Go to the documentation of this file.
111 void *(*LocalStorageAlloc)(void);
119 void *(*StateGetTx)(
void *alstate, uint64_t tx_id);
128 AppLayerTxData *(*GetTxData)(
void *tx);
177 static void AppLayerConfg(
void)
184 if (frames != NULL) {
201 if (f == NULL || f->
alparser == NULL)
247 return (alp_ctx.
ctxs[ipproto_map][alproto].
StateAlloc != NULL) ? 1 : 0;
257 memset(pstate, 0,
sizeof(*pstate));
269 AppLayerParserFramesFreeContainer(pstate->
frames);
278 memset(&alp_ctx, 0,
sizeof(alp_ctx));
348 const char *alproto_name)
360 r = snprintf(param,
sizeof(param),
"%s%s%s",
"app-layer.protocols.",
361 alproto_name,
".enabled");
364 }
else if (r > (
int)
sizeof(param)) {
371 r = snprintf(param,
sizeof(param),
"%s%s%s%s%s",
"app-layer.protocols.",
372 alproto_name,
".", ipproto,
".enabled");
375 }
else if (r > (
int)
sizeof(param)) {
390 }
else if (strcasecmp(node->
val,
"detection-only") == 0) {
412 Parser[(direction & STREAM_TOSERVER) ? 0 : 1] = Parser;
423 (direction & (STREAM_TOSERVER | STREAM_TOCLIENT));
445 void *(*StateAlloc)(
void *,
AppProto),
void (*StateFree)(
void *))
458 void *(*LocalStorageAlloc)(
void),
459 void (*LocalStorageFree)(
void *))
501 void (*Truncate)(
void *, uint8_t))
511 int (*StateGetProgress)(
void *alstate, uint8_t direction))
516 StateGetProgress = StateGetProgress;
522 void (*StateTransactionFree)(
void *, uint64_t))
527 StateTransactionFree = StateTransactionFree;
533 uint64_t (*StateGetTxCnt)(
void *alstate))
538 StateGetTxCnt = StateGetTxCnt;
544 void *(StateGetTx)(
void *alstate, uint64_t tx_id))
549 StateGetTx = StateGetTx;
567 BUG_ON(!AppProtoIsValid(alproto));
578 int (*StateGetEventInfoById)(
int event_id,
const char **event_name,
584 StateGetEventInfoById = StateGetEventInfoById;
600 int (*StateGetEventInfo)(
const char *event_name,
int *event_id,
606 StateGetEventInfo = StateGetEventInfo;
612 AppLayerTxData *(*GetTxData)(
void *tx))
622 bool (*ApplyTxConfig)(
void *state,
void *tx,
int mode, AppLayerTxConfig))
632 void (*SetStreamDepthFlag)(
void *tx, uint8_t
flags))
649 LocalStorageAlloc != NULL)
664 LocalStorageFree != NULL)
667 LocalStorageFree(local_data);
681 static AppLayerGetTxIterTuple AppLayerDefaultGetTxIterator(
682 const uint8_t ipproto,
const AppProto alproto,
683 void *alstate, uint64_t min_tx_id, uint64_t max_tx_id,
686 uint64_t ustate = *(uint64_t *)state;
687 uint64_t tx_id =
MAX(min_tx_id, ustate);
688 for ( ; tx_id < max_tx_id; tx_id++) {
690 if (tx_ptr != NULL) {
693 AppLayerGetTxIterTuple tuple = {
696 .has_next = (tx_id + 1 < max_tx_id),
698 SCLogDebug(
"tuple: %p/%"PRIu64
"/%s", tuple.tx_ptr, tuple.tx_id,
699 tuple.has_next ?
"true" :
"false");
704 AppLayerGetTxIterTuple no_tuple = { NULL, 0,
false };
713 return Func ? Func : AppLayerDefaultGetTxIterator;
743 static inline uint64_t GetTxDetectFlags(AppLayerTxData *txd,
const uint8_t dir)
745 uint64_t detect_flags =
746 (dir & STREAM_TOSERVER) ? txd->detect_flags_ts : txd->detect_flags_tc;
750 static inline void SetTxDetectFlags(AppLayerTxData *txd,
const uint8_t dir,
const uint64_t detect_flags)
752 if (dir & STREAM_TOSERVER) {
753 txd->detect_flags_ts = detect_flags;
755 txd->detect_flags_tc = detect_flags;
759 static inline uint32_t GetTxLogged(AppLayerTxData *txd)
761 return txd->logged.flags;
765 void *alstate,
const uint8_t
flags,
766 bool tag_txs_as_inspected)
770 const int direction = (
flags & STREAM_TOSERVER) ? 0 : 1;
774 const uint8_t ipproto = f->
proto;
779 memset(&state, 0,
sizeof(state));
781 SCLogDebug(
"called: %s, tag_txs_as_inspected %s",direction==0?
