suricata
app-layer-parser.h
Go to the documentation of this file.
1 /* Copyright (C) 2007-2020 Open Information Security Foundation
2  *
3  * You can copy, redistribute or modify this Program under the terms of
4  * the GNU General Public License version 2 as published by the Free
5  * Software Foundation.
6  *
7  * This program is distributed in the hope that it will be useful,
8  * but WITHOUT ANY WARRANTY; without even the implied warranty of
9  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
10  * GNU General Public License for more details.
11  *
12  * You should have received a copy of the GNU General Public License
13  * version 2 along with this program; if not, write to the Free Software
14  * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA
15  * 02110-1301, USA.
16  */
17 
18 /**
19  * \file
20  *
21  * \author Victor Julien <victor@inliniac.net>
22  * \author Anoop Saldanha <anoopsaldanha@gmail.com>
23  */
24 
25 #ifndef __APP_LAYER_PARSER_H__
26 #define __APP_LAYER_PARSER_H__
27 
28 #include "app-layer-events.h"
29 #include "util-file.h"
30 #include "rust.h"
31 #include "util-config.h"
32 
33 /* Flags for AppLayerParserState. */
34 // flag available BIT_U16(0)
35 #define APP_LAYER_PARSER_NO_INSPECTION BIT_U16(1)
36 #define APP_LAYER_PARSER_NO_REASSEMBLY BIT_U16(2)
37 #define APP_LAYER_PARSER_NO_INSPECTION_PAYLOAD BIT_U16(3)
38 #define APP_LAYER_PARSER_BYPASS_READY BIT_U16(4)
39 #define APP_LAYER_PARSER_EOF_TS BIT_U16(5)
40 #define APP_LAYER_PARSER_EOF_TC BIT_U16(6)
41 #define APP_LAYER_PARSER_TRUNC_TS BIT_U16(7)
42 #define APP_LAYER_PARSER_TRUNC_TC BIT_U16(8)
43 #define APP_LAYER_PARSER_SFRAME_TS BIT_U16(9)
44 #define APP_LAYER_PARSER_SFRAME_TC BIT_U16(10)
45 
46 /* Flags for AppLayerParserProtoCtx. */
47 #define APP_LAYER_PARSER_OPT_ACCEPT_GAPS BIT_U32(0)
48 #define APP_LAYER_PARSER_OPT_UNIDIR_TXS BIT_U32(1)
49 
50 #define APP_LAYER_PARSER_INT_STREAM_DEPTH_SET BIT_U32(0)
51 
52 /* applies to DetectFlags uint64_t field */
53 
54 /** reserved for future use */
55 #define APP_LAYER_TX_RESERVED1_FLAG BIT_U64(48)
56 #define APP_LAYER_TX_RESERVED2_FLAG BIT_U64(49)
57 #define APP_LAYER_TX_RESERVED3_FLAG BIT_U64(50)
58 #define APP_LAYER_TX_RESERVED4_FLAG BIT_U64(51)
59 #define APP_LAYER_TX_RESERVED5_FLAG BIT_U64(52)
60 #define APP_LAYER_TX_RESERVED6_FLAG BIT_U64(53)
61 #define APP_LAYER_TX_RESERVED7_FLAG BIT_U64(54)
62 #define APP_LAYER_TX_RESERVED8_FLAG BIT_U64(55)
63 #define APP_LAYER_TX_RESERVED9_FLAG BIT_U64(56)
64 #define APP_LAYER_TX_RESERVED10_FLAG BIT_U64(57)
65 #define APP_LAYER_TX_RESERVED11_FLAG BIT_U64(58)
66 #define APP_LAYER_TX_RESERVED12_FLAG BIT_U64(59)
67 #define APP_LAYER_TX_RESERVED13_FLAG BIT_U64(60)
68 #define APP_LAYER_TX_RESERVED14_FLAG BIT_U64(61)
69 #define APP_LAYER_TX_RESERVED15_FLAG BIT_U64(62)
70 
71 #define APP_LAYER_TX_RESERVED_FLAGS \
72  (APP_LAYER_TX_RESERVED1_FLAG | APP_LAYER_TX_RESERVED2_FLAG | APP_LAYER_TX_RESERVED3_FLAG | \
73  APP_LAYER_TX_RESERVED4_FLAG | APP_LAYER_TX_RESERVED5_FLAG | \
74  APP_LAYER_TX_RESERVED6_FLAG | APP_LAYER_TX_RESERVED7_FLAG | \
75  APP_LAYER_TX_RESERVED8_FLAG | APP_LAYER_TX_RESERVED9_FLAG | \
76  APP_LAYER_TX_RESERVED10_FLAG | APP_LAYER_TX_RESERVED11_FLAG | \
77  APP_LAYER_TX_RESERVED12_FLAG | APP_LAYER_TX_RESERVED13_FLAG | \
78  APP_LAYER_TX_RESERVED14_FLAG | APP_LAYER_TX_RESERVED15_FLAG)
79 
80 /** is tx fully inspected? */
81 #define APP_LAYER_TX_INSPECTED_FLAG BIT_U64(63)
82 /** other 63 bits are for tracking which prefilter engine is already
83  * completely inspected */
84 #define APP_LAYER_TX_PREFILTER_MASK ~(APP_LAYER_TX_INSPECTED_FLAG | APP_LAYER_TX_RESERVED_FLAGS)
85 
86 /** parser has successfully processed in the input, and has consumed
87  * all of it. */
88 #define APP_LAYER_OK (AppLayerResult) { 0, 0, 0 }
89 
90 /** parser has hit an unrecoverable error. Returning this to the API
91  * leads to no further calls to the parser. */
92 #define APP_LAYER_ERROR (AppLayerResult) { -1, 0, 0 }
93 
94 /** parser needs more data. Through 'c' it will indicate how many
95  * of the input bytes it has consumed. Through 'n' it will indicate
96  * how many more bytes it needs before getting called again.
