622
res
PoolThreadReserved res
Definition: stream-tcp-private.h:0
alp_tctx
AppLayerParserThreadCtx * alp_tctx
Definition: fuzz_applayerparserparse.c:20
AppLayerParserRegisterLogger
void AppLayerParserRegisterLogger(uint8_t ipproto, AppProto alproto)
Definition: app-layer-parser.c:440
app-layer-rfb.h
AppLayerParserRegisterGetFilesFunc
void AppLayerParserRegisterGetFilesFunc(uint8_t ipproto, AppProto alproto, FileContainer *(*StateGetFiles)(void *, uint8_t))
Definition: app-layer-parser.c:420
util-print.h
SCEnter
#define SCEnter(...)
Definition: util-debug.h:300
AppLayerParserProtoCtx_::SetStreamDepthFlag
void(* SetStreamDepthFlag)(void *tx, uint8_t flags)
Definition: app-layer-parser.c:123
AppLayerParserState_::min_id
uint64_t min_id
Definition: app-layer-parser.c:161
RegisterENIPTCPParsers
void RegisterENIPTCPParsers(void)
Function to register the ENIP protocol parsers and other functions.
Definition: app-layer-enip.c:529
ThreadVars_
Per thread variable structure.
Definition: threadvars.h:58
AppLayerParserRegisterLoggerBits
void AppLayerParserRegisterLoggerBits(uint8_t ipproto, AppProto alproto, LoggerId bits)
Definition: app-layer-parser.c:431
AppLayerParserProtoCtx_::StateGetEventInfo
int(* StateGetEventInfo)(const char *event_name, int *event_id, AppLayerEventType *event_type)
Definition: app-layer-parser.c:117
AppLayerParserRegisterStateFuncs
void AppLayerParserRegisterStateFuncs(uint8_t ipproto, AppProto alproto, void *(*StateAlloc)(void *, AppProto), void(*StateFree)(void *))
Definition: app-layer-parser.c:393
detect-engine-port.h
APP_LAYER_PARSER_OPT_UNIDIR_TXS
#define APP_LAYER_PARSER_OPT_UNIDIR_TXS
Definition: app-layer-parser.h:46
APP_LAYER_PARSER_NO_REASSEMBLY
#define APP_LAYER_PARSER_NO_REASSEMBLY
Definition: app-layer-parser.h:38
IS_DISRUPTED
#define IS_DISRUPTED(flags)
Definition: app-layer-parser.c:848
AppLayerParserSetEOF
void AppLayerParserSetEOF(AppLayerParserState *pstate)
Definition: app-layer-parser.c:1351
AppLayerParserProtoCtx_::RegisterUnittests
void(* RegisterUnittests)(void)
Definition: app-layer-parser.c:141
AppLayerParserStateFree
void AppLayerParserStateFree(AppLayerParserState *pstate)
Definition: app-layer-parser.c:202
FLOW_PROTO_MAX
@ FLOW_PROTO_MAX
Definition: flow-private.h:76
app-layer-parser.h
AppLayerParserStateCleanup
void AppLayerParserStateCleanup(const Flow *f, void *alstate, AppLayerParserState *pstate)
Definition: app-layer-parser.c:1471
TRUE
#define TRUE
Definition: suricata-common.h:33
AppLayerParserBackupParserTable
void AppLayerParserBackupParserTable(void)
Definition: app-layer-parser.c:1721
AppLayerParserProtoCtx_::StateGetEventInfoById
int(* StateGetEventInfoById)(int event_id, const char **event_name, AppLayerEventType *event_type)
Definition: app-layer-parser.c:115
BUG_ON
#define BUG_ON(x)
Definition: suricata-common.h:281
AppLayerDecoderEvents_::cnt
uint8_t cnt
Definition: app-layer-events.h:38
Flow_::sgh_toclient
const struct SigGroupHead_ * sgh_toclient
Definition: flow.h:490
RegisterNFSTCPParsers
void RegisterNFSTCPParsers(void)
Definition: app-layer-nfs-tcp.c:46
AppLayerParserProtoCtx
struct AppLayerParserProtoCtx_ AppLayerParserProtoCtx
App layer protocol parser context.
