suricata
|
#include "app-layer-protos.h"
Go to the source code of this file.
Data Structures | |
struct | AppLayerGetTxIterState |
Functions | |
int | AppLayerParserProtoIsRegistered (uint8_t ipproto, AppProto alproto) |
int | AppLayerParserSetup (void) |
void | AppLayerParserPostStreamSetup (void) |
int | AppLayerParserDeSetup (void) |
AppLayerParserThreadCtx * | AppLayerParserThreadCtxAlloc (void) |
Gets a new app layer protocol's parser thread context. More... | |
void | AppLayerParserThreadCtxFree (AppLayerParserThreadCtx *tctx) |
Destroys the app layer parser thread context obtained using AppLayerParserThreadCtxAlloc(). More... | |
int | SCAppLayerParserConfParserEnabled (const char *ipproto, const char *alproto_name) |
Given a protocol name, checks if the parser is enabled in the conf file. More... | |
enum ExceptionPolicy | AppLayerErrorGetExceptionPolicy (void) |
int | AppLayerParserPreRegister (void(*Register)(void)) |
int | AppLayerParserRegisterParser (uint8_t ipproto, AppProto alproto, uint8_t direction, AppLayerParserFPtr Parser) |
Register app layer parser for the protocol. More... | |
void | SCAppLayerParserRegisterParserAcceptableDataDirection (uint8_t ipproto, AppProto alproto, uint8_t direction) |
void | AppLayerParserRegisterOptionFlags (uint8_t ipproto, AppProto alproto, uint32_t flags) |
void | AppLayerParserRegisterStateFuncs (uint8_t ipproto, AppProto alproto, void *(*StateAlloc)(void *, AppProto), void(*StateFree)(void *)) |
void | AppLayerParserRegisterLocalStorageFunc (uint8_t ipproto, AppProto proto, void *(*LocalStorageAlloc)(void), void(*LocalStorageFree)(void *)) |
void | AppLayerParserRegisterGetTxFilesFunc (uint8_t ipproto, AppProto alproto, AppLayerGetFileState(*GetTxFiles)(void *, uint8_t)) |
void | SCAppLayerParserRegisterLogger (uint8_t ipproto, AppProto alproto) |
void | AppLayerParserRegisterLoggerBits (uint8_t ipproto, AppProto alproto, LoggerId bits) |
void | AppLayerParserRegisterGetStateProgressFunc (uint8_t ipproto, AppProto alproto, int(*StateGetStateProgress)(void *alstate, uint8_t direction)) |
void | AppLayerParserRegisterTxFreeFunc (uint8_t ipproto, AppProto alproto, void(*StateTransactionFree)(void *, uint64_t)) |
void | AppLayerParserRegisterGetTxCnt (uint8_t ipproto, AppProto alproto, uint64_t(*StateGetTxCnt)(void *alstate)) |
void | AppLayerParserRegisterGetTx (uint8_t ipproto, AppProto alproto, void *(StateGetTx)(void *alstate, uint64_t tx_id)) |
void | AppLayerParserRegisterGetTxIterator (uint8_t ipproto, AppProto alproto, AppLayerGetTxIteratorFunc Func) |
void | AppLayerParserRegisterStateProgressCompletionStatus (AppProto alproto, const int ts, const int tc) |
void | AppLayerParserRegisterGetEventInfo (uint8_t ipproto, AppProto alproto, int(*StateGetEventInfo)(const char *event_name, uint8_t *event_id, AppLayerEventType *event_type)) |
void | AppLayerParserRegisterGetEventInfoById (uint8_t ipproto, AppProto alproto, int(*StateGetEventInfoById)(uint8_t event_id, const char **event_name, AppLayerEventType *event_type)) |
void | AppLayerParserRegisterGetFrameFuncs (uint8_t ipproto, AppProto alproto, AppLayerParserGetFrameIdByNameFn GetFrameIdByName, AppLayerParserGetFrameNameByIdFn GetFrameNameById) |
void | AppLayerParserRegisterSetStreamDepthFlag (uint8_t ipproto, AppProto alproto, void(*SetStreamDepthFlag)(void *tx, uint8_t flags)) |
void | AppLayerParserRegisterGetStateFuncs (uint8_t ipproto, AppProto alproto, AppLayerParserGetStateIdByNameFn GetStateIdByName, AppLayerParserGetStateNameByIdFn GetStateNameById) |
void | AppLayerParserRegisterTxDataFunc (uint8_t ipproto, AppProto alproto, AppLayerTxData *(*GetTxData)(void *tx)) |
void | AppLayerParserRegisterApplyTxConfigFunc (uint8_t ipproto, AppProto alproto, bool(*ApplyTxConfig)(void *state, void *tx, int mode, AppLayerTxConfig)) |
void | AppLayerParserRegisterStateDataFunc (uint8_t ipproto, AppProto alproto, AppLayerStateData *(*GetStateData)(void *state)) |
AppLayerGetTxIteratorFunc | AppLayerGetTxIterator (const uint8_t ipproto, const AppProto alproto) |
void * | AppLayerParserGetProtocolParserLocalStorage (uint8_t ipproto, AppProto alproto) |
void | AppLayerParserDestroyProtocolParserLocalStorage (uint8_t ipproto, AppProto alproto, void *local_data) |
uint64_t | AppLayerParserGetTransactionLogId (AppLayerParserState *pstate) |
void | AppLayerParserSetTransactionLogId (AppLayerParserState *pstate, uint64_t tx_id) |