97  * \note consumed (c) should never be more than the input len
98  * needed (n) + consumed (c) should be more than the input len
99  */
100 #define APP_LAYER_INCOMPLETE(c,n) (AppLayerResult) { 1, (c), (n) }
101 
102 int AppLayerParserProtoIsRegistered(uint8_t ipproto, AppProto alproto);
103 
104 /***** transaction handling *****/
105 
106 int AppLayerParserSetup(void);
109 
111 
112 /**
113  * \brief Gets a new app layer protocol's parser thread context.
114  *
115  * \retval Non-NULL pointer on success.
116  * NULL pointer on failure.
117  */
119 
120 /**
121  * \brief Destroys the app layer parser thread context obtained
122  * using AppLayerParserThreadCtxAlloc().
123  *
124  * \param tctx Pointer to the thread context to be destroyed.
125  */
127 
128 /**
129  * \brief Given a protocol name, checks if the parser is enabled in
130  * the conf file.
131  *
132  * \param alproto_name Name of the app layer protocol.
133  *
134  * \retval 1 If enabled.
135  * \retval 0 If disabled.
136  */
137 int AppLayerParserConfParserEnabled(const char *ipproto,
138  const char *alproto_name);
139 
140 /** \brief Prototype for parsing functions */
141 typedef AppLayerResult (*AppLayerParserFPtr)(Flow *f, void *protocol_state,
142  AppLayerParserState *pstate, StreamSlice stream_slice, void *local_storage);
143 
144 typedef struct AppLayerGetTxIterState {
145  union {
146  void *ptr;
147  uint64_t u64;
148  } un;
150 
151 /** \brief tx iterator prototype */
152 typedef AppLayerGetTxIterTuple (*AppLayerGetTxIteratorFunc)
153  (const uint8_t ipproto, const AppProto alproto,
154  void *alstate, uint64_t min_tx_id, uint64_t max_tx_id,
155  AppLayerGetTxIterState *state);
156 
157 /***** Parser related registration *****/
158 
159 typedef int (*AppLayerParserGetFrameIdByNameFn)(const char *frame_name);
160 typedef const char *(*AppLayerParserGetFrameNameByIdFn)(const uint8_t id);
161 
162 /**
163  * \brief Register app layer parser for the protocol.
164  *
165  * \retval 0 On success.
166  * \retval -1 On failure.
