suricata
app-layer-parser.h
Go to the documentation of this file.
1 /* Copyright (C) 2007-2020 Open Information Security Foundation
2  *
3  * You can copy, redistribute or modify this Program under the terms of
4  * the GNU General Public License version 2 as published by the Free
5  * Software Foundation.
6  *
7  * This program is distributed in the hope that it will be useful,
8  * but WITHOUT ANY WARRANTY; without even the implied warranty of
9  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
10  * GNU General Public License for more details.
11  *
12  * You should have received a copy of the GNU General Public License
13  * version 2 along with this program; if not, write to the Free Software
14  * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA
15  * 02110-1301, USA.
16  */
17 
18 /**
19  * \file
20  *
21  * \author Victor Julien <victor@inliniac.net>
22  * \author Anoop Saldanha <anoopsaldanha@gmail.com>
23  */
24 
25 #ifndef __APP_LAYER_PARSER_H__
26 #define __APP_LAYER_PARSER_H__
27 
28 #include "app-layer-events.h"
29 #include "detect-engine-state.h"
30 #include "util-file.h"
31 #include "stream-tcp-private.h"
32 #include "rust.h"
33 
34 /* Flags for AppLayerParserState. */
35 #define APP_LAYER_PARSER_EOF BIT_U8(0)
36 #define APP_LAYER_PARSER_NO_INSPECTION BIT_U8(1)
37 #define APP_LAYER_PARSER_NO_REASSEMBLY BIT_U8(2)
38 #define APP_LAYER_PARSER_NO_INSPECTION_PAYLOAD BIT_U8(3)
39 #define APP_LAYER_PARSER_BYPASS_READY BIT_U8(4)
40 
41 /* Flags for AppLayerParserProtoCtx. */
42 #define APP_LAYER_PARSER_OPT_ACCEPT_GAPS BIT_U32(0)
43 
44 #define APP_LAYER_PARSER_INT_STREAM_DEPTH_SET BIT_U32(0)
45 
46 /* applies to DetectFlags uint64_t field */
47 
48 /** is tx fully inspected? */
49 #define APP_LAYER_TX_INSPECTED_FLAG BIT_U64(63)
50 /** other 63 bits are for tracking which prefilter engine is already
51  * completely inspected */
52 #define APP_LAYER_TX_PREFILTER_MASK ~APP_LAYER_TX_INSPECTED_FLAG
53 
54 /** parser has successfully processed in the input, and has consumed
55  * all of it. */
56 #define APP_LAYER_OK (AppLayerResult) { 0, 0, 0 }
57 
58 /** parser has hit an unrecoverable error. Returning this to the API
59  * leads to no further calls to the parser. */
60 #define APP_LAYER_ERROR (AppLayerResult) { -1, 0, 0 }
61 
62 /** parser needs more data. Through 'c' it will indicate how many
63  * of the input bytes it has consumed. Through 'n' it will indicate
64  * how many more bytes it needs before getting called again.
65  * \note consumed (c) should never be more than the input len
66  * needed (n) + consumed (c) should be more than the input len
67  */
68 #define APP_LAYER_INCOMPLETE(c,n) (AppLayerResult) { 1, (c), (n) }
69 
70 int AppLayerParserProtoIsRegistered(uint8_t ipproto, AppProto alproto);
71 
72 /***** transaction handling *****/
73 
74 int AppLayerParserSetup(void);
77 
79 
80 /**
81  * \brief Gets a new app layer protocol's parser thread context.
82  *
83  * \retval Non-NULL pointer on success.
84  * NULL pointer on failure.
85  */
87 
88 /**
89  * \brief Destroys the app layer parser thread context obtained
90  * using AppLayerParserThreadCtxAlloc().
91  *
92  * \param tctx Pointer to the thread context to be destroyed.
93  */
95 
96 /**
97  * \brief Given a protocol name, checks if the parser is enabled in
98  * the conf file.
99  *
100  * \param alproto_name Name of the app layer protocol.
101  *
102  * \retval 1 If enabled.
103  * \retval 0 If disabled.
