Go to the documentation of this file.
83 void *(*LocalStorageAlloc)(void);
92 void *(*StateGetTx)(
void *alstate, uint64_t tx_id);
97 uint8_t event_id,
const char **event_name, AppLayerEventType *event_type);
99 const char *event_name, uint8_t *event_id, AppLayerEventType *event_type);
101 AppLayerStateData *(*GetStateData)(
void *state);
155 static void AppLayerConfig(
void)
167 if (frames != NULL) {
184 if (f == NULL || f->
alparser == NULL)
230 return (alp_ctx.
ctxs[alproto][ipproto_map].
StateAlloc != NULL) ? 1 : 0;
251 AppLayerParserFramesFreeContainer(pstate->
frames);
344 const char *alproto_name)
356 r = snprintf(param,
sizeof(param),
"%s%s%s",
"app-layer.protocols.",
357 alproto_name,
".enabled");
360 }
else if (r > (
int)
sizeof(param)) {
361 FatalError(
"buffer not big enough to write param.");
367 r = snprintf(param,
sizeof(param),
"%s%s%s%s%s",
"app-layer.protocols.",
368 alproto_name,
".", ipproto,
".enabled");
371 }
else if (r > (
int)
sizeof(param)) {
372 FatalError(
"buffer not big enough to write param.");
386 }
else if (strcasecmp(node->
val,
"detection-only") == 0) {
389 SCLogError(
"Invalid value found for %s.", param);
408 .
Parser[(direction & STREAM_TOSERVER) ? 0 : 1] = Parser;
419 (direction & (STREAM_TOSERVER | STREAM_TOCLIENT));
435 void *(*StateAlloc)(
void *,
AppProto),
void (*StateFree)(
void *))
444 FatalError(
"Unable to realloc alp_ctx.ctxs.");
460 void *(*LocalStorageAlloc)(
void),
461 void (*LocalStorageFree)(
void *))
472 uint8_t ipproto,
AppProto alproto, AppLayerGetFileState (*GetTxFiles)(
void *, uint8_t))
500 int (*StateGetProgress)(
void *alstate, uint8_t direction))
510 void (*StateTransactionFree)(
void *, uint64_t))
520 uint64_t (*StateGetTxCnt)(
void *alstate))
530 void *(StateGetTx)(
void *alstate, uint64_t tx_id))
552 BUG_ON(!AppProtoIsValid(alproto));
563 int (*StateGetEventInfoById)(
564 uint8_t event_id,
const char **event_name, AppLayerEventType *event_type))
569 StateGetEventInfoById;
595 int (*StateGetEventInfo)(
596 const char *event_name, uint8_t *event_id, AppLayerEventType *event_type))
616 uint8_t ipproto,
AppProto alproto, AppLayerStateData *(*GetStateData)(
void *state))
626 bool (*ApplyTxConfig)(
void *state,
void *tx,
int mode, AppLayerTxConfig))
636 void (*SetStreamDepthFlag)(
void *tx, uint8_t
flags))
679 static AppLayerGetTxIterTuple AppLayerDefaultGetTxIterator(
680 const uint8_t ipproto,
const AppProto alproto,
681 void *alstate, uint64_t min_tx_id, uint64_t max_tx_id,
684 uint64_t ustate = *(uint64_t *)state;
685 uint64_t tx_id =
MAX(min_tx_id, ustate);
686 for ( ; tx_id < max_tx_id; tx_id++) {
688 if (tx_ptr != NULL) {
691 AppLayerGetTxIterTuple tuple = {
694 .has_next = (tx_id + 1 < max_tx_id),
696 SCLogDebug(
"tuple: %p/%"PRIu64
"/%s", tuple.tx_ptr, tuple.tx_id,
697 tuple.has_next ?
"true" :
"false");
702 AppLayerGetTxIterTuple no_tuple = { NULL, 0,
false };
711 return Func ? Func : AppLayerDefaultGetTxIterator;
744 uint8_t p = (dir & STREAM_TOSERVER) ? txd->detect_progress_ts : txd->detect_progress_tc;
750 return txd->logged.flags;
754 void *alstate,
const uint8_t
flags,
755 bool tag_txs_as_inspected)
759 const int direction = (
flags & STREAM_TOSERVER) ? 0 : 1;
763 const uint8_t ipproto = f->
proto;
769 SCLogDebug(
"called: %s, tag_txs_as_inspected %s",direction==0?
"toserver":
"toclient",
770 tag_txs_as_inspected?
"true":
"false");
775 AppLayerGetTxIterTuple ires = IterFunc(ipproto, alproto, alstate, idx, total_txs, &state);
776 if (ires.tx_ptr == NULL)
779 void *tx = ires.tx_ptr;
783 if (state_progress < state_done_progress)
787 if (txd && tag_txs_as_inspected) {
790 if (txd->flags & inspected_flag) {
791 txd->flags |= inspected_flag;
792 SCLogDebug(
"%p/%" PRIu64
" in-order tx is done for direction %s. Flags %02x", tx,
793 idx,
flags & STREAM_TOSERVER ?