167  */
168 int AppLayerParserRegisterParser(uint8_t ipproto, AppProto alproto,
169  uint8_t direction,
170  AppLayerParserFPtr Parser);
172  AppProto alproto,
173  uint8_t direction);
174 void AppLayerParserRegisterOptionFlags(uint8_t ipproto, AppProto alproto,
175  uint32_t flags);
176 void AppLayerParserRegisterStateFuncs(uint8_t ipproto, AppProto alproto,
177  void *(*StateAlloc)(void *, AppProto), void (*StateFree)(void *));
179  void *(*LocalStorageAlloc)(void), void (*LocalStorageFree)(void *));
180 // void AppLayerParserRegisterGetEventsFunc(uint8_t ipproto, AppProto proto,
181 // AppLayerDecoderEvents *(*StateGetEvents)(void *) __attribute__((nonnull)));
182 void AppLayerParserRegisterGetTxFilesFunc(uint8_t ipproto, AppProto alproto,
183  AppLayerGetFileState (*GetTxFiles)(void *, void *, uint8_t));
184 void AppLayerParserRegisterLoggerFuncs(uint8_t ipproto, AppProto alproto,
185  LoggerId (*StateGetTxLogged)(void *, void *),
186  void (*StateSetTxLogged)(void *, void *, LoggerId));
187 void AppLayerParserRegisterLogger(uint8_t ipproto, AppProto alproto);
188 void AppLayerParserRegisterLoggerBits(uint8_t ipproto, AppProto alproto, LoggerId bits);
189 void AppLayerParserRegisterTruncateFunc(uint8_t ipproto, AppProto alproto,
190  void (*Truncate)(void *, uint8_t));
191 void AppLayerParserRegisterGetStateProgressFunc(uint8_t ipproto, AppProto alproto,
192  int (*StateGetStateProgress)(void *alstate, uint8_t direction));
193 void AppLayerParserRegisterTxFreeFunc(uint8_t ipproto, AppProto alproto,
194  void (*StateTransactionFree)(void *, uint64_t));
195 void AppLayerParserRegisterGetTxCnt(uint8_t ipproto, AppProto alproto,
196  uint64_t (*StateGetTxCnt)(void *alstate));
197 void AppLayerParserRegisterGetTx(uint8_t ipproto, AppProto alproto,
198  void *(StateGetTx)(void *alstate, uint64_t tx_id));
199 void AppLayerParserRegisterGetTxIterator(uint8_t ipproto, AppProto alproto,
202  AppProto alproto, const int ts, const int tc);
203 void AppLayerParserRegisterGetEventInfo(uint8_t ipproto, AppProto alproto,
204  int (*StateGetEventInfo)(const char *event_name, int *event_id,
205  AppLayerEventType *event_type));
206 void AppLayerParserRegisterGetEventInfoById(uint8_t ipproto, AppProto alproto,
207  int (*StateGetEventInfoById)(int event_id, const char **event_name,
208  AppLayerEventType *event_type));
209 void AppLayerParserRegisterGetFrameFuncs(uint8_t ipproto, AppProto alproto,
210  AppLayerParserGetFrameIdByNameFn GetFrameIdByName,
211  AppLayerParserGetFrameNameByIdFn GetFrameNameById);
213  AppProto alproto,
214  uint32_t (*GetStreamDepth)(void));
215 void AppLayerParserRegisterSetStreamDepthFlag(uint8_t ipproto, AppProto alproto,
216  void (*SetStreamDepthFlag)(void *tx, uint8_t flags));
217 
218 void AppLayerParserRegisterTxDataFunc(uint8_t ipproto, AppProto alproto,
219  AppLayerTxData *(*GetTxData)(void *tx));
220 void AppLayerParserRegisterApplyTxConfigFunc(uint8_t ipproto, AppProto alproto,
221  bool (*ApplyTxConfig)(void *state, void *tx, int mode, AppLayerTxConfig));
223  uint8_t ipproto, AppProto alproto, AppLayerStateData *(*GetStateData)(void *state));
224 
225 /***** Get and transaction functions *****/
226 
227 uint32_t AppLayerParserGetOptionFlags(uint8_t protomap, AppProto alproto);
229  const AppProto alproto);
230 
231 void *AppLayerParserGetProtocolParserLocalStorage(uint8_t ipproto, AppProto alproto);
232 void AppLayerParserDestroyProtocolParserLocalStorage(uint8_t ipproto, AppProto alproto,
233  void *local_data);
234 
235 
237 void AppLayerParserSetTransactionLogId(AppLayerParserState *pstate, uint64_t tx_id);
238 
239 uint64_t AppLayerParserGetTransactionInspectId(AppLayerParserState *pstate, uint8_t direction);
241  void *alstate, const uint8_t flags, bool tag_txs_as_inspected);
242 
245 AppLayerDecoderEvents *AppLayerParserGetEventsByTx(uint8_t ipproto, AppProto alproto, void *tx);
246 AppLayerGetFileState AppLayerParserGetTxFiles(
247  const Flow *f, void *state, void *tx, const uint8_t direction);
248 int AppLayerParserGetStateProgress(uint8_t ipproto, AppProto alproto,
249  void *alstate, uint8_t direction);