FALSE
#define FALSE
Definition: suricata-common.h:34
AppLayerParserSetup
int AppLayerParserSetup(void)
Definition: app-layer-parser.c:213
SCReturn
#define SCReturn
Definition: util-debug.h:302
RegisterFTPParsers
void RegisterFTPParsers(void)
Definition: app-layer-ftp.c:1250
stream.h
AppLayerParserRegisterProtocolUnittests
void AppLayerParserRegisterProtocolUnittests(uint8_t ipproto, AppProto alproto, void(*RegisterUnittests)(void))
Definition: app-layer-parser.c:1712
AppLayerGetTxIterState
Definition: app-layer-parser.h:142
AppLayerParserProtoCtx_::StateAlloc
void *(* StateAlloc)(void *, AppProto)
Definition: app-layer-parser.c:100
FlowGetProtoMapping
uint8_t FlowGetProtoMapping(uint8_t proto)
Function to map the protocol to the defined FLOW_PROTO_* enumeration.
Definition: flow-util.c:95
RegisterTFTPParsers
void RegisterTFTPParsers(void)
Definition: app-layer-tftp.c:159
ALPROTO_IMAP
@ ALPROTO_IMAP
Definition: app-layer-protos.h:35
stream-tcp-private.h
FLOW_PROTO_APPLAYER_MAX
#define FLOW_PROTO_APPLAYER_MAX
Definition: flow-private.h:79
APP_LAYER_PARSER_EOF_TC
#define APP_LAYER_PARSER_EOF_TC
Definition: app-layer-parser.h:42
SCReturnUInt
#define SCReturnUInt(x)
Definition: util-debug.h:306
conf.h
DEBUG_ASSERT_FLOW_LOCKED
#define DEBUG_ASSERT_FLOW_LOCKED(f)
Definition: util-validate.h:108
BOTH_SET_OR_BOTH_UNSET
#define BOTH_SET_OR_BOTH_UNSET(a, b)
Definition: app-layer-parser.c:1498
AppLayerParserThreadCtx_::alproto_local_storage
void * alproto_local_storage[FLOW_PROTO_MAX][ALPROTO_MAX]
Definition: app-layer-parser.c:86
AppLayerParserRegisterGetEventInfo
void AppLayerParserRegisterGetEventInfo(uint8_t ipproto, AppProto alproto, int(*StateGetEventInfo)(const char *event_name, int *event_id, AppLayerEventType *event_type))
Definition: app-layer-parser.c:538
AppLayerParserSetDecoderEvents
void AppLayerParserSetDecoderEvents(AppLayerParserState *pstate, AppLayerDecoderEvents *devents)
Definition: app-layer-parser.c:812
SCReturnPtr
#define SCReturnPtr(x, type)
Definition: util-debug.h:316
AppLayerParserProtoCtx_::StateFree
void(* StateFree)(void *)
Definition: app-layer-parser.c:101
detect-engine-state.h
Data structures and function prototypes for keeping state for the detection engine.
AppLayerProtoDetectRegisterProtocol
void AppLayerProtoDetectRegisterProtocol(AppProto alproto, const char *alproto_name)
Registers a protocol for protocol detection phase.
Definition: app-layer-detect-proto.c:1889
AppLayerParserRegisterSetStreamDepthFlag
void AppLayerParserRegisterSetStreamDepthFlag(uint8_t ipproto, AppProto alproto, void(*SetStreamDepthFlag)(void *tx, uint8_t flags))
Definition: app-layer-parser.c:570
app-layer-sip.h
ALPROTO_HTTP2
@ ALPROTO_HTTP2
Definition: app-layer-protos.h:59
runmodes.h
RunmodeIsUnittests
int RunmodeIsUnittests(void)
Definition: suricata.c:271
SCLogInfo
#define SCLogInfo(...)
Macro used to log INFORMATIONAL messages.
Definition: util-debug.h:217
RegisterRdpParsers
void RegisterRdpParsers(void)
Definition: app-layer-rdp.c:35
APP_LAYER_PARSER_NO_INSPECTION
#define APP_LAYER_PARSER_NO_INSPECTION
Definition: app-layer-parser.h:37
AppLayerParserGetTx
void * AppLayerParserGetTx(uint8_t ipproto, AppProto alproto, void *alstate, uint64_t tx_id)
Definition: app-layer-parser.c:1062
g_detect_disabled
int g_detect_disabled
Definition: suricata.c:217
AppLayerParserRegisterParser
int AppLayerParserRegisterParser(uint8_t ipproto, AppProto alproto, uint8_t direction, AppLayerParserFPtr Parser)
Register app layer parser for the protocol.
Definition: app-layer-parser.c:354
decode-events.h
UTHFreeFlow
void UTHFreeFlow(Flow *flow)
Definition: util-unittest-helper.c:526
AppLayerParserThreadCtxAlloc
AppLayerParserThreadCtx * AppLayerParserThreadCtxAlloc(void)
Gets a new app layer protocol's parser thread context.
