suricata
app-layer-parser.h
Go to the documentation of this file.
1 /* Copyright (C) 2007-2020 Open Information Security Foundation
2  *
3  * You can copy, redistribute or modify this Program under the terms of
4  * the GNU General Public License version 2 as published by the Free
5  * Software Foundation.
6  *
7  * This program is distributed in the hope that it will be useful,
8  * but WITHOUT ANY WARRANTY; without even the implied warranty of
9  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
10  * GNU General Public License for more details.
11  *
12  * You should have received a copy of the GNU General Public License
13  * version 2 along with this program; if not, write to the Free Software
14  * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA
15  * 02110-1301, USA.
16  */
17 
18 /**
19  * \file
20  *
21  * \author Victor Julien <victor@inliniac.net>
22  * \author Anoop Saldanha <anoopsaldanha@gmail.com>
23  */
24 
25 #ifndef __APP_LAYER_PARSER_H__
26 #define __APP_LAYER_PARSER_H__
27 
28 #include "app-layer-events.h"
29 #include "detect-engine-state.h"
30 #include "util-file.h"
31 #include "stream-tcp-private.h"
32 #include "rust.h"
33 #include "util-config.h"
34 
35 /* Flags for AppLayerParserState. */
36 // flag available BIT_U8(0)
37 #define APP_LAYER_PARSER_NO_INSPECTION BIT_U8(1)
38 #define APP_LAYER_PARSER_NO_REASSEMBLY BIT_U8(2)
39 #define APP_LAYER_PARSER_NO_INSPECTION_PAYLOAD BIT_U8(3)
40 #define APP_LAYER_PARSER_BYPASS_READY BIT_U8(4)
41 #define APP_LAYER_PARSER_EOF_TS BIT_U8(5)
42 #define APP_LAYER_PARSER_EOF_TC BIT_U8(6)
43 
44 /* Flags for AppLayerParserProtoCtx. */
45 #define APP_LAYER_PARSER_OPT_ACCEPT_GAPS BIT_U32(0)
46 #define APP_LAYER_PARSER_OPT_UNIDIR_TXS BIT_U32(1)
47 
48 #define APP_LAYER_PARSER_INT_STREAM_DEPTH_SET BIT_U32(0)
49 
50 /* applies to DetectFlags uint64_t field */
51 
52 /** reserved for future use */
53 #define APP_LAYER_TX_RESERVED1_FLAG BIT_U64(48)
54 #define APP_LAYER_TX_RESERVED2_FLAG BIT_U64(49)
55 #define APP_LAYER_TX_RESERVED3_FLAG BIT_U64(50)
56 #define APP_LAYER_TX_RESERVED4_FLAG BIT_U64(51)
57 #define APP_LAYER_TX_RESERVED5_FLAG BIT_U64(52)
58 #define APP_LAYER_TX_RESERVED6_FLAG BIT_U64(53)
59 #define APP_LAYER_TX_RESERVED7_FLAG BIT_U64(54)
60 #define APP_LAYER_TX_RESERVED8_FLAG BIT_U64(55)
61 #define APP_LAYER_TX_RESERVED9_FLAG BIT_U64(56)
62 #define APP_LAYER_TX_RESERVED10_FLAG BIT_U64(57)
63 #define APP_LAYER_TX_RESERVED11_FLAG BIT_U64(58)
64 #define APP_LAYER_TX_RESERVED12_FLAG BIT_U64(59)
65 #define APP_LAYER_TX_RESERVED13_FLAG BIT_U64(60)
66 #define APP_LAYER_TX_RESERVED14_FLAG BIT_U64(61)
67 #define APP_LAYER_TX_RESERVED15_FLAG BIT_U64(62)
68 
69 #define APP_LAYER_TX_RESERVED_FLAGS \
70  (APP_LAYER_TX_RESERVED1_FLAG | APP_LAYER_TX_RESERVED2_FLAG | APP_LAYER_TX_RESERVED3_FLAG | \
71  APP_LAYER_TX_RESERVED4_FLAG | APP_LAYER_TX_RESERVED5_FLAG | \
72  APP_LAYER_TX_RESERVED6_FLAG | APP_LAYER_TX_RESERVED7_FLAG | \
73  APP_LAYER_TX_RESERVED8_FLAG | APP_LAYER_TX_RESERVED9_FLAG | \
74  APP_LAYER_TX_RESERVED10_FLAG | APP_LAYER_TX_RESERVED11_FLAG | \
75  APP_LAYER_TX_RESERVED12_FLAG | APP_LAYER_TX_RESERVED13_FLAG | \
76  APP_LAYER_TX_RESERVED14_FLAG | APP_LAYER_TX_RESERVED15_FLAG)
77 
78 /** is tx fully inspected? */
79 #define APP_LAYER_TX_INSPECTED_FLAG BIT_U64(63)
80 /** other 63 bits are for tracking which prefilter engine is already
81  * completely inspected */
82 #define APP_LAYER_TX_PREFILTER_MASK ~(APP_LAYER_TX_INSPECTED_FLAG | APP_LAYER_TX_RESERVED_FLAGS)
83 
84 /** parser has successfully processed in the input, and has consumed
85  * all of it. */
86 #define APP_LAYER_OK (AppLayerResult) { 0, 0, 0 }
87 
88 /** parser has hit an unrecoverable error. Returning this to the API
89  * leads to no further calls to the parser. */
90 #define APP_LAYER_ERROR (AppLayerResult) { -1, 0, 0 }
91 
92 /** parser needs more data. Through 'c' it will indicate how many
93  * of the input bytes it has consumed. Through 'n' it will indicate
94  * how many more bytes it needs before getting called again.