uint64_t | AppLayerParserGetTransactionInspectId (AppLayerParserState *pstate, uint8_t direction) |
void | AppLayerParserSetTransactionInspectId (const Flow *f, AppLayerParserState *pstate, void *alstate, const uint8_t flags, bool tag_txs_as_inspected) |
AppLayerDecoderEvents * | AppLayerParserGetDecoderEvents (AppLayerParserState *pstate) |
AppLayerDecoderEvents * | AppLayerParserGetEventsByTx (uint8_t ipproto, AppProto alproto, void *tx) |
AppLayerGetFileState | AppLayerParserGetTxFiles (const Flow *f, void *tx, const uint8_t direction) |
int | AppLayerParserGetStateProgress (uint8_t ipproto, AppProto alproto, void *alstate, uint8_t direction) |
get the progress value for a tx/protocol More... | |
uint64_t | AppLayerParserGetTxCnt (const Flow *, void *alstate) |
void * | AppLayerParserGetTx (uint8_t ipproto, AppProto alproto, void *alstate, uint64_t tx_id) |
int | AppLayerParserGetStateProgressCompletionStatus (AppProto alproto, uint8_t direction) |
int | AppLayerParserGetEventInfo (uint8_t ipproto, AppProto alproto, const char *event_name, uint8_t *event_id, AppLayerEventType *event_type) |
int | AppLayerParserGetEventInfoById (uint8_t ipproto, AppProto alproto, uint8_t event_id, const char **event_name, AppLayerEventType *event_type) |
uint64_t | AppLayerParserGetTransactionActive (const Flow *f, AppLayerParserState *pstate, uint8_t direction) |
uint8_t | AppLayerParserGetFirstDataDir (uint8_t ipproto, AppProto alproto) |
bool | AppLayerParserSupportsFiles (uint8_t ipproto, AppProto alproto) |
AppLayerTxData * | AppLayerParserGetTxData (uint8_t ipproto, AppProto alproto, void *tx) |
uint8_t | AppLayerParserGetTxDetectProgress (AppLayerTxData *txd, const uint8_t dir) |
AppLayerStateData * | AppLayerParserGetStateData (uint8_t ipproto, AppProto alproto, void *state) |
void | AppLayerParserApplyTxConfig (uint8_t ipproto, AppProto alproto, void *state, void *tx, enum ConfigAction mode, AppLayerTxConfig) |
int | AppLayerParserParse (ThreadVars *tv, AppLayerParserThreadCtx *tctx, Flow *f, AppProto alproto, uint8_t flags, const uint8_t *input, uint32_t input_len) |
void | AppLayerParserSetEOF (AppLayerParserState *pstate) |
bool | AppLayerParserHasDecoderEvents (AppLayerParserState *pstate) |
int | AppLayerParserProtocolHasLogger (uint8_t ipproto, AppProto alproto) |
LoggerId | AppLayerParserProtocolGetLoggerBits (uint8_t ipproto, AppProto alproto) |
void | AppLayerParserTriggerRawStreamInspection (Flow *f, int direction) |
void | SCAppLayerParserSetStreamDepth (uint8_t ipproto, AppProto alproto, uint32_t stream_depth) |
uint32_t | AppLayerParserGetStreamDepth (const Flow *f) |
void | AppLayerParserSetStreamDepthFlag (uint8_t ipproto, AppProto alproto, void *state, uint64_t tx_id, uint8_t flags) |
int | AppLayerParserIsEnabled (AppProto alproto) |
simple way to globally test if a alproto is registered and fully enabled in the configuration. More... | |
int | AppLayerParserGetFrameIdByName (uint8_t ipproto, AppProto alproto, const char *name) |
const char * | AppLayerParserGetFrameNameById (uint8_t ipproto, AppProto alproto, const uint8_t id) |
int | AppLayerParserGetStateIdByName (uint8_t ipproto, AppProto alproto, const char *name, uint8_t direction) |
const char * | AppLayerParserGetStateNameById (uint8_t ipproto, AppProto alproto, const int id, uint8_t direction) |
void | AppLayerParserStateProtoCleanup (uint8_t protomap, AppProto alproto, void *alstate, AppLayerParserState *pstate) |
void | AppLayerParserStateCleanup (const Flow *f, void *alstate, AppLayerParserState *pstate) |
void | AppLayerParserRegisterProtocolParsers (void) |
void | SCAppLayerParserStateSetFlag (AppLayerParserState *pstate, uint16_t flag) |
uint16_t | SCAppLayerParserStateIssetFlag (AppLayerParserState *pstate, uint16_t flag) |
AppLayerParserState * | AppLayerParserStateAlloc (void) |
void | AppLayerParserStateFree (AppLayerParserState *pstate) |
void | AppLayerParserTransactionsCleanup (Flow *f, const uint8_t pkt_dir) |
remove obsolete (inspected and logged) transactions More... | |
void | AppLayerParserRegisterProtocolUnittests (uint8_t ipproto, AppProto alproto, void(*RegisterUnittests)(void)) |
void | AppLayerParserRegisterUnittests (void) |
void | UTHAppLayerParserStateGetIds (void *ptr, uint64_t *i1, uint64_t *i2, uint64_t *log, uint64_t *min) |
void | AppLayerFramesFreeContainer (Flow *f) |
void | FileApplyTxFlags (const AppLayerTxData *txd, const uint8_t direction, File *file) |
Definition in file app-layer-parser.h.