"toserver" :
"toclient", txd->flags);
805 if (tag_txs_as_inspected) {
808 AppLayerGetTxIterTuple ires = IterFunc(ipproto, alproto, alstate, idx, total_txs, &state);
809 if (ires.tx_ptr == NULL)
812 void *tx = ires.tx_ptr;
816 if (ires.tx_id > idx && pstate->
inspect_id[direction] == idx) {
822 if (state_progress < state_done_progress)
828 const uint8_t inspected_flag = (
flags & STREAM_TOSERVER)
831 if (txd->flags & inspected_flag) {
832 txd->flags |= inspected_flag;
833 SCLogDebug(
"%p/%" PRIu64
" out of order tx is done for direction %s. Flag %02x",
834 tx, idx,
flags & STREAM_TOSERVER ?
"toserver" :
"toclient", txd->flags);
836 SCLogDebug(
"%p/%"PRIu64
" out of order tx. Update inspect_id? %"PRIu64,
859 "AppLayerDecoderEvents *");
871 if (txd != NULL && txd->events != NULL) {
886 AppLayerGetFileState files = { .fc = NULL, .cfg = NULL };
890 static void AppLayerParserFileTxHousekeeping(
891 const Flow *f,
void *tx,
const uint8_t pkt_dir,
const bool trunc)
899 #define IS_DISRUPTED(flags) ((flags) & (STREAM_DEPTH | STREAM_GAP))
918 const uint8_t ipproto = f->
proto;
920 void *
const alstate = f->
alstate;
923 if (alstate == NULL || alparser == NULL)
926 const uint64_t min = alparser->
min_id;
934 int pkt_dir_trunc = -1;
938 memset(&state, 0,
sizeof(state));
940 uint64_t new_min = min;
942 bool skipped =
false;
946 AppLayerGetTxIterTuple ires = IterFunc(ipproto, alproto, alstate, i, total_txs, &state);
947 if (ires.tx_ptr == NULL)
950 bool tx_skipped =
false;
951 void *tx = ires.tx_ptr;
956 if (txd != NULL && AppLayerParserHasFilesInDir(txd, pkt_dir)) {
957 if (pkt_dir_trunc == -1)
959 (pkt_dir == STREAM_TOSERVER) ? ts_disrupt_flags : tc_disrupt_flags);
960 AppLayerParserFileTxHousekeeping(f, tx, pkt_dir, (
bool)pkt_dir_trunc);
964 if (pkt_dir & STREAM_TOSERVER) {
965 txd->updated_ts =
false;
967 txd->updated_tc =
false;
970 const int tx_progress_tc =
972 if (tx_progress_tc < tx_end_state_tc) {
973 SCLogDebug(
"%p/%"PRIu64
" skipping: tc parser not done", tx, i);
977 const int tx_progress_ts =
979 if (tx_progress_ts < tx_end_state_ts) {
980 SCLogDebug(
"%p/%"PRIu64
" skipping: ts parser not done", tx, i);
985 if (txd && has_tx_detect_flags) {
990 SCLogDebug(
"%p/%" PRIu64
" skipping: TS inspect not done: ts:%02x", tx, i,
999 SCLogDebug(
"%p/%" PRIu64
" skipping: TC inspect not done: ts:%02x", tx, i,
1007 SCLogDebug(
"%p/%" PRIu64
" tx_skipped", tx, i);
1012 if (txd && logger_expectation != 0) {
1013 LoggerId tx_logged = GetTxLogged(txd);
1014 if (tx_logged != logger_expectation) {
1015 SCLogDebug(
"%p/%"PRIu64
" skipping: logging not done: want:%"PRIx32
", have:%"PRIx32,
1016 tx, i, logger_expectation, tx_logged);
1025 SCLogDebug(
"files_opened %u files_logged %u files_stored %u", txd->files_opened,
1026 txd->files_logged, txd->files_stored);
1028 if (txd->files_opened) {
1045 SCLogDebug(
"skipped? %s i %"PRIu64
", new_min %"PRIu64, skipped ?