Definition: app-layer-parser.c:247
AppLayerParserRegisterGetTx
void AppLayerParserRegisterGetTx(uint8_t ipproto, AppProto alproto, void *(StateGetTx)(void *alstate, uint64_t tx_id))
Definition: app-layer-parser.c:492
ConfigAction
ConfigAction
Definition: util-config.h:27
AppLayerParserProtoCtx_::Parser
AppLayerParserFPtr Parser[2]
Definition: app-layer-parser.c:96
app-layer-modbus.h
AppLayerParserProtoCtx_::StateTransactionFree
void(* StateTransactionFree)(void *, uint64_t)
Definition: app-layer-parser.c:102
app-layer-enip.h
SCReturnStruct
#define SCReturnStruct(x)
Definition: util-debug.h:320
app-layer-template-rust.h
RegisterSSLParsers
void RegisterSSLParsers(void)
Function to register the SSL protocol parser and other functions.
Definition: app-layer-ssl.c:2886
AppLayerParserProtoCtx_::option_flags
uint32_t option_flags
Definition: app-layer-parser.c:134
FAIL_IF
#define FAIL_IF(expr)
Fail a test if expression evaluates to true.
Definition: util-unittest.h:71
StreamTcpSetSessionNoReassemblyFlag
void StreamTcpSetSessionNoReassemblyFlag(TcpSession *, char)
disable reassembly
Definition: stream-tcp.c:5994
AppLayerParserTransactionsCleanup
void AppLayerParserTransactionsCleanup(Flow *f)
remove obsolete (inspected and logged) transactions
Definition: app-layer-parser.c:857
StreamTcpFreeConfig
void StreamTcpFreeConfig(bool quiet)
Definition: stream-tcp.c:670
flags
uint8_t flags
Definition: decode-gre.h:0
AppLayerParserParse
int AppLayerParserParse(ThreadVars *tv, AppLayerParserThreadCtx *alp_tctx, Flow *f, AppProto alproto, uint8_t flags, const uint8_t *input, uint32_t input_len)
Definition: app-layer-parser.c:1183
StreamTcpDisableAppLayer
void StreamTcpDisableAppLayer(Flow *f)
Definition: stream-tcp-reassemble.c:346
suricata-common.h
ALPROTO_HTTP1
@ ALPROTO_HTTP1
Definition: app-layer-protos.h:30
AppLayerParserProtoCtx_::internal_flags
uint32_t internal_flags
Definition: app-layer-parser.c:137
util-spm.h
AppLayerParserRegisterApplyTxConfigFunc
void AppLayerParserRegisterApplyTxConfigFunc(uint8_t ipproto, AppProto alproto, bool(*ApplyTxConfig)(void *state, void *tx, int mode, AppLayerTxConfig))
Definition: app-layer-parser.c:560
AppLayerParserProtoCtx_::StateGetFiles
FileContainer *(* StateGetFiles)(void *, uint8_t)
Definition: app-layer-parser.c:107
SCLogError
#define SCLogError(err_code,...)
Macro used to log ERROR messages.
Definition: util-debug.h:257
RegisterENIPUDPParsers
void RegisterENIPUDPParsers(void)
Function to register the ENIP protocol parsers and other functions.
Definition: app-layer-enip.c:446
AppLayerParserGetTxData
AppLayerTxData * AppLayerParserGetTxData(uint8_t ipproto, AppProto alproto, void *tx)
Definition: app-layer-parser.c:1134
FatalError
#define FatalError(x,...)