"toserver":
"toclient",
782 tag_txs_as_inspected?
"true":
"false");
787 AppLayerGetTxIterTuple ires = IterFunc(ipproto, alproto, alstate, idx, total_txs, &state);
788 if (ires.tx_ptr == NULL)
791 void *tx = ires.tx_ptr;
795 if (state_progress < state_done_progress)
799 if (txd && tag_txs_as_inspected) {
800 uint64_t detect_flags = GetTxDetectFlags(txd,
flags);
803 SetTxDetectFlags(txd,
flags, detect_flags);
804 SCLogDebug(
"%p/%"PRIu64
" in-order tx is done for direction %s. Flag %016"PRIx64,
805 tx, idx,
flags & STREAM_TOSERVER ?
"toserver" :
"toclient", detect_flags);
817 if (tag_txs_as_inspected) {
820 AppLayerGetTxIterTuple ires = IterFunc(ipproto, alproto, alstate, idx, total_txs, &state);
821 if (ires.tx_ptr == NULL)
824 void *tx = ires.tx_ptr;
828 if (ires.tx_id > idx && pstate->
inspect_id[direction] == idx) {
834 if (state_progress < state_done_progress)
840 uint64_t detect_flags = GetTxDetectFlags(txd,
flags);
843 SetTxDetectFlags(txd,
flags, detect_flags);
844 SCLogDebug(
"%p/%"PRIu64
" out of order tx is done for direction %s. Flag %016"PRIx64,
845 tx, idx,
flags & STREAM_TOSERVER ?
"toserver" :
"toclient", detect_flags);
847 SCLogDebug(
"%p/%"PRIu64
" out of order tx. Update inspect_id? %"PRIu64,
870 "AppLayerDecoderEvents *");
887 if (txd != NULL && txd->events != NULL) {
903 StateGetFiles(f->
alstate, direction);
909 #define IS_DISRUPTED(flags) ((flags) & (STREAM_DEPTH | STREAM_GAP))
928 const uint8_t ipproto = f->
proto;
930 void *
const alstate = f->
alstate;
933 if (alstate == NULL || alparser == NULL)
936 const uint64_t min = alparser->
min_id;
946 memset(&state, 0,
sizeof(state));
948 uint64_t new_min = min;
950 bool skipped =
false;
951 const bool is_unidir =
955 AppLayerGetTxIterTuple ires = IterFunc(ipproto, alproto, alstate, i, total_txs, &state);
956 if (ires.tx_ptr == NULL)
959 bool tx_skipped =
false;
960 void *tx = ires.tx_ptr;
965 const int tx_progress_tc =
967 if (tx_progress_tc < tx_end_state_tc) {
968 SCLogDebug(
"%p/%"PRIu64
" skipping: tc parser not done", tx, i);
972 const int tx_progress_ts =
974 if (tx_progress_ts < tx_end_state_ts) {
975 SCLogDebug(
"%p/%"PRIu64
" skipping: ts parser not done", tx, i);
981 bool inspected =
false;
982 if (txd && has_tx_detect_flags) {
984 uint64_t detect_flags_ts = GetTxDetectFlags(txd, STREAM_TOSERVER);
986 SCLogDebug(
"%p/%"PRIu64
" skipping: TS inspect not done: ts:%"PRIx64,
987 tx, i, detect_flags_ts);
994 uint64_t detect_flags_tc = GetTxDetectFlags(txd, STREAM_TOCLIENT);
996 SCLogDebug(
"%p/%"PRIu64
" skipping: TC inspect not done: tc:%"PRIx64,
997 tx, i, detect_flags_tc);
1007 if (!is_unidir && tx_skipped) {
1008 SCLogDebug(
"%p/%" PRIu64
" !is_unidir && tx_skipped", tx, i);
1017 if (is_unidir && tx_skipped && !inspected) {
1018 SCLogDebug(
"%p/%" PRIu64
" is_unidir && tx_skipped && !inspected", tx, i);
1023 if (txd && logger_expectation != 0) {
1024 LoggerId tx_logged = GetTxLogged(txd);
1025 if (tx_logged != logger_expectation) {
1026 SCLogDebug(
"%p/%"PRIu64
" skipping: logging not done: want:%"PRIx32
", have:%"PRIx32,
1027 tx, i, logger_expectation, tx_logged);
1035 if (txd && txd->files_opened) {
1051 SCLogDebug(
"skipped? %s i %"PRIu64
", new_min %"PRIu64, skipped ?