"true" :
"false", i, new_min);
1048 SCLogDebug(
"final i %"PRIu64
", new_min %"PRIu64, i, new_min);
1051 if (!ires.has_next) {
1055 SCLogDebug(
"no next: cur tx i %"PRIu64
", total %"PRIu64, i, total_txs);
1057 new_min = total_txs;
1058 SCLogDebug(
"no next: cur tx i %"PRIu64
", total %"PRIu64
": "
1059 "new_min updated to %"PRIu64, i, total_txs, new_min);
1067 SCLogDebug(
"update f->alparser->min_id? %"PRIu64
" vs %"PRIu64, new_min, alparser->
min_id);
1068 if (new_min > alparser->
min_id) {
1069 const uint64_t next_id = new_min;
1070 alparser->
min_id = next_id;
1079 static inline int StateGetProgressCompletionStatus(
const AppProto alproto,
const uint8_t
flags)
1081 if (
flags & STREAM_TOSERVER) {
1083 }
else if (
flags & STREAM_TOCLIENT) {
1097 void *alstate, uint8_t
flags)
1102 r = StateGetProgressCompletionStatus(alproto,
flags);
1104 uint8_t direction =
flags & (STREAM_TOCLIENT | STREAM_TOSERVER);
1106 alstate, direction);
1129 int r = StateGetProgressCompletionStatus(alproto, direction);
1134 uint8_t *event_id, AppLayerEventType *event_type)
1141 event_name, event_id, event_type);
1146 const char **event_name, AppLayerEventType *event_type)
1150 *event_name = (
const char *)NULL;
1154 event_id, event_name, event_type);
1203 AppLayerStateData *d =
1211 void *state,
void *tx,
enum ConfigAction mode, AppLayerTxConfig config)
1225 if ((
flags & (STREAM_EOF|STREAM_TOSERVER)) == (STREAM_EOF|STREAM_TOSERVER)) {
1226 SCLogDebug(
"setting APP_LAYER_PARSER_EOF_TS");
1228 }
else if ((
flags & (STREAM_EOF|STREAM_TOCLIENT)) == (STREAM_EOF|STREAM_TOCLIENT)) {
1229 SCLogDebug(
"setting APP_LAYER_PARSER_EOF_TC");
1238 static void HandleStreamFrames(
Flow *f, StreamSlice stream_slice,
const uint8_t *input,
1239 const uint32_t input_len,
const uint8_t
flags)
1241 const uint8_t direction = (
flags & STREAM_TOSERVER) ? 0 : 1;
1247 input != NULL && f->
proto == IPPROTO_TCP) {
1249 if (frame == NULL) {
1250 int64_t frame_len = -1;
1251 if (
flags & STREAM_EOF)
1252 frame_len = input_len;
1255 f, &stream_slice, stream_slice.offset, frame_len, direction,
FRAME_STREAM_TYPE);
1257 SCLogDebug(
"opened: frame %p id %" PRIi64, frame, frame->
id);
1262 if (direction == 0) {
1268 }
else if (
flags & STREAM_EOF) {
1273 int64_t slice_o = (int64_t)stream_slice.offset - (int64_t)frame->
offset;
1274 int64_t frame_len = slice_o + (int64_t)input_len;
1275 SCLogDebug(
"%s: EOF frame->offset %" PRIu64
" -> %" PRIi64
": o %" PRIi64,
1277 frame->
len = frame_len;
1282 static void Setup(
Flow *f,
const uint8_t direction,
const uint8_t *input, uint32_t input_len,
1283 const uint8_t
flags, StreamSlice *as)
1285 memset(as, 0,
sizeof(*as));
1287 as->input_len = input_len;
1301 uint8_t
flags,
const uint8_t *input, uint32_t input_len)
1304 #ifdef DEBUG_VALIDATION
1309 StreamSlice stream_slice;
1310 void *alstate = NULL;
1311 uint64_t p_tx_cnt = 0;
1312 uint32_t consumed = input_len;
1313 const uint8_t direction = (
flags & STREAM_TOSERVER) ? 0 : 1;
1317 if (f->
proto == IPPROTO_TCP) {
1323 if (
flags & STREAM_GAP) {
1325 SCLogDebug(
"app-layer parser does not accept gaps");
1335 if (pstate == NULL) {
1337 if (pstate == NULL) {
1343 SetEOFFlags(pstate,
flags);
1348 if (alstate == NULL) {
1352 SCLogDebug(
"alloced new app layer state %p (name %s)",
1360 SCLogDebug(
"state data: updating file_flags %04x with flow file_flags %04x",
1367 SCLogDebug(
"using existing app layer state %p (name %s))",
1374 if (input_len > 0 || (
flags & STREAM_EOF)) {
1375 Setup(f,
flags & (STREAM_TOSERVER | STREAM_TOCLIENT), input, input_len,
flags,
1377 HandleStreamFrames(f, stream_slice, input, input_len,
flags);
1380 if (((stream_slice.flags & STREAM_TOSERVER) &&
1381 stream_slice.offset >= g_eps_applayer_error_offset_ts)) {
1382 SCLogNotice(
"putting parser %s into an error state from toserver offset %" PRIu64,
1387 if (((stream_slice.flags & STREAM_TOCLIENT) &&
1388 stream_slice.offset >= g_eps_applayer_error_offset_tc)) {
1389 SCLogNotice(
"putting parser %s into an error state from toclient offset %" PRIu64,
1396 AppLayerResult res = p->
Parser[direction](f, alstate, pstate, stream_slice,
1398 if (res.status < 0) {
1401 }
else if (res.status > 0) {
1410 if (res.consumed > input_len || res.needed + res.consumed < input_len) {
1418 (
flags & STREAM_TOSERVER) ?