104  */
105 int AppLayerParserConfParserEnabled(const char *ipproto,
106  const char *alproto_name);
107 
108 /** \brief Prototype for parsing functions */
109 typedef AppLayerResult (*AppLayerParserFPtr)(Flow *f, void *protocol_state,
110  AppLayerParserState *pstate,
111  const uint8_t *buf, uint32_t buf_len,
112  void *local_storage, const uint8_t flags);
113 
114 typedef struct AppLayerGetTxIterState {
115  union {
116  void *ptr;
117  uint64_t u64;
118  } un;
120 
121 /** \brief tx iterator prototype */
122 typedef AppLayerGetTxIterTuple (*AppLayerGetTxIteratorFunc)
123  (const uint8_t ipproto, const AppProto alproto,
124  void *alstate, uint64_t min_tx_id, uint64_t max_tx_id,
125  AppLayerGetTxIterState *state);
126 
127 /***** Parser related registration *****/
128 
129 /**
130  * \brief Register app layer parser for the protocol.
131  *
132  * \retval 0 On success.
133  * \retval -1 On failure.
134  */
135 int AppLayerParserRegisterParser(uint8_t ipproto, AppProto alproto,
136  uint8_t direction,
137  AppLayerParserFPtr Parser);
139  AppProto alproto,
140  uint8_t direction);
141 void AppLayerParserRegisterOptionFlags(uint8_t ipproto, AppProto alproto,
142  uint32_t flags);
143 void AppLayerParserRegisterStateFuncs(uint8_t ipproto, AppProto alproto,
144  void *(*StateAlloc)(void),
145  void (*StateFree)(void *));
147  void *(*LocalStorageAlloc)(void),
148  void (*LocalStorageFree)(void *));
149 void AppLayerParserRegisterGetFilesFunc(uint8_t ipproto, AppProto alproto,
150  FileContainer *(*StateGetFiles)(void *, uint8_t));
152  AppLayerDecoderEvents *(*StateGetEvents)(void *) __attribute__((nonnull)));
153 void AppLayerParserRegisterLoggerFuncs(uint8_t ipproto, AppProto alproto,
154  LoggerId (*StateGetTxLogged)(void *, void *),
155  void (*StateSetTxLogged)(void *, void *, LoggerId));
156 void AppLayerParserRegisterLogger(uint8_t ipproto, AppProto alproto);
157 void AppLayerParserRegisterLoggerBits(uint8_t ipproto, AppProto alproto, LoggerId bits);
158 void AppLayerParserRegisterTruncateFunc(uint8_t ipproto, AppProto alproto,
159  void (*Truncate)(void *, uint8_t));
160 void AppLayerParserRegisterGetStateProgressFunc(uint8_t ipproto, AppProto alproto,
161  int (*StateGetStateProgress)(void *alstate, uint8_t direction));
162 void AppLayerParserRegisterTxFreeFunc(uint8_t ipproto, AppProto alproto,
163  void (*StateTransactionFree)(void *, uint64_t));
164 void AppLayerParserRegisterGetTxCnt(uint8_t ipproto, AppProto alproto,
165  uint64_t (*StateGetTxCnt)(void *alstate));
166 void AppLayerParserRegisterGetTx(uint8_t ipproto, AppProto alproto,
167  void *(StateGetTx)(void *alstate, uint64_t tx_id));
168 void AppLayerParserRegisterGetTxIterator(uint8_t ipproto, AppProto alproto,
171  int (*StateGetStateProgressCompletionStatus)(uint8_t direction));
172 void AppLayerParserRegisterGetEventInfo(uint8_t ipproto, AppProto alproto,
173  int (*StateGetEventInfo)(const char *event_name, int *event_id,
174  AppLayerEventType *event_type));
175 void AppLayerParserRegisterGetEventInfoById(uint8_t ipproto, AppProto alproto,
176  int (*StateGetEventInfoById)(int event_id, const char **event_name,
177  AppLayerEventType *event_type));
178 void AppLayerParserRegisterDetectStateFuncs(uint8_t ipproto, AppProto alproto,
179  DetectEngineState *(*GetTxDetectState)(void *tx),
180  int (*SetTxDetectState)(void *tx, DetectEngineState *));
182  AppProto alproto,
183  uint32_t (*GetStreamDepth)(void));