Definition: util-debug.h:532
AppLayerParserRegisterTxDataFunc
void AppLayerParserRegisterTxDataFunc(uint8_t ipproto, AppProto alproto, AppLayerTxData *(*GetTxData)(void *tx))
Definition: app-layer-parser.c:550
TcpSession_::client
TcpStream client
Definition: stream-tcp-private.h:272
AppLayerParserGetStreamDepth
uint32_t AppLayerParserGetStreamDepth(const Flow *f)
Definition: app-layer-parser.c:1433
tv
ThreadVars * tv
Definition: fuzz_decodepcapfile.c:29
util-validate.h
SCMalloc
#define SCMalloc(sz)
Definition: util-mem.h:47
RegisterSNMPParsers
void RegisterSNMPParsers(void)
Definition: app-layer-snmp.c:39
APP_LAYER_PARSER_OPT_ACCEPT_GAPS
#define APP_LAYER_PARSER_OPT_ACCEPT_GAPS
Definition: app-layer-parser.h:45
TcpSession_::server
TcpStream server
Definition: stream-tcp-private.h:271
AppLayerParserRegisterGetTxIterator
void AppLayerParserRegisterGetTxIterator(uint8_t ipproto, AppProto alproto, AppLayerGetTxIteratorFunc Func)
Definition: app-layer-parser.c:503
AppLayerParserProtoCtx_::complete_ts
int complete_ts
Definition: app-layer-parser.c:113
SCFree
#define SCFree(p)
Definition: util-mem.h:61
ConfNode_
Definition: conf.h:32
Flow_::alstate
void * alstate
Definition: flow.h:486
SC_ERR_FATAL
@ SC_ERR_FATAL
Definition: util-error.h:203
AppLayerParserPostStreamSetup
void AppLayerParserPostStreamSetup(void)
Definition: app-layer-parser.c:220
app-layer-template.h
Flow_::flags
uint32_t flags
Definition: flow.h:431
AppLayerParserGetDecoderEvents
AppLayerDecoderEvents * AppLayerParserGetDecoderEvents(AppLayerParserState *pstate)
Definition: app-layer-parser.c:804
THREE_SET
#define THREE_SET(a, b, c)
Definition: app-layer-parser.c:1500
TestState_::test
uint8_t test
Definition: app-layer-parser.c:1661
AppLayerParserRegisterGetEventInfoById
void AppLayerParserRegisterGetEventInfoById(uint8_t ipproto, AppProto alproto, int(*StateGetEventInfoById)(int event_id, const char **event_name, AppLayerEventType *event_type))
Definition: app-layer-parser.c:526
AppLayerGetProtoName
const char * AppLayerGetProtoName(AppProto alproto)
Given the internal protocol id, returns a string representation of the protocol.
Definition: app-layer.c:815
UTHAppLayerParserStateGetIds
void UTHAppLayerParserStateGetIds(void *ptr, uint64_t *i1, uint64_t *i2, uint64_t *log, uint64_t *min)
Definition: app-layer-parser.c:168
ConfValIsFalse
int ConfValIsFalse(const char *val)
Check if a value is false.
Definition: conf.c:590
RegisterHTPParsers
void RegisterHTPParsers(void)
Register the HTTP protocol and state handling functions to APP layer of the engine.
Definition: app-layer-htp.c:3066
ALPROTO_HTTP
@ ALPROTO_HTTP
Definition: app-layer-protos.h:63
AppLayerIncTxCounter
void AppLayerIncTxCounter(ThreadVars *tv, Flow *f, uint64_t step)
Definition: app-layer.c:114
app-layer-snmp.h
RegisterSMTPParsers
void RegisterSMTPParsers(void)
Register the SMTP Protocol parser.
Definition: app-layer-smtp.c:1768
AppLayerParserStateAlloc
AppLayerParserState * AppLayerParserStateAlloc(void)
Definition: app-layer-parser.c:189
SCReturnCT
#define SCReturnCT(x, type)
Definition: util-debug.h:314
app-layer-protos.h
RegisterTemplateParsers
void RegisterTemplateParsers(void)
Definition: app-layer-template.c:448
STREAMTCP_FLAG_APP_LAYER_DISABLED
#define STREAMTCP_FLAG_APP_LAYER_DISABLED
Definition: stream-tcp-private.h:188
AppLayerParserState_::decoder_events
AppLayerDecoderEvents * decoder_events
Definition: app-layer-parser.c:164
AppLayerParserRegisterGetTxCnt
void AppLayerParserRegisterGetTxCnt(uint8_t ipproto, AppProto alproto, uint64_t(*StateGetTxCnt)(void *alstate))
Definition: app-layer-parser.c:481
APP_LAYER_ERROR
#define APP_LAYER_ERROR
Definition: app-layer-parser.h:90
app-layer-smb.h
app-layer-mqtt.h
AppLayerParserProtoCtx_::StateGetProgress
int(* StateGetProgress)(void *alstate, uint8_t direction)
Definition: app-layer-parser.c:109
AppLayerParserProtocolGetLoggerBits
LoggerId AppLayerParserProtocolGetLoggerBits(uint8_t ipproto, AppProto alproto)
Definition: app-layer-parser.c:1403
AppLayerParserStateSetFlag
void AppLayerParserStateSetFlag(AppLayerParserState *pstate, uint8_t flag)
Definition: app-layer-parser.c:1607
AppLayerParserCtx_
Definition: app-layer-parser.c:145
AppLayerGetTxIteratorFunc
AppLayerGetTxIterTuple(* AppLayerGetTxIteratorFunc)(const uint8_t ipproto, const AppProto alproto, void *alstate, uint64_t min_tx_id, uint64_t max_tx_id, AppLayerGetTxIterState *state)
tx iterator prototype
Definition: app-layer-parser.h:151
g_file_logger_enabled
bool g_file_logger_enabled
Definition: output-file.c:37
likely
#define likely(expr)
Definition: util-optimize.h:32
RegisterHTTP2Parsers
void RegisterHTTP2Parsers(void)
Definition: app-layer-http2.c:56
STREAM_APP_PROGRESS
#define STREAM_APP_PROGRESS(stream)
Definition: stream-tcp-private.h:132
AppLayerParserThreadCtx_
Definition: app-layer-parser.c:85
AppLayerProtoDetectPMRegisterPatternCS
int AppLayerProtoDetectPMRegisterPatternCS(uint8_t ipproto, AppProto alproto, const char *pattern, uint16_t depth, uint16_t offset, uint8_t direction)
Registers a case-sensitive pattern for protocol detection.