"toserver" :
"toclient");
1419 if (direction == 0) {
1433 consumed = res.consumed;
1441 if (f->
proto == IPPROTO_TCP) {
1463 FlowSetNoPayloadInspectionFlag(f);
1469 FlowSetNoPayloadInspectionFlag(f);
1471 if (f->
proto == IPPROTO_TCP) {
1483 if (cur_tx_cnt > p_tx_cnt &&
tv) {
1489 if (consumed != input_len && f->
proto == IPPROTO_TCP && f->
protoctx != NULL) {
1499 if (f->
proto == IPPROTO_TCP) {
1513 SCLogDebug(
"setting APP_LAYER_PARSER_EOF_TC and APP_LAYER_PARSER_EOF_TS");
1554 int r = (!alp_ctx.
ctxs[alproto][ipproto_map].
logger) ? 0 : 1;
1571 if (f != NULL && f->
protoctx != NULL)
1597 if (state != NULL) {
1612 uint8_t ipproto,
AppProto alproto,
const char *
name,
const uint8_t direction)
1627 uint8_t ipproto,
AppProto alproto,
const int id,
const uint8_t direction)
1663 if (
ctx->StateFree != NULL && alstate != NULL)
1664 ctx->StateFree(alstate);
1678 static void ValidateParserProtoDump(
AppProto alproto, uint8_t ipproto)
1682 printf(
"ERROR: incomplete app-layer registration\n");
1683 printf(
"AppLayer protocol %s ipproto %u\n",
AppProtoToString(alproto), ipproto);
1684 printf(
"- option flags %"PRIx32
"\n",
ctx->option_flags);
1685 printf(
"- first_data_dir %"PRIx8
"\n",
ctx->first_data_dir);
1686 printf(
"Mandatory:\n");
1687 printf(
"- Parser[0] %p Parser[1] %p\n",
ctx->Parser[0],
ctx->Parser[1]);
1688 printf(
"- StateAlloc %p StateFree %p\n",
ctx->StateAlloc,
ctx->StateFree);
1689 printf(
"- StateGetTx %p StateGetTxCnt %p StateTransactionFree %p\n",
1690 ctx->StateGetTx,
ctx->StateGetTxCnt,
ctx->StateTransactionFree);
1691 printf(
"- GetTxData %p\n",
ctx->GetTxData);
1692 printf(
"- GetStateData %p\n",
ctx->GetStateData);
1693 printf(
"- StateGetProgress %p\n",
ctx->StateGetProgress);
1694 printf(
"Optional:\n");
1695 printf(
"- LocalStorageAlloc %p LocalStorageFree %p\n",
ctx->LocalStorageAlloc,
ctx->LocalStorageFree);
1696 printf(
"- StateGetEventInfo %p StateGetEventInfoById %p\n",
ctx->StateGetEventInfo,
1697 ctx->StateGetEventInfoById);
1700 #define BOTH_SET(a, b) ((a) != NULL && (b) != NULL)
1701 #define BOTH_SET_OR_BOTH_UNSET(a, b) (((a) == NULL && (b) == NULL) || ((a) != NULL && (b) != NULL))
1702 #define THREE_SET(a, b, c) ((a) != NULL && (b) != NULL && (c) != NULL)
1704 static void ValidateParserProto(
AppProto alproto, uint8_t ipproto)
1709 if (
ctx->Parser[0] == NULL &&
ctx->Parser[1] == NULL)
1721 if (
ctx->StateGetProgress == NULL) {
1728 if (
ctx->GetTxData == NULL) {
1731 if (
ctx->GetStateData == NULL) {
1736 ValidateParserProtoDump(alproto, ipproto);
1740 #undef BOTH_SET_OR_BOTH_UNSET
1743 static void ValidateParser(
AppProto alproto)
1745 ValidateParserProto(alproto, IPPROTO_TCP);
1746 ValidateParserProto(alproto, IPPROTO_UDP);
1749 static void ValidateParsers(
void)
1757 #define ARRAY_CAP_STEP 16
1758 static void (**PreRegisteredCallbacks)(void) = NULL;
1759 static size_t preregistered_callbacks_nb = 0;
1760 static size_t preregistered_callbacks_cap = 0;
1764 if (preregistered_callbacks_nb == preregistered_callbacks_cap) {
1765 void *tmp =
SCRealloc(PreRegisteredCallbacks,
1766 sizeof(
void *) * (preregistered_callbacks_cap +
ARRAY_CAP_STEP));
1771 PreRegisteredCallbacks = tmp;
1773 PreRegisteredCallbacks[preregistered_callbacks_nb] = Register;
1774 preregistered_callbacks_nb++;
1786 SCRegisterDcerpcParser();
1787 SCRegisterDcerpcUdpParser();
1792 SCRegisterDnsUdpParser();
1793 SCRegisterDnsTcpParser();
1794 SCRegisterBittorrentDhtUdpParser();
1796 SCEnipRegisterParsers();
1800 rs_register_ntp_parser();
1803 rs_register_krb5_parser();
1804 SCRegisterDhcpParser();
1805 SCRegisterSnmpParser();
1806 rs_sip_register_parser();
1807 rs_quic_register_parser();
1808 rs_websocket_register_parser();
1809 SCRegisterLdapTcpParser();
1810 SCRegisterLdapUdpParser();
1811 rs_template_register_parser();
1812 SCRfbRegisterParser();
1813 SCMqttRegisterParser();
1814 SCRegisterPgsqlParser();
1815 SCRegisterPop3Parser();
1816 SCRegisterRdpParser();
1818 rs_telnet_register_parser();
1821 for (
size_t i = 0; i < preregistered_callbacks_nb; i++) {
1822 PreRegisteredCallbacks[i]();
1833 pstate->
flags |= flag;
1850 void (*RegisterUnittests)(
void))
1867 ctx = &alp_ctx.