95  * \note consumed (c) should never be more than the input len
96  * needed (n) + consumed (c) should be more than the input len
97  */
98 #define APP_LAYER_INCOMPLETE(c,n) (AppLayerResult) { 1, (c), (n) }
99 
100 int AppLayerParserProtoIsRegistered(uint8_t ipproto, AppProto alproto);
101 
102 /***** transaction handling *****/
103 
104 int AppLayerParserSetup(void);
107 
109 
110 /**
111  * \brief Gets a new app layer protocol's parser thread context.
112  *
113  * \retval Non-NULL pointer on success.
114  * NULL pointer on failure.
115  */
117 
118 /**
119  * \brief Destroys the app layer parser thread context obtained
120  * using AppLayerParserThreadCtxAlloc().
121  *
122  * \param tctx Pointer to the thread context to be destroyed.
123  */
125 
126 /**
127  * \brief Given a protocol name, checks if the parser is enabled in
128  * the conf file.
129  *
130  * \param alproto_name Name of the app layer protocol.
131  *
132  * \retval 1 If enabled.
133  * \retval 0 If disabled.
134  */
135 int AppLayerParserConfParserEnabled(const char *ipproto,
136  const char *alproto_name);
137 
138 /** \brief Prototype for parsing functions */
139 typedef AppLayerResult (*AppLayerParserFPtr)(Flow *f, void *protocol_state,
140  AppLayerParserState *pstate,
141  const uint8_t *buf, uint32_t buf_len,
142  void *local_storage, const uint8_t flags);
143 
144 typedef struct AppLayerGetTxIterState {
145  union {
146  void *ptr;
147  uint64_t u64;
148  } un;
150 
151 /** \brief tx iterator prototype */
152 typedef AppLayerGetTxIterTuple (*AppLayerGetTxIteratorFunc)
153  (const uint8_t ipproto, const AppProto alproto,
154  void *alstate, uint64_t min_tx_id, uint64_t max_tx_id,
155  AppLayerGetTxIterState *state);
156 
157 /***** Parser related registration *****/
158 
159 /**
160  * \brief Register app layer parser for the protocol.
161  *
162  * \retval 0 On success.
163  * \retval -1 On failure.