#define APP_LAYER_ERROR (AppLayerResult) { -1, 0, 0 } |
parser has hit an unrecoverable error. Returning this to the API leads to no further calls to the parser.
Definition at line 82 of file app-layer-parser.h.
#define APP_LAYER_INCOMPLETE | ( | c, | |
n | |||
) | (AppLayerResult) { 1, (c), (n) } |
parser needs more data. Through 'c' it will indicate how many of the input bytes it has consumed. Through 'n' it will indicate how many more bytes it needs before getting called again.
Definition at line 90 of file app-layer-parser.h.
#define APP_LAYER_OK (AppLayerResult) { 0, 0, 0 } |
parser has successfully processed in the input, and has consumed all of it.
Definition at line 78 of file app-layer-parser.h.
#define APP_LAYER_PARSER_BYPASS_READY BIT_U16(4) |
Definition at line 53 of file app-layer-parser.h.
#define APP_LAYER_PARSER_EOF_TC BIT_U16(6) |
Definition at line 55 of file app-layer-parser.h.
#define APP_LAYER_PARSER_EOF_TS BIT_U16(5) |
Definition at line 54 of file app-layer-parser.h.
#define APP_LAYER_PARSER_INT_STREAM_DEPTH_SET BIT_U32(0) |
Definition at line 63 of file app-layer-parser.h.
#define APP_LAYER_PARSER_NO_INSPECTION BIT_U16(1) |
Definition at line 50 of file app-layer-parser.h.
#define APP_LAYER_PARSER_NO_INSPECTION_PAYLOAD BIT_U16(3) |
Definition at line 52 of file app-layer-parser.h.
#define APP_LAYER_PARSER_NO_REASSEMBLY BIT_U16(2) |
Definition at line 51 of file app-layer-parser.h.
#define APP_LAYER_PARSER_OPT_ACCEPT_GAPS BIT_U32(0) |
Definition at line 61 of file app-layer-parser.h.
#define APP_LAYER_PARSER_SFRAME_TC BIT_U16(10) |
Definition at line 58 of file app-layer-parser.h.
#define APP_LAYER_PARSER_SFRAME_TS BIT_U16(9) |
Definition at line 57 of file app-layer-parser.h.
#define APP_LAYER_TX_ACCEPT BIT_U8(4) |
accept is applied to entire tx
Definition at line 74 of file app-layer-parser.h.
#define APP_LAYER_TX_INSPECTED_TC BIT_U8(3) |
Definition at line 72 of file app-layer-parser.h.
#define APP_LAYER_TX_INSPECTED_TS BIT_U8(2) |
is tx fully inspected?
Definition at line 71 of file app-layer-parser.h.
#define APP_LAYER_TX_SKIP_INSPECT_TC BIT_U8(1) |
Definition at line 69 of file app-layer-parser.h.
#define APP_LAYER_TX_SKIP_INSPECT_TS BIT_U8(0) |
should inspection be skipped in that direction
Definition at line 68 of file app-layer-parser.h.
#define AppLayerParserHasFilesInDir | ( | txd, | |
direction | |||
) | ((txd)->files_opened && ((txd)->file_tx & (direction)) != 0) |
check if tx (possibly) has files in this tx for the direction
Definition at line 265 of file app-layer-parser.h.
typedef struct AppLayerDecoderEvents_ AppLayerDecoderEvents |
Definition at line 1 of file app-layer-parser.h.
typedef enum AppLayerEventType AppLayerEventType |
Definition at line 1 of file app-layer-parser.h.
typedef struct AppLayerGetFileState AppLayerGetFileState |
Definition at line 1 of file app-layer-parser.h.
typedef AppLayerGetTxIterTuple(* AppLayerGetTxIteratorFunc) (const uint8_t ipproto, const AppProto alproto, void *alstate, uint64_t min_tx_id, uint64_t max_tx_id, AppLayerGetTxIterState *state) |
tx iterator prototype
Definition at line 142 of file app-layer-parser.h.
typedef struct AppLayerGetTxIterState AppLayerGetTxIterState |
typedef struct AppLayerGetTxIterTuple AppLayerGetTxIterTuple |
Definition at line 1 of file app-layer-parser.h.
typedef AppLayerResult(* AppLayerParserFPtr) (Flow *f, void *protocol_state, AppLayerParserState *pstate, StreamSlice stream_slice, void *local_storage) |
Prototype for parsing functions.
