suricata
app-layer-parser.c
Go to the documentation of this file.
1 /* Copyright (C) 2007-2021 Open Information Security Foundation
2  *
3  * You can copy, redistribute or modify this Program under the terms of
4  * the GNU General Public License version 2 as published by the Free
5  * Software Foundation.
6  *
7  * This program is distributed in the hope that it will be useful,
8  * but WITHOUT ANY WARRANTY; without even the implied warranty of
9  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
10  * GNU General Public License for more details.
11  *
12  * You should have received a copy of the GNU General Public License
13  * version 2 along with this program; if not, write to the Free Software
14  * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA
15  * 02110-1301, USA.
16  */
17 
18 /**
19  * \file
20  *
21  * \author Victor Julien <victor@inliniac.net>
22  *
23  * Generic App-layer parsing functions.
24  */
25 
26 #include "suricata-common.h"
27 #include "app-layer-parser.h"
28 
29 #include "flow.h"
30 #include "flow-private.h"
31 #include "flow-util.h"
32 
33 #include "app-layer-frames.h"
34 
35 #include "stream-tcp.h"
36 
37 #include "util-validate.h"
38 
39 #include "app-layer.h"
40 #include "app-layer-detect-proto.h"
41 
42 #include "app-layer-ftp.h"
43 #include "app-layer-smtp.h"
44 
45 #include "app-layer-smb.h"
46 #include "app-layer-htp.h"
47 #include "app-layer-ssl.h"
48 #include "app-layer-ssh.h"
49 #include "app-layer-modbus.h"
50 #include "app-layer-dnp3.h"
51 #include "app-layer-nfs-tcp.h"
52 #include "app-layer-nfs-udp.h"
53 #include "app-layer-tftp.h"
54 #include "app-layer-ike.h"
55 #include "app-layer-http2.h"
56 #include "app-layer-imap.h"
57 
59  void *(*alproto_local_storage)[FLOW_PROTO_MAX];
60 };
61 
62 
63 /**
64  * \brief App layer protocol parser context.
65  */
67 {
68  /* 0 - to_server, 1 - to_client. */
70 
71  bool logger;
72 
73  /* Indicates the direction the parser is ready to see the data
74  * the first time for a flow. Values accepted -
75  * STREAM_TOSERVER, STREAM_TOCLIENT */
76  uint8_t first_data_dir;
77 
78  uint32_t logger_bits; /**< registered loggers for this proto */
79 
80  void *(*StateAlloc)(void *, AppProto);
81  void (*StateFree)(void *);
82  void (*StateTransactionFree)(void *, uint64_t);
83  void *(*LocalStorageAlloc)(void);
84  void (*LocalStorageFree)(void *);
85 
86  /** get FileContainer reference from the TX. MUST return a non-NULL reference if the TX
87  * has or may have files in the requested direction at some point. */
88  AppLayerGetFileState (*GetTxFiles)(void *, uint8_t);
89 
90  int (*StateGetProgress)(void *alstate, uint8_t direction);
91  uint64_t (*StateGetTxCnt)(void *alstate);
92  void *(*StateGetTx)(void *alstate, uint64_t tx_id);
97  uint8_t event_id, const char **event_name, AppLayerEventType *event_type);
99  const char *event_name, uint8_t *event_id, AppLayerEventType *event_type);
100 
101  AppLayerStateData *(*GetStateData)(void *state);
102  AppLayerTxData *(*GetTxData)(void *tx);
103  bool (*ApplyTxConfig)(void *state, void *tx, int mode, AppLayerTxConfig);
104 
105  void (*SetStreamDepthFlag)(void *tx, uint8_t flags);
106 
109 
110  /* each app-layer has its own value */
111  uint32_t stream_depth;
112 
113  /* Option flags such as supporting gaps or not. */
114  uint32_t option_flags;
115  /* coccinelle: AppLayerParserProtoCtx:option_flags:APP_LAYER_PARSER_OPT_ */
116 
117  uint32_t internal_flags;
118  /* coccinelle: AppLayerParserProtoCtx:internal_flags:APP_LAYER_PARSER_INT_ */
119 
120 #ifdef UNITTESTS
121  void (*RegisterUnittests)(void);
122 #endif
124 
125 typedef struct AppLayerParserCtx_ {
128 
130  /* coccinelle: AppLayerParserState:flags:APP_LAYER_PARSER_ */
131  uint16_t flags;
132 
133  /* Indicates the current transaction that is being inspected.
134  * We have a var per direction. */
135  uint64_t inspect_id[2];
136  /* Indicates the current transaction being logged. Unlike inspect_id,
137  * we don't need a var per direction since we don't log a transaction
138  * unless we have the entire transaction. */
139  uint64_t log_id;
140 
141  uint64_t min_id;
142 
143  /* Used to store decoder events. */
145 
147 };
148 
150 
151 static void AppLayerConfig(void)
152 {
153  g_applayerparser_error_policy = ExceptionPolicyParse("app-layer.error-policy", true);
154 }
155 
156 static void AppLayerParserFramesFreeContainer(FramesContainer *frames)
157 {
158  if (frames != NULL) {
159  FramesFree(&frames->toserver);
160  FramesFree(&frames->toclient);
161  SCFree(frames);
162  }
163 }
164 
166 {
167  if (f == NULL || f->alparser == NULL || f->alparser->frames == NULL)
168  return;
169  AppLayerParserFramesFreeContainer(f->alparser->frames);
170  f->alparser->frames = NULL;
171 }
172 
174 {
175  if (f == NULL || f->alparser == NULL)
176  return NULL;
177  return f->alparser->frames;
178 }
179 
181 {
182 #ifdef UNITTESTS
183  if (f == NULL || f->alparser == NULL || (f->proto == IPPROTO_TCP && f->protoctx == NULL))
184  return NULL;
185 #endif
186  DEBUG_VALIDATE_BUG_ON(f == NULL || f->alparser == NULL);
187  if (f->alparser->frames == NULL) {
188  f->alparser->frames = SCCalloc(1, sizeof(FramesContainer));
189  if (f->alparser->frames == NULL) {
190  return NULL;
191  }
192 #ifdef DEBUG
193  f->alparser->frames->toserver.ipproto = f->proto;
194  f->alparser->frames->toserver.alproto = f->alproto;
195  f->alparser->frames->toclient.ipproto = f->proto;
196  f->alparser->frames->toclient.alproto = f->alproto;
197 #endif
198  }
199  return f->alparser->frames;
200 }
201 
202 #ifdef UNITTESTS
203 void UTHAppLayerParserStateGetIds(void *ptr, uint64_t *i1, uint64_t *i2, uint64_t *log, uint64_t *min)
204 {
205  struct AppLayerParserState_ *s = ptr;
206  *i1 = s->inspect_id[0];
207  *i2 = s->inspect_id[1];
208  *log = s->log_id;
209  *min = s->min_id;
210 }
211 #endif
212 
213 /* Static global version of the parser context.
214  * Post 2.0 let's look at changing this to move it out to app-layer.c. */
215 static AppLayerParserCtx alp_ctx;
216 
217 int AppLayerParserProtoIsRegistered(uint8_t ipproto, AppProto alproto)
218 {
219  uint8_t ipproto_map = FlowGetProtoMapping(ipproto);
220 
221  return (alp_ctx.ctxs[alproto][ipproto_map].StateAlloc != NULL) ? 1 : 0;
222 }
223 
225 {
226  SCEnter();
227 
228  AppLayerParserState *pstate = (AppLayerParserState *)SCCalloc(1, sizeof(*pstate));
229  if (pstate == NULL)
230  goto end;
231 
232  end:
233  SCReturnPtr(pstate, "AppLayerParserState");
234 }
235 
237 {
238  SCEnter();
239 
240  if (pstate->decoder_events != NULL)
242  AppLayerParserFramesFreeContainer(pstate->frames);
243  SCFree(pstate);
244 
245  SCReturn;
246 }
247 
249 {
250  SCEnter();
251  // initial allocation that will later be grown using realloc,
252  // when new protocols register themselves and make g_alproto_max grow
254  if (unlikely(alp_ctx.ctxs == NULL)) {
255  FatalError("Unable to alloc alp_ctx.ctxs.");
256  }
257  SCReturnInt(0);
258 }
259 
261 {
262  /* lets set a default value for stream_depth */
263  for (int flow_proto = 0; flow_proto < FLOW_PROTO_DEFAULT; flow_proto++) {
264  for (AppProto alproto = 0; alproto < g_alproto_max; alproto++) {
265  if (!(alp_ctx.ctxs[alproto][flow_proto].internal_flags &
267  alp_ctx.ctxs[alproto][flow_proto].stream_depth = stream_config.reassembly_depth;
268  }
269  }
270  }
271 }
272 
274 {
275  SCEnter();
276 
277  SCFree(alp_ctx.ctxs);
278 
281 
282  SCReturnInt(0);
283 }
284 
286 {
287  SCEnter();
288 
289  AppLayerParserThreadCtx *tctx = SCCalloc(1, sizeof(*tctx));
290  if (tctx == NULL)
291  goto end;
292 
294  if (unlikely(tctx->alproto_local_storage == NULL)) {
295  SCFree(tctx);
296  tctx = NULL;
297  goto end;
298  }
299  for (uint8_t flow_proto = 0; flow_proto < FLOW_PROTO_DEFAULT; flow_proto++) {
300  for (AppProto alproto = 0; alproto < g_alproto_max; alproto++) {
301  uint8_t ipproto = FlowGetReverseProtoMapping(flow_proto);
302 
303  tctx->alproto_local_storage[alproto][flow_proto] =
305  }
306  }
307 
308  end:
309  SCReturnPtr(tctx, "void *");
310 }
311 
313 {
314  SCEnter();
315 
316  for (uint8_t flow_proto = 0; flow_proto < FLOW_PROTO_DEFAULT; flow_proto++) {
317  for (AppProto alproto = 0; alproto < g_alproto_max; alproto++) {
318  uint8_t ipproto = FlowGetReverseProtoMapping(flow_proto);
319 
321  ipproto, alproto, tctx->alproto_local_storage[alproto][flow_proto]);
322  }
323  }
324 
326  SCFree(tctx);
327  SCReturn;
328 }
329 
330 /** \brief check if a parser is enabled in the config
331  * Returns enabled always if: were running unittests
332  */
333 int AppLayerParserConfParserEnabled(const char *ipproto,
334  const char *alproto_name)
335 {
336  SCEnter();
337 
338  int enabled = 1;
339  char param[100];
340  ConfNode *node;
341  int r;
342 
343  if (RunmodeIsUnittests())
344  goto enabled;
345 
346  r = snprintf(param, sizeof(param), "%s%s%s", "app-layer.protocols.",
347  alproto_name, ".enabled");
348  if (r < 0) {
349  FatalError("snprintf failure.");
350  } else if (r > (int)sizeof(param)) {
351  FatalError("buffer not big enough to write param.");
352  }
353 
354  node = ConfGetNode(param);
355  if (node == NULL) {
356  SCLogDebug("Entry for %s not found.", param);
357  r = snprintf(param, sizeof(param), "%s%s%s%s%s", "app-layer.protocols.",
358  alproto_name, ".", ipproto, ".enabled");
359  if (r < 0) {
360  FatalError("snprintf failure.");
361  } else if (r > (int)sizeof(param)) {
362  FatalError("buffer not big enough to write param.");
363  }
364 
365  node = ConfGetNode(param);
366  if (node == NULL) {
367  SCLogDebug("Entry for %s not found.", param);
368  goto enabled;
369  }
370  }
371 
372  if (ConfValIsTrue(node->val)) {
373  goto enabled;
374  } else if (ConfValIsFalse(node->val)) {
375  goto disabled;
376  } else if (strcasecmp(node->val, "detection-only") == 0) {
377  goto disabled;
378  } else {
379  SCLogError("Invalid value found for %s.", param);
380  exit(EXIT_FAILURE);
381  }
382 
383  disabled:
384  enabled = 0;
385  enabled:
386  SCReturnInt(enabled);
387 }
388 
389 /***** Parser related registration *****/
390 
391 int AppLayerParserRegisterParser(uint8_t ipproto, AppProto alproto,
392  uint8_t direction,
393  AppLayerParserFPtr Parser)
394 {
395  SCEnter();
396 
397  alp_ctx.ctxs[alproto][FlowGetProtoMapping(ipproto)]
398  .Parser[(direction & STREAM_TOSERVER) ? 0 : 1] = Parser;
399 
400  SCReturnInt(0);
401 }
402 
404  uint8_t direction)
405 {