"true" :
"false", i, new_min);
1054 SCLogDebug(
"final i %"PRIu64
", new_min %"PRIu64, i, new_min);
1057 if (!ires.has_next) {
1061 SCLogDebug(
"no next: cur tx i %"PRIu64
", total %"PRIu64, i, total_txs);
1063 new_min = total_txs;
1064 SCLogDebug(
"no next: cur tx i %"PRIu64
", total %"PRIu64
": "
1065 "new_min updated to %"PRIu64, i, total_txs, new_min);
1073 SCLogDebug(
"update f->alparser->min_id? %"PRIu64
" vs %"PRIu64, new_min, alparser->
min_id);
1074 if (new_min > alparser->
min_id) {
1075 const uint64_t next_id = new_min;
1076 alparser->
min_id = next_id;
1085 static inline int StateGetProgressCompletionStatus(
const AppProto alproto,
const uint8_t
flags)
1087 if (
flags & STREAM_TOSERVER) {
1089 }
else if (
flags & STREAM_TOCLIENT) {
1103 void *alstate, uint8_t
flags)
1108 r = StateGetProgressCompletionStatus(alproto,
flags);
1111 StateGetProgress(alstate,
flags);
1134 int r = StateGetProgressCompletionStatus(alproto, direction);
1153 *event_name = (
const char *)NULL;
1203 void *state,
void *tx,
enum ConfigAction mode, AppLayerTxConfig config)
1217 if ((
flags & (STREAM_EOF|STREAM_TOSERVER)) == (STREAM_EOF|STREAM_TOSERVER)) {
1218 SCLogDebug(
"setting APP_LAYER_PARSER_EOF_TS");
1220 }
else if ((
flags & (STREAM_EOF|STREAM_TOCLIENT)) == (STREAM_EOF|STREAM_TOCLIENT)) {
1221 SCLogDebug(
"setting APP_LAYER_PARSER_EOF_TC");
1226 static void Setup(
Flow *f,
const uint8_t direction,
const uint8_t *input, uint32_t input_len,
1227 const uint8_t
flags, StreamSlice *as)
1229 memset(as, 0,
sizeof(*as));
1231 as->input_len = input_len;
1245 uint8_t
flags,
const uint8_t *input, uint32_t input_len)
1248 #ifdef DEBUG_VALIDATION
1253 StreamSlice stream_slice;
1254 void *alstate = NULL;
1255 uint64_t p_tx_cnt = 0;
1256 uint32_t consumed = input_len;
1257 const uint8_t direction = (
flags & STREAM_TOSERVER) ? 0 : 1;
1261 if (f->
proto == IPPROTO_TCP) {
1267 if (
flags & STREAM_GAP) {
1269 SCLogDebug(
"app-layer parser does not accept gaps");
1280 if (pstate == NULL) {
1282 if (pstate == NULL) {
1288 SetEOFFlags(pstate,
flags);
1293 if (alstate == NULL) {
1297 SCLogDebug(
"alloced new app layer state %p (name %s)",
1300 SCLogDebug(
"using existing app layer state %p (name %s))",
1307 if (input_len > 0 || (
flags & STREAM_EOF)) {
1308 Setup(f,
flags & (STREAM_TOSERVER | STREAM_TOCLIENT), input, input_len,
flags,
1311 if (((stream_slice.flags & STREAM_TOSERVER) &&
1312 stream_slice.offset >= g_eps_applayer_error_offset_ts)) {
1313 SCLogNotice(
"putting parser %s into an error state from toserver offset %" PRIu64,
1318 if (((stream_slice.flags & STREAM_TOCLIENT) &&
1319 stream_slice.offset >= g_eps_applayer_error_offset_tc)) {
1320 SCLogNotice(
"putting parser %s into an error state from toclient offset %" PRIu64,
1327 AppLayerResult
res = p->
Parser[direction](f, alstate, pstate, stream_slice,
1329 if (
res.status < 0) {
1332 }
else if (
res.status > 0) {
1341 if (
res.consumed > input_len ||
res.needed +
res.consumed < input_len) {
1349 (
flags & STREAM_TOSERVER) ?
"toserver" :
"toclient");
1350 if (direction == 0) {
1364 consumed =
res.consumed;
1371 FlowSetNoPayloadInspectionFlag(f);
1373 if (f->
proto == IPPROTO_TCP) {
1398 FlowSetNoPayloadInspectionFlag(f);
1400 if (f->
proto == IPPROTO_TCP) {
1412 if (cur_tx_cnt > p_tx_cnt &&
tv) {
1417 if (
flags & STREAM_DEPTH)
1422 if (consumed != input_len && f->
proto == IPPROTO_TCP && f->
protoctx != NULL) {
1432 if (f->
proto == IPPROTO_TCP) {
1446 SCLogDebug(
"setting APP_LAYER_PARSER_EOF_TC and APP_LAYER_PARSER_EOF_TS");
1487 int r = (alp_ctx.
ctxs[ipproto_map][alproto].