ctxs[alproto][ip];
1868 if (
ctx->RegisterUnittests == NULL)
1870 ctx->RegisterUnittests();
void AppLayerParserRegisterGetStateProgressFunc(uint8_t ipproto, AppProto alproto, int(*StateGetProgress)(void *alstate, uint8_t direction))
int AppLayerParserDeSetup(void)
AppLayerStateData *(* GetStateData)(void *state)
uint64_t(* StateGetTxCnt)(void *alstate)
enum ExceptionPolicy g_applayerparser_error_policy
int SCConfValIsTrue(const char *val)
Check if a value is true.
AppLayerTxData *(* GetTxData)(void *tx)
void RegisterSMBParsers(void)
void RegisterIKEParsers(void)
int AppLayerParserIsEnabled(AppProto alproto)
simple way to globally test if a alproto is registered and fully enabled in the configuration.
void AppLayerParserRegisterLocalStorageFunc(uint8_t ipproto, AppProto alproto, void *(*LocalStorageAlloc)(void), void(*LocalStorageFree)(void *))
int AppLayerParserProtocolHasLogger(uint8_t ipproto, AppProto alproto)
void AppLayerParserRegisterOptionFlags(uint8_t ipproto, AppProto alproto, uint32_t flags)
const char * AppLayerParserGetStateNameById(uint8_t ipproto, AppProto alproto, const int id, const uint8_t direction)
void FramesFree(Frames *frames)
void AppLayerParserSetStreamDepthFlag(uint8_t ipproto, AppProto alproto, void *state, uint64_t tx_id, uint8_t flags)
#define APP_LAYER_TX_SKIP_INSPECT_TC
void AppLayerParserSetTransactionLogId(AppLayerParserState *pstate, uint64_t tx_id)
bool g_filedata_logger_enabled
void AppLayerParserSetStreamDepth(uint8_t ipproto, AppProto alproto, uint32_t stream_depth)
void AppLayerParserApplyTxConfig(uint8_t ipproto, AppProto alproto, void *state, void *tx, enum ConfigAction mode, AppLayerTxConfig config)
void AppLayerParserTransactionsCleanup(Flow *f, const uint8_t pkt_dir)
remove obsolete (inspected and logged) transactions
void * AppLayerParserGetProtocolParserLocalStorage(uint8_t ipproto, AppProto alproto)
void(* LocalStorageFree)(void *)
App layer protocol parser context.
void RegisterSSHParsers(void)
Function to register the SSH protocol parsers and other functions.
void *(* StateGetTx)(void *alstate, uint64_t tx_id)
#define FLOW_SGH_TOCLIENT
void AppLayerParserSetTransactionInspectId(const Flow *f, AppLayerParserState *pstate, void *alstate, const uint8_t flags, bool tag_txs_as_inspected)
#define APP_LAYER_PARSER_BYPASS_READY
AppLayerDecoderEvents * AppLayerParserGetEventsByTx(uint8_t ipproto, AppProto alproto, void *tx)
AppLayerGetTxIteratorFunc AppLayerGetTxIterator(const uint8_t ipproto, const AppProto alproto)
struct HtpBodyChunk_ * next
void RegisterModbusParsers(void)
Function to register the Modbus protocol parser.
uint8_t AppLayerParserGetTxDetectProgress(AppLayerTxData *txd, const uint8_t dir)
void StreamTcpSetDisableRawReassemblyFlag(TcpSession *, char)
Set the No reassembly flag for the given direction in given TCP session.
FramesContainer * AppLayerFramesSetupContainer(Flow *f)
int AppLayerParserConfParserEnabled(const char *ipproto, const char *alproto_name)
check if a parser is enabled in the config Returns enabled always if: were running unittests
int AppLayerParserGetStateProgress(uint8_t ipproto, AppProto alproto, void *alstate, uint8_t flags)
get the progress value for a tx/protocol
void AppLayerParserTriggerRawStreamReassembly(Flow *f, int direction)
uint32_t reassembly_depth
AppLayerParserGetStateNameByIdFn GetStateNameById
void AppLayerIncGapErrorCounter(ThreadVars *tv, Flow *f)
#define APP_LAYER_PARSER_INT_STREAM_DEPTH_SET
void StreamTcpReassembleTriggerRawReassembly(TcpSession *ssn, int direction)
Trigger RAW stream reassembly.