406  SCEnter();
407 
408  alp_ctx.ctxs[alproto][FlowGetProtoMapping(ipproto)].first_data_dir |=
409  (direction & (STREAM_TOSERVER | STREAM_TOCLIENT));
410 
411  SCReturn;
412 }
413 
414 void AppLayerParserRegisterOptionFlags(uint8_t ipproto, AppProto alproto,
415  uint32_t flags)
416 {
417  SCEnter();
418 
419  alp_ctx.ctxs[alproto][FlowGetProtoMapping(ipproto)].option_flags |= flags;
420 
421  SCReturn;
422 }
423 
424 void AppLayerParserRegisterStateFuncs(uint8_t ipproto, AppProto alproto,
425  void *(*StateAlloc)(void *, AppProto), void (*StateFree)(void *))
426 {
427  SCEnter();
428 
429  alp_ctx.ctxs[alproto][FlowGetProtoMapping(ipproto)].StateAlloc = StateAlloc;
430  alp_ctx.ctxs[alproto][FlowGetProtoMapping(ipproto)].StateFree = StateFree;
431 
432  SCReturn;
433 }
434 
435 void AppLayerParserRegisterLocalStorageFunc(uint8_t ipproto, AppProto alproto,
436  void *(*LocalStorageAlloc)(void),
437  void (*LocalStorageFree)(void *))
438 {
439  SCEnter();
440 
441  alp_ctx.ctxs[alproto][FlowGetProtoMapping(ipproto)].LocalStorageAlloc = LocalStorageAlloc;
442  alp_ctx.ctxs[alproto][FlowGetProtoMapping(ipproto)].LocalStorageFree = LocalStorageFree;
443 
444  SCReturn;
445 }
446 
448  uint8_t ipproto, AppProto alproto, AppLayerGetFileState (*GetTxFiles)(void *, uint8_t))
449 {
450  SCEnter();
451 
452  alp_ctx.ctxs[alproto][FlowGetProtoMapping(ipproto)].GetTxFiles = GetTxFiles;
453 
454  SCReturn;
455 }
456 
457 void AppLayerParserRegisterLoggerBits(uint8_t ipproto, AppProto alproto, LoggerId bits)
458 {
459  SCEnter();
460 
461  alp_ctx.ctxs[alproto][FlowGetProtoMapping(ipproto)].logger_bits = bits;
462 
463  SCReturn;
464 }
465 
466 void AppLayerParserRegisterLogger(uint8_t ipproto, AppProto alproto)
467 {
468  SCEnter();
469 
470  alp_ctx.ctxs[alproto][FlowGetProtoMapping(ipproto)].logger = true;
471 
472  SCReturn;
473 }
474 
476  int (*StateGetProgress)(void *alstate, uint8_t direction))
477 {
478  SCEnter();
479 
480  alp_ctx.ctxs[alproto][FlowGetProtoMapping(ipproto)].StateGetProgress = StateGetProgress;
481 
482  SCReturn;
483 }
484 
485 void AppLayerParserRegisterTxFreeFunc(uint8_t ipproto, AppProto alproto,
486  void (*StateTransactionFree)(void *, uint64_t))
487 {
488  SCEnter();
489 
490  alp_ctx.ctxs[alproto][FlowGetProtoMapping(ipproto)].StateTransactionFree = StateTransactionFree;
491 
492  SCReturn;
493 }
494 
495 void AppLayerParserRegisterGetTxCnt(uint8_t ipproto, AppProto alproto,
496  uint64_t (*StateGetTxCnt)(void *alstate))
497 {
498  SCEnter();
499 
500  alp_ctx.ctxs[alproto][FlowGetProtoMapping(ipproto)].StateGetTxCnt = StateGetTxCnt;
501 
502  SCReturn;
503 }
504 
505 void AppLayerParserRegisterGetTx(uint8_t ipproto, AppProto alproto,
506  void *(StateGetTx)(void *alstate, uint64_t tx_id))
507 {
508  SCEnter();
509 
510  alp_ctx.ctxs[alproto][FlowGetProtoMapping(ipproto)].StateGetTx = StateGetTx;
511 
512  SCReturn;
513 }
514 
515 void AppLayerParserRegisterGetTxIterator(uint8_t ipproto, AppProto alproto,
517 {
518  SCEnter();
519  alp_ctx.ctxs[alproto][FlowGetProtoMapping(ipproto)].StateGetTxIterator = Func;
520  SCReturn;
521 }
522 
524  AppProto alproto, const int ts, const int tc)
525 {
526  BUG_ON(ts == 0);
527  BUG_ON(tc == 0);
528  BUG_ON(!AppProtoIsValid(alproto));
529  BUG_ON(alp_ctx.ctxs[alproto][FLOW_PROTO_DEFAULT].complete_ts != 0 &&
530  alp_ctx.ctxs[alproto][FLOW_PROTO_DEFAULT].complete_ts != ts);
531  BUG_ON(alp_ctx.ctxs[alproto][FLOW_PROTO_DEFAULT].complete_tc != 0 &&
532  alp_ctx.ctxs[alproto][FLOW_PROTO_DEFAULT].complete_tc != tc);
533 
534  alp_ctx.ctxs[alproto][FLOW_PROTO_DEFAULT].complete_ts = ts;
535  alp_ctx.ctxs[alproto][FLOW_PROTO_DEFAULT].complete_tc = tc;
536 }
537 
538 void AppLayerParserRegisterGetEventInfoById(uint8_t ipproto, AppProto alproto,
539  int (*StateGetEventInfoById)(
540  uint8_t event_id, const char **event_name, AppLayerEventType *event_type))
541 {
542  SCEnter();
543 
544  alp_ctx.ctxs[alproto][FlowGetProtoMapping(ipproto)].StateGetEventInfoById =
545  StateGetEventInfoById;
546 
547  SCReturn;
548 }
549 
550 void AppLayerParserRegisterGetFrameFuncs(uint8_t ipproto, AppProto alproto,
551  AppLayerParserGetFrameIdByNameFn GetIdByNameFunc,
552  AppLayerParserGetFrameNameByIdFn GetNameByIdFunc)
553 {
554  SCEnter();
555  alp_ctx.ctxs[alproto][FlowGetProtoMapping(ipproto)].GetFrameIdByName = GetIdByNameFunc;
556  alp_ctx.ctxs[alproto][FlowGetProtoMapping(ipproto)].GetFrameNameById = GetNameByIdFunc;
557  SCReturn;
558 }
559 
560 void AppLayerParserRegisterGetEventInfo(uint8_t ipproto, AppProto alproto,
561  int (*StateGetEventInfo)(
562  const char *event_name, uint8_t *event_id, AppLayerEventType *event_type))
563 {
564  SCEnter();
565 
566  alp_ctx.ctxs[alproto][FlowGetProtoMapping(ipproto)].StateGetEventInfo = StateGetEventInfo;
567 
568  SCReturn;
569 }
570 
571 void AppLayerParserRegisterTxDataFunc(uint8_t ipproto, AppProto alproto,
572  AppLayerTxData *(*GetTxData)(void *tx))
573 {
574  SCEnter();
575 
576  alp_ctx.ctxs[alproto][FlowGetProtoMapping(ipproto)].GetTxData = GetTxData;
577 
578  SCReturn;
579 }
580 
582  uint8_t ipproto, AppProto alproto, AppLayerStateData *(*GetStateData)(void *state))
583 {
584  SCEnter();
585 
586  alp_ctx.ctxs[alproto][FlowGetProtoMapping(ipproto)].GetStateData = GetStateData;
587 
588  SCReturn;
589 }
590 
591 void AppLayerParserRegisterApplyTxConfigFunc(uint8_t ipproto, AppProto alproto,
592  bool (*ApplyTxConfig)(void *state, void *tx, int mode, AppLayerTxConfig))
593 {
594  SCEnter();
595 
596  alp_ctx.ctxs[alproto][FlowGetProtoMapping(ipproto)].ApplyTxConfig = ApplyTxConfig;
597 
598  SCReturn;
599 }
600 
602  void (*SetStreamDepthFlag)(void *tx, uint8_t flags))
603 {
604  SCEnter();
605 
606  alp_ctx.ctxs[alproto][FlowGetProtoMapping(ipproto)].SetStreamDepthFlag = SetStreamDepthFlag;
607 
608  SCReturn;
609 }
610 
611 /***** Get and transaction functions *****/
612 
614 {
615  SCEnter();
616  void * r = NULL;
617 
618  if (alp_ctx.ctxs[alproto][FlowGetProtoMapping(ipproto)].LocalStorageAlloc != NULL) {
619  r = alp_ctx.ctxs[alproto][FlowGetProtoMapping(ipproto)].LocalStorageAlloc();
620  }
621 
622  SCReturnPtr(r, "void *");
623 }
624 
626  void *local_data)
627 {
628  SCEnter();
629 
630  if (alp_ctx.ctxs[alproto][FlowGetProtoMapping(ipproto)].LocalStorageFree != NULL) {
631  alp_ctx.ctxs[alproto][FlowGetProtoMapping(ipproto)].LocalStorageFree(local_data);
632  }
633 
634  SCReturn;
635 }
636 
637 /** \brief default tx iterator
638  *
639  * Used if the app layer parser doesn't register its own iterator.
640  * Simply walks the tx_id space until it finds a tx. Uses 'state' to
641  * keep track of where it left off.
642  *
643  * \retval txptr or NULL if no more txs in list
644  */
645 static AppLayerGetTxIterTuple AppLayerDefaultGetTxIterator(
646  const uint8_t ipproto, const AppProto alproto,
647  void *alstate, uint64_t min_tx_id, uint64_t max_tx_id,
648  AppLayerGetTxIterState *state)
649 {
650  uint64_t ustate = *(uint64_t *)state;
651  uint64_t tx_id = MAX(min_tx_id, ustate);
652  for ( ; tx_id < max_tx_id; tx_id++) {
653  void *tx_ptr = AppLayerParserGetTx(ipproto, alproto, alstate, tx_id);
654  if (tx_ptr != NULL) {
655  ustate = tx_id + 1;
656  *state = *(AppLayerGetTxIterState *)&ustate;
657  AppLayerGetTxIterTuple tuple = {
658  .tx_ptr = tx_ptr,
659  .tx_id = tx_id,
660  .has_next = (tx_id + 1 < max_tx_id),
661  };
662  SCLogDebug("tuple: %p/%"PRIu64"/%s", tuple.tx_ptr, tuple.tx_id,
663  tuple.has_next ? "true" : "false");
664  return tuple;
665  }
666  }
667 
668  AppLayerGetTxIterTuple no_tuple = { NULL, 0, false };
669  return no_tuple;
670 }
671 
673  const AppProto alproto)
674 {
676  alp_ctx.ctxs[alproto][FlowGetProtoMapping(ipproto)].StateGetTxIterator;
677  return Func ? Func : AppLayerDefaultGetTxIterator;
678 }
679 
681 {
682  SCEnter();
683 
684  SCReturnCT((pstate == NULL) ? 0 : pstate->log_id, "uint64_t");
685 }
686 
688 {
689  SCEnter();
690 
691  if (pstate != NULL)
692  pstate->log_id = tx_id;
693 
694  SCReturn;
695 }
696 
697 uint64_t AppLayerParserGetTransactionInspectId(AppLayerParserState *pstate, uint8_t direction)
698 {
699  SCEnter();
700 
701  if (pstate != NULL)
702  SCReturnCT(pstate->inspect_id[(direction & STREAM_TOSERVER) ? 0 : 1], "uint64_t");
703 
705  SCReturnCT(0ULL, "uint64_t");
706 }
707 
708 inline uint64_t AppLayerParserGetTxDetectFlags(AppLayerTxData *txd, const uint8_t dir)
709 {
710  uint64_t detect_flags =
711  (dir & STREAM_TOSERVER) ? txd->detect_flags_ts : txd->detect_flags_tc;
712  return detect_flags;
713 }
714 
715 static inline void SetTxDetectFlags(AppLayerTxData *txd, const uint8_t dir, const uint64_t detect_flags)
716 {
717  if (dir & STREAM_TOSERVER) {
718  txd->detect_flags_ts = detect_flags;
719  } else {
720  txd->detect_flags_tc = detect_flags;
721  }
722 }
723 
724 static inline uint32_t GetTxLogged(AppLayerTxData *txd)
725 {
726  return txd->logged.flags;
727 }
728 
730  void *alstate, const uint8_t flags,
731  bool tag_txs_as_inspected)
732 {
733  SCEnter();
734 
735  const int direction = (flags & STREAM_TOSERVER) ? 0 : 1;
736  const uint64_t total_txs = AppLayerParserGetTxCnt(f, alstate);
737  uint64_t idx = AppLayerParserGetTransactionInspectId(pstate, flags);
738  const int state_done_progress = AppLayerParserGetStateProgressCompletionStatus(f->alproto, flags);
739  const uint8_t ipproto = f->proto;
740  const AppProto alproto = f->alproto;
741 
742  AppLayerGetTxIteratorFunc IterFunc = AppLayerGetTxIterator(ipproto, alproto);
743  AppLayerGetTxIterState state = { 0 };
744 
745  SCLogDebug("called: %s, tag_txs_as_inspected %s",direction==0?"toserver":"toclient",
746  tag_txs_as_inspected?"true":"false");
747 
748  /* mark all txs as inspected if the applayer progress is
749  * at the 'end state'. */
750  while (1) {
751  AppLayerGetTxIterTuple ires = IterFunc(ipproto, alproto, alstate, idx, total_txs, &state);
752  if (ires.tx_ptr == NULL)
753  break;
754 
755  void *tx = ires.tx_ptr;
756  idx = ires.tx_id;
757 
758  int state_progress = AppLayerParserGetStateProgress(ipproto, alproto, tx, flags);
759  if (state_progress < state_done_progress)
760  break;
761 
762  AppLayerTxData *txd = AppLayerParserGetTxData(ipproto, alproto, tx);
763  if (txd && tag_txs_as_inspected) {
764  uint64_t detect_flags = AppLayerParserGetTxDetectFlags(txd, flags);
765  if ((detect_flags & APP_LAYER_TX_INSPECTED_FLAG) == 0) {
766  detect_flags |= APP_LAYER_TX_INSPECTED_FLAG;