164  */
165 int AppLayerParserRegisterParser(uint8_t ipproto, AppProto alproto,
166  uint8_t direction,
167  AppLayerParserFPtr Parser);
169  AppProto alproto,
170  uint8_t direction);
171 void AppLayerParserRegisterOptionFlags(uint8_t ipproto, AppProto alproto,
172  uint32_t flags);
173 void AppLayerParserRegisterStateFuncs(uint8_t ipproto, AppProto alproto,
174  void *(*StateAlloc)(void *, AppProto), void (*StateFree)(void *));
176  void *(*LocalStorageAlloc)(void),
177  void (*LocalStorageFree)(void *));
178 void AppLayerParserRegisterGetFilesFunc(uint8_t ipproto, AppProto alproto,
179  FileContainer *(*StateGetFiles)(void *, uint8_t));
181  AppLayerDecoderEvents *(*StateGetEvents)(void *) __attribute__((nonnull)));
182 void AppLayerParserRegisterLoggerFuncs(uint8_t ipproto, AppProto alproto,
183  LoggerId (*StateGetTxLogged)(void *, void *),
184  void (*StateSetTxLogged)(void *, void *, LoggerId));
185 void AppLayerParserRegisterLogger(uint8_t ipproto, AppProto alproto);
186 void AppLayerParserRegisterLoggerBits(uint8_t ipproto, AppProto alproto, LoggerId bits);
187 void AppLayerParserRegisterTruncateFunc(uint8_t ipproto, AppProto alproto,
188  void (*Truncate)(void *, uint8_t));
189 void AppLayerParserRegisterGetStateProgressFunc(uint8_t ipproto, AppProto alproto,
190  int (*StateGetStateProgress)(void *alstate, uint8_t direction));
191 void AppLayerParserRegisterTxFreeFunc(uint8_t ipproto, AppProto alproto,
192  void (*StateTransactionFree)(void *, uint64_t));
193 void AppLayerParserRegisterGetTxCnt(uint8_t ipproto, AppProto alproto,
194  uint64_t (*StateGetTxCnt)(void *alstate));
195 void AppLayerParserRegisterGetTx(uint8_t ipproto, AppProto alproto,
196  void *(StateGetTx)(void *alstate, uint64_t tx_id));
197 void AppLayerParserRegisterGetTxIterator(uint8_t ipproto, AppProto alproto,
200  AppProto alproto, const int ts, const int tc);
201 void AppLayerParserRegisterGetEventInfo(uint8_t ipproto, AppProto alproto,
202  int (*StateGetEventInfo)(const char *event_name, int *event_id,
203  AppLayerEventType *event_type));
204 void AppLayerParserRegisterGetEventInfoById(uint8_t ipproto, AppProto alproto,
205  int (*StateGetEventInfoById)(int event_id, const char **event_name,
206  AppLayerEventType *event_type));
207 void AppLayerParserRegisterDetectStateFuncs(uint8_t ipproto, AppProto alproto,
208  DetectEngineState *(*GetTxDetectState)(void *tx),
209  int (*SetTxDetectState)(void *tx, DetectEngineState *));
211  AppProto alproto,
212  uint32_t (*GetStreamDepth)(void));
213 void AppLayerParserRegisterSetStreamDepthFlag(uint8_t ipproto, AppProto alproto,
214  void (*SetStreamDepthFlag)(void *tx, uint8_t flags));
215 
216 void AppLayerParserRegisterTxDataFunc(uint8_t ipproto, AppProto alproto,
217  AppLayerTxData *(*GetTxData)(void *tx));
218 void AppLayerParserRegisterApplyTxConfigFunc(uint8_t ipproto, AppProto alproto,
219  bool (*ApplyTxConfig)(void *state, void *tx, int mode, AppLayerTxConfig));
220 
221 /***** Get and transaction functions *****/
222 
223 uint32_t AppLayerParserGetOptionFlags(uint8_t protomap, AppProto alproto);
225  const AppProto alproto);
226 
227 void *AppLayerParserGetProtocolParserLocalStorage(uint8_t ipproto, AppProto alproto);
228 void AppLayerParserDestroyProtocolParserLocalStorage(uint8_t ipproto, AppProto alproto,
229  void *local_data);
230 
231 
233 void AppLayerParserSetTransactionLogId(AppLayerParserState *pstate, uint64_t tx_id);
234 
235 uint64_t AppLayerParserGetTransactionInspectId(AppLayerParserState *pstate, uint8_t direction);
237  void *alstate, const uint8_t flags, bool tag_txs_as_inspected);
238 
241 AppLayerDecoderEvents *AppLayerParserGetEventsByTx(uint8_t ipproto, AppProto alproto, void *tx);