250 uint64_t AppLayerParserGetTxCnt(const Flow *, void *alstate);
251 void *AppLayerParserGetTx(uint8_t ipproto, AppProto alproto, void *alstate, uint64_t tx_id);
252 int AppLayerParserGetStateProgressCompletionStatus(AppProto alproto, uint8_t direction);
253 int AppLayerParserGetEventInfo(uint8_t ipproto, AppProto alproto, const char *event_name,
254  int *event_id, AppLayerEventType *event_type);
255 int AppLayerParserGetEventInfoById(uint8_t ipproto, AppProto alproto, int event_id,
256  const char **event_name, AppLayerEventType *event_type);
257 
258 uint64_t AppLayerParserGetTransactionActive(const Flow *f, AppLayerParserState *pstate, uint8_t direction);
259 
260 uint8_t AppLayerParserGetFirstDataDir(uint8_t ipproto, AppProto alproto);
261 
262 int AppLayerParserSupportsFiles(uint8_t ipproto, AppProto alproto);
263 
264 AppLayerTxData *AppLayerParserGetTxData(uint8_t ipproto, AppProto alproto, void *tx);
265 AppLayerStateData *AppLayerParserGetStateData(uint8_t ipproto, AppProto alproto, void *state);
266 void AppLayerParserApplyTxConfig(uint8_t ipproto, AppProto alproto,
267  void *state, void *tx, enum ConfigAction mode, AppLayerTxConfig);
268 
269 static inline bool AppLayerParserIsFileTx(const AppLayerTxData *txd)
270 {
271  if (txd->file_tx != 0) {
272  return true;
273  }
274  return false;
275 }
276 
277 static inline bool AppLayerParserIsFileTxInDir(const AppLayerTxData *txd, const uint8_t direction)
278 {
279  if ((txd->file_tx & direction) != 0) {
280  return true;
281  }
282  return false;
283 }
284 
285 /** \brief check if tx (possibly) has files in this tx for the direction */
286 static inline bool AppLayerParserHasFilesInDir(const AppLayerTxData *txd, const uint8_t direction)
287 {
288  return (txd->files_opened && AppLayerParserIsFileTxInDir(txd, direction));
289 }
290 
291 /***** General *****/
292 
294  uint8_t flags, const uint8_t *input, uint32_t input_len);
297 int AppLayerParserProtocolHasLogger(uint8_t ipproto, AppProto alproto);
298 LoggerId AppLayerParserProtocolGetLoggerBits(uint8_t ipproto, AppProto alproto);
299 void AppLayerParserTriggerRawStreamReassembly(Flow *f, int direction);
300 void AppLayerParserSetStreamDepth(uint8_t ipproto, AppProto alproto, uint32_t stream_depth);
301 uint32_t AppLayerParserGetStreamDepth(const Flow *f);
302 void AppLayerParserSetStreamDepthFlag(uint8_t ipproto, AppProto alproto, void *state, uint64_t tx_id, uint8_t flags);
303 int AppLayerParserIsEnabled(AppProto alproto);
304 int AppLayerParserGetFrameIdByName(uint8_t ipproto, AppProto alproto, const char *name);
305 const char *AppLayerParserGetFrameNameById(uint8_t ipproto, AppProto alproto, const uint8_t id);
306 
307 /***** Cleanup *****/
308 
310  uint8_t protomap, AppProto alproto, void *alstate, AppLayerParserState *pstate);
311 void AppLayerParserStateCleanup(const Flow *f, void *alstate, AppLayerParserState *pstate);
312 
314 
315 void AppLayerParserStateSetFlag(AppLayerParserState *pstate, uint16_t flag);
316 uint16_t AppLayerParserStateIssetFlag(AppLayerParserState *pstate, uint16_t flag);
317 
320 
321 void AppLayerParserTransactionsCleanup(Flow *f, const uint8_t pkt_dir);
322 
323 #ifdef DEBUG
324 void AppLayerParserStatePrintDetails(AppLayerParserState *pstate);
325 #endif
326 
327 
328 /***** Unittests *****/
329 
330 #ifdef UNITTESTS
331 void AppLayerParserRegisterProtocolUnittests(uint8_t ipproto, AppProto alproto,
332  void (*RegisterUnittests)(void));
336 void UTHAppLayerParserStateGetIds(void *ptr, uint64_t *i1, uint64_t *i2, uint64_t *log, uint64_t *min);
337 #endif
338 
340 void FileApplyTxFlags(const AppLayerTxData *txd, const uint8_t direction, File *file);
341 
342 #endif /* __APP_LAYER_PARSER_H__ */
AppLayerParserGetStateProgress
int AppLayerParserGetStateProgress(uint8_t ipproto, AppProto alproto, void *alstate, uint8_t direction)
get the progress value for a tx/protocol
Definition: app-layer-parser.c:1122
AppLayerParserThreadCtxFree
void AppLayerParserThreadCtxFree(AppLayerParserThreadCtx *tctx)
Destroys the app layer parser thread context obtained using AppLayerParserThreadCtxAlloc().