logger ==
false) ? 0 : 1;
1504 if (f != NULL && f->
protoctx != NULL)
1530 if (state != NULL) {
1567 if (ctx->
StateFree != NULL && alstate != NULL)
1582 static void ValidateParserProtoDump(
AppProto alproto, uint8_t ipproto)
1586 printf(
"ERROR: incomplete app-layer registration\n");
1587 printf(
"AppLayer protocol %s ipproto %u\n",
AppProtoToString(alproto), ipproto);
1588 printf(
"- option flags %"PRIx32
"\n", ctx->
option_flags);
1590 printf(
"Mandatory:\n");
1591 printf(
"- Parser[0] %p Parser[1] %p\n", ctx->
Parser[0], ctx->
Parser[1]);
1593 printf(
"- StateGetTx %p StateGetTxCnt %p StateTransactionFree %p\n",
1595 printf(
"- GetTxData %p\n", ctx->
GetTxData);
1597 printf(
"Optional:\n");
1599 printf(
"- StateGetEventInfo %p StateGetEventInfoById %p\n", ctx->
StateGetEventInfo,
1603 #define BOTH_SET(a, b) ((a) != NULL && (b) != NULL)
1604 #define BOTH_SET_OR_BOTH_UNSET(a, b) (((a) == NULL && (b) == NULL) || ((a) != NULL && (b) != NULL))
1605 #define THREE_SET_OR_THREE_UNSET(a, b, c) (((a) == NULL && (b) == NULL && (c) == NULL) || ((a) != NULL && (b) != NULL && (c) != NULL))
1606 #define THREE_SET(a, b, c) ((a) != NULL && (b) != NULL && (c) != NULL)
1608 static void ValidateParserProto(
AppProto alproto, uint8_t ipproto)
1637 ValidateParserProtoDump(alproto, ipproto);
1641 #undef BOTH_SET_OR_BOTH_UNSET
1642 #undef THREE_SET_OR_THREE_UNSET
1645 static void ValidateParser(
AppProto alproto)
1647 ValidateParserProto(alproto, IPPROTO_TCP);
1648 ValidateParserProto(alproto, IPPROTO_UDP);
1651 static void ValidateParsers(
void)
1667 rs_dcerpc_register_parser();
1668 rs_dcerpc_udp_register_parser();
1673 rs_dns_udp_register_parser();
1674 rs_dns_tcp_register_parser();
1685 rs_dhcp_register_parser();
1692 rs_pgsql_register_parser();
1696 rs_telnet_register_parser();
1702 "1|20|capability", 12, 0, STREAM_TOSERVER) < 0)
1704 SCLogInfo(
"imap proto registration failure");
1708 SCLogInfo(
"Protocol detection and parser disabled for %s protocol.",
1721 pstate->
flags |= flag;
1753 SCLogDebug(
"AppLayerParser parser state information for parser state p(%p). "
1754 "p->inspect_id[0](%"PRIu64
"), "
1755 "p->inspect_id[1](%"PRIu64
"), "
1756 "p->log_id(%"PRIu64
"), "
1757 "p->decoder_events(%p).",
1780 StreamSlice stream_slice,
void *local_data)
1788 static void *TestProtocolStateAlloc(
void *orig_state,
AppProto proto_orig)
1801 static void TestProtocolStateFree(
void *s)
1806 static uint64_t TestGetTxCnt(
void *state)
1812 static void TestStateTransactionFree(
void *state, uint64_t tx_id)
1817 static void *TestGetTx(
void *state, uint64_t tx_id)
1824 void (*RegisterUnittests)(
void))
1828 RegisterUnittests = RegisterUnittests;
1835 alp_ctx_backup_unittest = alp_ctx;
1836 memset(&alp_ctx, 0,
sizeof(alp_ctx));
1843 alp_ctx = alp_ctx_backup_unittest;
1844 memset(&alp_ctx_backup_unittest, 0,
sizeof(alp_ctx_backup_unittest));
1852 static int AppLayerParserTest01(
void)
1857 uint8_t testbuf[] = { 0x11 };
1858 uint32_t testlen =
sizeof(testbuf);
1862 memset(&ssn, 0,
sizeof(ssn));
1867 TestProtocolStateAlloc, TestProtocolStateFree);
1872 f =
UTHBuildFlow(AF_INET,
"1.2.3.4",
"4.3.2.1", 20, 40);
1876 f->
proto = IPPROTO_TCP;
1881 STREAM_TOSERVER | STREAM_EOF, testbuf,
1897 static int AppLayerParserTest02(
void)
1902 uint8_t testbuf[] = { 0x11 };
1903 uint32_t testlen =
sizeof(testbuf);
1908 TestProtocolParser);
1910 TestProtocolStateAlloc, TestProtocolStateFree);
1915 f =
UTHBuildFlow(AF_INET,
"1.2.3.4",
"4.3.2.1", 20, 40);
1918 f->
proto = IPPROTO_UDP;
1924 STREAM_TOSERVER | STREAM_EOF, testbuf,
1944 for (alproto = 0; alproto <
ALPROTO_MAX; alproto++) {
1945 ctx = &alp_ctx.