Definition at line 131 of file app-layer-parser.h.
typedef int(* AppLayerParserGetFrameIdByNameFn) (const char *frame_name) |
Definition at line 160 of file app-layer-parser.h.
typedef const char*(* AppLayerParserGetFrameNameByIdFn) (const uint8_t id) |
Definition at line 161 of file app-layer-parser.h.
typedef int(* AppLayerParserGetStateIdByNameFn) (const char *name, const uint8_t direction) |
name | progress name to get the id for |
direction | STREAM_TOSERVER/STREAM_TOCLIENT |
Definition at line 153 of file app-layer-parser.h.
typedef const char*(* AppLayerParserGetStateNameByIdFn) (const int id, const uint8_t direction) |
id | progress value id to get the name for |
direction | STREAM_TOSERVER/STREAM_TOCLIENT |
Definition at line 158 of file app-layer-parser.h.
typedef struct AppLayerParserState_ AppLayerParserState |
Definition at line 1 of file app-layer-parser.h.
typedef struct AppLayerParserThreadCtx_ AppLayerParserThreadCtx |
Definition at line 97 of file app-layer-parser.h.
typedef struct AppLayerResult AppLayerResult |
Definition at line 1 of file app-layer-parser.h.
typedef struct AppLayerStateData AppLayerStateData |
Definition at line 1 of file app-layer-parser.h.
typedef struct AppLayerTxConfig AppLayerTxConfig |
Definition at line 1 of file app-layer-parser.h.
typedef struct AppLayerTxData AppLayerTxData |
Definition at line 1 of file app-layer-parser.h.
Definition at line 1 of file app-layer-parser.h.
Definition at line 1 of file app-layer-parser.h.
Definition at line 1 of file app-layer-parser.h.
typedef struct StreamSlice StreamSlice |
Definition at line 1 of file app-layer-parser.h.
typedef struct ThreadVars_ ThreadVars |
Definition at line 1 of file app-layer-parser.h.
enum ExceptionPolicy AppLayerErrorGetExceptionPolicy | ( | void | ) |
Definition at line 157 of file app-layer-parser.c.
void AppLayerFramesFreeContainer | ( | Flow * | f | ) |
Definition at line 176 of file app-layer-parser.c.
References Flow_::alparser, and AppLayerParserState_::frames.
AppLayerGetTxIteratorFunc AppLayerGetTxIterator | ( | const uint8_t | ipproto, |
const AppProto | alproto | ||
) |
Definition at line 707 of file app-layer-parser.c.
Referenced by AppLayerParserSetTransactionInspectId().
void AppLayerParserApplyTxConfig | ( | uint8_t | ipproto, |
AppProto | alproto, | ||
void * | state, | ||
void * | tx, | ||
enum ConfigAction | mode, | ||
AppLayerTxConfig | |||
) |
Definition at line 1201 of file app-layer-parser.c.
References FlowGetProtoMapping(), and SCEnter.
int AppLayerParserDeSetup | ( | void | ) |
Definition at line 285 of file app-layer-parser.c.
References SCEnter, and SCFree.
Referenced by AppLayerDeSetup().
void AppLayerParserDestroyProtocolParserLocalStorage | ( | uint8_t | ipproto, |
AppProto | alproto, | ||
void * | local_data | ||
) |
Definition at line 660 of file app-layer-parser.c.
References SCEnter.
Referenced by AppLayerParserThreadCtxFree().
AppLayerDecoderEvents* AppLayerParserGetDecoderEvents | ( | AppLayerParserState * | pstate | ) |
Definition at line 849 of file app-layer-parser.c.
References AppLayerParserState_::decoder_events, SCEnter, and SCReturnPtr.
Referenced by AppLayerParserHasDecoderEvents().
int AppLayerParserGetEventInfo | ( | uint8_t | ipproto, |
AppProto | alproto, | ||
const char * | event_name, | ||
uint8_t * | event_id, | ||
AppLayerEventType * | event_type | ||
) |
Definition at line 1124 of file app-layer-parser.c.
References FlowGetProtoMapping(), and SCEnter.
int AppLayerParserGetEventInfoById | ( | uint8_t | ipproto, |
AppProto | alproto, | ||
uint8_t | event_id, | ||
const char ** | event_name, | ||
AppLayerEventType * | event_type | ||
) |
Definition at line 1136 of file app-layer-parser.c.
References FlowGetProtoMapping(), and SCEnter.
AppLayerDecoderEvents* AppLayerParserGetEventsByTx | ( | uint8_t | ipproto, |
AppProto | alproto, | ||
void * | tx | ||
) |
Definition at line 857 of file app-layer-parser.c.
References AppLayerParserGetTxData(), AppLayerDecoderEvents_::events, SCEnter, and SCReturnPtr.
uint8_t AppLayerParserGetFirstDataDir | ( | uint8_t | ipproto, |
AppProto | alproto | ||
) |
Definition at line 1149 of file app-layer-parser.c.
References SCEnter.
int AppLayerParserGetFrameIdByName | ( | uint8_t | ipproto, |
AppProto | alproto, | ||
const char * | name | ||
) |
Definition at line 1627 of file app-layer-parser.c.
const char* AppLayerParserGetFrameNameById | ( | uint8_t | ipproto, |
AppProto | alproto, | ||
const uint8_t | id | ||
) |
Definition at line 1636 of file app-layer-parser.c.
Referenced by DetectRunFrameInspectRule(), and FrameJsonLogOneFrame().
void* AppLayerParserGetProtocolParserLocalStorage | ( | uint8_t | ipproto, |
AppProto | alproto | ||
) |
Definition at line 648 of file app-layer-parser.c.
References SCEnter.
Referenced by AppLayerParserThreadCtxAlloc().
AppLayerStateData* AppLayerParserGetStateData | ( | uint8_t | ipproto, |
AppProto | alproto, | ||
void * | state | ||
) |
Definition at line 1190 of file app-layer-parser.c.