uint64_t AppLayerParserGetTransactionLogId(AppLayerParserState *pstate)
const char * AppProtoToString(AppProto alproto)
Maps the ALPROTO_*, to its string equivalent.
bool AppLayerParserSupportsFiles(uint8_t ipproto, AppProto alproto)
void AppLayerParserRegisterStateProgressCompletionStatus(AppProto alproto, const int ts, const int tc)
void AppLayerParserRegisterParserAcceptableDataDirection(uint8_t ipproto, AppProto alproto, uint8_t direction)
int AppLayerParserGetStateProgressCompletionStatus(AppProto alproto, uint8_t direction)
uint8_t AppLayerParserGetFirstDataDir(uint8_t ipproto, AppProto alproto)
int AppLayerParserProtoIsRegistered(uint8_t ipproto, AppProto alproto)
void AppLayerParserRegisterTxFreeFunc(uint8_t ipproto, AppProto alproto, void(*StateTransactionFree)(void *, uint64_t))
#define FLOW_NOPAYLOAD_INSPECTION
int AppLayerParserGetStateIdByName(uint8_t ipproto, AppProto alproto, const char *name, const uint8_t direction)
void AppLayerParserStateProtoCleanup(uint8_t protomap, AppProto alproto, void *alstate, AppLayerParserState *pstate)
AppLayerGetTxIteratorFunc StateGetTxIterator
void AppLayerParserThreadCtxFree(AppLayerParserThreadCtx *tctx)
Destroys the app layer parser thread context obtained using AppLayerParserThreadCtxAlloc().
void AppLayerDecoderEventsFreeEvents(AppLayerDecoderEvents **events)
void StreamTcpUpdateAppLayerProgress(TcpSession *ssn, char direction, const uint32_t progress)
update reassembly progress
void AppLayerParserRegisterGetStateFuncs(uint8_t ipproto, AppProto alproto, AppLayerParserGetStateIdByNameFn GetIdByNameFunc, AppLayerParserGetStateNameByIdFn GetNameByIdFunc)
int SCConfValIsFalse(const char *val)
Check if a value is false.
AppLayerStateData * AppLayerParserGetStateData(uint8_t ipproto, AppProto alproto, void *state)
Frame * AppLayerFrameNewByAbsoluteOffset(Flow *f, const StreamSlice *stream_slice, const uint64_t frame_start, const int64_t len, int dir, uint8_t frame_type)
create new frame using the absolute offset from the start of the stream
Frame * AppLayerFrameGetLastOpenByType(Flow *f, const int dir, const uint8_t frame_type)
TcpStreamCnf stream_config
#define APP_LAYER_PARSER_EOF_TS
void AppLayerIncAllocErrorCounter(ThreadVars *tv, Flow *f)
@ EXCEPTION_POLICY_NOT_SET
enum ExceptionPolicy ExceptionPolicyParse(const char *option, bool support_flow)
void AppLayerParserRegisterUnittests(void)
uint64_t AppLayerParserGetTransactionInspectId(AppLayerParserState *pstate, uint8_t direction)
Data structure to store app layer decoder events.
bool(* ApplyTxConfig)(void *state, void *tx, int mode, AppLayerTxConfig)
uint8_t FlowGetReverseProtoMapping(uint8_t rproto)
void RegisterDNP3Parsers(void)
Register the DNP3 application protocol parser.
int(* StateGetEventInfoById)(uint8_t event_id, const char **event_name, AppLayerEventType *event_type)
void FTPParserCleanup(void)
Free memory allocated for global FTP parser state.
AppLayerGetFileState AppLayerParserGetTxFiles(const Flow *f, void *tx, const uint8_t direction)
const struct SigGroupHead_ * sgh_toserver
AppLayerResult(* AppLayerParserFPtr)(Flow *f, void *protocol_state, AppLayerParserState *pstate, StreamSlice stream_slice, void *local_storage)
Prototype for parsing functions.
struct AppLayerParserCtx_ AppLayerParserCtx
AppLayerParserState * alparser
void AppLayerParserRegisterProtocolParsers(void)
#define APP_LAYER_PARSER_SFRAME_TS
int AppLayerParserGetEventInfoById(uint8_t ipproto, AppProto alproto, uint8_t event_id, const char **event_name, AppLayerEventType *event_type)
AppLayerParserGetFrameIdByNameFn GetFrameIdByName
const char * AppLayerParserGetFrameNameById(uint8_t ipproto, AppProto alproto, const uint8_t id)
uint64_t AppLayerParserGetTransactionActive(const Flow *f, AppLayerParserState *pstate, uint8_t direction)
void AppLayerFramesFreeContainer(Flow *f)
void *(* alproto_local_storage)[FLOW_PROTO_MAX]
int(* StateGetEventInfo)(const char *event_name, uint8_t *event_id, AppLayerEventType *event_type)
AppLayerParserThreadCtx * alp_tctx
void AppLayerParserRegisterLogger(uint8_t ipproto, AppProto alproto)
void AppLayerParserRegisterGetFrameFuncs(uint8_t ipproto, AppProto alproto, AppLayerParserGetFrameIdByNameFn GetIdByNameFunc, AppLayerParserGetFrameNameByIdFn GetNameByIdFunc)
void(* SetStreamDepthFlag)(void *tx, uint8_t flags)
Per thread variable structure.