ctxs[ip][alproto];
void(* Truncate)(void *, uint8_t)
void AppLayerParserRegisterGetStateProgressFunc(uint8_t ipproto, AppProto alproto, int(*StateGetProgress)(void *alstate, uint8_t direction))
int AppLayerParserDeSetup(void)
void RegisterNTPParsers(void)
uint64_t(* StateGetTxCnt)(void *alstate)
enum ExceptionPolicy g_applayerparser_error_policy
AppLayerTxData *(* GetTxData)(void *tx)
#define FAIL_IF_NULL(expr)
Fail a test if expression evaluates to NULL.
void RegisterTemplateRustParsers(void)
AppLayerParserProtoCtx ctxs[FLOW_PROTO_MAX][ALPROTO_MAX]
void RegisterSMBParsers(void)
void RegisterIKEParsers(void)
int AppLayerParserIsEnabled(AppProto alproto)
simple way to globally test if a alproto is registered and fully enabled in the configuration.
void AppLayerParserRegisterLocalStorageFunc(uint8_t ipproto, AppProto alproto, void *(*LocalStorageAlloc)(void), void(*LocalStorageFree)(void *))
int AppLayerParserProtocolHasLogger(uint8_t ipproto, AppProto alproto)
void AppLayerParserRegisterOptionFlags(uint8_t ipproto, AppProto alproto, uint32_t flags)
void FramesFree(Frames *frames)
void AppLayerParserSetStreamDepthFlag(uint8_t ipproto, AppProto alproto, void *state, uint64_t tx_id, uint8_t flags)
void RegisterQuicParsers(void)
void AppLayerParserSetTransactionLogId(AppLayerParserState *pstate, uint64_t tx_id)
bool g_filedata_logger_enabled
void AppLayerParserSetStreamDepth(uint8_t ipproto, AppProto alproto, uint32_t stream_depth)
void AppLayerParserApplyTxConfig(uint8_t ipproto, AppProto alproto, void *state, void *tx, enum ConfigAction mode, AppLayerTxConfig config)
void * AppLayerParserGetProtocolParserLocalStorage(uint8_t ipproto, AppProto alproto)
void UtRegisterTest(const char *name, int(*TestFn)(void))
Register unit test.
void(* LocalStorageFree)(void *)
App layer protocol parser context.
void RegisterSSHParsers(void)
Function to register the SSH protocol parsers and other functions.
void *(* StateGetTx)(void *alstate, uint64_t tx_id)
void AppLayerParserSetTransactionInspectId(const Flow *f, AppLayerParserState *pstate, void *alstate, const uint8_t flags, bool tag_txs_as_inspected)
#define APP_LAYER_PARSER_BYPASS_READY
AppLayerDecoderEvents * AppLayerParserGetEventsByTx(uint8_t ipproto, AppProto alproto, void *tx)
AppLayerGetTxIteratorFunc AppLayerGetTxIterator(const uint8_t ipproto, const AppProto alproto)
struct HtpBodyChunk_ * next
void RegisterModbusParsers(void)
Function to register the Modbus protocol parser.
void StreamTcpSetDisableRawReassemblyFlag(TcpSession *, char)
Set the No reassembly flag for the given direction in given TCP session.
FramesContainer * AppLayerFramesSetupContainer(Flow *f)
int AppLayerParserConfParserEnabled(const char *ipproto, const char *alproto_name)
check if a parser is enabled in the config Returns enabled always if: were running unittests
int AppLayerParserGetStateProgress(uint8_t ipproto, AppProto alproto, void *alstate, uint8_t flags)
get the progress value for a tx/protocol
void AppLayerParserTriggerRawStreamReassembly(Flow *f, int direction)
ConfNode * ConfGetNode(const char *name)
Get a ConfNode by name.
uint32_t reassembly_depth
void AppLayerIncGapErrorCounter(ThreadVars *tv, Flow *f)
#define APP_LAYER_PARSER_INT_STREAM_DEPTH_SET
enum AppLayerEventType_ AppLayerEventType
void StreamTcpReassembleTriggerRawReassembly(TcpSession *ssn, int direction)
Trigger RAW stream reassembly.
uint64_t AppLayerParserGetTransactionLogId(AppLayerParserState *pstate)
const char * AppProtoToString(AppProto alproto)
Maps the ALPROTO_*, to its string equivalent.