242 FileContainer *AppLayerParserGetFiles(const Flow *f, const uint8_t direction);
243 int AppLayerParserGetStateProgress(uint8_t ipproto, AppProto alproto,
244  void *alstate, uint8_t direction);
245 uint64_t AppLayerParserGetTxCnt(const Flow *, void *alstate);
246 void *AppLayerParserGetTx(uint8_t ipproto, AppProto alproto, void *alstate, uint64_t tx_id);
247 int AppLayerParserGetStateProgressCompletionStatus(AppProto alproto, uint8_t direction);
248 int AppLayerParserGetEventInfo(uint8_t ipproto, AppProto alproto, const char *event_name,
249  int *event_id, AppLayerEventType *event_type);
250 int AppLayerParserGetEventInfoById(uint8_t ipproto, AppProto alproto, int event_id,
251  const char **event_name, AppLayerEventType *event_type);
252 
253 uint64_t AppLayerParserGetTransactionActive(const Flow *f, AppLayerParserState *pstate, uint8_t direction);
254 
255 uint8_t AppLayerParserGetFirstDataDir(uint8_t ipproto, AppProto alproto);
256 
257 int AppLayerParserSupportsFiles(uint8_t ipproto, AppProto alproto);
258 int AppLayerParserHasTxDetectState(uint8_t ipproto, AppProto alproto, void *alstate);
259 DetectEngineState *AppLayerParserGetTxDetectState(uint8_t ipproto, AppProto alproto, void *tx);
260 int AppLayerParserSetTxDetectState(const Flow *f, void *tx, DetectEngineState *s);
261 
262 AppLayerTxData *AppLayerParserGetTxData(uint8_t ipproto, AppProto alproto, void *tx);
263 void AppLayerParserApplyTxConfig(uint8_t ipproto, AppProto alproto,
264  void *state, void *tx, enum ConfigAction mode, AppLayerTxConfig);
265 
266 /***** General *****/
267 
269  uint8_t flags, const uint8_t *input, uint32_t input_len);
272 int AppLayerParserProtocolIsTxEventAware(uint8_t ipproto, AppProto alproto);
273 int AppLayerParserProtocolHasLogger(uint8_t ipproto, AppProto alproto);
274 LoggerId AppLayerParserProtocolGetLoggerBits(uint8_t ipproto, AppProto alproto);
275 void AppLayerParserTriggerRawStreamReassembly(Flow *f, int direction);
276 void AppLayerParserSetStreamDepth(uint8_t ipproto, AppProto alproto, uint32_t stream_depth);
277 uint32_t AppLayerParserGetStreamDepth(const Flow *f);
278 void AppLayerParserSetStreamDepthFlag(uint8_t ipproto, AppProto alproto, void *state, uint64_t tx_id, uint8_t flags);
279 int AppLayerParserIsEnabled(AppProto alproto);
280 
281 /***** Cleanup *****/
282 
284  uint8_t protomap, AppProto alproto, void *alstate, AppLayerParserState *pstate);
285 void AppLayerParserStateCleanup(const Flow *f, void *alstate, AppLayerParserState *pstate);
286 
288 
289 
290 void AppLayerParserStateSetFlag(AppLayerParserState *pstate, uint8_t flag);
291 int AppLayerParserStateIssetFlag(AppLayerParserState *pstate, uint8_t flag);
292 
293 void AppLayerParserStreamTruncated(uint8_t ipproto, AppProto alproto, void *alstate,
294  uint8_t direction);
295 
296 
297 
300 
302 
303 #ifdef DEBUG
304 void AppLayerParserStatePrintDetails(AppLayerParserState *pstate);
305 #endif
306 
307 
308 /***** Unittests *****/
309 
310 #ifdef UNITTESTS
311 void AppLayerParserRegisterProtocolUnittests(uint8_t ipproto, AppProto alproto,
312  void (*RegisterUnittests)(void));
316 void UTHAppLayerParserStateGetIds(void *ptr, uint64_t *i1, uint64_t *i2, uint64_t *log, uint64_t *min);
317 #endif
318 
319 #endif /* __APP_LAYER_PARSER_H__ */
AppLayerParserGetStateProgress
int AppLayerParserGetStateProgress(uint8_t ipproto, AppProto alproto, void *alstate, uint8_t direction)
get the progress value for a tx/protocol
Definition: app-layer-parser.c:1069
AppLayerParserThreadCtxFree
void AppLayerParserThreadCtxFree(AppLayerParserThreadCtx *tctx)
Destroys the app layer parser thread context obtained using AppLayerParserThreadCtxAlloc().