184 void AppLayerParserRegisterDetectFlagsFuncs(uint8_t ipproto, AppProto alproto,
185  uint64_t(*GetTxDetectFlags)(void *tx, uint8_t dir),
186  void (*SetTxDetectFlags)(void *tx, uint8_t dir, uint64_t));
187 void AppLayerParserRegisterSetStreamDepthFlag(uint8_t ipproto, AppProto alproto,
188  void (*SetStreamDepthFlag)(void *tx, uint8_t flags));
189 
190 /***** Get and transaction functions *****/
191 
193  const AppProto alproto);
194 
195 void *AppLayerParserGetProtocolParserLocalStorage(uint8_t ipproto, AppProto alproto);
196 void AppLayerParserDestroyProtocolParserLocalStorage(uint8_t ipproto, AppProto alproto,
197  void *local_data);
198 
199 
201 void AppLayerParserSetTransactionLogId(AppLayerParserState *pstate, uint64_t tx_id);
202 
203 void AppLayerParserSetTxLogged(uint8_t ipproto, AppProto alproto, void *alstate,
204  void *tx, LoggerId logged);
205 LoggerId AppLayerParserGetTxLogged(const Flow *f, void *alstate, void *tx);
206 
207 uint64_t AppLayerParserGetTransactionInspectId(AppLayerParserState *pstate, uint8_t direction);
209  void *alstate, const uint8_t flags, bool tag_txs_as_inspected);
210 
213 AppLayerDecoderEvents *AppLayerParserGetEventsByTx(uint8_t ipproto, AppProto alproto, void *tx);
214 FileContainer *AppLayerParserGetFiles(const Flow *f, const uint8_t direction);
215 int AppLayerParserGetStateProgress(uint8_t ipproto, AppProto alproto,
216  void *alstate, uint8_t direction);
217 uint64_t AppLayerParserGetTxCnt(const Flow *, void *alstate);
218 void *AppLayerParserGetTx(uint8_t ipproto, AppProto alproto, void *alstate, uint64_t tx_id);
219 int AppLayerParserGetStateProgressCompletionStatus(AppProto alproto, uint8_t direction);
220 int AppLayerParserGetEventInfo(uint8_t ipproto, AppProto alproto, const char *event_name,
221  int *event_id, AppLayerEventType *event_type);
222 int AppLayerParserGetEventInfoById(uint8_t ipproto, AppProto alproto, int event_id,
223  const char **event_name, AppLayerEventType *event_type);
224 
225 uint64_t AppLayerParserGetTransactionActive(const Flow *f, AppLayerParserState *pstate, uint8_t direction);
226 
227 uint8_t AppLayerParserGetFirstDataDir(uint8_t ipproto, AppProto alproto);
228 
229 int AppLayerParserSupportsFiles(uint8_t ipproto, AppProto alproto);
230 int AppLayerParserSupportsTxDetectState(uint8_t ipproto, AppProto alproto);
231 int AppLayerParserHasTxDetectState(uint8_t ipproto, AppProto alproto, void *alstate);
232 DetectEngineState *AppLayerParserGetTxDetectState(uint8_t ipproto, AppProto alproto, void *tx);
233 int AppLayerParserSetTxDetectState(const Flow *f, void *tx, DetectEngineState *s);
234 
235 uint64_t AppLayerParserGetTxDetectFlags(uint8_t ipproto, AppProto alproto, void *tx, uint8_t dir);
236 void AppLayerParserSetTxDetectFlags(uint8_t ipproto, AppProto alproto, void *tx, uint8_t dir, uint64_t);
238 
239 /***** General *****/
240 
242  uint8_t flags, const uint8_t *input, uint32_t input_len);
245 int AppLayerParserProtocolIsTxEventAware(uint8_t ipproto, AppProto alproto);
246 int AppLayerParserProtocolHasLogger(uint8_t ipproto, AppProto alproto);
247 LoggerId AppLayerParserProtocolGetLoggerBits(uint8_t ipproto, AppProto alproto);
248 void AppLayerParserTriggerRawStreamReassembly(Flow *f, int direction);
249 void AppLayerParserSetStreamDepth(uint8_t ipproto, AppProto alproto, uint32_t stream_depth);
250 uint32_t AppLayerParserGetStreamDepth(const Flow *f);
251 void AppLayerParserSetStreamDepthFlag(uint8_t ipproto, AppProto alproto, void *state, uint64_t tx_id, uint8_t flags);