767  SetTxDetectFlags(txd, flags, detect_flags);
768  SCLogDebug("%p/%"PRIu64" in-order tx is done for direction %s. Flag %016"PRIx64,
769  tx, idx, flags & STREAM_TOSERVER ? "toserver" : "toclient", detect_flags);
770  }
771  }
772  idx++;
773  if (!ires.has_next)
774  break;
775  }
776  pstate->inspect_id[direction] = idx;
777  SCLogDebug("inspect_id now %"PRIu64, pstate->inspect_id[direction]);
778 
779  /* if necessary we flag all txs that are complete as 'inspected'
780  * also move inspect_id forward. */
781  if (tag_txs_as_inspected) {
782  /* continue at idx */
783  while (1) {
784  AppLayerGetTxIterTuple ires = IterFunc(ipproto, alproto, alstate, idx, total_txs, &state);
785  if (ires.tx_ptr == NULL)
786  break;
787 
788  void *tx = ires.tx_ptr;
789  /* if we got a higher id than the minimum we requested, we
790  * skipped a bunch of 'null-txs'. Lets see if we can up the
791  * inspect tracker */
792  if (ires.tx_id > idx && pstate->inspect_id[direction] == idx) {
793  pstate->inspect_id[direction] = ires.tx_id;
794  }
795  idx = ires.tx_id;
796 
797  const int state_progress = AppLayerParserGetStateProgress(ipproto, alproto, tx, flags);
798  if (state_progress < state_done_progress)
799  break;
800 
801  /* txd can be NULL for HTTP sessions where the user data alloc failed */
802  AppLayerTxData *txd = AppLayerParserGetTxData(ipproto, alproto, tx);
803  if (likely(txd)) {
804  uint64_t detect_flags = AppLayerParserGetTxDetectFlags(txd, flags);
805  if ((detect_flags & APP_LAYER_TX_INSPECTED_FLAG) == 0) {
806  detect_flags |= APP_LAYER_TX_INSPECTED_FLAG;
807  SetTxDetectFlags(txd, flags, detect_flags);
808  SCLogDebug("%p/%"PRIu64" out of order tx is done for direction %s. Flag %016"PRIx64,
809  tx, idx, flags & STREAM_TOSERVER ? "toserver" : "toclient", detect_flags);
810 
811  SCLogDebug("%p/%"PRIu64" out of order tx. Update inspect_id? %"PRIu64,
812  tx, idx, pstate->inspect_id[direction]);
813  if (pstate->inspect_id[direction]+1 == idx)
814  pstate->inspect_id[direction] = idx;
815  }
816  } else {
817  if (pstate->inspect_id[direction]+1 == idx)
818  pstate->inspect_id[direction] = idx;
819  }
820  if (!ires.has_next)
821  break;
822  idx++;
823  }
824  }
825 
826  SCReturn;
827 }
828 
830 {
831  SCEnter();
832 
833  SCReturnPtr(pstate->decoder_events,
834  "AppLayerDecoderEvents *");
835 }
836 
838  void *tx)
839 {
840  SCEnter();
841 
842  AppLayerDecoderEvents *ptr = NULL;
843 
844  /* Access events via the tx_data. */
845  AppLayerTxData *txd = AppLayerParserGetTxData(ipproto, alproto, tx);
846  if (txd != NULL && txd->events != NULL) {
847  ptr = txd->events;
848  }
849 
850  SCReturnPtr(ptr, "AppLayerDecoderEvents *");
851 }
852 
853 AppLayerGetFileState AppLayerParserGetTxFiles(const Flow *f, void *tx, const uint8_t direction)
854 {
855  SCEnter();
856 
857  if (alp_ctx.ctxs[f->alproto][f->protomap].GetTxFiles != NULL) {
858  return alp_ctx.ctxs[f->alproto][f->protomap].GetTxFiles(tx, direction);
859  }
860 
861  AppLayerGetFileState files = { .fc = NULL, .cfg = NULL };
862  return files;
863 }
864 
865 static void AppLayerParserFileTxHousekeeping(
866  const Flow *f, void *tx, const uint8_t pkt_dir, const bool trunc)
867 {
868  AppLayerGetFileState files = AppLayerParserGetTxFiles(f, tx, pkt_dir);
869  if (files.fc) {
870  FilesPrune(files.fc, files.cfg, trunc);
871  }
872 }
873 
874 #define IS_DISRUPTED(flags) ((flags) & (STREAM_DEPTH | STREAM_GAP))
875 
876 extern int g_detect_disabled;
877 extern bool g_file_logger_enabled;
878 extern bool g_filedata_logger_enabled;
879 
880 /**
881  * \brief remove obsolete (inspected and logged) transactions
882  */
883 void AppLayerParserTransactionsCleanup(Flow *f, const uint8_t pkt_dir)
884 {
885  SCEnter();
887 
888  AppLayerParserProtoCtx *p = &alp_ctx.ctxs[f->alproto][f->protomap];
889  if (unlikely(p->StateTransactionFree == NULL))
890  SCReturn;
891 
892  const bool has_tx_detect_flags = !g_detect_disabled;
893  const uint8_t ipproto = f->proto;
894  const AppProto alproto = f->alproto;
895  void * const alstate = f->alstate;
896  AppLayerParserState * const alparser = f->alparser;
897 
898  if (alstate == NULL || alparser == NULL)
899  SCReturn;
900 
901  const uint64_t min = alparser->min_id;
902  const uint64_t total_txs = AppLayerParserGetTxCnt(f, alstate);
903  const LoggerId logger_expectation = AppLayerParserProtocolGetLoggerBits(ipproto, alproto);
904  const int tx_end_state_ts = AppLayerParserGetStateProgressCompletionStatus(alproto, STREAM_TOSERVER);
905  const int tx_end_state_tc = AppLayerParserGetStateProgressCompletionStatus(alproto, STREAM_TOCLIENT);
906  const uint8_t ts_disrupt_flags = FlowGetDisruptionFlags(f, STREAM_TOSERVER);
907  const uint8_t tc_disrupt_flags = FlowGetDisruptionFlags(f, STREAM_TOCLIENT);
908 
909  int pkt_dir_trunc = -1;
910 
911  AppLayerGetTxIteratorFunc IterFunc = AppLayerGetTxIterator(ipproto, alproto);
913  memset(&state, 0, sizeof(state));
914  uint64_t i = min;
915  uint64_t new_min = min;
916  SCLogDebug("start min %"PRIu64, min);
917  bool skipped = false;
918  // const bool support_files = AppLayerParserSupportsFiles(f->proto, f->alproto);
919 
920  while (1) {
921  AppLayerGetTxIterTuple ires = IterFunc(ipproto, alproto, alstate, i, total_txs, &state);
922  if (ires.tx_ptr == NULL)
923  break;
924 
925  bool tx_skipped = false;
926  void *tx = ires.tx_ptr;
927  i = ires.tx_id; // actual tx id for the tx the IterFunc returned
928 
929  SCLogDebug("%p/%"PRIu64" checking", tx, i);
930  AppLayerTxData *txd = AppLayerParserGetTxData(ipproto, alproto, tx);
931  if (txd != NULL && AppLayerParserHasFilesInDir(txd, pkt_dir)) {
932  if (pkt_dir_trunc == -1)
933  pkt_dir_trunc = IS_DISRUPTED(
934  (pkt_dir == STREAM_TOSERVER) ? ts_disrupt_flags : tc_disrupt_flags);
935  AppLayerParserFileTxHousekeeping(f, tx, pkt_dir, (bool)pkt_dir_trunc);
936  }
937  if (txd) {
938  // should be reset by parser next time it updates the tx
939  if (pkt_dir & STREAM_TOSERVER) {
940  txd->updated_ts = false;
941  } else {
942  txd->updated_tc = false;
943  }
944  }
945  const int tx_progress_tc =
946  AppLayerParserGetStateProgress(ipproto, alproto, tx, tc_disrupt_flags);
947  if (tx_progress_tc < tx_end_state_tc) {
948  SCLogDebug("%p/%"PRIu64" skipping: tc parser not done", tx, i);
949  skipped = true;
950  goto next;
951  }
952  const int tx_progress_ts =
953  AppLayerParserGetStateProgress(ipproto, alproto, tx, ts_disrupt_flags);
954  if (tx_progress_ts < tx_end_state_ts) {
955  SCLogDebug("%p/%"PRIu64" skipping: ts parser not done", tx, i);
956  skipped = true;
957  goto next;
958  }
959 
960  if (txd && has_tx_detect_flags) {
961  if (!IS_DISRUPTED(ts_disrupt_flags) &&
962  (f->sgh_toserver != NULL || (f->flags & FLOW_SGH_TOSERVER) == 0)) {
963  uint64_t detect_flags_ts = AppLayerParserGetTxDetectFlags(txd, STREAM_TOSERVER);
964  if (!(detect_flags_ts &
966  SCLogDebug("%p/%" PRIu64 " skipping: TS inspect not done: ts:%" PRIx64, tx, i,
967  detect_flags_ts);
968  tx_skipped = true;
969  }
970  }
971  if (!IS_DISRUPTED(tc_disrupt_flags) &&
972  (f->sgh_toclient != NULL || (f->flags & FLOW_SGH_TOCLIENT) == 0)) {
973  uint64_t detect_flags_tc = AppLayerParserGetTxDetectFlags(txd, STREAM_TOCLIENT);
974  if (!(detect_flags_tc &
976  SCLogDebug("%p/%" PRIu64 " skipping: TC inspect not done: ts:%" PRIx64, tx, i,
977  detect_flags_tc);
978  tx_skipped = true;
979  }
980  }
981  }
982 
983  if (tx_skipped) {
984  SCLogDebug("%p/%" PRIu64 " tx_skipped", tx, i);
985  skipped = true;
986  goto next;
987  }
988 
989  if (txd && logger_expectation != 0) {
990  LoggerId tx_logged = GetTxLogged(txd);
991  if (tx_logged != logger_expectation) {
992  SCLogDebug("%p/%"PRIu64" skipping: logging not done: want:%"PRIx32", have:%"PRIx32,
993  tx, i, logger_expectation, tx_logged);
994  skipped = true;
995  goto next;
996  }
997  }
998 
999  /* if file logging is enabled, we keep a tx active while some of the files aren't
1000  * logged yet. */
1001  if (txd) {
1002  SCLogDebug("files_opened %u files_logged %u files_stored %u", txd->files_opened,
1003  txd->files_logged, txd->files_stored);
1004 
1005  if (txd->files_opened) {
1006  if (g_file_logger_enabled && txd->files_opened != txd->files_logged) {
1007  skipped = true;
1008  goto next;
1009  }
1010  if (g_filedata_logger_enabled && txd->files_opened != txd->files_stored) {
1011  skipped = true;
1012  goto next;
1013  }
1014  }
1015  }
1016 
1017  /* if we are here, the tx can be freed. */
1018  p->StateTransactionFree(alstate, i);
1019  SCLogDebug("%p/%"PRIu64" freed", tx, i);
1020 
1021  /* if we didn't skip any tx so far, up the minimum */
1022  SCLogDebug("skipped? %s i %"PRIu64", new_min %"PRIu64, skipped ? "true" : "false", i, new_min);
1023  if (!skipped)
1024  new_min = i + 1;
1025  SCLogDebug("final i %"PRIu64", new_min %"PRIu64, i, new_min);
1026 
1027 next:
1028  if (!ires.has_next) {
1029  /* this was the last tx. See if we skipped any. If not
1030  * we removed all and can update the minimum to the max
1031  * id. */
1032  SCLogDebug("no next: cur tx i %"PRIu64", total %"PRIu64, i, total_txs);
1033  if (!skipped) {
1034  new_min = total_txs;
1035  SCLogDebug("no next: cur tx i %"PRIu64", total %"PRIu64": "
1036  "new_min updated to %"PRIu64, i, total_txs, new_min);
1037  }
1038  break;
1039  }
1040  i++;
1041  }
1042 
1043  /* see if we need to bring all trackers up to date. */
1044  SCLogDebug("update f->alparser->min_id? %"PRIu64" vs %"PRIu64, new_min, alparser->min_id);
1045  if (new_min > alparser->min_id) {
1046  const uint64_t next_id = new_min;
1047  alparser->min_id = next_id;
1048  alparser->inspect_id[0] = MAX(alparser->inspect_id[0], next_id);
1049  alparser->inspect_id[1] = MAX(alparser->inspect_id[1], next_id);
1050  alparser->log_id = MAX(alparser->log_id, next_id);
1051  SCLogDebug("updated f->alparser->min_id %"PRIu64, alparser->min_id);
1052  }
1053  SCReturn;
1054 }
1055 
1056 static inline int StateGetProgressCompletionStatus(const AppProto alproto, const uint8_t flags)
1057 {
1058  if (flags & STREAM_TOSERVER) {
1059  return alp_ctx.ctxs[alproto][FLOW_PROTO_DEFAULT].complete_ts;
1060  } else if (flags & STREAM_TOCLIENT) {
1061  return alp_ctx.ctxs[alproto][FLOW_PROTO_DEFAULT].complete_tc;
1062  } else {
1064  return 0;
1065  }
1066 }
1067 
1068 /**
1069  * \brief get the progress value for a tx/protocol
1070  *
1071  * If the stream is disrupted, we return the 'completion' value.