Definition: app-layer-parser.c:277
AppLayerParserGetFiles
FileContainer * AppLayerParserGetFiles(const Flow *f, const uint8_t direction)
Definition: app-layer-parser.c:861
AppLayerParserGetTx
void * AppLayerParserGetTx(uint8_t ipproto, AppProto alproto, void *alstate, uint64_t tx_id)
Definition: app-layer-parser.c:1090
AppLayerParserStreamTruncated
void AppLayerParserStreamTruncated(uint8_t ipproto, AppProto alproto, void *alstate, uint8_t direction)
Definition: app-layer-parser.c:1661
AppLayerParserPostStreamSetup
void AppLayerParserPostStreamSetup(void)
Definition: app-layer-parser.c:224
AppLayerParserGetDecoderEvents
AppLayerDecoderEvents * AppLayerParserGetDecoderEvents(AppLayerParserState *pstate)
Definition: app-layer-parser.c:831
FileContainer_
Definition: util-file.h:107
AppLayerParserRegisterGetTx
void AppLayerParserRegisterGetTx(uint8_t ipproto, AppProto alproto, void *(StateGetTx)(void *alstate, uint64_t tx_id))
Definition: app-layer-parser.c:507
AppLayerParserRegisterLogger
void AppLayerParserRegisterLogger(uint8_t ipproto, AppProto alproto)
Definition: app-layer-parser.c:455
ts
uint64_t ts
Definition: source-erf-file.c:54
AppLayerParserRegisterLoggerBits
void AppLayerParserRegisterLoggerBits(uint8_t ipproto, AppProto alproto, LoggerId bits)
Definition: app-layer-parser.c:446
AppLayerParserGetTxDetectState
DetectEngineState * AppLayerParserGetTxDetectState(uint8_t ipproto, AppProto alproto, void *tx)
Definition: app-layer-parser.c:1162
AppLayerGetTxIterState::ptr
void * ptr
Definition: app-layer-parser.h:146
AppLayerGetTxIterState::un
union AppLayerGetTxIterState::@15 un
AppLayerParserStateAlloc
AppLayerParserState * AppLayerParserStateAlloc(void)
Definition: app-layer-parser.c:193
AppLayerParserSetTxDetectState
int AppLayerParserSetTxDetectState(const Flow *f, void *tx, DetectEngineState *s)
Definition: app-layer-parser.c:1169
AppLayerParserTransactionsCleanup
void AppLayerParserTransactionsCleanup(Flow *f)
remove obsolete (inspected and logged) transactions
Definition: app-layer-parser.c:885
AppLayerParserSetEOF
void AppLayerParserSetEOF(AppLayerParserState *pstate)
Definition: app-layer-parser.c:1378
AppLayerParserRegisterGetTxCnt
void AppLayerParserRegisterGetTxCnt(uint8_t ipproto, AppProto alproto, uint64_t(*StateGetTxCnt)(void *alstate))
Definition: app-layer-parser.c:496
DetectEngineState_
Definition: detect-engine-state.h:93
AppLayerParserGetEventInfoById
int AppLayerParserGetEventInfoById(uint8_t ipproto, AppProto alproto, int event_id, const char **event_name, AppLayerEventType *event_type)
Definition: app-layer-parser.c:1115
AppLayerParserGetStreamDepth
uint32_t AppLayerParserGetStreamDepth(const Flow *f)
Definition: app-layer-parser.c:1468
AppLayerParserHasTxDetectState
int AppLayerParserHasTxDetectState(uint8_t ipproto, AppProto alproto, void *alstate)
AppProto
uint16_t AppProto
Definition: app-layer-protos.h:77
AppLayerParserFPtr
AppLayerResult(* AppLayerParserFPtr)(Flow *f, void *protocol_state, AppLayerParserState *pstate, const uint8_t *buf, uint32_t buf_len, void *local_storage, const uint8_t flags)
Prototype for parsing functions.
Definition: app-layer-parser.h:139
AppLayerParserSetDecoderEvents
void AppLayerParserSetDecoderEvents(AppLayerParserState *pstate, AppLayerDecoderEvents *devents)
Definition: app-layer-parser.c:839
AppLayerParserRegisterSetStreamDepthFlag
void AppLayerParserRegisterSetStreamDepthFlag(uint8_t ipproto, AppProto alproto, void(*SetStreamDepthFlag)(void *tx, uint8_t flags))
Definition: app-layer-parser.c:597
Flow_
Flow data structure.