252 int AppLayerParserIsEnabled(AppProto alproto);
253 
254 /***** Cleanup *****/
255 
256 void AppLayerParserStateCleanup(const Flow *f, void *alstate, AppLayerParserState *pstate);
257 
259 
260 
261 void AppLayerParserStateSetFlag(AppLayerParserState *pstate, uint8_t flag);
262 int AppLayerParserStateIssetFlag(AppLayerParserState *pstate, uint8_t flag);
263 
264 void AppLayerParserStreamTruncated(uint8_t ipproto, AppProto alproto, void *alstate,
265  uint8_t direction);
266 
267 
268 
271 
273 
274 #ifdef DEBUG
275 void AppLayerParserStatePrintDetails(AppLayerParserState *pstate);
276 #endif
277 
278 
279 /***** Unittests *****/
280 
281 #ifdef UNITTESTS
282 void AppLayerParserRegisterProtocolUnittests(uint8_t ipproto, AppProto alproto,
283  void (*RegisterUnittests)(void));
287 void UTHAppLayerParserStateGetIds(void *ptr, uint64_t *i1, uint64_t *i2, uint64_t *log, uint64_t *min);
288 #endif
289 
290 #endif /* __APP_LAYER_PARSER_H__ */
AppLayerParserGetStateProgress
int AppLayerParserGetStateProgress(uint8_t ipproto, AppProto alproto, void *alstate, uint8_t direction)
get the progress value for a tx/protocol
Definition: app-layer-parser.c:1013
AppLayerParserThreadCtxFree
void AppLayerParserThreadCtxFree(AppLayerParserThreadCtx *tctx)
Destroys the app layer parser thread context obtained using AppLayerParserThreadCtxAlloc().
Definition: app-layer-parser.c:279
AppLayerParserGetFiles
FileContainer * AppLayerParserGetFiles(const Flow *f, const uint8_t direction)
Definition: app-layer-parser.c:864
AppLayerParserGetTx
void * AppLayerParserGetTx(uint8_t ipproto, AppProto alproto, void *alstate, uint64_t tx_id)
Definition: app-layer-parser.c:1037
AppLayerParserStreamTruncated
void AppLayerParserStreamTruncated(uint8_t ipproto, AppProto alproto, void *alstate, uint8_t direction)
Definition: app-layer-parser.c:1616
AppLayerParserPostStreamSetup
void AppLayerParserPostStreamSetup(void)
Definition: app-layer-parser.c:226
AppLayerParserGetDecoderEvents
AppLayerDecoderEvents * AppLayerParserGetDecoderEvents(AppLayerParserState *pstate)
Definition: app-layer-parser.c:834
FileContainer_
Definition: util-file.h:100
AppLayerParserRegisterGetTx
void AppLayerParserRegisterGetTx(uint8_t ipproto, AppProto alproto, void *(StateGetTx)(void *alstate, uint64_t tx_id))
Definition: app-layer-parser.c:523
AppLayerParserRegisterLogger
void AppLayerParserRegisterLogger(uint8_t ipproto, AppProto alproto)
Definition: app-layer-parser.c:471
AppLayerParserRegisterLoggerBits
void AppLayerParserRegisterLoggerBits(uint8_t ipproto, AppProto alproto, LoggerId bits)
Definition: app-layer-parser.c:462
AppLayerParserGetTxDetectState
DetectEngineState * AppLayerParserGetTxDetectState(uint8_t ipproto, AppProto alproto, void *tx)
Definition: app-layer-parser.c:1117
AppLayerGetTxIterState::ptr
void * ptr
Definition: app-layer-parser.h:116
AppLayerParserStateAlloc
AppLayerParserState * AppLayerParserStateAlloc(void)
Definition: app-layer-parser.c:195
AppLayerParserSetTxDetectState
int AppLayerParserSetTxDetectState(const Flow *f, void *tx, DetectEngineState *s)
Definition: app-layer-parser.c:1125
AppLayerParserSupportsTxDetectState
int AppLayerParserSupportsTxDetectState(uint8_t ipproto, AppProto alproto)
Definition: app-layer-parser.c:1110
AppLayerParserTransactionsCleanup
void AppLayerParserTransactionsCleanup(Flow *f)
remove obsolete (inspected and logged) transactions
Definition: app-layer-parser.c:882
AppLayerParserSetEOF
void AppLayerParserSetEOF(AppLayerParserState *pstate)