1072  */
1073 int AppLayerParserGetStateProgress(uint8_t ipproto, AppProto alproto,
1074  void *alstate, uint8_t flags)
1075 {
1076  SCEnter();
1077  int r;
1078  if (unlikely(IS_DISRUPTED(flags))) {
1079  r = StateGetProgressCompletionStatus(alproto, flags);
1080  } else {
1081  uint8_t direction = flags & (STREAM_TOCLIENT | STREAM_TOSERVER);
1082  r = alp_ctx.ctxs[alproto][FlowGetProtoMapping(ipproto)].StateGetProgress(
1083  alstate, direction);
1084  }
1085  SCReturnInt(r);
1086 }
1087 
1088 uint64_t AppLayerParserGetTxCnt(const Flow *f, void *alstate)
1089 {
1090  SCEnter();
1091  uint64_t r = alp_ctx.ctxs[f->alproto][f->protomap].StateGetTxCnt(alstate);
1092  SCReturnCT(r, "uint64_t");
1093 }
1094 
1095 void *AppLayerParserGetTx(uint8_t ipproto, AppProto alproto, void *alstate, uint64_t tx_id)
1096 {
1097  SCEnter();
1098  void *r = alp_ctx.ctxs[alproto][FlowGetProtoMapping(ipproto)].StateGetTx(alstate, tx_id);
1099  SCReturnPtr(r, "void *");
1100 }
1101 
1103  uint8_t direction)
1104 {
1105  SCEnter();
1106  int r = StateGetProgressCompletionStatus(alproto, direction);
1107  SCReturnInt(r);
1108 }
1109 
1110 int AppLayerParserGetEventInfo(uint8_t ipproto, AppProto alproto, const char *event_name,
1111  uint8_t *event_id, AppLayerEventType *event_type)
1112 {
1113  SCEnter();
1114  const int ipproto_map = FlowGetProtoMapping(ipproto);
1115  int r = (alp_ctx.ctxs[alproto][ipproto_map].StateGetEventInfo == NULL)
1116  ? -1
1117  : alp_ctx.ctxs[alproto][ipproto_map].StateGetEventInfo(
1118  event_name, event_id, event_type);
1119  SCReturnInt(r);
1120 }
1121 
1122 int AppLayerParserGetEventInfoById(uint8_t ipproto, AppProto alproto, uint8_t event_id,
1123  const char **event_name, AppLayerEventType *event_type)
1124 {
1125  SCEnter();
1126  const int ipproto_map = FlowGetProtoMapping(ipproto);
1127  *event_name = (const char *)NULL;
1128  int r = (alp_ctx.ctxs[alproto][ipproto_map].StateGetEventInfoById == NULL)
1129  ? -1
1130  : alp_ctx.ctxs[alproto][ipproto_map].StateGetEventInfoById(
1131  event_id, event_name, event_type);
1132  SCReturnInt(r);
1133 }
1134 
1135 uint8_t AppLayerParserGetFirstDataDir(uint8_t ipproto, AppProto alproto)
1136 {
1137  SCEnter();
1138  uint8_t r = alp_ctx.ctxs[alproto][FlowGetProtoMapping(ipproto)].first_data_dir;
1139  SCReturnCT(r, "uint8_t");
1140 }
1141 
1143  AppLayerParserState *pstate, uint8_t direction)
1144 {
1145  SCEnter();
1146 
1147  uint64_t active_id;
1148  uint64_t log_id = pstate->log_id;
1149  uint64_t inspect_id = pstate->inspect_id[(direction & STREAM_TOSERVER) ? 0 : 1];
1150  if (alp_ctx.ctxs[f->alproto][f->protomap].logger) {
1151  active_id = MIN(log_id, inspect_id);
1152  } else {
1153  active_id = inspect_id;
1154  }
1155 
1156  SCReturnCT(active_id, "uint64_t");
1157 }
1158 
1159 bool AppLayerParserSupportsFiles(uint8_t ipproto, AppProto alproto)
1160 {
1161  // Custom case for only signature-only protocol so far
1162  if (alproto == ALPROTO_HTTP) {
1163  return AppLayerParserSupportsFiles(ipproto, ALPROTO_HTTP1) ||
1165  }
1166  return alp_ctx.ctxs[alproto][FlowGetProtoMapping(ipproto)].GetTxFiles != NULL;
1167 }
1168 
1169 AppLayerTxData *AppLayerParserGetTxData(uint8_t ipproto, AppProto alproto, void *tx)
1170 {
1171  SCEnter();
1172  AppLayerTxData *d = alp_ctx.ctxs[alproto][FlowGetProtoMapping(ipproto)].GetTxData(tx);
1173  SCReturnPtr(d, "AppLayerTxData");
1174 }
1175 
1176 AppLayerStateData *AppLayerParserGetStateData(uint8_t ipproto, AppProto alproto, void *state)
1177 {
1178  SCEnter();
1179  if (alp_ctx.ctxs[alproto][FlowGetProtoMapping(ipproto)].GetStateData) {
1180  AppLayerStateData *d =
1181  alp_ctx.ctxs[alproto][FlowGetProtoMapping(ipproto)].GetStateData(state);
1182  SCReturnPtr(d, "AppLayerStateData");
1183  }
1184  SCReturnPtr(NULL, "AppLayerStateData");
1185 }
1186 
1187 void AppLayerParserApplyTxConfig(uint8_t ipproto, AppProto alproto,
1188  void *state, void *tx, enum ConfigAction mode, AppLayerTxConfig config)
1189 {
1190  SCEnter();
1191  const int ipproto_map = FlowGetProtoMapping(ipproto);
1192  if (alp_ctx.ctxs[alproto][ipproto_map].ApplyTxConfig) {
1193  alp_ctx.ctxs[alproto][ipproto_map].ApplyTxConfig(state, tx, mode, config);
1194  }
1195  SCReturn;
1196 }
1197 
1198 /***** General *****/
1199 
1200 static inline void SetEOFFlags(AppLayerParserState *pstate, const uint8_t flags)
1201 {
1202  if ((flags & (STREAM_EOF|STREAM_TOSERVER)) == (STREAM_EOF|STREAM_TOSERVER)) {
1203  SCLogDebug("setting APP_LAYER_PARSER_EOF_TS");
1205  } else if ((flags & (STREAM_EOF|STREAM_TOCLIENT)) == (STREAM_EOF|STREAM_TOCLIENT)) {
1206  SCLogDebug("setting APP_LAYER_PARSER_EOF_TC");
1208  }
1209 }
1210 
1211 /** \internal
1212  * \brief create/close stream frames
1213  * On first invocation of TCP parser in a direction, create a <alproto>.stream frame.
1214  * On STREAM_EOF, set the final length. */
1215 static void HandleStreamFrames(Flow *f, StreamSlice stream_slice, const uint8_t *input,
1216  const uint32_t input_len, const uint8_t flags)
1217 {
1218  const uint8_t direction = (flags & STREAM_TOSERVER) ? 0 : 1;
1219  AppLayerParserState *pstate = f->alparser;
1220 
1221  /* setup the generic stream frame */
1222  if (((direction == 0 && (pstate->flags & APP_LAYER_PARSER_SFRAME_TS) == 0) ||
1223  (direction == 1 && (pstate->flags & APP_LAYER_PARSER_SFRAME_TC) == 0)) &&
1224  input != NULL && f->proto == IPPROTO_TCP) {
1225  Frame *frame = AppLayerFrameGetLastOpenByType(f, direction, FRAME_STREAM_TYPE);
1226  if (frame == NULL) {
1227  int64_t frame_len = -1;
1228  if (flags & STREAM_EOF)
1229  frame_len = input_len;
1230 
1232  f, &stream_slice, stream_slice.offset, frame_len, direction, FRAME_STREAM_TYPE);
1233  if (frame) {
1234  SCLogDebug("opened: frame %p id %" PRIi64, frame, frame->id);
1235  frame->flags = FRAME_FLAG_ENDS_AT_EOF; // TODO logic is not yet implemented
1237  frame->id != 1); // should always be the first frame that is created
1238  }
1239  if (direction == 0) {
1240  pstate->flags |= APP_LAYER_PARSER_SFRAME_TS;
1241  } else {
1242  pstate->flags |= APP_LAYER_PARSER_SFRAME_TC;
1243  }
1244  }
1245  } else if (flags & STREAM_EOF) {
1246  Frame *frame = AppLayerFrameGetLastOpenByType(f, direction, FRAME_STREAM_TYPE);
1247  SCLogDebug("EOF closing: frame %p", frame);
1248  if (frame) {
1249  /* calculate final frame length */
1250  int64_t slice_o = (int64_t)stream_slice.offset - (int64_t)frame->offset;
1251  int64_t frame_len = slice_o + (int64_t)input_len;
1252  SCLogDebug("%s: EOF frame->offset %" PRIu64 " -> %" PRIi64 ": o %" PRIi64,
1253  AppProtoToString(f->alproto), frame->offset, frame_len, slice_o);
1254  frame->len = frame_len;
1255  }
1256  }
1257 }
1258 
1259 static void Setup(Flow *f, const uint8_t direction, const uint8_t *input, uint32_t input_len,
1260  const uint8_t flags, StreamSlice *as)
1261 {
1262  memset(as, 0, sizeof(*as));
1263  as->input = input;
1264  as->input_len = input_len;
1265  as->flags = flags;
1266 
1267  if (f->proto == IPPROTO_TCP && f->protoctx != NULL) {
1268  TcpSession *ssn = f->protoctx;
1269  TcpStream *stream = (direction & STREAM_TOSERVER) ? &ssn->client : &ssn->server;
1270  as->offset = STREAM_APP_PROGRESS(stream);
1271  }
1272 }
1273 
1274 /** \retval int -1 in case of unrecoverable error. App-layer tracking stops for this flow.
1275  * \retval int 0 ok: we did not update app_progress
1276  * \retval int 1 ok: we updated app_progress */
1278  uint8_t flags, const uint8_t *input, uint32_t input_len)
1279 {
1280  SCEnter();
1281 #ifdef DEBUG_VALIDATION
1283 #endif
1284  AppLayerParserState *pstate = f->alparser;
1285  AppLayerParserProtoCtx *p = &alp_ctx.ctxs[alproto][f->protomap];
1286  StreamSlice stream_slice;
1287  void *alstate = NULL;
1288  uint64_t p_tx_cnt = 0;
1289  uint32_t consumed = input_len;
1290  const uint8_t direction = (flags & STREAM_TOSERVER) ? 0 : 1;
1291 
1292  /* we don't have the parser registered for this protocol */
1293  if (p->StateAlloc == NULL) {
1294  if (f->proto == IPPROTO_TCP) {
1296  }
1297  goto end;
1298  }
1299 
1300  if (flags & STREAM_GAP) {
1302  SCLogDebug("app-layer parser does not accept gaps");
1303  if (f->alstate != NULL && !FlowChangeProto(f)) {
1305  }
1307  goto error;
1308  }
1309  }
1310 
1311  /* Get the parser state (if any) */
1312  if (pstate == NULL) {
1313  f->alparser = pstate = AppLayerParserStateAlloc();
1314  if (pstate == NULL) {
1316  goto error;
1317  }
1318  }
1319 
1320  SetEOFFlags(pstate, flags);
1321 
1322  alstate = f->alstate;
1323  if (alstate == NULL || FlowChangeProto(f)) {
1324  f->alstate = alstate = p->StateAlloc(alstate, f->alproto_orig);
1325  if (alstate == NULL) {
1327  goto error;
1328  }
1329  SCLogDebug("alloced new app layer state %p (name %s)",
1330  alstate, AppLayerGetProtoName(f->alproto));
1331 
1332  /* set flow flags to state */
1333  if (f->file_flags != 0) {
1334  AppLayerStateData *sd = AppLayerParserGetStateData(f->proto, f->alproto, f->alstate);
1335  if (sd != NULL) {
1336  if ((sd->file_flags & f->file_flags) != f->file_flags) {
1337  SCLogDebug("state data: updating file_flags %04x with flow file_flags %04x",
1338  sd->file_flags, f->file_flags);
1339  sd->file_flags |= f->file_flags;
1340  }
1341  }
1342  }
1343  } else {
1344  SCLogDebug("using existing app layer state %p (name %s))",
1345  alstate, AppLayerGetProtoName(f->alproto));
1346  }
1347 
1348  p_tx_cnt = AppLayerParserGetTxCnt(f, f->alstate);
1349 
1350  /* invoke the recursive parser, but only on data. We may get empty msgs on EOF */
1351  if (input_len > 0 || (flags & STREAM_EOF)) {
1352  Setup(f, flags & (STREAM_TOSERVER | STREAM_TOCLIENT), input, input_len, flags,
1353  &stream_slice);
1354  HandleStreamFrames(f, stream_slice, input, input_len, flags);
1355 
1356 #ifdef DEBUG
1357  if (((stream_slice.flags & STREAM_TOSERVER) &&
1358  stream_slice.offset >= g_eps_applayer_error_offset_ts)) {
1359  SCLogNotice("putting parser %s into an error state from toserver offset %" PRIu64,
1360  AppProtoToString(alproto), g_eps_applayer_error_offset_ts);
1362  goto error;
1363  }
1364  if (((stream_slice.flags & STREAM_TOCLIENT) &&
1365  stream_slice.offset >= g_eps_applayer_error_offset_tc)) {
1366  SCLogNotice("putting parser %s into an error state from toclient offset %" PRIu64,
1367  AppProtoToString(alproto), g_eps_applayer_error_offset_tc);
1369  goto error;
1370  }
1371 #endif
1372  /* invoke the parser */
1373  AppLayerResult res = p->Parser[direction](f, alstate, pstate, stream_slice,
1374  alp_tctx->alproto_local_storage[alproto][f->protomap]);
1375  if (res.status < 0) {
1377  goto error;
1378  } else if (res.status > 0) {
1379  DEBUG_VALIDATE_BUG_ON(res.consumed > input_len);
1380  DEBUG_VALIDATE_BUG_ON(res.needed + res.consumed < input_len);
1381  DEBUG_VALIDATE_BUG_ON(res.needed == 0);
1382  /* incomplete is only supported for TCP */
1383  DEBUG_VALIDATE_BUG_ON(f->proto != IPPROTO_TCP);
1384 
1385  /* put protocol in error state on improper use of the
1386  * return codes. */
1387  if (res.consumed > input_len || res.needed + res.consumed < input_len) {
1389  goto error;
1390  }
1391 
1392  if (f->proto == IPPROTO_TCP && f->protoctx != NULL) {
1393  TcpSession *ssn = f->protoctx;
1394  SCLogDebug("direction %d/%s", direction,
1395  (flags & STREAM_TOSERVER) ? "toserver" : "toclient");
1396  if (direction == 0) {
1397  /* parser told us how much data it needs on top of what it
1398  * consumed. So we need tell stream engine how much we need
1399  * before the next call */
1400  ssn->client.data_required = res.needed;
1401  SCLogDebug("setting data_required %u", ssn->client.data_required);
1402  } else {
1403  /* parser told us how much data it needs on top of what it
1404  * consumed. So we need tell stream engine how much we need
1405  * before the next call */
1406  ssn->server.data_required = res.needed;
1407  SCLogDebug("setting data_required %u", ssn->server.data_required);
1408  }
1409  }
1410  consumed = res.consumed;
1411  }
1412  }
1413 
1414  /* set the packets to no inspection and reassembly if required */
1415  if (pstate->flags & APP_LAYER_PARSER_NO_INSPECTION) {
1416  AppLayerParserSetEOF(pstate);
1417 
1418  if (f->proto == IPPROTO_TCP) {
1420 
1421  /* Set the no reassembly flag for both the stream in this TcpSession */
1422  if (pstate->flags & APP_LAYER_PARSER_NO_REASSEMBLY) {
1423  /* Used only if it's TCP */
1424  TcpSession *ssn = f->protoctx;
1425  if (ssn != NULL) {
1428  }
1429  }
1430  /* Set the bypass flag for both the stream in this TcpSession */
1431  if (pstate->flags & APP_LAYER_PARSER_BYPASS_READY) {
1432  /* Used only if it's TCP */
1433  TcpSession *ssn = f->protoctx;
1434  if (ssn != NULL) {
1436  }
1437  }
1438  } else {
1439  // for TCP, this is set after flushing
1440  FlowSetNoPayloadInspectionFlag(f);
1441  }
1442  }
1443 
1444  /* In cases like HeartBleed for TLS we need to inspect AppLayer but not Payload */
1446  FlowSetNoPayloadInspectionFlag(f);
1447  /* Set the no reassembly flag for both the stream in this TcpSession */
1448  if (f->proto == IPPROTO_TCP) {
1449  /* Used only if it's TCP */
1450  TcpSession *ssn = f->protoctx;
1451  if (ssn != NULL) {
1454  }
1455  }
1456  }
1457 
1458  /* get the diff in tx cnt for stats keeping */
1459  uint64_t cur_tx_cnt = AppLayerParserGetTxCnt(f, f->alstate);
1460  if (cur_tx_cnt > p_tx_cnt && tv) {
1461  AppLayerIncTxCounter(tv, f, cur_tx_cnt - p_tx_cnt);
1462  }
1463 
1464  end:
1465  /* update app progress */
1466  if (consumed != input_len && f->proto == IPPROTO_TCP && f->protoctx != NULL) {
1467  TcpSession *ssn = f->protoctx;
1468  StreamTcpUpdateAppLayerProgress(ssn, direction, consumed);
1469  SCReturnInt(1);
1470  }
1471 
1472  SCReturnInt(0);
1473  error:
1474  /* Set the no app layer inspection flag for both
1475  * the stream in this Flow */
1476  if (f->proto == IPPROTO_TCP) {
1478  }
1479  AppLayerParserSetEOF(pstate);
1480  SCReturnInt(-1);
1481 }
1482 
1484 {
1485  SCEnter();
1486 
1487  if (pstate == NULL)
1488  goto end;
1489 
1490  SCLogDebug("setting APP_LAYER_PARSER_EOF_TC and APP_LAYER_PARSER_EOF_TS");
1492 
1493  end:
1494  SCReturn;
1495 }
1496 
1497 /* return true if there are app parser decoder events. These are
1498  * only the ones that are set during protocol detection. */
1500 {
1501  SCEnter();
1502 
1503  if (pstate == NULL)
1504  return false;
1505 
1508  return true;
1509 
1510  /* if we have reached here, we don't have events */
1511  return false;
1512 }
1513 
1514 /** \brief simple way to globally test if a alproto is registered
1515  * and fully enabled in the configuration.