References SCEnter.
int AppLayerParserGetStateIdByName | ( | uint8_t | ipproto, |
AppProto | alproto, | ||
const char * | name, | ||
const uint8_t | direction | ||
) |
name | progress name to get the id for |
direction | STREAM_TOSERVER/STREAM_TOCLIENT |
id | progress value id to get the name for |
direction | STREAM_TOSERVER/STREAM_TOCLIENT |
Definition at line 1602 of file app-layer-parser.c.
const char* AppLayerParserGetStateNameById | ( | uint8_t | ipproto, |
AppProto | alproto, | ||
const int | id, | ||
const uint8_t | direction | ||
) |
id | progress value id to get the name for |
direction | STREAM_TOSERVER/STREAM_TOCLIENT |
Definition at line 1617 of file app-layer-parser.c.
Referenced by DetectRegisterAppLayerHookLists(), DetectRunPrefilterTx(), and ListAppLayerHooks().
int AppLayerParserGetStateProgress | ( | uint8_t | ipproto, |
AppProto | alproto, | ||
void * | alstate, | ||
uint8_t | flags | ||
) |
get the progress value for a tx/protocol
If the stream is disrupted, we return the 'completion' value.
Definition at line 1087 of file app-layer-parser.c.
References flags, IS_DISRUPTED, SCEnter, and unlikely.
Referenced by AppLayerParserSetTransactionInspectId(), DetectEngineInspectBufferGeneric(), DetectEngineInspectBufferSingle(), DetectEngineInspectFiledata(), and DetectEngineInspectMultiBufferGeneric().
int AppLayerParserGetStateProgressCompletionStatus | ( | AppProto | alproto, |
uint8_t | direction | ||
) |
Definition at line 1116 of file app-layer-parser.c.
References SCEnter.
Referenced by AppLayerParserSetTransactionInspectId(), DetectRegisterAppLayerHookLists(), and ListAppLayerHooks().
uint32_t AppLayerParserGetStreamDepth | ( | const Flow * | f | ) |
Definition at line 1579 of file app-layer-parser.c.
References SCReturnInt.
uint64_t AppLayerParserGetTransactionActive | ( | const Flow * | f, |
AppLayerParserState * | pstate, | ||
uint8_t | direction | ||
) |
Definition at line 1156 of file app-layer-parser.c.
References AppLayerParserState_::inspect_id, AppLayerParserState_::log_id, and SCEnter.
Referenced by FlowNeedsReassembly().
uint64_t AppLayerParserGetTransactionInspectId | ( | AppLayerParserState * | pstate, |
uint8_t | direction | ||
) |
Definition at line 732 of file app-layer-parser.c.
References DEBUG_VALIDATE_BUG_ON, AppLayerParserState_::inspect_id, SCEnter, and SCReturnCT.
Referenced by AppLayerParserSetTransactionInspectId().
uint64_t AppLayerParserGetTransactionLogId | ( | AppLayerParserState * | pstate | ) |
Definition at line 715 of file app-layer-parser.c.
References AppLayerParserState_::log_id, SCEnter, and SCReturnCT.
void* AppLayerParserGetTx | ( | uint8_t | ipproto, |
AppProto | alproto, | ||
void * | alstate, | ||
uint64_t | tx_id | ||
) |
Definition at line 1109 of file app-layer-parser.c.
References SCEnter.
Referenced by AppLayerParserSetStreamDepthFlag(), and LuaExtensionsMatchSetup().
uint64_t AppLayerParserGetTxCnt | ( | const Flow * | , |
void * | alstate | ||
) |
Definition at line 1102 of file app-layer-parser.c.
References SCEnter.
Referenced by AppLayerParserSetTransactionInspectId(), and FlowNeedsReassembly().
AppLayerTxData* AppLayerParserGetTxData | ( | uint8_t | ipproto, |
AppProto | alproto, | ||
void * | tx | ||
) |
Definition at line 1183 of file app-layer-parser.c.
References SCEnter.
Referenced by AppLayerParserGetEventsByTx(), AppLayerParserSetTransactionInspectId(), and DetectRunStoreStateTx().
|
inline |
Definition at line 743 of file app-layer-parser.c.
AppLayerGetFileState AppLayerParserGetTxFiles | ( | const Flow * | f, |
void * | tx, | ||
const uint8_t | direction | ||
) |
Definition at line 873 of file app-layer-parser.c.
References SCEnter.
Referenced by DetectEngineInspectFiledata(), and DetectFileInspectGeneric().
bool AppLayerParserHasDecoderEvents | ( | AppLayerParserState * | pstate | ) |
Definition at line 1513 of file app-layer-parser.c.
References AppLayerParserGetDecoderEvents(), AppLayerDecoderEvents_::cnt, AppLayerParserState_::decoder_events, and SCEnter.
int AppLayerParserIsEnabled | ( | AppProto | alproto | ) |
simple way to globally test if a alproto is registered and fully enabled in the configuration.
Definition at line 1531 of file app-layer-parser.c.
References FLOW_PROTO_APPLAYER_MAX.
int AppLayerParserParse | ( | ThreadVars * | tv, |
AppLayerParserThreadCtx * | alp_tctx, | ||
Flow * | f, | ||
AppProto | alproto, | ||
uint8_t | flags, | ||
const uint8_t * | input, | ||
uint32_t | input_len | ||
) |
int | -1 in case of unrecoverable error. App-layer tracking stops for this flow. |
int | 0 ok: we did not update app_progress |
int | 1 ok: we updated app_progress |
Definition at line 1291 of file app-layer-parser.c.