void AppLayerParserRegisterLoggerBits(uint8_t ipproto, AppProto alproto, LoggerId bits)
void AppLayerParserRegisterStateFuncs(uint8_t ipproto, AppProto alproto, void *(*StateAlloc)(void *, AppProto), void(*StateFree)(void *))
#define APP_LAYER_PARSER_NO_REASSEMBLY
#define IS_DISRUPTED(flags)
void AppLayerParserSetEOF(AppLayerParserState *pstate)
void(* RegisterUnittests)(void)
void AppLayerParserStateFree(AppLayerParserState *pstate)
void AppLayerParserStateCleanup(const Flow *f, void *alstate, AppLayerParserState *pstate)
const struct SigGroupHead_ * sgh_toclient
void RegisterNFSTCPParsers(void)
void AppLayerParserRegisterGetEventInfo(uint8_t ipproto, AppProto alproto, int(*StateGetEventInfo)(const char *event_name, uint8_t *event_id, AppLayerEventType *event_type))
AppLayerParserGetFrameNameByIdFn GetFrameNameById
struct AppLayerParserProtoCtx_ AppLayerParserProtoCtx
App layer protocol parser context.
int AppLayerParserSetup(void)
void RegisterFTPParsers(void)
void AppLayerParserRegisterProtocolUnittests(uint8_t ipproto, AppProto alproto, void(*RegisterUnittests)(void))
void *(* StateAlloc)(void *, AppProto)
uint8_t FlowGetProtoMapping(uint8_t proto)
Function to map the protocol to the defined FLOW_PROTO_* enumeration.
void RegisterTFTPParsers(void)
#define FLOW_PROTO_APPLAYER_MAX
#define APP_LAYER_PARSER_EOF_TC
#define DEBUG_ASSERT_FLOW_LOCKED(f)
#define BOTH_SET_OR_BOTH_UNSET(a, b)
#define SCReturnPtr(x, type)
void(* StateFree)(void *)
void AppLayerParserRegisterGetTxFilesFunc(uint8_t ipproto, AppProto alproto, AppLayerGetFileState(*GetTxFiles)(void *, uint8_t))
void AppLayerParserRegisterSetStreamDepthFlag(uint8_t ipproto, AppProto alproto, void(*SetStreamDepthFlag)(void *tx, uint8_t flags))
#define APP_LAYER_PARSER_SFRAME_TC
void AppLayerIncParserErrorCounter(ThreadVars *tv, Flow *f)
int RunmodeIsUnittests(void)
#define APP_LAYER_PARSER_NO_INSPECTION
void * AppLayerParserGetTx(uint8_t ipproto, AppProto alproto, void *alstate, uint64_t tx_id)
int AppLayerParserRegisterParser(uint8_t ipproto, AppProto alproto, uint8_t direction, AppLayerParserFPtr Parser)
Register app layer parser for the protocol.
#define SCRealloc(ptr, sz)
AppLayerParserThreadCtx * AppLayerParserThreadCtxAlloc(void)
Gets a new app layer protocol's parser thread context.
void AppLayerParserRegisterGetTx(uint8_t ipproto, AppProto alproto, void *(StateGetTx)(void *alstate, uint64_t tx_id))
enum ExceptionPolicy AppLayerErrorGetExceptionPolicy(void)
void AppLayerParserStateSetFlag(AppLayerParserState *pstate, uint16_t flag)
AppLayerParserFPtr Parser[2]
struct AppLayerTxData AppLayerTxData
void(* StateTransactionFree)(void *, uint64_t)
int AppLayerParserPreRegister(void(*Register)(void))
void RegisterSSLParsers(void)
Function to register the SSL protocol parser and other functions.