1516  */
1518 {
1519  for (int i = 0; i < FLOW_PROTO_APPLAYER_MAX; i++) {
1520  if (alp_ctx.ctxs[alproto][i].StateGetProgress != NULL) {
1521  return 1;
1522  }
1523  }
1524  return 0;
1525 }
1526 
1527 int AppLayerParserProtocolHasLogger(uint8_t ipproto, AppProto alproto)
1528 {
1529  SCEnter();
1530  int ipproto_map = FlowGetProtoMapping(ipproto);
1531  int r = (!alp_ctx.ctxs[alproto][ipproto_map].logger) ? 0 : 1;
1532  SCReturnInt(r);
1533 }
1534 
1536 {
1537  SCEnter();
1538  const int ipproto_map = FlowGetProtoMapping(ipproto);
1539  LoggerId r = alp_ctx.ctxs[alproto][ipproto_map].logger_bits;
1540  SCReturnUInt(r);
1541 }
1542 
1544 {
1545  SCEnter();
1546 
1547  SCLogDebug("f %p tcp %p direction %d", f, f ? f->protoctx : NULL, direction);
1548  if (f != NULL && f->protoctx != NULL)
1550 
1551  SCReturn;
1552 }
1553 
1554 void AppLayerParserSetStreamDepth(uint8_t ipproto, AppProto alproto, uint32_t stream_depth)
1555 {
1556  SCEnter();
1557 
1558  alp_ctx.ctxs[alproto][FlowGetProtoMapping(ipproto)].stream_depth = stream_depth;
1559  alp_ctx.ctxs[alproto][FlowGetProtoMapping(ipproto)].internal_flags |=
1561 
1562  SCReturn;
1563 }
1564 
1566 {
1567  SCReturnInt(alp_ctx.ctxs[f->alproto][f->protomap].stream_depth);
1568 }
1569 
1570 void AppLayerParserSetStreamDepthFlag(uint8_t ipproto, AppProto alproto, void *state, uint64_t tx_id, uint8_t flags)
1571 {
1572  SCEnter();
1573  void *tx = NULL;
1574  if (state != NULL) {
1575  if ((tx = AppLayerParserGetTx(ipproto, alproto, state, tx_id)) != NULL) {
1576  if (alp_ctx.ctxs[alproto][FlowGetProtoMapping(ipproto)].SetStreamDepthFlag != NULL) {
1577  alp_ctx.ctxs[alproto][FlowGetProtoMapping(ipproto)].SetStreamDepthFlag(tx, flags);
1578  }
1579  }
1580  }
1581  SCReturn;
1582 }
1583 
1584 int AppLayerParserGetFrameIdByName(uint8_t ipproto, AppProto alproto, const char *name)
1585 {
1586  if (alp_ctx.ctxs[alproto][FlowGetProtoMapping(ipproto)].GetFrameIdByName != NULL) {
1587  return alp_ctx.ctxs[alproto][FlowGetProtoMapping(ipproto)].GetFrameIdByName(name);
1588  } else {
1589  return -1;
1590  }
1591 }
1592 
1593 const char *AppLayerParserGetFrameNameById(uint8_t ipproto, AppProto alproto, const uint8_t id)
1594 {
1595  if (alp_ctx.ctxs[alproto][FlowGetProtoMapping(ipproto)].GetFrameNameById != NULL) {
1596  return alp_ctx.ctxs[alproto][FlowGetProtoMapping(ipproto)].GetFrameNameById(id);
1597  } else {
1598  return NULL;
1599  }
1600 }
1601 
1602 /***** Cleanup *****/
1603 
1605  uint8_t protomap, AppProto alproto, void *alstate, AppLayerParserState *pstate)
1606 {
1607  SCEnter();
1608 
1609  AppLayerParserProtoCtx *ctx = &alp_ctx.ctxs[alproto][protomap];
1610 
1611  if (ctx->StateFree != NULL && alstate != NULL)
1612  ctx->StateFree(alstate);
1613 
1614  /* free the app layer parser api state */
1615  if (pstate != NULL)
1616  AppLayerParserStateFree(pstate);
1617 
1618  SCReturn;
1619 }
1620 
1621 void AppLayerParserStateCleanup(const Flow *f, void *alstate, AppLayerParserState *pstate)
1622 {
1623  AppLayerParserStateProtoCleanup(f->protomap, f->alproto, alstate, pstate);
1624 }
1625 
1626 static void ValidateParserProtoDump(AppProto alproto, uint8_t ipproto)
1627 {
1628  uint8_t map = FlowGetProtoMapping(ipproto);
1629  const AppLayerParserProtoCtx *ctx = &alp_ctx.ctxs[alproto][map];
1630  printf("ERROR: incomplete app-layer registration\n");
1631  printf("AppLayer protocol %s ipproto %u\n", AppProtoToString(alproto), ipproto);
1632  printf("- option flags %"PRIx32"\n", ctx->option_flags);
1633  printf("- first_data_dir %"PRIx8"\n", ctx->first_data_dir);
1634  printf("Mandatory:\n");
1635  printf("- Parser[0] %p Parser[1] %p\n", ctx->Parser[0], ctx->Parser[1]);
1636  printf("- StateAlloc %p StateFree %p\n", ctx->StateAlloc, ctx->StateFree);
1637  printf("- StateGetTx %p StateGetTxCnt %p StateTransactionFree %p\n",
1638  ctx->StateGetTx, ctx->StateGetTxCnt, ctx->StateTransactionFree);
1639  printf("- GetTxData %p\n", ctx->GetTxData);
1640  printf("- GetStateData %p\n", ctx->GetStateData);
1641  printf("- StateGetProgress %p\n", ctx->StateGetProgress);
1642  printf("Optional:\n");
1643  printf("- LocalStorageAlloc %p LocalStorageFree %p\n", ctx->LocalStorageAlloc, ctx->LocalStorageFree);
1644  printf("- StateGetEventInfo %p StateGetEventInfoById %p\n", ctx->StateGetEventInfo,
1645  ctx->StateGetEventInfoById);
1646 }
1647 
1648 #define BOTH_SET(a, b) ((a) != NULL && (b) != NULL)
1649 #define BOTH_SET_OR_BOTH_UNSET(a, b) (((a) == NULL && (b) == NULL) || ((a) != NULL && (b) != NULL))
1650 #define THREE_SET(a, b, c) ((a) != NULL && (b) != NULL && (c) != NULL)
1652 static void ValidateParserProto(AppProto alproto, uint8_t ipproto)
1653 {
1654  uint8_t map = FlowGetProtoMapping(ipproto);
1655  const AppLayerParserProtoCtx *ctx = &alp_ctx.ctxs[alproto][map];
1656 
1657  if (ctx->Parser[0] == NULL && ctx->Parser[1] == NULL)
1658  return;
1659 
1660  if (!(BOTH_SET(ctx->Parser[0], ctx->Parser[1]))) {
1661  goto bad;
1662  }
1663  if (!(BOTH_SET(ctx->StateFree, ctx->StateAlloc))) {
1664  goto bad;
1665  }
1666  if (!(THREE_SET(ctx->StateGetTx, ctx->StateGetTxCnt, ctx->StateTransactionFree))) {
1667  goto bad;
1668  }
1669  if (ctx->StateGetProgress == NULL) {
1670  goto bad;
1671  }
1672  /* local storage is optional, but needs both set if used */
1673  if (!(BOTH_SET_OR_BOTH_UNSET(ctx->LocalStorageAlloc, ctx->LocalStorageFree))) {
1674  goto bad;
1675  }
1676  if (ctx->GetTxData == NULL) {
1677  goto bad;
1678  }
1679  if (ctx->GetStateData == NULL) {
1680  goto bad;
1681  }
1682  return;
1683 bad:
1684  ValidateParserProtoDump(alproto, ipproto);
1685  exit(EXIT_FAILURE);
1686 }
1687 #undef BOTH_SET
1688 #undef BOTH_SET_OR_BOTH_UNSET
1689 #undef THREE_SET_OR_THREE_UNSET
1690 #undef THREE_SET
1691 
1692 static void ValidateParser(AppProto alproto)
1693 {
1694  ValidateParserProto(alproto, IPPROTO_TCP);
1695  ValidateParserProto(alproto, IPPROTO_UDP);
1696 }
1697 
1698 static void ValidateParsers(void)
1699 {
1700  AppProto p = 0;
1701  for (; p < g_alproto_max; p++) {
1702  ValidateParser(p);
1703  }
1704 }
1705 
1706 #define ARRAY_CAP_STEP 16
1707 static void (**PreRegisteredCallbacks)(void) = NULL;
1708 static size_t preregistered_callbacks_nb = 0;
1709 static size_t preregistered_callbacks_cap = 0;
1710 
1711 int AppLayerParserPreRegister(void (*Register)(void))
1712 {
1713  if (preregistered_callbacks_nb == preregistered_callbacks_cap) {
1714  void *tmp = SCRealloc(PreRegisteredCallbacks,
1715  sizeof(void *) * (preregistered_callbacks_cap + ARRAY_CAP_STEP));
1716  if (tmp == NULL) {
1717  return 1;
1718  }
1719  preregistered_callbacks_cap += ARRAY_CAP_STEP;
1720  PreRegisteredCallbacks = tmp;
1721  }
1722  PreRegisteredCallbacks[preregistered_callbacks_nb] = Register;
1723  preregistered_callbacks_nb++;
1724  return 0;
1725 }
1726 
1728 {
1729  SCEnter();
1730 
1731  AppLayerConfig();
1732 
1735  SCRegisterDcerpcParser();
1736  SCRegisterDcerpcUdpParser();
1741  SCRegisterDnsUdpParser();
1742  SCRegisterDnsTcpParser();
1743  SCRegisterBittorrentDhtUdpParser();
1745  SCEnipRegisterParsers();
1749  rs_register_ntp_parser();
1752  rs_register_krb5_parser();
1753  SCRegisterDhcpParser();
1754  rs_register_snmp_parser();
1755  rs_sip_register_parser();
1756  rs_quic_register_parser();
1757  rs_websocket_register_parser();
1758  SCRegisterLdapTcpParser();
1759  SCRegisterLdapUdpParser();
1760  rs_template_register_parser();
1761  SCRfbRegisterParser();
1762  SCMqttRegisterParser();
1763  SCRegisterPgsqlParser();
1764  rs_rdp_register_parser();
1766  rs_telnet_register_parser();
1768 
1769  /** POP3 */
1771  if (AppLayerProtoDetectConfProtoDetectionEnabled("tcp", "pop3")) {
1773  IPPROTO_TCP, ALPROTO_POP3, "+OK ", 4, 0, STREAM_TOCLIENT) < 0) {
1774  FatalError("pop3 proto registration failure");
1775  }
1776  } else {
1777  SCLogInfo("Protocol detection and parser disabled for pop3 protocol.");
1778  }
1779  for (size_t i = 0; i < preregistered_callbacks_nb; i++) {
1780  PreRegisteredCallbacks[i]();
1781  }
1782 
1783  ValidateParsers();
1784 }
1785 
1786 
1787 /* coccinelle: AppLayerParserStateSetFlag():2,2:APP_LAYER_PARSER_ */
1789 {
1790  SCEnter();
1791  pstate->flags |= flag;
1792  SCReturn;
1793 }
1794 
1795 /* coccinelle: AppLayerParserStateIssetFlag():2,2:APP_LAYER_PARSER_ */
1796 uint16_t AppLayerParserStateIssetFlag(AppLayerParserState *pstate, uint16_t flag)
1797 {
1798  SCEnter();
1799  SCReturnUInt(pstate->flags & flag);
1800 }
1801 
1802 /***** Unittests *****/
1803 
1804 #ifdef UNITTESTS
1805 #include "util-unittest-helper.h"
1806 
1808  void (*RegisterUnittests)(void))
1809 {
1810  SCEnter();
1811  alp_ctx.ctxs[FlowGetProtoMapping(ipproto)][alproto].