References Flow_::alparser, BUG_ON, FlowGetProtoMapping(), Flow_::proto, Flow_::protomap, and SCEnter.
Referenced by LLVMFuzzerTestOneInput().
void AppLayerParserPostStreamSetup | ( | void | ) |
Definition at line 272 of file app-layer-parser.c.
References FLOW_PROTO_DEFAULT, and g_alproto_max.
Referenced by PreRunInit().
int AppLayerParserPreRegister | ( | void(*)(void) | Register | ) |
Definition at line 1753 of file app-layer-parser.c.
Definition at line 1549 of file app-layer-parser.c.
References FlowGetProtoMapping(), and SCEnter.
int AppLayerParserProtocolHasLogger | ( | uint8_t | ipproto, |
AppProto | alproto | ||
) |
Definition at line 1541 of file app-layer-parser.c.
References FlowGetProtoMapping(), and SCEnter.
int AppLayerParserProtoIsRegistered | ( | uint8_t | ipproto, |
AppProto | alproto | ||
) |
Definition at line 228 of file app-layer-parser.c.
References FlowGetProtoMapping().
void AppLayerParserRegisterApplyTxConfigFunc | ( | uint8_t | ipproto, |
AppProto | alproto, | ||
bool(*)(void *state, void *tx, int mode, AppLayerTxConfig) | ApplyTxConfig | ||
) |
Definition at line 626 of file app-layer-parser.c.
References SCEnter.
void AppLayerParserRegisterGetEventInfo | ( | uint8_t | ipproto, |
AppProto | alproto, | ||
int(*)(const char *event_name, uint8_t *event_id, AppLayerEventType *event_type) | StateGetEventInfo | ||
) |
Definition at line 595 of file app-layer-parser.c.
References SCEnter.
void AppLayerParserRegisterGetEventInfoById | ( | uint8_t | ipproto, |
AppProto | alproto, | ||
int(*)(uint8_t event_id, const char **event_name, AppLayerEventType *event_type) | StateGetEventInfoById | ||
) |
Definition at line 563 of file app-layer-parser.c.
References SCEnter.
void AppLayerParserRegisterGetFrameFuncs | ( | uint8_t | ipproto, |
AppProto | alproto, | ||
AppLayerParserGetFrameIdByNameFn | GetFrameIdByName, | ||
AppLayerParserGetFrameNameByIdFn | GetFrameNameById | ||
) |
Definition at line 585 of file app-layer-parser.c.
References SCEnter.
void AppLayerParserRegisterGetStateFuncs | ( | uint8_t | ipproto, |
AppProto | alproto, | ||
AppLayerParserGetStateIdByNameFn | GetStateIdByName, | ||
AppLayerParserGetStateNameByIdFn | GetStateNameById | ||
) |
Definition at line 575 of file app-layer-parser.c.
References SCEnter.
void AppLayerParserRegisterGetStateProgressFunc | ( | uint8_t | ipproto, |
AppProto | alproto, | ||
int(*)(void *alstate, uint8_t direction) | StateGetStateProgress | ||
) |
Definition at line 500 of file app-layer-parser.c.
References SCEnter.
void AppLayerParserRegisterGetTx | ( | uint8_t | ipproto, |
AppProto | alproto, | ||
void * | StateGetTx)(void *alstate, uint64_t tx_id | ||
) |
Definition at line 530 of file app-layer-parser.c.
References SCEnter.
void AppLayerParserRegisterGetTxCnt | ( | uint8_t | ipproto, |
AppProto | alproto, | ||
uint64_t(*)(void *alstate) | StateGetTxCnt | ||
) |
Definition at line 520 of file app-layer-parser.c.
References SCEnter.
void AppLayerParserRegisterGetTxFilesFunc | ( | uint8_t | ipproto, |
AppProto | alproto, | ||
AppLayerGetFileState(*)(void *, uint8_t) | GetTxFiles | ||
) |
Definition at line 472 of file app-layer-parser.c.
References SCEnter.
void AppLayerParserRegisterGetTxIterator | ( | uint8_t | ipproto, |
AppProto | alproto, | ||
AppLayerGetTxIteratorFunc | Func | ||
) |
Definition at line 540 of file app-layer-parser.c.
References SCEnter.
void AppLayerParserRegisterLocalStorageFunc | ( | uint8_t | ipproto, |
AppProto | proto, | ||
void *(*)(void) | LocalStorageAlloc, | ||
void(*)(void *) | LocalStorageFree | ||
) |
Definition at line 460 of file app-layer-parser.c.
References SCEnter.
Definition at line 482 of file app-layer-parser.c.
References SCEnter.
void AppLayerParserRegisterOptionFlags | ( | uint8_t | ipproto, |
AppProto | alproto, | ||
uint32_t | flags | ||
) |
Definition at line 425 of file app-layer-parser.c.
References SCEnter.
int AppLayerParserRegisterParser | ( | uint8_t | ipproto, |
AppProto | alproto, | ||
uint8_t | direction, | ||
AppLayerParserFPtr | Parser | ||
) |
Register app layer parser for the protocol.