void AppLayerParserRegisterTruncateFunc(uint8_t ipproto, AppProto alproto, void(*Truncate)(void *, uint8_t))
void AppLayerParserRegisterStateProgressCompletionStatus(AppProto alproto, const int ts, const int tc)
void AppLayerParserRegisterParserAcceptableDataDirection(uint8_t ipproto, AppProto alproto, uint8_t direction)
int AppLayerParserGetStateProgressCompletionStatus(AppProto alproto, uint8_t direction)
uint8_t AppLayerParserGetFirstDataDir(uint8_t ipproto, AppProto alproto)
int AppLayerParserProtoIsRegistered(uint8_t ipproto, AppProto alproto)
void AppLayerParserRegisterTxFreeFunc(uint8_t ipproto, AppProto alproto, void(*StateTransactionFree)(void *, uint64_t))
#define FLOW_NOPAYLOAD_INSPECTION
int AppLayerParserSupportsFiles(uint8_t ipproto, AppProto alproto)
void AppLayerParserStateProtoCleanup(uint8_t protomap, AppProto alproto, void *alstate, AppLayerParserState *pstate)
AppLayerGetTxIteratorFunc StateGetTxIterator
void AppLayerParserThreadCtxFree(AppLayerParserThreadCtx *tctx)
Destroys the app layer parser thread context obtained using AppLayerParserThreadCtxAlloc().
void AppLayerDecoderEventsFreeEvents(AppLayerDecoderEvents **events)
void StreamTcpUpdateAppLayerProgress(TcpSession *ssn, char direction, const uint32_t progress)
update reassembly progress
FileContainer * AppLayerParserGetFiles(const Flow *f, const uint8_t direction)
#define APP_LAYER_TX_INSPECTED_FLAG
uint32_t AppLayerParserGetOptionFlags(uint8_t protomap, AppProto alproto)
struct TestState_ TestState
void RegisterSIPParsers(void)
TcpStreamCnf stream_config
#define APP_LAYER_PARSER_EOF_TS
void AppLayerIncAllocErrorCounter(ThreadVars *tv, Flow *f)
void AppLayerParserRegisterUnittests(void)
uint64_t AppLayerParserGetTransactionInspectId(AppLayerParserState *pstate, uint8_t direction)
void RegisterKRB5Parsers(void)
Data structure to store app layer decoder events.
bool(* ApplyTxConfig)(void *state, void *tx, int mode, AppLayerTxConfig)
uint8_t FlowGetReverseProtoMapping(uint8_t rproto)
void RegisterDNP3Parsers(void)
Register the DNP3 application protocol parser.
int ConfValIsTrue(const char *val)
Check if a value is true.
void FTPParserCleanup(void)
Free memory allocated for global FTP parser state.
int AppLayerParserGetEventInfoById(uint8_t ipproto, AppProto alproto, int event_id, const char **event_name, AppLayerEventType *event_type)
const struct SigGroupHead_ * sgh_toserver
void AppLayerParserRestoreParserTable(void)
AppLayerResult(* AppLayerParserFPtr)(Flow *f, void *protocol_state, AppLayerParserState *pstate, StreamSlice stream_slice, void *local_storage)
Prototype for parsing functions.
struct AppLayerParserCtx_ AppLayerParserCtx
AppLayerParserState * alparser
void AppLayerParserRegisterProtocolParsers(void)
void RegisterRFBParsers(void)
void StreamTcpInitConfig(bool)
To initialize the stream global configuration data.
Flow * UTHBuildFlow(int family, const char *src, const char *dst, Port sp, Port dp)
int AppLayerParserStateIssetFlag(AppLayerParserState *pstate, uint8_t flag)
#define PASS
Pass the test.
AppLayerParserGetFrameIdByNameFn GetFrameIdByName
const char * AppLayerParserGetFrameNameById(uint8_t ipproto, AppProto alproto, const uint8_t id)
uint64_t AppLayerParserGetTransactionActive(const Flow *f, AppLayerParserState *pstate, uint8_t direction)
void AppLayerFramesFreeContainer(Flow *f)
void AppLayerParserStreamTruncated(uint8_t ipproto, AppProto alproto, void *alstate, uint8_t direction)
AppLayerParserThreadCtx * alp_tctx
void AppLayerParserRegisterLogger(uint8_t ipproto, AppProto alproto)
void AppLayerParserRegisterGetFilesFunc(uint8_t ipproto, AppProto alproto, FileContainer *(*StateGetFiles)(void *, uint8_t))
void AppLayerParserRegisterGetFrameFuncs(uint8_t ipproto, AppProto alproto, AppLayerParserGetFrameIdByNameFn GetIdByNameFunc, AppLayerParserGetFrameNameByIdFn GetNameByIdFunc)
void(* SetStreamDepthFlag)(void *tx, uint8_t flags)
void RegisterENIPTCPParsers(void)
Function to register the ENIP protocol parsers and other functions.