Definition: flow.h:353
AppLayerEventType
enum AppLayerEventType_ AppLayerEventType
LoggerId
LoggerId
Definition: suricata-common.h:432
AppLayerParserRegisterGetEventInfoById
void AppLayerParserRegisterGetEventInfoById(uint8_t ipproto, AppProto alproto, int(*StateGetEventInfoById)(int event_id, const char **event_name, AppLayerEventType *event_type))
Definition: app-layer-parser.c:541
UTHAppLayerParserStateGetIds
void UTHAppLayerParserStateGetIds(void *ptr, uint64_t *i1, uint64_t *i2, uint64_t *log, uint64_t *min)
Definition: app-layer-parser.c:172
AppLayerParserRegisterGetFilesFunc
void AppLayerParserRegisterGetFilesFunc(uint8_t ipproto, AppProto alproto, FileContainer *(*StateGetFiles)(void *, uint8_t))
Definition: app-layer-parser.c:424
rust.h
proto
uint8_t proto
Definition: decode-template.h:0
AppLayerParserRegisterGetStreamDepth
void AppLayerParserRegisterGetStreamDepth(uint8_t ipproto, AppProto alproto, uint32_t(*GetStreamDepth)(void))
AppLayerParserProtocolGetLoggerBits
LoggerId AppLayerParserProtocolGetLoggerBits(uint8_t ipproto, AppProto alproto)
Definition: app-layer-parser.c:1438
AppLayerParserStateSetFlag
void AppLayerParserStateSetFlag(AppLayerParserState *pstate, uint8_t flag)
Definition: app-layer-parser.c:1646
AppLayerGetTxIterState::u64
uint64_t u64
Definition: app-layer-parser.h:147
AppLayerParserSetup
int AppLayerParserSetup(void)
Definition: app-layer-parser.c:217
AppLayerParserRegisterProtocolUnittests
void AppLayerParserRegisterProtocolUnittests(uint8_t ipproto, AppProto alproto, void(*RegisterUnittests)(void))
Definition: app-layer-parser.c:1752
AppLayerDecoderEvents_
Data structure to store app layer decoder events.
Definition: app-layer-events.h:34
AppLayerParserSetStreamDepth
void AppLayerParserSetStreamDepth(uint8_t ipproto, AppProto alproto, uint32_t stream_depth)
Definition: app-layer-parser.c:1457
AppLayerParserGetProtocolParserLocalStorage
void * AppLayerParserGetProtocolParserLocalStorage(uint8_t ipproto, AppProto alproto)
Definition: app-layer-parser.c:609
__attribute__
enum @23 __attribute__
DNP3 application header.
AppLayerParserRegisterLoggerFuncs
void AppLayerParserRegisterLoggerFuncs(uint8_t ipproto, AppProto alproto, LoggerId(*StateGetTxLogged)(void *, void *), void(*StateSetTxLogged)(void *, void *, LoggerId))
AppLayerParserConfParserEnabled
int AppLayerParserConfParserEnabled(const char *ipproto, const char *alproto_name)
Given a protocol name, checks if the parser is enabled in the conf file.
Definition: app-layer-parser.c:300
AppLayerParserTriggerRawStreamReassembly
void AppLayerParserTriggerRawStreamReassembly(Flow *f, int direction)
Definition: app-layer-parser.c:1446
AppLayerParserGetEventInfo
int AppLayerParserGetEventInfo(uint8_t ipproto, AppProto alproto, const char *event_name, int *event_id, AppLayerEventType *event_type)
Definition: app-layer-parser.c:1105
AppLayerParserState_
Definition: app-layer-parser.c:153
AppLayerParserRegisterGetEventsFunc
void AppLayerParserRegisterGetEventsFunc(uint8_t ipproto, AppProto proto, AppLayerDecoderEvents *(*StateGetEvents)(void *) __attribute__((nonnull)))
AppLayerParserGetTransactionLogId
uint64_t AppLayerParserGetTransactionLogId(AppLayerParserState *pstate)
Definition: app-layer-parser.c:682
AppLayerParserRegisterLocalStorageFunc
void AppLayerParserRegisterLocalStorageFunc(uint8_t ipproto, AppProto proto, void *(*LocalStorageAlloc)(void), void(*LocalStorageFree)(void *))
Definition: app-layer-parser.c:410
AppLayerParserRegisterStateProgressCompletionStatus
void AppLayerParserRegisterStateProgressCompletionStatus(AppProto alproto, const int ts, const int tc)
Definition: app-layer-parser.c:526
AppLayerParserProtoIsRegistered
int AppLayerParserProtoIsRegistered(uint8_t ipproto, AppProto alproto)
Definition: app-layer-parser.c:186
AppLayerParserSupportsFiles
int AppLayerParserSupportsFiles(uint8_t ipproto, AppProto alproto)
Definition: app-layer-parser.c:1150
ThreadVars_
Per thread variable structure.