0 | On success. |
-1 | On failure. |
Definition at line 402 of file app-layer-parser.c.
References SCEnter.
void AppLayerParserRegisterProtocolParsers | ( | void | ) |
Definition at line 1769 of file app-layer-parser.c.
References SCEnter.
void AppLayerParserRegisterProtocolUnittests | ( | uint8_t | ipproto, |
AppProto | alproto, | ||
void(*)(void) | RegisterUnittests | ||
) |
Definition at line 1840 of file app-layer-parser.c.
Referenced by RegisterIKEParsers(), and RegisterModbusParsers().
void AppLayerParserRegisterSetStreamDepthFlag | ( | uint8_t | ipproto, |
AppProto | alproto, | ||
void(*)(void *tx, uint8_t flags) | SetStreamDepthFlag | ||
) |
Definition at line 636 of file app-layer-parser.c.
References SCEnter.
void AppLayerParserRegisterStateDataFunc | ( | uint8_t | ipproto, |
AppProto | alproto, | ||
AppLayerStateData *(*)(void *state) | GetStateData | ||
) |
Definition at line 616 of file app-layer-parser.c.
References SCEnter.
void AppLayerParserRegisterStateFuncs | ( | uint8_t | ipproto, |
AppProto | alproto, | ||
void *(*)(void *, AppProto) | StateAlloc, | ||
void(*)(void *) | StateFree | ||
) |
Definition at line 435 of file app-layer-parser.c.
References SCEnter.
void AppLayerParserRegisterStateProgressCompletionStatus | ( | AppProto | alproto, |
const int | ts, | ||
const int | tc | ||
) |
Definition at line 548 of file app-layer-parser.c.
void AppLayerParserRegisterTxDataFunc | ( | uint8_t | ipproto, |
AppProto | alproto, | ||
AppLayerTxData *(*)(void *tx) | GetTxData | ||
) |
Definition at line 606 of file app-layer-parser.c.
References SCEnter.
void AppLayerParserRegisterTxFreeFunc | ( | uint8_t | ipproto, |
AppProto | alproto, | ||
void(*)(void *, uint64_t) | StateTransactionFree | ||
) |
Definition at line 510 of file app-layer-parser.c.
References SCEnter.
void AppLayerParserRegisterUnittests | ( | void | ) |
Definition at line 1848 of file app-layer-parser.c.
References ctx, FLOW_PROTO_DEFAULT, g_alproto_max, and SCEnter.
void AppLayerParserSetEOF | ( | AppLayerParserState * | pstate | ) |
Definition at line 1497 of file app-layer-parser.c.
References APP_LAYER_PARSER_EOF_TC, APP_LAYER_PARSER_EOF_TS, SCAppLayerParserStateSetFlag(), SCEnter, SCLogDebug, and SCReturn.
void AppLayerParserSetStreamDepthFlag | ( | uint8_t | ipproto, |
AppProto | alproto, | ||
void * | state, | ||
uint64_t | tx_id, | ||
uint8_t | flags | ||
) |
Definition at line 1584 of file app-layer-parser.c.
References AppLayerParserGetTx(), and SCEnter.
void AppLayerParserSetTransactionInspectId | ( | const Flow * | f, |
AppLayerParserState * | pstate, | ||
void * | alstate, | ||
const uint8_t | flags, | ||
bool | tag_txs_as_inspected | ||
) |
Definition at line 754 of file app-layer-parser.c.
References Flow_::alproto, APP_LAYER_TX_INSPECTED_TC, APP_LAYER_TX_INSPECTED_TS, AppLayerGetTxIterator(), AppLayerParserGetStateProgress(), AppLayerParserGetStateProgressCompletionStatus(), AppLayerParserGetTransactionInspectId(), AppLayerParserGetTxCnt(), AppLayerParserGetTxData(), flags, AppLayerParserState_::inspect_id, Flow_::proto, SCEnter, SCLogDebug, and SCReturn.
void AppLayerParserSetTransactionLogId | ( | AppLayerParserState * | pstate, |
uint64_t | tx_id | ||
) |
Definition at line 722 of file app-layer-parser.c.
References AppLayerParserState_::log_id, SCEnter, and SCReturn.
int AppLayerParserSetup | ( | void | ) |
Definition at line 259 of file app-layer-parser.c.
References SCEnter.
AppLayerParserState* AppLayerParserStateAlloc | ( | void | ) |
Definition at line 235 of file app-layer-parser.c.
References SCCalloc, SCEnter, and SCReturnPtr.
void AppLayerParserStateCleanup | ( | const Flow * | f, |
void * | alstate, | ||
AppLayerParserState * | pstate | ||
) |
Definition at line 1664 of file app-layer-parser.c.
References Flow_::alproto, AppLayerParserStateProtoCleanup(), and Flow_::protomap.
Referenced by FlowCleanupAppLayer().
void AppLayerParserStateFree | ( | AppLayerParserState * | pstate | ) |
Definition at line 247 of file app-layer-parser.c.
References AppLayerDecoderEventsFreeEvents(), AppLayerParserState_::decoder_events, and SCEnter.
void AppLayerParserStateProtoCleanup | ( | uint8_t | protomap, |
AppProto | alproto, | ||
void * | alstate, | ||
AppLayerParserState * | pstate | ||
) |
Definition at line 1647 of file app-layer-parser.c.