Per thread variable structure.
void AppLayerParserRegisterLoggerBits(uint8_t ipproto, AppProto alproto, LoggerId bits)
int(* StateGetEventInfo)(const char *event_name, int *event_id, AppLayerEventType *event_type)
void AppLayerParserRegisterStateFuncs(uint8_t ipproto, AppProto alproto, void *(*StateAlloc)(void *, AppProto), void(*StateFree)(void *))
#define APP_LAYER_PARSER_OPT_UNIDIR_TXS
#define APP_LAYER_PARSER_NO_REASSEMBLY
#define IS_DISRUPTED(flags)
void AppLayerParserSetEOF(AppLayerParserState *pstate)
@ EXCEPTION_POLICY_IGNORE
void(* RegisterUnittests)(void)
void AppLayerParserStateFree(AppLayerParserState *pstate)
void AppLayerParserStateCleanup(const Flow *f, void *alstate, AppLayerParserState *pstate)
void AppLayerParserBackupParserTable(void)
int(* StateGetEventInfoById)(int event_id, const char **event_name, AppLayerEventType *event_type)
const struct SigGroupHead_ * sgh_toclient
void RegisterNFSTCPParsers(void)
AppLayerParserGetFrameNameByIdFn GetFrameNameById
struct AppLayerParserProtoCtx_ AppLayerParserProtoCtx
App layer protocol parser context.
int AppLayerParserSetup(void)
void RegisterFTPParsers(void)
void AppLayerParserRegisterProtocolUnittests(uint8_t ipproto, AppProto alproto, void(*RegisterUnittests)(void))
void *(* StateAlloc)(void *, AppProto)
uint8_t FlowGetProtoMapping(uint8_t proto)
Function to map the protocol to the defined FLOW_PROTO_* enumeration.
void RegisterTFTPParsers(void)
#define FLOW_PROTO_APPLAYER_MAX
#define APP_LAYER_PARSER_EOF_TC
#define DEBUG_ASSERT_FLOW_LOCKED(f)
#define BOTH_SET_OR_BOTH_UNSET(a, b)
void * alproto_local_storage[FLOW_PROTO_MAX][ALPROTO_MAX]
void AppLayerParserRegisterGetEventInfo(uint8_t ipproto, AppProto alproto, int(*StateGetEventInfo)(const char *event_name, int *event_id, AppLayerEventType *event_type))
void AppLayerParserSetDecoderEvents(AppLayerParserState *pstate, AppLayerDecoderEvents *devents)
#define SCReturnPtr(x, type)
void(* StateFree)(void *)
Data structures and function prototypes for keeping state for the detection engine.
void AppLayerProtoDetectRegisterProtocol(AppProto alproto, const char *alproto_name)
Registers a protocol for protocol detection phase.
void AppLayerParserRegisterSetStreamDepthFlag(uint8_t ipproto, AppProto alproto, void(*SetStreamDepthFlag)(void *tx, uint8_t flags))
void AppLayerIncParserErrorCounter(ThreadVars *tv, Flow *f)
int RunmodeIsUnittests(void)
#define SCLogInfo(...)
Macro used to log INFORMATIONAL messages.
void RegisterRdpParsers(void)
#define APP_LAYER_PARSER_NO_INSPECTION
void * AppLayerParserGetTx(uint8_t ipproto, AppProto alproto, void *alstate, uint64_t tx_id)
int AppLayerParserRegisterParser(uint8_t ipproto, AppProto alproto, uint8_t direction, AppLayerParserFPtr Parser)
Register app layer parser for the protocol.
void UTHFreeFlow(Flow *flow)
AppLayerParserThreadCtx * AppLayerParserThreadCtxAlloc(void)
Gets a new app layer protocol's parser thread context.
void AppLayerParserRegisterGetTx(uint8_t ipproto, AppProto alproto, void *(StateGetTx)(void *alstate, uint64_t tx_id))
AppLayerParserFPtr Parser[2]
void(* StateTransactionFree)(void *, uint64_t)
#define SCReturnStruct(x)
void RegisterSSLParsers(void)
Function to register the SSL protocol parser and other functions.
#define FAIL_IF(expr)
Fail a test if expression evaluates to true.
void StreamTcpSetSessionNoReassemblyFlag(TcpSession *, char)
disable reassembly
void AppLayerParserTransactionsCleanup(Flow *f)
remove obsolete (inspected and logged) transactions
void StreamTcpFreeConfig(bool quiet)
enum ExceptionPolicy ExceptionPolicyParse(const char *option, const bool support_flow)
int AppLayerParserParse(ThreadVars *tv, AppLayerParserThreadCtx *alp_tctx, Flow *f, AppProto alproto, uint8_t flags, const uint8_t *input, uint32_t input_len)
const char *(* AppLayerParserGetFrameNameByIdFn)(const uint8_t id)
void StreamTcpDisableAppLayer(Flow *f)
int AppLayerParserGetFrameIdByName(uint8_t ipproto, AppProto alproto, const char *name)
void AppLayerParserRegisterApplyTxConfigFunc(uint8_t ipproto, AppProto alproto, bool(*ApplyTxConfig)(void *state, void *tx, int mode, AppLayerTxConfig))
FileContainer *(* StateGetFiles)(void *, uint8_t)
#define SCLogError(err_code,...)