Definition: app-layer-parser.c:314
AppLayerParserGetTx
void * AppLayerParserGetTx(uint8_t ipproto, AppProto alproto, void *alstate, uint64_t tx_id)
Definition: app-layer-parser.c:1143
AppLayerParserPostStreamSetup
void AppLayerParserPostStreamSetup(void)
Definition: app-layer-parser.c:269
AppLayerParserGetDecoderEvents
AppLayerDecoderEvents * AppLayerParserGetDecoderEvents(AppLayerParserState *pstate)
Definition: app-layer-parser.c:861
AppLayerParserRegisterGetTx
void AppLayerParserRegisterGetTx(uint8_t ipproto, AppProto alproto, void *(StateGetTx)(void *alstate, uint64_t tx_id))
Definition: app-layer-parser.c:529
AppLayerParserRegisterLogger
void AppLayerParserRegisterLogger(uint8_t ipproto, AppProto alproto)
Definition: app-layer-parser.c:477
ts
uint64_t ts
Definition: source-erf-file.c:55
AppLayerParserRegisterLoggerBits
void AppLayerParserRegisterLoggerBits(uint8_t ipproto, AppProto alproto, LoggerId bits)
Definition: app-layer-parser.c:468
AppLayerGetTxIterState::ptr
void * ptr
Definition: app-layer-parser.h:146
AppLayerParserStateAlloc
AppLayerParserState * AppLayerParserStateAlloc(void)
Definition: app-layer-parser.c:237
AppLayerParserSetEOF
void AppLayerParserSetEOF(AppLayerParserState *pstate)
Definition: app-layer-parser.c:1531
AppLayerParserRegisterGetTxCnt
void AppLayerParserRegisterGetTxCnt(uint8_t ipproto, AppProto alproto, uint64_t(*StateGetTxCnt)(void *alstate))
Definition: app-layer-parser.c:518
AppLayerParserGetEventInfoById
int AppLayerParserGetEventInfoById(uint8_t ipproto, AppProto alproto, int event_id, const char **event_name, AppLayerEventType *event_type)
Definition: app-layer-parser.c:1168
AppLayerParserRegisterGetFrameFuncs
void AppLayerParserRegisterGetFrameFuncs(uint8_t ipproto, AppProto alproto, AppLayerParserGetFrameIdByNameFn GetFrameIdByName, AppLayerParserGetFrameNameByIdFn GetFrameNameById)
Definition: app-layer-parser.c:575
AppLayerParserGetStreamDepth
uint32_t AppLayerParserGetStreamDepth(const Flow *f)
Definition: app-layer-parser.c:1613
AppProto
uint16_t AppProto
Definition: app-layer-protos.h:80
AppLayerParserSetDecoderEvents
void AppLayerParserSetDecoderEvents(AppLayerParserState *pstate, AppLayerDecoderEvents *devents)
Definition: app-layer-parser.c:869
AppLayerParserRegisterSetStreamDepthFlag
void AppLayerParserRegisterSetStreamDepthFlag(uint8_t ipproto, AppProto alproto, void(*SetStreamDepthFlag)(void *tx, uint8_t flags))
Definition: app-layer-parser.c:627
Flow_
Flow data structure.
Definition: flow.h:357
AppLayerEventType
enum AppLayerEventType_ AppLayerEventType
LoggerId
LoggerId
Definition: suricata-common.h:449
AppLayerParserRegisterGetEventInfoById
void AppLayerParserRegisterGetEventInfoById(uint8_t ipproto, AppProto alproto, int(*StateGetEventInfoById)(int event_id, const char **event_name, AppLayerEventType *event_type))
Definition: app-layer-parser.c:563
UTHAppLayerParserStateGetIds
void UTHAppLayerParserStateGetIds(void *ptr, uint64_t *i1, uint64_t *i2, uint64_t *log, uint64_t *min)
Definition: app-layer-parser.c:216
rust.h
proto
uint8_t proto
Definition: decode-template.h:0
AppLayerParserRegisterGetStreamDepth
void AppLayerParserRegisterGetStreamDepth(uint8_t ipproto, AppProto alproto, uint32_t(*GetStreamDepth)(void))
AppLayerParserProtocolGetLoggerBits
LoggerId AppLayerParserProtocolGetLoggerBits(uint8_t ipproto, AppProto alproto)
Definition: app-layer-parser.c:1583
AppLayerParserGetFrameIdByName
int AppLayerParserGetFrameIdByName(uint8_t ipproto, AppProto alproto, const char *name)
Definition: app-layer-parser.c:1632
AppLayerGetTxIterState::u64
uint64_t u64
Definition: app-layer-parser.h:147
AppLayerParserSetup
int AppLayerParserSetup(void)
Definition: app-layer-parser.c:262
AppLayerParserRegisterProtocolUnittests
void AppLayerParserRegisterProtocolUnittests(uint8_t ipproto, AppProto alproto, void(*RegisterUnittests)(void))
Definition: app-layer-parser.c:1926
AppLayerDecoderEvents_
Data structure to store app layer decoder events.