Definition: threadvars.h:58
AppLayerParserRegisterDetectStateFuncs
void AppLayerParserRegisterDetectStateFuncs(uint8_t ipproto, AppProto alproto, DetectEngineState *(*GetTxDetectState)(void *tx), int(*SetTxDetectState)(void *tx, DetectEngineState *))
Definition: app-layer-parser.c:565
AppLayerParserGetOptionFlags
uint32_t AppLayerParserGetOptionFlags(uint8_t protomap, AppProto alproto)
Definition: app-layer-parser.c:391
AppLayerParserRegisterOptionFlags
void AppLayerParserRegisterOptionFlags(uint8_t ipproto, AppProto alproto, uint32_t flags)
Definition: app-layer-parser.c:381
AppLayerParserGetTxData
AppLayerTxData * AppLayerParserGetTxData(uint8_t ipproto, AppProto alproto, void *tx)
Definition: app-layer-parser.c:1177
AppLayerParserRegisterTxDataFunc
void AppLayerParserRegisterTxDataFunc(uint8_t ipproto, AppProto alproto, AppLayerTxData *(*GetTxData)(void *tx))
Definition: app-layer-parser.c:577
AppLayerParserDestroyProtocolParserLocalStorage
void AppLayerParserDestroyProtocolParserLocalStorage(uint8_t ipproto, AppProto alproto, void *local_data)
Definition: app-layer-parser.c:624
AppLayerGetTxIterState
Definition: app-layer-parser.h:144
AppLayerParserGetTransactionInspectId
uint64_t AppLayerParserGetTransactionInspectId(AppLayerParserState *pstate, uint8_t direction)
Definition: app-layer-parser.c:699
AppLayerParserHasDecoderEvents
bool AppLayerParserHasDecoderEvents(AppLayerParserState *pstate)
Definition: app-layer-parser.c:1394
AppLayerParserSetTransactionInspectId
void AppLayerParserSetTransactionInspectId(const Flow *f, AppLayerParserState *pstate, void *alstate, const uint8_t flags, bool tag_txs_as_inspected)
Definition: app-layer-parser.c:730
stream-tcp-private.h
AppLayerParserRegisterGetTxIterator
void AppLayerParserRegisterGetTxIterator(uint8_t ipproto, AppProto alproto, AppLayerGetTxIteratorFunc Func)
Definition: app-layer-parser.c:518
AppLayerParserProtocolIsTxEventAware
int AppLayerParserProtocolIsTxEventAware(uint8_t ipproto, AppProto alproto)
Definition: app-layer-parser.c:1422
AppLayerGetTxIterator
AppLayerGetTxIteratorFunc AppLayerGetTxIterator(const uint8_t ipproto, const AppProto alproto)
Definition: app-layer-parser.c:674
detect-engine-state.h
Data structures and function prototypes for keeping state for the detection engine.
AppLayerParserRestoreParserTable
void AppLayerParserRestoreParserTable(void)
Definition: app-layer-parser.c:1769
AppLayerGetTxIterState
struct AppLayerGetTxIterState AppLayerGetTxIterState
AppLayerParserStateIssetFlag
int AppLayerParserStateIssetFlag(AppLayerParserState *pstate, uint8_t flag)
Definition: app-layer-parser.c:1654
AppLayerParserRegisterTxFreeFunc
void AppLayerParserRegisterTxFreeFunc(uint8_t ipproto, AppProto alproto, void(*StateTransactionFree)(void *, uint64_t))
Definition: app-layer-parser.c:485
AppLayerParserDeSetup
int AppLayerParserDeSetup(void)
Definition: app-layer-parser.c:241
ConfigAction
ConfigAction
Definition: util-config.h:27
util-file.h
AppLayerParserIsEnabled
int AppLayerParserIsEnabled(AppProto alproto)
simple way to globally test if a alproto is registered and fully enabled in the configuration.