void StreamTcpSetSessionNoReassemblyFlag(TcpSession *, char)
disable reassembly
int AppLayerParserParse(ThreadVars *tv, AppLayerParserThreadCtx *alp_tctx, Flow *f, AppProto alproto, uint8_t flags, const uint8_t *input, uint32_t input_len)
const char *(* AppLayerParserGetFrameNameByIdFn)(const uint8_t id)
void StreamTcpDisableAppLayer(Flow *f)
AppLayerParserProtoCtx(* ctxs)[FLOW_PROTO_MAX]
int AppLayerParserGetFrameIdByName(uint8_t ipproto, AppProto alproto, const char *name)
void AppLayerParserRegisterApplyTxConfigFunc(uint8_t ipproto, AppProto alproto, bool(*ApplyTxConfig)(void *state, void *tx, int mode, AppLayerTxConfig))
void AppLayerParserRegisterStateDataFunc(uint8_t ipproto, AppProto alproto, AppLayerStateData *(*GetStateData)(void *state))
void FilesPrune(FileContainer *fc, const StreamingBufferConfig *sbcfg, const bool trunc)
void AppLayerIncInternalErrorCounter(ThreadVars *tv, Flow *f)
const char *(* AppLayerParserGetStateNameByIdFn)(const int id, const uint8_t direction)
AppLayerTxData * AppLayerParserGetTxData(uint8_t ipproto, AppProto alproto, void *tx)
void AppLayerParserRegisterTxDataFunc(uint8_t ipproto, AppProto alproto, AppLayerTxData *(*GetTxData)(void *tx))
uint32_t AppLayerParserGetStreamDepth(const Flow *f)
void RegisterIMAPParsers(void)
AppLayerGetFileState(* GetTxFiles)(void *, uint8_t)
AppLayerParserGetStateIdByNameFn GetStateIdByName
#define FRAME_STREAM_TYPE
#define APP_LAYER_PARSER_OPT_ACCEPT_GAPS
#define APP_LAYER_TX_INSPECTED_TS
void AppLayerParserRegisterGetTxIterator(uint8_t ipproto, AppProto alproto, AppLayerGetTxIteratorFunc Func)
FramesContainer * AppLayerFramesGetContainer(Flow *f)
SCConfNode * SCConfGetNode(const char *name)
Get a SCConfNode by name.
#define SCLogError(...)
Macro used to log ERROR messages.
#define FLOW_SGH_TOSERVER
void AppLayerParserPostStreamSetup(void)
AppLayerDecoderEvents * AppLayerParserGetDecoderEvents(AppLayerParserState *pstate)
#define THREE_SET(a, b, c)
const char * AppLayerGetProtoName(AppProto alproto)
Given the internal protocol id, returns a string representation of the protocol.
void UTHAppLayerParserStateGetIds(void *ptr, uint64_t *i1, uint64_t *i2, uint64_t *log, uint64_t *min)
void RegisterHTPParsers(void)
Register the HTTP protocol and state handling functions to APP layer of the engine.
int(* AppLayerParserGetStateIdByNameFn)(const char *name, const uint8_t direction)
void AppLayerIncTxCounter(ThreadVars *tv, Flow *f, uint64_t step)
#define FRAME_FLAG_ENDS_AT_EOF
void RegisterSMTPParsers(void)
Register the SMTP Protocol parser.
AppLayerParserState * AppLayerParserStateAlloc(void)
#define SCReturnCT(x, type)
AppLayerDecoderEvents * decoder_events
void AppLayerParserRegisterGetTxCnt(uint8_t ipproto, AppProto alproto, uint64_t(*StateGetTxCnt)(void *alstate))
int(* StateGetProgress)(void *alstate, uint8_t direction)
LoggerId AppLayerParserProtocolGetLoggerBits(uint8_t ipproto, AppProto alproto)
void AppLayerParserRegisterGetEventInfoById(uint8_t ipproto, AppProto alproto, int(*StateGetEventInfoById)(uint8_t event_id, const char **event_name, AppLayerEventType *event_type))
AppLayerGetTxIterTuple(* AppLayerGetTxIteratorFunc)(const uint8_t ipproto, const AppProto alproto, void *alstate, uint64_t min_tx_id, uint64_t max_tx_id, AppLayerGetTxIterState *state)
tx iterator prototype
bool g_file_logger_enabled
void RegisterHTTP2Parsers(void)
#define STREAM_APP_PROGRESS(stream)
#define APP_LAYER_PARSER_NO_INSPECTION_PAYLOAD
int FlowChangeProto(Flow *f)
Check if change proto flag is set for flow.
uint8_t FlowGetDisruptionFlags(const Flow *f, uint8_t flags)
get 'disruption' flags: GAP/DEPTH/PASS
uint16_t AppLayerParserStateIssetFlag(AppLayerParserState *pstate, uint16_t flag)
#define SCLogNotice(...)
Macro used to log NOTICE messages.
void RegisterNFSUDPParsers(void)
AppProto alproto
application level protocol
void AppLayerParserDestroyProtocolParserLocalStorage(uint8_t ipproto, AppProto alproto, void *local_data)
uint64_t AppLayerParserGetTxCnt(const Flow *f, void *alstate)
void SMTPParserCleanup(void)
Free memory allocated for global SMTP parser state.
bool AppLayerParserHasDecoderEvents(AppLayerParserState *pstate)
int(* AppLayerParserGetFrameIdByNameFn)(const char *frame_name)
void StreamTcpSetSessionBypassFlag(TcpSession *)
enable bypass
#define DEBUG_VALIDATE_BUG_ON(exp)
#define APP_LAYER_TX_INSPECTED_TC
void *(* LocalStorageAlloc)(void)
int AppLayerParserGetEventInfo(uint8_t ipproto, AppProto alproto, const char *event_name, uint8_t *event_id, AppLayerEventType *event_type)
#define APP_LAYER_TX_SKIP_INSPECT_TS