Referenced by AppLayerParserStateCleanup().
bool AppLayerParserSupportsFiles | ( | uint8_t | ipproto, |
AppProto | alproto | ||
) |
Definition at line 1173 of file app-layer-parser.c.
References ALPROTO_HTTP, ALPROTO_HTTP1, ALPROTO_HTTP2, and AppLayerParserSupportsFiles().
Referenced by AppLayerParserSupportsFiles().
AppLayerParserThreadCtx* AppLayerParserThreadCtxAlloc | ( | void | ) |
Gets a new app layer protocol's parser thread context.
Non-NULL | pointer on success. NULL pointer on failure. |
Definition at line 297 of file app-layer-parser.c.
References AppLayerParserThreadCtx_::alproto_local_storage, AppLayerParserGetProtocolParserLocalStorage(), FLOW_PROTO_DEFAULT, FLOW_PROTO_MAX, FlowGetReverseProtoMapping(), g_alproto_max, SCCalloc, SCEnter, SCFree, SCReturnPtr, and unlikely.
Referenced by AppLayerGetCtxThread(), and LLVMFuzzerTestOneInput().
void AppLayerParserThreadCtxFree | ( | AppLayerParserThreadCtx * | tctx | ) |
Destroys the app layer parser thread context obtained using AppLayerParserThreadCtxAlloc().
tctx | Pointer to the thread context to be destroyed. |
Definition at line 324 of file app-layer-parser.c.
References AppLayerParserThreadCtx_::alproto_local_storage, AppLayerParserDestroyProtocolParserLocalStorage(), FLOW_PROTO_DEFAULT, FlowGetReverseProtoMapping(), g_alproto_max, SCEnter, SCFree, and SCReturn.
Referenced by AppLayerDestroyCtxThread().
void AppLayerParserTransactionsCleanup | ( | Flow * | f, |
const uint8_t | pkt_dir | ||
) |
remove obsolete (inspected and logged) transactions
Definition at line 903 of file app-layer-parser.c.
References DEBUG_ASSERT_FLOW_LOCKED, and SCEnter.
Referenced by LLVMFuzzerTestOneInput().
void AppLayerParserTriggerRawStreamInspection | ( | Flow * | f, |
int | direction | ||
) |
Definition at line 1557 of file app-layer-parser.c.
References Flow_::protoctx, SCEnter, SCLogDebug, SCReturn, and StreamTcpReassembleTriggerRawInspection().
void FileApplyTxFlags | ( | const AppLayerTxData * | txd, |
const uint8_t | direction, | ||
File * | file | ||
) |
Definition at line 278 of file util-file.c.
References DEBUG_VALIDATE_BUG_ON, FILE_NOSTORE, FILE_STORE, FileFlowFlagsToFlags(), File_::flags, and SCLogDebug.
Referenced by OutputFiledataLogFfc(), and OutputFileLogFfc().
int SCAppLayerParserConfParserEnabled | ( | const char * | ipproto, |
const char * | alproto_name | ||
) |
Given a protocol name, checks if the parser is enabled in the conf file.
alproto_name | Name of the app layer protocol. |
1 | If enabled. |
0 | If disabled. |
Given a protocol name, checks if the parser is enabled in the conf file.
Definition at line 345 of file app-layer-parser.c.
References FatalError, RunmodeIsUnittests(), SCConfGetNode(), SCConfValIsFalse(), SCConfValIsTrue(), SCEnter, SCLogDebug, SCLogError, SCReturnInt, and SCConfNode_::val.
Referenced by HTPFreeConfig().
void SCAppLayerParserRegisterLogger | ( | uint8_t | ipproto, |
AppProto | alproto | ||
) |
Definition at line 491 of file app-layer-parser.c.
References SCEnter.
void SCAppLayerParserRegisterParserAcceptableDataDirection | ( | uint8_t | ipproto, |
AppProto | alproto, | ||
uint8_t | direction | ||
) |
Definition at line 414 of file app-layer-parser.c.
References SCEnter.
void SCAppLayerParserSetStreamDepth | ( | uint8_t | ipproto, |
AppProto | alproto, | ||
uint32_t | stream_depth | ||
) |
Definition at line 1568 of file app-layer-parser.c.
References SCEnter.
uint16_t SCAppLayerParserStateIssetFlag | ( | AppLayerParserState * | pstate, |
uint16_t | flag | ||
) |
Definition at line 1829 of file app-layer-parser.c.
References AppLayerParserState_::flags, SCEnter, and SCReturnUInt.
Referenced by LLVMFuzzerTestOneInput().
void SCAppLayerParserStateSetFlag | ( | AppLayerParserState * | pstate, |
uint16_t | flag | ||
) |
Definition at line 1821 of file app-layer-parser.c.
References AppLayerParserState_::flags, SCEnter, and SCReturn.
Referenced by AppLayerParserSetEOF(), and StreamTcpDisableAppLayer().
void UTHAppLayerParserStateGetIds | ( | void * | ptr, |
uint64_t * | i1, | ||
uint64_t * | i2, | ||
uint64_t * | log, | ||
uint64_t * | min | ||
) |
Definition at line 214 of file app-layer-parser.c.
References AppLayerParserState_::inspect_id, AppLayerParserState_::log_id, and AppLayerParserState_::min_id.