1812  RegisterUnittests = RegisterUnittests;
1813  SCReturn;
1814 }
1815 
1817 {
1818  SCEnter();
1819 
1820  int ip;
1821  AppProto alproto;
1823 
1824  for (ip = 0; ip < FLOW_PROTO_DEFAULT; ip++) {
1825  for (alproto = 0; alproto < g_alproto_max; alproto++) {
1826  ctx = &alp_ctx.ctxs[alproto][ip];
1827  if (ctx->RegisterUnittests == NULL)
1828  continue;
1829  ctx->RegisterUnittests();
1830  }
1831  }
1832 
1833  SCReturn;
1834 }
1835 
1836 #endif
app-layer-nfs-udp.h
AppLayerParserRegisterGetStateProgressFunc
void AppLayerParserRegisterGetStateProgressFunc(uint8_t ipproto, AppProto alproto, int(*StateGetProgress)(void *alstate, uint8_t direction))
Definition: app-layer-parser.c:475
AppLayerParserDeSetup
int AppLayerParserDeSetup(void)
Definition: app-layer-parser.c:273
TcpStream_
Definition: stream-tcp-private.h:106
AppLayerParserProtoCtx_::GetStateData
AppLayerStateData *(* GetStateData)(void *state)
Definition: app-layer-parser.c:101
ts
uint64_t ts
Definition: source-erf-file.c:55
AppLayerParserProtoCtx_::StateGetTxCnt
uint64_t(* StateGetTxCnt)(void *alstate)
Definition: app-layer-parser.c:91
g_applayerparser_error_policy
enum ExceptionPolicy g_applayerparser_error_policy
Definition: app-layer-parser.c:149
AppLayerParserProtoCtx_::logger_bits
uint32_t logger_bits
Definition: app-layer-parser.c:78
AppLayerParserProtoCtx_::complete_tc
int complete_tc
Definition: app-layer-parser.c:95
AppLayerParserProtoCtx_::GetTxData
AppLayerTxData *(* GetTxData)(void *tx)
Definition: app-layer-parser.c:102
app-layer-tftp.h
AppLayerParserState_::log_id
uint64_t log_id
Definition: app-layer-parser.c:139
RegisterSMBParsers
void RegisterSMBParsers(void)
Definition: app-layer-smb.c:45
app-layer-ssh.h
RegisterIKEParsers
void RegisterIKEParsers(void)
Definition: app-layer-ike.c:40
AppLayerParserIsEnabled
int AppLayerParserIsEnabled(AppProto alproto)
simple way to globally test if a alproto is registered and fully enabled in the configuration.
Definition: app-layer-parser.c:1517
AppLayerParserRegisterLocalStorageFunc
void AppLayerParserRegisterLocalStorageFunc(uint8_t ipproto, AppProto alproto, void *(*LocalStorageAlloc)(void), void(*LocalStorageFree)(void *))
Definition: app-layer-parser.c:435
BOTH_SET
#define BOTH_SET(a, b)
Definition: app-layer-parser.c:1648
AppLayerParserProtocolHasLogger
int AppLayerParserProtocolHasLogger(uint8_t ipproto, AppProto alproto)
Definition: app-layer-parser.c:1527
AppLayerParserRegisterOptionFlags
void AppLayerParserRegisterOptionFlags(uint8_t ipproto, AppProto alproto, uint32_t flags)
Definition: app-layer-parser.c:414
flow-util.h
FramesFree
void FramesFree(Frames *frames)
Definition: app-layer-frames.c:447
AppLayerParserSetStreamDepthFlag
void AppLayerParserSetStreamDepthFlag(uint8_t ipproto, AppProto alproto, void *state, uint64_t tx_id, uint8_t flags)
Definition: app-layer-parser.c:1570
AppLayerParserSetTransactionLogId
void AppLayerParserSetTransactionLogId(AppLayerParserState *pstate, uint64_t tx_id)
Definition: app-layer-parser.c:687
g_filedata_logger_enabled
bool g_filedata_logger_enabled
Definition: output-filedata.c:37
AppLayerParserSetStreamDepth
void AppLayerParserSetStreamDepth(uint8_t ipproto, AppProto alproto, uint32_t stream_depth)
Definition: app-layer-parser.c:1554
ConfNode_::val
char * val
Definition: conf.h:34
stream-tcp.h
AppLayerParserApplyTxConfig
void AppLayerParserApplyTxConfig(uint8_t ipproto, AppProto alproto, void *state, void *tx, enum ConfigAction mode, AppLayerTxConfig config)
Definition: app-layer-parser.c:1187
unlikely
#define unlikely(expr)
Definition: util-optimize.h:35
AppLayerParserTransactionsCleanup
void AppLayerParserTransactionsCleanup(Flow *f, const uint8_t pkt_dir)
remove obsolete (inspected and logged) transactions
Definition: app-layer-parser.c:883
AppLayerParserGetProtocolParserLocalStorage
void * AppLayerParserGetProtocolParserLocalStorage(uint8_t ipproto, AppProto alproto)
Definition: app-layer-parser.c:613
AppLayerParserProtoCtx_::LocalStorageFree
void(* LocalStorageFree)(void *)
Definition: app-layer-parser.c:84
AppLayerParserProtoCtx_
App layer protocol parser context.
Definition: app-layer-parser.c:67
RegisterSSHParsers
void RegisterSSHParsers(void)
Function to register the SSH protocol parsers and other functions.
Definition: app-layer-ssh.c:81
AppLayerParserProtoCtx_::StateGetTx
void *(* StateGetTx)(void *alstate, uint64_t tx_id)
Definition: app-layer-parser.c:92
SCLogDebug
#define SCLogDebug(...)
Definition: util-debug.h:269
FLOW_SGH_TOCLIENT
#define FLOW_SGH_TOCLIENT
Definition: flow.h:73
AppLayerParserSetTransactionInspectId
void AppLayerParserSetTransactionInspectId(const Flow *f, AppLayerParserState *pstate, void *alstate, const uint8_t flags, bool tag_txs_as_inspected)
Definition: app-layer-parser.c:729
APP_LAYER_PARSER_BYPASS_READY
#define APP_LAYER_PARSER_BYPASS_READY
Definition: app-layer-parser.h:38
AppLayerParserGetEventsByTx
AppLayerDecoderEvents * AppLayerParserGetEventsByTx(uint8_t ipproto, AppProto alproto, void *tx)
Definition: app-layer-parser.c:837
AppLayerGetTxIterator
AppLayerGetTxIteratorFunc AppLayerGetTxIterator(const uint8_t ipproto, const AppProto alproto)
Definition: app-layer-parser.c:672
next
struct HtpBodyChunk_ * next
Definition: app-layer-htp.h:0
RegisterModbusParsers
void RegisterModbusParsers(void)
Function to register the Modbus protocol parser.
Definition: app-layer-modbus.c:49
Flow_::proto
uint8_t proto
Definition: flow.h:376
AppProto
uint16_t AppProto
Definition: app-layer-protos.h:85
StreamTcpSetDisableRawReassemblyFlag
void StreamTcpSetDisableRawReassemblyFlag(TcpSession *, char)
Set the No reassembly flag for the given direction in given TCP session.
Definition: stream-tcp.c:6699
AppLayerFramesSetupContainer
FramesContainer * AppLayerFramesSetupContainer(Flow *f)
Definition: app-layer-parser.c:180
AppLayerParserConfParserEnabled
int AppLayerParserConfParserEnabled(const char *ipproto, const char *alproto_name)
check if a parser is enabled in the config Returns enabled always if: were running unittests
Definition: app-layer-parser.c:333
AppLayerParserGetStateProgress
int AppLayerParserGetStateProgress(uint8_t ipproto, AppProto alproto, void *alstate, uint8_t flags)
get the progress value for a tx/protocol
Definition: app-layer-parser.c:1073
AppLayerParserTriggerRawStreamReassembly
void AppLayerParserTriggerRawStreamReassembly(Flow *f, int direction)
Definition: app-layer-parser.c:1543
ALPROTO_POP3
@ ALPROTO_POP3
Definition: app-layer-protos.h:72
FramesContainer::toserver
Frames toserver
Definition: app-layer-frames.h:72
ConfGetNode
ConfNode * ConfGetNode(const char *name)
Get a ConfNode by name.
Definition: conf.c:181
Frame::offset
uint64_t offset
Definition: app-layer-frames.h:49
TcpStreamCnf_::reassembly_depth
uint32_t reassembly_depth
Definition: stream-tcp.h:75
Frame
Definition: app-layer-frames.h:43
flow-private.h
Flow_
Flow data structure.
Definition: flow.h:354
AppLayerIncGapErrorCounter
void AppLayerIncGapErrorCounter(ThreadVars *tv, Flow *f)
Definition: app-layer.c:162
APP_LAYER_PARSER_INT_STREAM_DEPTH_SET
#define APP_LAYER_PARSER_INT_STREAM_DEPTH_SET
Definition: app-layer-parser.h:48
StreamTcpReassembleTriggerRawReassembly
void StreamTcpReassembleTriggerRawReassembly(TcpSession *ssn, int direction)
Trigger RAW stream reassembly.
Definition: stream-tcp-reassemble.c:2156
LoggerId
LoggerId
Definition: suricata-common.h:469
Flow_::protomap
uint8_t protomap
Definition: flow.h:443
AppLayerParserGetTransactionLogId
uint64_t AppLayerParserGetTransactionLogId(AppLayerParserState *pstate)
Definition: app-layer-parser.c:680
AppProtoToString
const char * AppProtoToString(AppProto alproto)
Maps the ALPROTO_*, to its string equivalent.
Definition: app-layer-protos.c:40
ctx
struct Thresholds ctx
AppLayerParserSupportsFiles
bool AppLayerParserSupportsFiles(uint8_t ipproto, AppProto alproto)
Definition: app-layer-parser.c:1159
AppLayerParserRegisterStateProgressCompletionStatus
void AppLayerParserRegisterStateProgressCompletionStatus(AppProto alproto, const int ts, const int tc)
Definition: app-layer-parser.c:523
AppLayerParserRegisterParserAcceptableDataDirection
void AppLayerParserRegisterParserAcceptableDataDirection(uint8_t ipproto, AppProto alproto, uint8_t direction)
Definition: app-layer-parser.c:403
AppLayerParserGetStateProgressCompletionStatus
int AppLayerParserGetStateProgressCompletionStatus(AppProto alproto, uint8_t direction)
Definition: app-layer-parser.c:1102
AppLayerParserGetFirstDataDir
uint8_t AppLayerParserGetFirstDataDir(uint8_t ipproto, AppProto alproto)
Definition: app-layer-parser.c:1135
AppLayerParserProtoIsRegistered
int AppLayerParserProtoIsRegistered(uint8_t ipproto, AppProto alproto)
Definition: app-layer-parser.c:217
AppLayerParserRegisterTxFreeFunc
void AppLayerParserRegisterTxFreeFunc(uint8_t ipproto, AppProto alproto, void(*StateTransactionFree)(void *, uint64_t))
Definition: app-layer-parser.c:485
FLOW_NOPAYLOAD_INSPECTION
#define FLOW_NOPAYLOAD_INSPECTION
Definition: flow.h:65
Frame::id
int64_t id
Definition: app-layer-frames.h:51
APP_LAYER_TX_SKIP_INSPECT_FLAG
#define APP_LAYER_TX_SKIP_INSPECT_FLAG
Definition: app-layer-parser.h:78
Flow_::alproto_orig
AppProto alproto_orig
Definition: flow.h:454
AppLayerParserStateProtoCleanup
void AppLayerParserStateProtoCleanup(uint8_t protomap, AppProto alproto, void *alstate, AppLayerParserState *pstate)
Definition: app-layer-parser.c:1604
AppLayerParserProtoCtx_::StateGetTxIterator
AppLayerGetTxIteratorFunc StateGetTxIterator
Definition: app-layer-parser.c:93
AppLayerParserThreadCtxFree
void AppLayerParserThreadCtxFree(AppLayerParserThreadCtx *tctx)
Destroys the app layer parser thread context obtained using AppLayerParserThreadCtxAlloc().