Definition: app-layer-detect-proto.c:1785
app-layer-smtp.h
APP_LAYER_PARSER_NO_INSPECTION_PAYLOAD
#define APP_LAYER_PARSER_NO_INSPECTION_PAYLOAD
Definition: app-layer-parser.h:39
FlowChangeProto
int FlowChangeProto(Flow *f)
Check if change proto flag is set for flow.
Definition: flow.c:212
FlowGetDisruptionFlags
uint8_t FlowGetDisruptionFlags(const Flow *f, uint8_t flags)
get 'disruption' flags: GAP/DEPTH/PASS
Definition: flow.c:1121
TcpSession_
Definition: stream-tcp-private.h:260
RegisterNFSUDPParsers
void RegisterNFSUDPParsers(void)
Definition: app-layer-nfs-udp.c:62
FLOW_PROTO_DEFAULT
@ FLOW_PROTO_DEFAULT
Definition: flow-private.h:73
Flow_::alproto
AppProto alproto
application level protocol
Definition: flow.h:460
AppLayerParserDestroyProtocolParserLocalStorage
void AppLayerParserDestroyProtocolParserLocalStorage(uint8_t ipproto, AppProto alproto, void *local_data)
Definition: app-layer-parser.c:597
util-pool.h
SCReturnInt
#define SCReturnInt(x)
Definition: util-debug.h:304
AppLayerParserGetTxCnt
uint64_t AppLayerParserGetTxCnt(const Flow *f, void *alstate)
Definition: app-layer-parser.c:1055
AppLayerProtoDetectConfProtoDetectionEnabled
int AppLayerProtoDetectConfProtoDetectionEnabled(const char *ipproto, const char *alproto)
Given a protocol name, checks if proto detection is enabled in the conf file.
Definition: app-layer-detect-proto.c:2052
SMTPParserCleanup
void SMTPParserCleanup(void)
Free memory allocated for global SMTP parser state.
Definition: app-layer-smtp.c:1822
AppLayerParserHasDecoderEvents
bool AppLayerParserHasDecoderEvents(AppLayerParserState *pstate)
Definition: app-layer-parser.c:1367
RegisterMQTTParsers
void RegisterMQTTParsers(void)
Definition: app-layer-mqtt.c:37
AppLayerDecoderEvents_::events
uint8_t * events
Definition: app-layer-events.h:36
StreamTcpSetSessionBypassFlag
void StreamTcpSetSessionBypassFlag(TcpSession *)
enable bypass
Definition: stream-tcp.c:6021
DEBUG_VALIDATE_BUG_ON
#define DEBUG_VALIDATE_BUG_ON(exp)
Definition: util-validate.h:111
app-layer-ssl.h
TestState_
Definition: app-layer-parser.c:1660
app-layer-ntp.h
debug.h
AppLayerParserState_::flags
uint8_t flags
Definition: app-layer-parser.c:151
AppLayerParserProtoCtx_::LocalStorageAlloc
void *(* LocalStorageAlloc)(void)
Definition: app-layer-parser.c:103
app-layer-nfs-tcp.h
app-layer-rdp.h
app-layer.h
AppLayerParserGetEventInfo
int AppLayerParserGetEventInfo(uint8_t ipproto, AppProto alproto, const char *event_name, int *event_id, AppLayerEventType *event_type)
Definition: app-layer-parser.c:1077
AppLayerParserProtoCtx_::first_data_dir
uint8_t first_data_dir
Definition: app-layer-parser.c:131