Definition: app-layer-parser.c:1335
AppLayerParserRegisterGetTxCnt
void AppLayerParserRegisterGetTxCnt(uint8_t ipproto, AppProto alproto, uint64_t(*StateGetTxCnt)(void *alstate))
Definition: app-layer-parser.c:512
DetectEngineState_
Definition: detect-engine-state.h:92
AppLayerParserGetEventInfoById
int AppLayerParserGetEventInfoById(uint8_t ipproto, AppProto alproto, int event_id, const char **event_name, AppLayerEventType *event_type)
Definition: app-layer-parser.c:1065
AppLayerParserGetStreamDepth
uint32_t AppLayerParserGetStreamDepth(const Flow *f)
Definition: app-layer-parser.c:1420
AppLayerParserHasTxDetectState
int AppLayerParserHasTxDetectState(uint8_t ipproto, AppProto alproto, void *alstate)
AppProto
uint16_t AppProto
Definition: app-layer-protos.h:71
AppLayerParserFPtr
AppLayerResult(* AppLayerParserFPtr)(Flow *f, void *protocol_state, AppLayerParserState *pstate, const uint8_t *buf, uint32_t buf_len, void *local_storage, const uint8_t flags)
Prototype for parsing functions.
Definition: app-layer-parser.h:109
AppLayerParserSetDecoderEvents
void AppLayerParserSetDecoderEvents(AppLayerParserState *pstate, AppLayerDecoderEvents *devents)
Definition: app-layer-parser.c:842
AppLayerParserRegisterSetStreamDepthFlag
void AppLayerParserRegisterSetStreamDepthFlag(uint8_t ipproto, AppProto alproto, void(*SetStreamDepthFlag)(void *tx, uint8_t flags))
Definition: app-layer-parser.c:601
Flow_
Flow data structure.
Definition: flow.h:343
AppLayerEventType
enum AppLayerEventType_ AppLayerEventType
LoggerId
LoggerId
Definition: suricata-common.h:439
logged
int logged
Definition: app-layer-htp.h:1
AppLayerParserRegisterGetEventInfoById
void AppLayerParserRegisterGetEventInfoById(uint8_t ipproto, AppProto alproto, int(*StateGetEventInfoById)(int event_id, const char **event_name, AppLayerEventType *event_type))
Definition: app-layer-parser.c:553
UTHAppLayerParserStateGetIds
void UTHAppLayerParserStateGetIds(void *ptr, uint64_t *i1, uint64_t *i2, uint64_t *log, uint64_t *min)
Definition: app-layer-parser.c:174
AppLayerParserRegisterGetFilesFunc
void AppLayerParserRegisterGetFilesFunc(uint8_t ipproto, AppProto alproto, FileContainer *(*StateGetFiles)(void *, uint8_t))
Definition: app-layer-parser.c:425
rust.h
AppLayerParserSetTxDetectFlags
void AppLayerParserSetTxDetectFlags(uint8_t ipproto, AppProto alproto, void *tx, uint8_t dir, uint64_t)
Definition: app-layer-parser.c:1157
proto
uint8_t proto
Definition: decode-template.h:0
AppLayerParserRegisterGetStreamDepth
void AppLayerParserRegisterGetStreamDepth(uint8_t ipproto, AppProto alproto, uint32_t(*GetStreamDepth)(void))
AppLayerParserProtocolGetLoggerBits
LoggerId AppLayerParserProtocolGetLoggerBits(uint8_t ipproto, AppProto alproto)
Definition: app-layer-parser.c:1390
AppLayerParserStateSetFlag
void AppLayerParserStateSetFlag(AppLayerParserState *pstate, uint8_t flag)
Definition: app-layer-parser.c:1601
AppLayerParserGetTxLogged
LoggerId AppLayerParserGetTxLogged(const Flow *f, void *alstate, void *tx)
Definition: app-layer-parser.c:700
AppLayerGetTxIterState::u64
uint64_t u64
Definition: app-layer-parser.h:117
AppLayerParserSetup
int AppLayerParserSetup(void)
Definition: app-layer-parser.c:219
AppLayerParserRegisterProtocolUnittests
void AppLayerParserRegisterProtocolUnittests(uint8_t ipproto, AppProto alproto, void(*RegisterUnittests)(void))
Definition: app-layer-parser.c:1707
AppLayerDecoderEvents_
Data structure to store app layer decoder events.