Definition: app-layer-events.h:34
AppLayerParserSetStreamDepth
void AppLayerParserSetStreamDepth(uint8_t ipproto, AppProto alproto, uint32_t stream_depth)
Definition: app-layer-parser.c:1602
AppLayerParserStateIssetFlag
uint16_t AppLayerParserStateIssetFlag(AppLayerParserState *pstate, uint16_t flag)
Definition: app-layer-parser.c:1822
AppLayerParserGetProtocolParserLocalStorage
void * AppLayerParserGetProtocolParserLocalStorage(uint8_t ipproto, AppProto alproto)
Definition: app-layer-parser.c:639
AppLayerParserFPtr
AppLayerResult(* AppLayerParserFPtr)(Flow *f, void *protocol_state, AppLayerParserState *pstate, StreamSlice stream_slice, void *local_storage)
Prototype for parsing functions.
Definition: app-layer-parser.h:141
AppLayerParserRegisterLoggerFuncs
void AppLayerParserRegisterLoggerFuncs(uint8_t ipproto, AppProto alproto, LoggerId(*StateGetTxLogged)(void *, void *), void(*StateSetTxLogged)(void *, void *, LoggerId))
FileApplyTxFlags
void FileApplyTxFlags(const AppLayerTxData *txd, const uint8_t direction, File *file)
Definition: util-file.c:292
AppLayerParserConfParserEnabled
int AppLayerParserConfParserEnabled(const char *ipproto, const char *alproto_name)
Given a protocol name, checks if the parser is enabled in the conf file.
Definition: app-layer-parser.c:334
AppLayerParserTriggerRawStreamReassembly
void AppLayerParserTriggerRawStreamReassembly(Flow *f, int direction)
Definition: app-layer-parser.c:1591
AppLayerParserGetEventInfo
int AppLayerParserGetEventInfo(uint8_t ipproto, AppProto alproto, const char *event_name, int *event_id, AppLayerEventType *event_type)
Definition: app-layer-parser.c:1158
AppLayerParserState_
Definition: app-layer-parser.c:139
AppLayerParserGetTransactionLogId
uint64_t AppLayerParserGetTransactionLogId(AppLayerParserState *pstate)
Definition: app-layer-parser.c:712
AppLayerParserRegisterLocalStorageFunc
void AppLayerParserRegisterLocalStorageFunc(uint8_t ipproto, AppProto proto, void *(*LocalStorageAlloc)(void), void(*LocalStorageFree)(void *))
Definition: app-layer-parser.c:444
AppLayerParserStateSetFlag
void AppLayerParserStateSetFlag(AppLayerParserState *pstate, uint16_t flag)
Definition: app-layer-parser.c:1814
AppLayerParserRegisterStateProgressCompletionStatus
void AppLayerParserRegisterStateProgressCompletionStatus(AppProto alproto, const int ts, const int tc)
Definition: app-layer-parser.c:548
AppLayerParserProtoIsRegistered
int AppLayerParserProtoIsRegistered(uint8_t ipproto, AppProto alproto)
Definition: app-layer-parser.c:230
AppLayerParserSupportsFiles
int AppLayerParserSupportsFiles(uint8_t ipproto, AppProto alproto)
Definition: app-layer-parser.c:1203
ThreadVars_
Per thread variable structure.
Definition: threadvars.h:57
AppLayerParserGetTxFiles
AppLayerGetFileState AppLayerParserGetTxFiles(const Flow *f, void *state, void *tx, const uint8_t direction)
Definition: app-layer-parser.c:890
AppLayerParserGetOptionFlags
uint32_t AppLayerParserGetOptionFlags(uint8_t protomap, AppProto alproto)
Definition: app-layer-parser.c:425
AppLayerParserRegisterOptionFlags
void AppLayerParserRegisterOptionFlags(uint8_t ipproto, AppProto alproto, uint32_t flags)
Definition: app-layer-parser.c:415
AppLayerParserRegisterStateDataFunc
void AppLayerParserRegisterStateDataFunc(uint8_t ipproto, AppProto alproto, AppLayerStateData *(*GetStateData)(void *state))
Definition: app-layer-parser.c:607
AppLayerParserRegisterGetTxFilesFunc
void AppLayerParserRegisterGetTxFilesFunc(uint8_t ipproto, AppProto alproto, AppLayerGetFileState(*GetTxFiles)(void *, void *, uint8_t))
Definition: app-layer-parser.c:458
AppLayerParserGetTxData
AppLayerTxData * AppLayerParserGetTxData(uint8_t ipproto, AppProto alproto, void *tx)
Definition: app-layer-parser.c:1215
AppLayerParserRegisterTxDataFunc