Definition: app-layer-parser.c:1412
flags
uint8_t flags
Definition: decode-gre.h:0
AppLayerParserApplyTxConfig
void AppLayerParserApplyTxConfig(uint8_t ipproto, AppProto alproto, void *state, void *tx, enum ConfigAction mode, AppLayerTxConfig)
Definition: app-layer-parser.c:1184
AppLayerParserSetTransactionLogId
void AppLayerParserSetTransactionLogId(AppLayerParserState *pstate, uint64_t tx_id)
Definition: app-layer-parser.c:689
AppLayerParserRegisterStateFuncs
void AppLayerParserRegisterStateFuncs(uint8_t ipproto, AppProto alproto, void *(*StateAlloc)(void *, AppProto), void(*StateFree)(void *))
Definition: app-layer-parser.c:397
AppLayerParserRegisterUnittests
void AppLayerParserRegisterUnittests(void)
Definition: app-layer-parser.c:1865
AppLayerParserStateCleanup
void AppLayerParserStateCleanup(const Flow *f, void *alstate, AppLayerParserState *pstate)
Definition: app-layer-parser.c:1506
AppLayerParserBackupParserTable
void AppLayerParserBackupParserTable(void)
Definition: app-layer-parser.c:1761
AppLayerParserRegisterGetStateProgressFunc
void AppLayerParserRegisterGetStateProgressFunc(uint8_t ipproto, AppProto alproto, int(*StateGetStateProgress)(void *alstate, uint8_t direction))
Definition: app-layer-parser.c:474
tv
ThreadVars * tv
Definition: fuzz_decodepcapfile.c:29
app-layer-events.h
AppLayerParserRegisterTruncateFunc
void AppLayerParserRegisterTruncateFunc(uint8_t ipproto, AppProto alproto, void(*Truncate)(void *, uint8_t))
Definition: app-layer-parser.c:464
AppLayerParserRegisterProtocolParsers
void AppLayerParserRegisterProtocolParsers(void)
Definition: app-layer-parser.c:1592
AppLayerParserGetFirstDataDir
uint8_t AppLayerParserGetFirstDataDir(uint8_t ipproto, AppProto alproto)
Definition: app-layer-parser.c:1126
AppLayerParserRegisterGetEventInfo
void AppLayerParserRegisterGetEventInfo(uint8_t ipproto, AppProto alproto, int(*StateGetEventInfo)(const char *event_name, int *event_id, AppLayerEventType *event_type))
Definition: app-layer-parser.c:553
util-config.h
AppLayerParserGetTxCnt
uint64_t AppLayerParserGetTxCnt(const Flow *, void *alstate)
Definition: app-layer-parser.c:1083
AppLayerParserRegisterParser
int AppLayerParserRegisterParser(uint8_t ipproto, AppProto alproto, uint8_t direction, AppLayerParserFPtr Parser)
Register app layer parser for the protocol.
Definition: app-layer-parser.c:358
AppLayerParserProtocolHasLogger
int AppLayerParserProtocolHasLogger(uint8_t ipproto, AppProto alproto)
Definition: app-layer-parser.c:1430
AppLayerParserThreadCtxAlloc
AppLayerParserThreadCtx * AppLayerParserThreadCtxAlloc(void)
Gets a new app layer protocol's parser thread context.
Definition: app-layer-parser.c:251
AppLayerParserSetStreamDepthFlag
void AppLayerParserSetStreamDepthFlag(uint8_t ipproto, AppProto alproto, void *state, uint64_t tx_id, uint8_t flags)
Definition: app-layer-parser.c:1473
AppLayerGetTxIteratorFunc
AppLayerGetTxIterTuple(* AppLayerGetTxIteratorFunc)(const uint8_t ipproto, const AppProto alproto, void *alstate, uint64_t min_tx_id, uint64_t max_tx_id, AppLayerGetTxIterState *state)
tx iterator prototype
Definition: app-layer-parser.h:153
AppLayerParserThreadCtx_
Definition: app-layer-parser.c:85
AppLayerParserStateFree
void AppLayerParserStateFree(AppLayerParserState *pstate)
Definition: app-layer-parser.c:206
AppLayerParserGetEventsByTx
AppLayerDecoderEvents * AppLayerParserGetEventsByTx(uint8_t ipproto, AppProto alproto, void *tx)
Definition: app-layer-parser.c:844
AppLayerParserRegisterApplyTxConfigFunc
void AppLayerParserRegisterApplyTxConfigFunc(uint8_t ipproto, AppProto alproto, bool(*ApplyTxConfig)(void *state, void *tx, int mode, AppLayerTxConfig))
Definition: app-layer-parser.c:587
AppLayerParserParse
int AppLayerParserParse(ThreadVars *tv, AppLayerParserThreadCtx *tctx, Flow *f, AppProto alproto, uint8_t flags, const uint8_t *input, uint32_t input_len)
Definition: app-layer-parser.c:1211
AppLayerParserRegisterParserAcceptableDataDirection
void AppLayerParserRegisterParserAcceptableDataDirection(uint8_t ipproto, AppProto alproto, uint8_t direction)
Definition: app-layer-parser.c:370
AppLayerParserGetStateProgressCompletionStatus
int AppLayerParserGetStateProgressCompletionStatus(AppProto alproto, uint8_t direction)
Definition: app-layer-parser.c:1097
AppLayerParserStateProtoCleanup
void AppLayerParserStateProtoCleanup(uint8_t protomap, AppProto alproto, void *alstate, AppLayerParserState *pstate)
Definition: app-layer-parser.c:1489
AppLayerParserGetTransactionActive
uint64_t AppLayerParserGetTransactionActive(const Flow *f, AppLayerParserState *pstate, uint8_t direction)
Definition: app-layer-parser.c:1133