Definition: app-layer-events.h:34
AppLayerParserRegisterStateFuncs
void AppLayerParserRegisterStateFuncs(uint8_t ipproto, AppProto alproto, void *(*StateAlloc)(void), void(*StateFree)(void *))
Definition: app-layer-parser.c:397
AppLayerParserSetStreamDepth
void AppLayerParserSetStreamDepth(uint8_t ipproto, AppProto alproto, uint32_t stream_depth)
Definition: app-layer-parser.c:1409
AppLayerParserGetProtocolParserLocalStorage
void * AppLayerParserGetProtocolParserLocalStorage(uint8_t ipproto, AppProto alproto)
Definition: app-layer-parser.c:613
__attribute__
enum @31 __attribute__
DNP3 application header.
Definition: detect-engine-analyzer.c:583
AppLayerParserRegisterLoggerFuncs
void AppLayerParserRegisterLoggerFuncs(uint8_t ipproto, AppProto alproto, LoggerId(*StateGetTxLogged)(void *, void *), void(*StateSetTxLogged)(void *, void *, LoggerId))
Definition: app-layer-parser.c:447
AppLayerParserConfParserEnabled
int AppLayerParserConfParserEnabled(const char *ipproto, const char *alproto_name)
Given a protocol name, checks if the parser is enabled in the conf file.
Definition: app-layer-parser.c:302
AppLayerParserTriggerRawStreamReassembly
void AppLayerParserTriggerRawStreamReassembly(Flow *f, int direction)
Definition: app-layer-parser.c:1398
AppLayerParserGetEventInfo
int AppLayerParserGetEventInfo(uint8_t ipproto, AppProto alproto, const char *event_name, int *event_id, AppLayerEventType *event_type)
Definition: app-layer-parser.c:1055
AppLayerParserState_
Definition: app-layer-parser.c:155
AppLayerParserRegisterGetEventsFunc
void AppLayerParserRegisterGetEventsFunc(uint8_t ipproto, AppProto proto, AppLayerDecoderEvents *(*StateGetEvents)(void *) __attribute__((nonnull)))
AppLayerParserGetTransactionLogId
uint64_t AppLayerParserGetTransactionLogId(AppLayerParserState *pstate)
Definition: app-layer-parser.c:714
AppLayerParserRegisterLocalStorageFunc
void AppLayerParserRegisterLocalStorageFunc(uint8_t ipproto, AppProto proto, void *(*LocalStorageAlloc)(void), void(*LocalStorageFree)(void *))
Definition: app-layer-parser.c:411
AppLayerParserProtoIsRegistered
int AppLayerParserProtoIsRegistered(uint8_t ipproto, AppProto alproto)
Definition: app-layer-parser.c:188
AppLayerParserSupportsFiles
int AppLayerParserSupportsFiles(uint8_t ipproto, AppProto alproto)
Definition: app-layer-parser.c:1103
ThreadVars_
Per thread variable structure.