Definition: app-layer-parser.c:312
MIN
#define MIN(x, y)
Definition: suricata-common.h:400
AppLayerDecoderEventsFreeEvents
void AppLayerDecoderEventsFreeEvents(AppLayerDecoderEvents **events)
Definition: app-layer-events.c:136
StreamTcpUpdateAppLayerProgress
void StreamTcpUpdateAppLayerProgress(TcpSession *ssn, char direction, const uint32_t progress)
update reassembly progress
Definition: stream-tcp.c:6663
FramesContainer
Definition: app-layer-frames.h:71
APP_LAYER_TX_INSPECTED_FLAG
#define APP_LAYER_TX_INSPECTED_FLAG
Definition: app-layer-parser.h:80
AppLayerParserGetStateData
AppLayerStateData * AppLayerParserGetStateData(uint8_t ipproto, AppProto alproto, void *state)
Definition: app-layer-parser.c:1176
app-layer-http2.h
app-layer-ftp.h
AppLayerFrameNewByAbsoluteOffset
Frame * AppLayerFrameNewByAbsoluteOffset(Flow *f, const StreamSlice *stream_slice, const uint64_t frame_start, const int64_t len, int dir, uint8_t frame_type)
create new frame using the absolute offset from the start of the stream
Definition: app-layer-frames.c:598
AppLayerFrameGetLastOpenByType
Frame * AppLayerFrameGetLastOpenByType(Flow *f, const int dir, const uint8_t frame_type)
Definition: app-layer-frames.c:712
stream_config
TcpStreamCnf stream_config
Definition: stream-tcp.c:219
MAX
#define MAX(x, y)
Definition: suricata-common.h:404
APP_LAYER_PARSER_EOF_TS
#define APP_LAYER_PARSER_EOF_TS
Definition: app-layer-parser.h:39
Flow_::protoctx
void * protoctx
Definition: flow.h:439
TcpStream_::data_required
uint32_t data_required
Definition: stream-tcp-private.h:133
AppLayerIncAllocErrorCounter
void AppLayerIncAllocErrorCounter(ThreadVars *tv, Flow *f)
Definition: app-layer.c:170
EXCEPTION_POLICY_NOT_SET
@ EXCEPTION_POLICY_NOT_SET
Definition: util-exception-policy-types.h:26
ExceptionPolicyParse
enum ExceptionPolicy ExceptionPolicyParse(const char *option, bool support_flow)
Definition: util-exception-policy.c:232
AppLayerParserRegisterUnittests
void AppLayerParserRegisterUnittests(void)
Definition: app-layer-parser.c:1816
AppLayerParserGetTransactionInspectId
uint64_t AppLayerParserGetTransactionInspectId(AppLayerParserState *pstate, uint8_t direction)
Definition: app-layer-parser.c:697
AppLayerDecoderEvents_
Data structure to store app layer decoder events.
Definition: app-layer-events.h:36
AppLayerParserProtoCtx_::ApplyTxConfig
bool(* ApplyTxConfig)(void *state, void *tx, int mode, AppLayerTxConfig)
Definition: app-layer-parser.c:103
FlowGetReverseProtoMapping
uint8_t FlowGetReverseProtoMapping(uint8_t rproto)
Definition: flow-util.c:112
RegisterDNP3Parsers
void RegisterDNP3Parsers(void)
Register the DNP3 application protocol parser.
Definition: app-layer-dnp3.c:1532
ConfValIsTrue
int ConfValIsTrue(const char *val)
Check if a value is true.
Definition: conf.c:536
util-unittest-helper.h
AppLayerParserProtoCtx_::StateGetEventInfoById
int(* StateGetEventInfoById)(uint8_t event_id, const char **event_name, AppLayerEventType *event_type)
Definition: app-layer-parser.c:96
FTPParserCleanup
void FTPParserCleanup(void)
Free memory allocated for global FTP parser state.
Definition: app-layer-ftp.c:1401
AppLayerParserGetTxFiles
AppLayerGetFileState AppLayerParserGetTxFiles(const Flow *f, void *tx, const uint8_t direction)
Definition: app-layer-parser.c:853
AppLayerParserState_::flags
uint16_t flags
Definition: app-layer-parser.c:131
Flow_::sgh_toserver
const struct SigGroupHead_ * sgh_toserver
Definition: flow.h:481
AppLayerParserState_::inspect_id
uint64_t inspect_id[2]
Definition: app-layer-parser.c:135
AppLayerParserFPtr
AppLayerResult(* AppLayerParserFPtr)(Flow *f, void *protocol_state, AppLayerParserState *pstate, StreamSlice stream_slice, void *local_storage)
Prototype for parsing functions.
Definition: app-layer-parser.h:140
AppLayerParserCtx
struct AppLayerParserCtx_ AppLayerParserCtx
Flow_::alparser
AppLayerParserState * alparser
Definition: flow.h:473
AppLayerParserRegisterProtocolParsers
void AppLayerParserRegisterProtocolParsers(void)
Definition: app-layer-parser.c:1727
app-layer-detect-proto.h
APP_LAYER_PARSER_SFRAME_TS
#define APP_LAYER_PARSER_SFRAME_TS
Definition: app-layer-parser.h:42
app-layer-htp.h
FramesContainer::toclient
Frames toclient
Definition: app-layer-frames.h:73
AppLayerParserProtoCtx_::stream_depth
uint32_t stream_depth
Definition: app-layer-parser.c:111
AppLayerParserState_
Definition: app-layer-parser.c:129
AppLayerParserGetEventInfoById
int AppLayerParserGetEventInfoById(uint8_t ipproto, AppProto alproto, uint8_t event_id, const char **event_name, AppLayerEventType *event_type)
Definition: app-layer-parser.c:1122
AppLayerParserProtoCtx_::GetFrameIdByName
AppLayerParserGetFrameIdByNameFn GetFrameIdByName
Definition: app-layer-parser.c:107
AppLayerParserGetFrameNameById
const char * AppLayerParserGetFrameNameById(uint8_t ipproto, AppProto alproto, const uint8_t id)
Definition: app-layer-parser.c:1593
g_alproto_max
AppProto g_alproto_max
Definition: app-layer-protos.c:29
AppLayerParserGetTransactionActive
uint64_t AppLayerParserGetTransactionActive(const Flow *f, AppLayerParserState *pstate, uint8_t direction)
Definition: app-layer-parser.c:1142
AppLayerParserProtoCtx_::logger
bool logger
Definition: app-layer-parser.c:71
app-layer-ike.h
AppLayerFramesFreeContainer
void AppLayerFramesFreeContainer(Flow *f)
Definition: app-layer-parser.c:165
app-layer-dnp3.h
AppLayerParserThreadCtx_::alproto_local_storage
void *(* alproto_local_storage)[FLOW_PROTO_MAX]
Definition: app-layer-parser.c:59
AppLayerParserGetTxDetectFlags
uint64_t AppLayerParserGetTxDetectFlags(AppLayerTxData *txd, const uint8_t dir)
Definition: app-layer-parser.c:708
AppLayerParserProtoCtx_::StateGetEventInfo
int(* StateGetEventInfo)(const char *event_name, uint8_t *event_id, AppLayerEventType *event_type)
Definition: app-layer-parser.c:98
alp_tctx
AppLayerParserThreadCtx * alp_tctx
Definition: fuzz_applayerparserparse.c:22
AppLayerParserRegisterLogger
void AppLayerParserRegisterLogger(uint8_t ipproto, AppProto alproto)
Definition: app-layer-parser.c:466
AppLayerParserRegisterGetFrameFuncs
void AppLayerParserRegisterGetFrameFuncs(uint8_t ipproto, AppProto alproto, AppLayerParserGetFrameIdByNameFn GetIdByNameFunc, AppLayerParserGetFrameNameByIdFn GetNameByIdFunc)
Definition: app-layer-parser.c:550
SCEnter
#define SCEnter(...)
Definition: util-debug.h:271
AppLayerParserProtoCtx_::SetStreamDepthFlag
void(* SetStreamDepthFlag)(void *tx, uint8_t flags)
Definition: app-layer-parser.c:105
AppLayerParserState_::min_id
uint64_t min_id
Definition: app-layer-parser.c:141
ThreadVars_
Per thread variable structure.
Definition: threadvars.h:58
AppLayerParserRegisterLoggerBits
void AppLayerParserRegisterLoggerBits(uint8_t ipproto, AppProto alproto, LoggerId bits)
Definition: app-layer-parser.c:457
AppLayerParserRegisterStateFuncs
void AppLayerParserRegisterStateFuncs(uint8_t ipproto, AppProto alproto, void *(*StateAlloc)(void *, AppProto), void(*StateFree)(void *))
Definition: app-layer-parser.c:424
APP_LAYER_PARSER_NO_REASSEMBLY
#define APP_LAYER_PARSER_NO_REASSEMBLY
Definition: app-layer-parser.h:36
IS_DISRUPTED
#define IS_DISRUPTED(flags)
Definition: app-layer-parser.c:874
AppLayerParserSetEOF
void AppLayerParserSetEOF(AppLayerParserState *pstate)
Definition: app-layer-parser.c:1483
AppLayerParserProtoCtx_::RegisterUnittests
void(* RegisterUnittests)(void)
Definition: app-layer-parser.c:121
AppLayerParserStateFree
void AppLayerParserStateFree(AppLayerParserState *pstate)
Definition: app-layer-parser.c:236
FLOW_PROTO_MAX
@ FLOW_PROTO_MAX
Definition: flow-private.h:74
app-layer-parser.h
AppLayerParserStateCleanup
void AppLayerParserStateCleanup(const Flow *f, void *alstate, AppLayerParserState *pstate)
Definition: app-layer-parser.c:1621
BUG_ON
#define BUG_ON(x)
Definition: suricata-common.h:309
AppLayerDecoderEvents_::cnt
uint8_t cnt
Definition: app-layer-events.h:40
Flow_::sgh_toclient
const struct SigGroupHead_ * sgh_toclient
Definition: flow.h:478
RegisterNFSTCPParsers
void RegisterNFSTCPParsers(void)
Definition: app-layer-nfs-tcp.c:46
AppLayerParserRegisterGetEventInfo
void AppLayerParserRegisterGetEventInfo(uint8_t ipproto, AppProto alproto, int(*StateGetEventInfo)(const char *event_name, uint8_t *event_id, AppLayerEventType *event_type))
Definition: app-layer-parser.c:560
AppLayerParserProtoCtx_::GetFrameNameById
AppLayerParserGetFrameNameByIdFn GetFrameNameById
Definition: app-layer-parser.c:108
AppLayerParserProtoCtx
struct AppLayerParserProtoCtx_ AppLayerParserProtoCtx
App layer protocol parser context.
AppLayerParserSetup
int AppLayerParserSetup(void)
Definition: app-layer-parser.c:248
SCReturn
#define SCReturn
Definition: util-debug.h:273
RegisterFTPParsers
void RegisterFTPParsers(void)
Definition: app-layer-ftp.c:1267
AppLayerParserRegisterProtocolUnittests
void AppLayerParserRegisterProtocolUnittests(uint8_t ipproto, AppProto alproto, void(*RegisterUnittests)(void))
Definition: app-layer-parser.c:1807
AppLayerGetTxIterState
Definition: app-layer-parser.h:143
AppLayerParserProtoCtx_::StateAlloc
void *(* StateAlloc)(void *, AppProto)
Definition: app-layer-parser.c:80
FlowGetProtoMapping
uint8_t FlowGetProtoMapping(uint8_t proto)
Function to map the protocol to the defined FLOW_PROTO_* enumeration.
Definition: flow-util.c:98
RegisterTFTPParsers
void RegisterTFTPParsers(void)
Definition: app-layer-tftp.c:155
FLOW_PROTO_APPLAYER_MAX
#define FLOW_PROTO_APPLAYER_MAX
Definition: flow-private.h:77
APP_LAYER_PARSER_EOF_TC
#define APP_LAYER_PARSER_EOF_TC
Definition: app-layer-parser.h:40
SCReturnUInt
#define SCReturnUInt(x)
Definition: util-debug.h:277
DEBUG_ASSERT_FLOW_LOCKED
#define DEBUG_ASSERT_FLOW_LOCKED(f)
Definition: util-validate.h:99
BOTH_SET_OR_BOTH_UNSET
#define BOTH_SET_OR_BOTH_UNSET(a, b)
Definition: app-layer-parser.c:1649
Frame::len
int64_t len
Definition: app-layer-frames.h:50
name
const char * name
Definition: tm-threads.c:2081
SCReturnPtr
#define SCReturnPtr(x, type)
Definition: util-debug.h:287
AppLayerParserProtoCtx_::StateFree
void(* StateFree)(void *)
Definition: app-layer-parser.c:81
AppLayerParserRegisterGetTxFilesFunc
void AppLayerParserRegisterGetTxFilesFunc(uint8_t ipproto, AppProto alproto, AppLayerGetFileState(*GetTxFiles)(void *, uint8_t))
Definition: app-layer-parser.c:447
AppLayerProtoDetectRegisterProtocol
void AppLayerProtoDetectRegisterProtocol(AppProto alproto, const char *alproto_name)
Registers a protocol for protocol detection phase.
Definition: app-layer-detect-proto.c:1767
AppLayerParserRegisterSetStreamDepthFlag
void AppLayerParserRegisterSetStreamDepthFlag(uint8_t ipproto, AppProto alproto, void(*SetStreamDepthFlag)(void *tx, uint8_t flags))
Definition: app-layer-parser.c:601
APP_LAYER_PARSER_SFRAME_TC
#define APP_LAYER_PARSER_SFRAME_TC
Definition: app-layer-parser.h:43
AppLayerIncParserErrorCounter
void AppLayerIncParserErrorCounter(ThreadVars *tv, Flow *f)
Definition: app-layer.c:178
ALPROTO_HTTP2
@ ALPROTO_HTTP2
Definition: app-layer-protos.h:70
RunmodeIsUnittests
int RunmodeIsUnittests(void)
Definition: suricata.c:255
SCLogInfo
#define SCLogInfo(...)
Macro used to log INFORMATIONAL messages.
Definition: util-debug.h:224
APP_LAYER_PARSER_NO_INSPECTION
#define APP_LAYER_PARSER_NO_INSPECTION
Definition: app-layer-parser.h:35
AppLayerParserGetTx
void * AppLayerParserGetTx(uint8_t ipproto, AppProto alproto, void *alstate, uint64_t tx_id)
Definition: app-layer-parser.c:1095
g_detect_disabled
int g_detect_disabled
Definition: suricata.c:183
AppLayerParserRegisterParser
int AppLayerParserRegisterParser(uint8_t ipproto, AppProto alproto, uint8_t direction, AppLayerParserFPtr Parser)
Register app layer parser for the protocol.
Definition: app-layer-parser.c:391
app-layer-imap.h
Frame::flags
uint8_t flags
Definition: app-layer-frames.h:45
SCRealloc
#define SCRealloc(ptr, sz)
Definition: util-mem.h:50
AppLayerParserThreadCtxAlloc
AppLayerParserThreadCtx * AppLayerParserThreadCtxAlloc(void)
Gets a new app layer protocol's parser thread context.