void AppLayerParserRegisterTxDataFunc(uint8_t ipproto, AppProto alproto, AppLayerTxData *(*GetTxData)(void *tx))
Definition: app-layer-parser.c:597
AppLayerParserTransactionsCleanup
void AppLayerParserTransactionsCleanup(Flow *f, const uint8_t pkt_dir)
remove obsolete (inspected and logged) transactions
Definition: app-layer-parser.c:921
AppLayerParserDestroyProtocolParserLocalStorage
void AppLayerParserDestroyProtocolParserLocalStorage(uint8_t ipproto, AppProto alproto, void *local_data)
Definition: app-layer-parser.c:654
AppLayerGetTxIterState
Definition: app-layer-parser.h:144
AppLayerParserGetTransactionInspectId
uint64_t AppLayerParserGetTransactionInspectId(AppLayerParserState *pstate, uint8_t direction)
Definition: app-layer-parser.c:729
AppLayerParserHasDecoderEvents
bool AppLayerParserHasDecoderEvents(AppLayerParserState *pstate)
Definition: app-layer-parser.c:1547
AppLayerParserSetTransactionInspectId
void AppLayerParserSetTransactionInspectId(const Flow *f, AppLayerParserState *pstate, void *alstate, const uint8_t flags, bool tag_txs_as_inspected)
Definition: app-layer-parser.c:760
AppLayerParserRegisterGetTxIterator
void AppLayerParserRegisterGetTxIterator(uint8_t ipproto, AppProto alproto, AppLayerGetTxIteratorFunc Func)
Definition: app-layer-parser.c:540
AppLayerGetTxIterator
AppLayerGetTxIteratorFunc AppLayerGetTxIterator(const uint8_t ipproto, const AppProto alproto)
Definition: app-layer-parser.c:704
AppLayerParserRestoreParserTable
void AppLayerParserRestoreParserTable(void)
Definition: app-layer-parser.c:1943
AppLayerGetTxIterState
struct AppLayerGetTxIterState AppLayerGetTxIterState
AppLayerParserRegisterTxFreeFunc
void AppLayerParserRegisterTxFreeFunc(uint8_t ipproto, AppProto alproto, void(*StateTransactionFree)(void *, uint64_t))
Definition: app-layer-parser.c:507
AppLayerParserDeSetup
int AppLayerParserDeSetup(void)
Definition: app-layer-parser.c:283
ConfigAction
ConfigAction
Definition: util-config.h:27
AppLayerParserGetFrameNameById
const char * AppLayerParserGetFrameNameById(uint8_t ipproto, AppProto alproto, const uint8_t id)
Definition: app-layer-parser.c:1641
AppLayerFramesFreeContainer
void AppLayerFramesFreeContainer(Flow *f)
Definition: app-layer-parser.c:175
util-file.h
File_
Definition: util-file.h:79
AppLayerTxData
struct AppLayerTxData AppLayerTxData
Definition: detect.h:1303
AppLayerParserIsEnabled
int AppLayerParserIsEnabled(AppProto alproto)
simple way to globally test if a alproto is registered and fully enabled in the configuration.
Definition: app-layer-parser.c:1565
flags
uint8_t flags
Definition: decode-gre.h:0
AppLayerParserGetFrameNameByIdFn
const char *(* AppLayerParserGetFrameNameByIdFn)(const uint8_t id)
Definition: app-layer-parser.h:160
AppLayerParserGetStateData
AppLayerStateData * AppLayerParserGetStateData(uint8_t ipproto, AppProto alproto, void *state)
Definition: app-layer-parser.c:1222
AppLayerParserApplyTxConfig
void AppLayerParserApplyTxConfig(uint8_t ipproto, AppProto alproto, void *state, void *tx, enum ConfigAction mode, AppLayerTxConfig)
Definition: app-layer-parser.c:1233
AppLayerParserSetTransactionLogId
void AppLayerParserSetTransactionLogId(AppLayerParserState *pstate, uint64_t tx_id)
Definition: app-layer-parser.c:719
AppLayerParserRegisterStateFuncs
void AppLayerParserRegisterStateFuncs(uint8_t ipproto, AppProto alproto, void *(*StateAlloc)(void *, AppProto), void(*StateFree)(void *))
Definition: app-layer-parser.c:431
AppLayerParserRegisterUnittests
void AppLayerParserRegisterUnittests(void)
Definition: app-layer-parser.c:2038
AppLayerParserStateCleanup
void AppLayerParserStateCleanup(const Flow *f, void *alstate, AppLayerParserState *pstate)
Definition: app-layer-parser.c:1669
AppLayerParserBackupParserTable
void AppLayerParserBackupParserTable(void)
Definition: app-layer-parser.c:1935