Definition: threadvars.h:58
AppLayerParserSetTxLogged
void AppLayerParserSetTxLogged(uint8_t ipproto, AppProto alproto, void *alstate, void *tx, LoggerId logged)
Definition: app-layer-parser.c:686
AppLayerParserRegisterDetectStateFuncs
void AppLayerParserRegisterDetectStateFuncs(uint8_t ipproto, AppProto alproto, DetectEngineState *(*GetTxDetectState)(void *tx), int(*SetTxDetectState)(void *tx, DetectEngineState *))
Definition: app-layer-parser.c:577
AppLayerParserRegisterOptionFlags
void AppLayerParserRegisterOptionFlags(uint8_t ipproto, AppProto alproto, uint32_t flags)
Definition: app-layer-parser.c:387
AppLayerParserDestroyProtocolParserLocalStorage
void AppLayerParserDestroyProtocolParserLocalStorage(uint8_t ipproto, AppProto alproto, void *local_data)
Definition: app-layer-parser.c:628
AppLayerGetTxIterState
Definition: app-layer-parser.h:114
AppLayerParserGetTransactionInspectId
uint64_t AppLayerParserGetTransactionInspectId(AppLayerParserState *pstate, uint8_t direction)
Definition: app-layer-parser.c:731
AppLayerParserHasDecoderEvents
bool AppLayerParserHasDecoderEvents(AppLayerParserState *pstate)
Definition: app-layer-parser.c:1350
AppLayerParserSetTransactionInspectId
void AppLayerParserSetTransactionInspectId(const Flow *f, AppLayerParserState *pstate, void *alstate, const uint8_t flags, bool tag_txs_as_inspected)
Definition: app-layer-parser.c:741
stream-tcp-private.h
AppLayerParserRegisterGetTxIterator
void AppLayerParserRegisterGetTxIterator(uint8_t ipproto, AppProto alproto, AppLayerGetTxIteratorFunc Func)
Definition: app-layer-parser.c:534
AppLayerParserProtocolIsTxEventAware
int AppLayerParserProtocolIsTxEventAware(uint8_t ipproto, AppProto alproto)
Definition: app-layer-parser.c:1374
AppLayerGetTxIterator
AppLayerGetTxIteratorFunc AppLayerGetTxIterator(const uint8_t ipproto, const AppProto alproto)
Definition: app-layer-parser.c:678
AppLayerParserRegisterDetectFlagsFuncs
void AppLayerParserRegisterDetectFlagsFuncs(uint8_t ipproto, AppProto alproto, uint64_t(*GetTxDetectFlags)(void *tx, uint8_t dir), void(*SetTxDetectFlags)(void *tx, uint8_t dir, uint64_t))
Definition: app-layer-parser.c:589
detect-engine-state.h
Data structures and function prototypes for keeping state for the detection engine.
AppLayerParserRestoreParserTable
void AppLayerParserRestoreParserTable(void)
Definition: app-layer-parser.c:1724
AppLayerGetTxIterState
struct AppLayerGetTxIterState AppLayerGetTxIterState
AppLayerParserStateIssetFlag
int AppLayerParserStateIssetFlag(AppLayerParserState *pstate, uint8_t flag)
Definition: app-layer-parser.c:1609
AppLayerParserRegisterTxFreeFunc
void AppLayerParserRegisterTxFreeFunc(uint8_t ipproto, AppProto alproto, void(*StateTransactionFree)(void *, uint64_t))
Definition: app-layer-parser.c:501
AppLayerParserDeSetup
int AppLayerParserDeSetup(void)
Definition: app-layer-parser.c:243
util-file.h
AppLayerParserIsEnabled
int AppLayerParserIsEnabled(AppProto alproto)
simple way to globally test if a alproto is registered and fully enabled in the configuration.
Definition: app-layer-parser.c:1368
flags
uint8_t flags
Definition: decode-gre.h:0
AppLayerParserSetTransactionLogId
void AppLayerParserSetTransactionLogId(AppLayerParserState *pstate, uint64_t tx_id)
Definition: app-layer-parser.c:721
AppLayerParserRegisterUnittests
void AppLayerParserRegisterUnittests(void)
Definition: app-layer-parser.c:1844
AppLayerParserSupportsTxDetectFlags
bool AppLayerParserSupportsTxDetectFlags(AppProto alproto)
Definition: app-layer-parser.c:1136
AppLayerParserStateCleanup
void AppLayerParserStateCleanup(const Flow *f, void *alstate, AppLayerParserState *pstate)
Definition: app-layer-parser.c:1441
AppLayerParserBackupParserTable