Definition: app-layer-parser.c:285
AppLayerParserRegisterGetTx
void AppLayerParserRegisterGetTx(uint8_t ipproto, AppProto alproto, void *(StateGetTx)(void *alstate, uint64_t tx_id))
Definition: app-layer-parser.c:505
ConfigAction
ConfigAction
Definition: util-config.h:27
AppLayerParserStateSetFlag
void AppLayerParserStateSetFlag(AppLayerParserState *pstate, uint16_t flag)
Definition: app-layer-parser.c:1788
AppLayerParserProtoCtx_::Parser
AppLayerParserFPtr Parser[2]
Definition: app-layer-parser.c:69
app-layer-modbus.h
AppLayerTxData
struct AppLayerTxData AppLayerTxData
Definition: detect.h:1383
AppLayerParserProtoCtx_::StateTransactionFree
void(* StateTransactionFree)(void *, uint64_t)
Definition: app-layer-parser.c:82
app-layer-frames.h
AppLayerParserPreRegister
int AppLayerParserPreRegister(void(*Register)(void))
Definition: app-layer-parser.c:1711
RegisterSSLParsers
void RegisterSSLParsers(void)
Function to register the SSL protocol parser and other functions.
Definition: app-layer-ssl.c:3207
AppLayerParserProtoCtx_::option_flags
uint32_t option_flags
Definition: app-layer-parser.c:114
StreamTcpSetSessionNoReassemblyFlag
void StreamTcpSetSessionNoReassemblyFlag(TcpSession *, char)
disable reassembly
Definition: stream-tcp.c:6683
flags
uint8_t flags
Definition: decode-gre.h:0
AppLayerParserParse
int AppLayerParserParse(ThreadVars *tv, AppLayerParserThreadCtx *alp_tctx, Flow *f, AppProto alproto, uint8_t flags, const uint8_t *input, uint32_t input_len)
Definition: app-layer-parser.c:1277
AppLayerParserGetFrameNameByIdFn
const char *(* AppLayerParserGetFrameNameByIdFn)(const uint8_t id)
Definition: app-layer-parser.h:159
StreamTcpDisableAppLayer
void StreamTcpDisableAppLayer(Flow *f)
Definition: stream-tcp-reassemble.c:448
suricata-common.h
AppLayerParserCtx_::ctxs
AppLayerParserProtoCtx(* ctxs)[FLOW_PROTO_MAX]
Definition: app-layer-parser.c:126
AppLayerParserGetFrameIdByName
int AppLayerParserGetFrameIdByName(uint8_t ipproto, AppProto alproto, const char *name)
Definition: app-layer-parser.c:1584
ALPROTO_HTTP1
@ ALPROTO_HTTP1
Definition: app-layer-protos.h:36
AppLayerParserProtoCtx_::internal_flags
uint32_t internal_flags
Definition: app-layer-parser.c:117
AppLayerParserRegisterApplyTxConfigFunc
void AppLayerParserRegisterApplyTxConfigFunc(uint8_t ipproto, AppProto alproto, bool(*ApplyTxConfig)(void *state, void *tx, int mode, AppLayerTxConfig))
Definition: app-layer-parser.c:591
AppLayerParserRegisterStateDataFunc
void AppLayerParserRegisterStateDataFunc(uint8_t ipproto, AppProto alproto, AppLayerStateData *(*GetStateData)(void *state))
Definition: app-layer-parser.c:581
FilesPrune
void FilesPrune(FileContainer *fc, const StreamingBufferConfig *sbcfg, const bool trunc)
Definition: util-file.c:1206
AppLayerIncInternalErrorCounter
void AppLayerIncInternalErrorCounter(ThreadVars *tv, Flow *f)
Definition: app-layer.c:186
AppLayerParserGetTxData
AppLayerTxData * AppLayerParserGetTxData(uint8_t ipproto, AppProto alproto, void *tx)
Definition: app-layer-parser.c:1169
FatalError
#define FatalError(...)
Definition: util-debug.h:502
AppLayerParserRegisterTxDataFunc
void AppLayerParserRegisterTxDataFunc(uint8_t ipproto, AppProto alproto, AppLayerTxData *(*GetTxData)(void *tx))
Definition: app-layer-parser.c:571
TcpSession_::client
TcpStream client
Definition: stream-tcp-private.h:297
AppLayerParserGetStreamDepth
uint32_t AppLayerParserGetStreamDepth(const Flow *f)
Definition: app-layer-parser.c:1565
RegisterIMAPParsers
void RegisterIMAPParsers(void)
Definition: app-layer-imap.c:84
tv
ThreadVars * tv
Definition: fuzz_decodepcapfile.c:32
AppLayerParserProtoCtx_::GetTxFiles
AppLayerGetFileState(* GetTxFiles)(void *, uint8_t)
Definition: app-layer-parser.c:88
util-validate.h
FRAME_STREAM_TYPE
#define FRAME_STREAM_TYPE
Definition: app-layer-frames.h:30
APP_LAYER_PARSER_OPT_ACCEPT_GAPS
#define APP_LAYER_PARSER_OPT_ACCEPT_GAPS
Definition: app-layer-parser.h:46
TcpSession_::server
TcpStream server
Definition: stream-tcp-private.h:296
AppLayerParserRegisterGetTxIterator
void AppLayerParserRegisterGetTxIterator(uint8_t ipproto, AppProto alproto, AppLayerGetTxIteratorFunc Func)
Definition: app-layer-parser.c:515
AppLayerFramesGetContainer
FramesContainer * AppLayerFramesGetContainer(Flow *f)
Definition: app-layer-parser.c:173
SCLogError
#define SCLogError(...)
Macro used to log ERROR messages.
Definition: util-debug.h:261
AppLayerParserProtoCtx_::complete_ts
int complete_ts
Definition: app-layer-parser.c:94
FLOW_SGH_TOSERVER
#define FLOW_SGH_TOSERVER
Definition: flow.h:71
SCFree
#define SCFree(p)
Definition: util-mem.h:61
ConfNode_
Definition: conf.h:32
Flow_::alstate
void * alstate
Definition: flow.h:474
AppLayerParserPostStreamSetup
void AppLayerParserPostStreamSetup(void)
Definition: app-layer-parser.c:260
Flow_::flags
uint32_t flags
Definition: flow.h:419
AppLayerParserGetDecoderEvents
AppLayerDecoderEvents * AppLayerParserGetDecoderEvents(AppLayerParserState *pstate)
Definition: app-layer-parser.c:829
THREE_SET
#define THREE_SET(a, b, c)
Definition: app-layer-parser.c:1650
AppLayerGetProtoName
const char * AppLayerGetProtoName(AppProto alproto)
Given the internal protocol id, returns a string representation of the protocol.
Definition: app-layer.c:1008
UTHAppLayerParserStateGetIds
void UTHAppLayerParserStateGetIds(void *ptr, uint64_t *i1, uint64_t *i2, uint64_t *log, uint64_t *min)
Definition: app-layer-parser.c:203
ConfValIsFalse
int ConfValIsFalse(const char *val)
Check if a value is false.
Definition: conf.c:561
RegisterHTPParsers
void RegisterHTPParsers(void)
Register the HTTP protocol and state handling functions to APP layer of the engine.
Definition: app-layer-htp.c:2812
ALPROTO_HTTP
@ ALPROTO_HTTP
Definition: app-layer-protos.h:76
AppLayerIncTxCounter
void AppLayerIncTxCounter(ThreadVars *tv, Flow *f, uint64_t step)
Definition: app-layer.c:154
FRAME_FLAG_ENDS_AT_EOF
#define FRAME_FLAG_ENDS_AT_EOF
Definition: app-layer-frames.h:38
RegisterSMTPParsers
void RegisterSMTPParsers(void)
Register the SMTP Protocol parser.
Definition: app-layer-smtp.c:1864
AppLayerParserStateAlloc
AppLayerParserState * AppLayerParserStateAlloc(void)
Definition: app-layer-parser.c:224
SCReturnCT
#define SCReturnCT(x, type)
Definition: util-debug.h:285
AppLayerParserState_::decoder_events
AppLayerDecoderEvents * decoder_events
Definition: app-layer-parser.c:144
AppLayerParserRegisterGetTxCnt
void AppLayerParserRegisterGetTxCnt(uint8_t ipproto, AppProto alproto, uint64_t(*StateGetTxCnt)(void *alstate))
Definition: app-layer-parser.c:495
app-layer-smb.h
AppLayerParserProtoCtx_::StateGetProgress
int(* StateGetProgress)(void *alstate, uint8_t direction)
Definition: app-layer-parser.c:90
AppLayerParserProtocolGetLoggerBits
LoggerId AppLayerParserProtocolGetLoggerBits(uint8_t ipproto, AppProto alproto)
Definition: app-layer-parser.c:1535
AppLayerParserCtx_
Definition: app-layer-parser.c:125
AppLayerParserRegisterGetEventInfoById
void AppLayerParserRegisterGetEventInfoById(uint8_t ipproto, AppProto alproto, int(*StateGetEventInfoById)(uint8_t event_id, const char **event_name, AppLayerEventType *event_type))
Definition: app-layer-parser.c:538
AppLayerGetTxIteratorFunc
AppLayerGetTxIterTuple(* AppLayerGetTxIteratorFunc)(const uint8_t ipproto, const AppProto alproto, void *alstate, uint64_t min_tx_id, uint64_t max_tx_id, AppLayerGetTxIterState *state)
tx iterator prototype
Definition: app-layer-parser.h:152
g_file_logger_enabled
bool g_file_logger_enabled
Definition: output-file.c:39
likely
#define likely(expr)
Definition: util-optimize.h:32
RegisterHTTP2Parsers
void RegisterHTTP2Parsers(void)
Definition: app-layer-http2.c:56
STREAM_APP_PROGRESS
#define STREAM_APP_PROGRESS(stream)
Definition: stream-tcp-private.h:145
AppLayerParserThreadCtx_
Definition: app-layer-parser.c:58
AppLayerProtoDetectPMRegisterPatternCS
int AppLayerProtoDetectPMRegisterPatternCS(uint8_t ipproto, AppProto alproto, const char *pattern, uint16_t depth, uint16_t offset, uint8_t direction)
Registers a case-sensitive pattern for protocol detection.
Definition: app-layer-detect-proto.c:1649
app-layer-smtp.h
APP_LAYER_PARSER_NO_INSPECTION_PAYLOAD
#define APP_LAYER_PARSER_NO_INSPECTION_PAYLOAD
Definition: app-layer-parser.h:37
FlowChangeProto
int FlowChangeProto(Flow *f)
Check if change proto flag is set for flow.
Definition: flow.c:194
FlowGetDisruptionFlags
uint8_t FlowGetDisruptionFlags(const Flow *f, uint8_t flags)
get 'disruption' flags: GAP/DEPTH/PASS
Definition: flow.c:1125
TcpSession_
Definition: stream-tcp-private.h:283
flow.h
AppLayerParserStateIssetFlag
uint16_t AppLayerParserStateIssetFlag(AppLayerParserState *pstate, uint16_t flag)
Definition: app-layer-parser.c:1796
SCLogNotice
#define SCLogNotice(...)
Macro used to log NOTICE messages.
Definition: util-debug.h:237
RegisterNFSUDPParsers
void RegisterNFSUDPParsers(void)
Definition: app-layer-nfs-udp.c:63
FLOW_PROTO_DEFAULT
@ FLOW_PROTO_DEFAULT
Definition: flow-private.h:71
Flow_::file_flags
uint16_t file_flags
Definition: flow.h:421
Flow_::alproto
AppProto alproto
application level protocol
Definition: flow.h:448
ExceptionPolicy
ExceptionPolicy
Definition: util-exception-policy-types.h:25
SCCalloc
#define SCCalloc(nm, sz)
Definition: util-mem.h:53
AppLayerParserDestroyProtocolParserLocalStorage
void AppLayerParserDestroyProtocolParserLocalStorage(uint8_t ipproto, AppProto alproto, void *local_data)
Definition: app-layer-parser.c:625
SCReturnInt
#define SCReturnInt(x)
Definition: util-debug.h:275
AppLayerParserGetTxCnt
uint64_t AppLayerParserGetTxCnt(const Flow *f, void *alstate)
Definition: app-layer-parser.c:1088
AppLayerProtoDetectConfProtoDetectionEnabled
int AppLayerProtoDetectConfProtoDetectionEnabled(const char *ipproto, const char *alproto)
Given a protocol name, checks if proto detection is enabled in the conf file.
Definition: app-layer-detect-proto.c:1959
SMTPParserCleanup
void SMTPParserCleanup(void)
Free memory allocated for global SMTP parser state.
Definition: app-layer-smtp.c:1919
AppLayerParserHasDecoderEvents
bool AppLayerParserHasDecoderEvents(AppLayerParserState *pstate)
Definition: app-layer-parser.c:1499
AppLayerParserGetFrameIdByNameFn
int(* AppLayerParserGetFrameIdByNameFn)(const char *frame_name)
Definition: app-layer-parser.h:158
AppLayerDecoderEvents_::events
uint8_t * events
Definition: app-layer-events.h:38
AppLayerParserState_::frames
FramesContainer * frames
Definition: app-layer-parser.c:146
StreamTcpSetSessionBypassFlag
void StreamTcpSetSessionBypassFlag(TcpSession *)
enable bypass
Definition: stream-tcp.c:6710
DEBUG_VALIDATE_BUG_ON
#define DEBUG_VALIDATE_BUG_ON(exp)
Definition: util-validate.h:102
app-layer-ssl.h
ARRAY_CAP_STEP
#define ARRAY_CAP_STEP
Definition: app-layer-parser.c:1706
AppLayerParserProtoCtx_::LocalStorageAlloc
void *(* LocalStorageAlloc)(void)
Definition: app-layer-parser.c:83
AppLayerParserGetEventInfo
int AppLayerParserGetEventInfo(uint8_t ipproto, AppProto alproto, const char *event_name, uint8_t *event_id, AppLayerEventType *event_type)
Definition: app-layer-parser.c:1110
app-layer-nfs-tcp.h
app-layer.h
AppLayerParserProtoCtx_::first_data_dir
uint8_t first_data_dir
Definition: app-layer-parser.c:76