Macro used to log ERROR messages.
void RegisterENIPUDPParsers(void)
Function to register the ENIP protocol parsers and other functions.
void AppLayerIncInternalErrorCounter(ThreadVars *tv, Flow *f)
AppLayerTxData * AppLayerParserGetTxData(uint8_t ipproto, AppProto alproto, void *tx)
#define FatalError(x,...)
void AppLayerParserRegisterTxDataFunc(uint8_t ipproto, AppProto alproto, AppLayerTxData *(*GetTxData)(void *tx))
uint32_t AppLayerParserGetStreamDepth(const Flow *f)
void RegisterSNMPParsers(void)
#define APP_LAYER_PARSER_OPT_ACCEPT_GAPS
void AppLayerParserRegisterGetTxIterator(uint8_t ipproto, AppProto alproto, AppLayerGetTxIteratorFunc Func)
FramesContainer * AppLayerFramesGetContainer(Flow *f)
void AppLayerParserPostStreamSetup(void)
AppLayerDecoderEvents * AppLayerParserGetDecoderEvents(AppLayerParserState *pstate)
#define THREE_SET(a, b, c)
void AppLayerParserRegisterGetEventInfoById(uint8_t ipproto, AppProto alproto, int(*StateGetEventInfoById)(int event_id, const char **event_name, AppLayerEventType *event_type))
const char * AppLayerGetProtoName(AppProto alproto)
Given the internal protocol id, returns a string representation of the protocol.
void UTHAppLayerParserStateGetIds(void *ptr, uint64_t *i1, uint64_t *i2, uint64_t *log, uint64_t *min)
int ConfValIsFalse(const char *val)
Check if a value is false.
void RegisterHTPParsers(void)
Register the HTTP protocol and state handling functions to APP layer of the engine.
void AppLayerIncTxCounter(ThreadVars *tv, Flow *f, uint64_t step)
void RegisterSMTPParsers(void)
Register the SMTP Protocol parser.
AppLayerParserState * AppLayerParserStateAlloc(void)
#define SCReturnCT(x, type)
void RegisterTemplateParsers(void)
#define STREAMTCP_FLAG_APP_LAYER_DISABLED
AppLayerDecoderEvents * decoder_events
void AppLayerParserRegisterGetTxCnt(uint8_t ipproto, AppProto alproto, uint64_t(*StateGetTxCnt)(void *alstate))
int(* StateGetProgress)(void *alstate, uint8_t direction)
LoggerId AppLayerParserProtocolGetLoggerBits(uint8_t ipproto, AppProto alproto)
void AppLayerParserStateSetFlag(AppLayerParserState *pstate, uint8_t flag)
AppLayerGetTxIterTuple(* AppLayerGetTxIteratorFunc)(const uint8_t ipproto, const AppProto alproto, void *alstate, uint64_t min_tx_id, uint64_t max_tx_id, AppLayerGetTxIterState *state)
tx iterator prototype
bool g_file_logger_enabled
void RegisterHTTP2Parsers(void)
#define STREAM_APP_PROGRESS(stream)
int AppLayerProtoDetectPMRegisterPatternCS(uint8_t ipproto, AppProto alproto, const char *pattern, uint16_t depth, uint16_t offset, uint8_t direction)
Registers a case-sensitive pattern for protocol detection.
#define APP_LAYER_PARSER_NO_INSPECTION_PAYLOAD
int FlowChangeProto(Flow *f)
Check if change proto flag is set for flow.
uint8_t FlowGetDisruptionFlags(const Flow *f, uint8_t flags)
get 'disruption' flags: GAP/DEPTH/PASS
#define SCLogNotice(...)
Macro used to log NOTICE messages.
void RegisterNFSUDPParsers(void)
AppProto alproto
application level protocol
void AppLayerParserDestroyProtocolParserLocalStorage(uint8_t ipproto, AppProto alproto, void *local_data)
uint64_t AppLayerParserGetTxCnt(const Flow *f, void *alstate)
int AppLayerProtoDetectConfProtoDetectionEnabled(const char *ipproto, const char *alproto)
Given a protocol name, checks if proto detection is enabled in the conf file.
void SMTPParserCleanup(void)
Free memory allocated for global SMTP parser state.
bool AppLayerParserHasDecoderEvents(AppLayerParserState *pstate)
void RegisterMQTTParsers(void)
int(* AppLayerParserGetFrameIdByNameFn)(const char *frame_name)
void StreamTcpSetSessionBypassFlag(TcpSession *)
enable bypass
#define DEBUG_VALIDATE_BUG_ON(exp)
void *(* LocalStorageAlloc)(void)
int AppLayerParserGetEventInfo(uint8_t ipproto, AppProto alproto, const char *event_name, int *event_id, AppLayerEventType *event_type)