void AppLayerParserBackupParserTable(void)
Definition: app-layer-parser.c:1716
AppLayerParserGetTxDetectFlags
uint64_t AppLayerParserGetTxDetectFlags(uint8_t ipproto, AppProto alproto, void *tx, uint8_t dir)
Definition: app-layer-parser.c:1147
AppLayerParserRegisterGetStateProgressFunc
void AppLayerParserRegisterGetStateProgressFunc(uint8_t ipproto, AppProto alproto, int(*StateGetStateProgress)(void *alstate, uint8_t direction))
Definition: app-layer-parser.c:490
tv
ThreadVars * tv
Definition: fuzz_decodepcapfile.c:29
app-layer-events.h
AppLayerParserRegisterGetStateProgressCompletionStatus
void AppLayerParserRegisterGetStateProgressCompletionStatus(AppProto alproto, int(*StateGetStateProgressCompletionStatus)(uint8_t direction))
Definition: app-layer-parser.c:542
AppLayerParserRegisterTruncateFunc
void AppLayerParserRegisterTruncateFunc(uint8_t ipproto, AppProto alproto, void(*Truncate)(void *, uint8_t))
Definition: app-layer-parser.c:480
AppLayerParserRegisterProtocolParsers
void AppLayerParserRegisterProtocolParsers(void)
Definition: app-layer-parser.c:1549
AppLayerParserGetFirstDataDir
uint8_t AppLayerParserGetFirstDataDir(uint8_t ipproto, AppProto alproto)
Definition: app-layer-parser.c:1076
AppLayerParserRegisterGetEventInfo
void AppLayerParserRegisterGetEventInfo(uint8_t ipproto, AppProto alproto, int(*StateGetEventInfo)(const char *event_name, int *event_id, AppLayerEventType *event_type))
Definition: app-layer-parser.c:565
AppLayerParserGetTxCnt
uint64_t AppLayerParserGetTxCnt(const Flow *, void *alstate)
Definition: app-layer-parser.c:1028
AppLayerParserRegisterParser
int AppLayerParserRegisterParser(uint8_t ipproto, AppProto alproto, uint8_t direction, AppLayerParserFPtr Parser)
Register app layer parser for the protocol.
Definition: app-layer-parser.c:364
AppLayerParserProtocolHasLogger
int AppLayerParserProtocolHasLogger(uint8_t ipproto, AppProto alproto)
Definition: app-layer-parser.c:1382
AppLayerParserThreadCtxAlloc
AppLayerParserThreadCtx * AppLayerParserThreadCtxAlloc(void)
Gets a new app layer protocol's parser thread context.
Definition: app-layer-parser.c:253
AppLayerParserSetStreamDepthFlag
void AppLayerParserSetStreamDepthFlag(uint8_t ipproto, AppProto alproto, void *state, uint64_t tx_id, uint8_t flags)
Definition: app-layer-parser.c:1425
AppLayerGetTxIteratorFunc
AppLayerGetTxIterTuple(* AppLayerGetTxIteratorFunc)(const uint8_t ipproto, const AppProto alproto, void *alstate, uint64_t min_tx_id, uint64_t max_tx_id, AppLayerGetTxIterState *state)
tx iterator prototype
Definition: app-layer-parser.h:123
AppLayerParserThreadCtx_
Definition: app-layer-parser.c:85
AppLayerParserStateFree
void AppLayerParserStateFree(AppLayerParserState *pstate)
Definition: app-layer-parser.c:208
AppLayerParserGetEventsByTx
AppLayerDecoderEvents * AppLayerParserGetEventsByTx(uint8_t ipproto, AppProto alproto, void *tx)
Definition: app-layer-parser.c:847
AppLayerParserParse
int AppLayerParserParse(ThreadVars *tv, AppLayerParserThreadCtx *tctx, Flow *f, AppProto alproto, uint8_t flags, const uint8_t *input, uint32_t input_len)
Definition: app-layer-parser.c:1171
AppLayerGetTxIterState::un
union AppLayerGetTxIterState::@23 un
AppLayerParserRegisterParserAcceptableDataDirection
void AppLayerParserRegisterParserAcceptableDataDirection(uint8_t ipproto, AppProto alproto, uint8_t direction)
Definition: app-layer-parser.c:376
AppLayerParserGetStateProgressCompletionStatus
int AppLayerParserGetStateProgressCompletionStatus(AppProto alproto, uint8_t direction)
Definition: app-layer-parser.c:1046
AppLayerParserGetTransactionActive
uint64_t AppLayerParserGetTransactionActive(const Flow *f, AppLayerParserState *pstate, uint8_t direction)
Definition: app-layer-parser.c:1085