AppLayerParserRegisterGetStateProgressFunc
void AppLayerParserRegisterGetStateProgressFunc(uint8_t ipproto, AppProto alproto, int(*StateGetStateProgress)(void *alstate, uint8_t direction))
Definition: app-layer-parser.c:496
tv
ThreadVars * tv
Definition: fuzz_decodepcapfile.c:32
AppLayerGetTxIterState::un
union AppLayerGetTxIterState::@16 un
app-layer-events.h
AppLayerParserRegisterTruncateFunc
void AppLayerParserRegisterTruncateFunc(uint8_t ipproto, AppProto alproto, void(*Truncate)(void *, uint8_t))
Definition: app-layer-parser.c:486
AppLayerParserRegisterProtocolParsers
void AppLayerParserRegisterProtocolParsers(void)
Definition: app-layer-parser.c:1755
AppLayerParserGetFirstDataDir
uint8_t AppLayerParserGetFirstDataDir(uint8_t ipproto, AppProto alproto)
Definition: app-layer-parser.c:1179
AppLayerParserRegisterGetEventInfo
void AppLayerParserRegisterGetEventInfo(uint8_t ipproto, AppProto alproto, int(*StateGetEventInfo)(const char *event_name, int *event_id, AppLayerEventType *event_type))
Definition: app-layer-parser.c:585
util-config.h
AppLayerParserGetTxCnt
uint64_t AppLayerParserGetTxCnt(const Flow *, void *alstate)
Definition: app-layer-parser.c:1136
AppLayerParserRegisterParser
int AppLayerParserRegisterParser(uint8_t ipproto, AppProto alproto, uint8_t direction, AppLayerParserFPtr Parser)
Register app layer parser for the protocol.
Definition: app-layer-parser.c:392
AppLayerParserProtocolHasLogger
int AppLayerParserProtocolHasLogger(uint8_t ipproto, AppProto alproto)
Definition: app-layer-parser.c:1575
AppLayerParserThreadCtxAlloc
AppLayerParserThreadCtx * AppLayerParserThreadCtxAlloc(void)
Gets a new app layer protocol's parser thread context.
Definition: app-layer-parser.c:293
AppLayerParserSetStreamDepthFlag
void AppLayerParserSetStreamDepthFlag(uint8_t ipproto, AppProto alproto, void *state, uint64_t tx_id, uint8_t flags)
Definition: app-layer-parser.c:1618
AppLayerGetTxIteratorFunc
AppLayerGetTxIterTuple(* AppLayerGetTxIteratorFunc)(const uint8_t ipproto, const AppProto alproto, void *alstate, uint64_t min_tx_id, uint64_t max_tx_id, AppLayerGetTxIterState *state)
tx iterator prototype
Definition: app-layer-parser.h:153
AppLayerParserThreadCtx_
Definition: app-layer-parser.c:66
AppLayerParserStateFree
void AppLayerParserStateFree(AppLayerParserState *pstate)
Definition: app-layer-parser.c:250
AppLayerParserGetEventsByTx
AppLayerDecoderEvents * AppLayerParserGetEventsByTx(uint8_t ipproto, AppProto alproto, void *tx)
Definition: app-layer-parser.c:874
AppLayerParserRegisterApplyTxConfigFunc
void AppLayerParserRegisterApplyTxConfigFunc(uint8_t ipproto, AppProto alproto, bool(*ApplyTxConfig)(void *state, void *tx, int mode, AppLayerTxConfig))
Definition: app-layer-parser.c:617
AppLayerParserParse
int AppLayerParserParse(ThreadVars *tv, AppLayerParserThreadCtx *tctx, Flow *f, AppProto alproto, uint8_t flags, const uint8_t *input, uint32_t input_len)
Definition: app-layer-parser.c:1323
AppLayerParserGetFrameIdByNameFn
int(* AppLayerParserGetFrameIdByNameFn)(const char *frame_name)
Definition: app-layer-parser.h:159
AppLayerParserRegisterParserAcceptableDataDirection
void AppLayerParserRegisterParserAcceptableDataDirection(uint8_t ipproto, AppProto alproto, uint8_t direction)
Definition: app-layer-parser.c:404
AppLayerParserGetStateProgressCompletionStatus
int AppLayerParserGetStateProgressCompletionStatus(AppProto alproto, uint8_t direction)
Definition: app-layer-parser.c:1150
AppLayerParserStateProtoCleanup
void AppLayerParserStateProtoCleanup(uint8_t protomap, AppProto alproto, void *alstate, AppLayerParserState *pstate)
Definition: app-layer-parser.c:1652
AppLayerParserGetTransactionActive
uint64_t AppLayerParserGetTransactionActive(const Flow *f, AppLayerParserState *pstate, uint8_t direction)
Definition: app-layer-parser.c:1186