suricata
app-layer-parser.h
Go to the documentation of this file.
1 /* Copyright (C) 2007-2025 Open Information Security Foundation
2  *
3  * You can copy, redistribute or modify this Program under the terms of
4  * the GNU General Public License version 2 as published by the Free
5  * Software Foundation.
6  *
7  * This program is distributed in the hope that it will be useful,
8  * but WITHOUT ANY WARRANTY; without even the implied warranty of
9  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
10  * GNU General Public License for more details.
11  *
12  * You should have received a copy of the GNU General Public License
13  * version 2 along with this program; if not, write to the Free Software
14  * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA
15  * 02110-1301, USA.
16  */
17 
18 /**
19  * \file
20  *
21  * \author Victor Julien <victor@inliniac.net>
22  * \author Anoop Saldanha <anoopsaldanha@gmail.com>
23  */
24 
25 #ifndef SURICATA_APP_LAYER_PARSER_H
26 #define SURICATA_APP_LAYER_PARSER_H
27 
28 #include "app-layer-protos.h"
29 // Forward declarations for bindgen
30 enum ConfigAction;
31 typedef struct Flow_ Flow;
34 typedef struct ThreadVars_ ThreadVars;
35 typedef struct File_ File;
36 typedef enum LoggerId LoggerId;
37 // Forward declarations from rust
38 typedef struct StreamSlice StreamSlice;
39 typedef struct AppLayerResult AppLayerResult;
42 typedef struct AppLayerTxData AppLayerTxData;
45 typedef struct AppLayerTxConfig AppLayerTxConfig;
46 
47 /* Flags for AppLayerParserState. */
48 // flag available BIT_U16(0)
49 #define APP_LAYER_PARSER_NO_INSPECTION BIT_U16(1)
50 #define APP_LAYER_PARSER_NO_REASSEMBLY BIT_U16(2)
51 #define APP_LAYER_PARSER_NO_INSPECTION_PAYLOAD BIT_U16(3)
52 #define APP_LAYER_PARSER_BYPASS_READY BIT_U16(4)
53 #define APP_LAYER_PARSER_EOF_TS BIT_U16(5)
54 #define APP_LAYER_PARSER_EOF_TC BIT_U16(6)
55 /* 2x vacancy */
56 #define APP_LAYER_PARSER_SFRAME_TS BIT_U16(9)
57 #define APP_LAYER_PARSER_SFRAME_TC BIT_U16(10)
58 
59 /* Flags for AppLayerParserProtoCtx. */
60 #define APP_LAYER_PARSER_OPT_ACCEPT_GAPS BIT_U32(0)
61 
62 #define APP_LAYER_PARSER_INT_STREAM_DEPTH_SET BIT_U32(0)
63 
64 /* for use with the detect_progress_ts|detect_progress_tc fields */
65 
66 /** should inspection be skipped in that direction */
67 #define APP_LAYER_TX_SKIP_INSPECT_TS BIT_U8(0)
68 #define APP_LAYER_TX_SKIP_INSPECT_TC BIT_U8(1)
69 /** is tx fully inspected? */
70 #define APP_LAYER_TX_INSPECTED_TS BIT_U8(2)
71 #define APP_LAYER_TX_INSPECTED_TC BIT_U8(3)
72 /** accept is applied to entire tx */
73 #define APP_LAYER_TX_ACCEPT BIT_U8(4)
74 
75 /** parser has successfully processed in the input, and has consumed
76  * all of it. */
77 #define APP_LAYER_OK (AppLayerResult) { 0, 0, 0 }
78 
79 /** parser has hit an unrecoverable error. Returning this to the API
80  * leads to no further calls to the parser. */
81 #define APP_LAYER_ERROR (AppLayerResult) { -1, 0, 0 }
82 
83 /** parser needs more data. Through 'c' it will indicate how many
84  * of the input bytes it has consumed. Through 'n' it will indicate
85  * how many more bytes it needs before getting called again.
86  * \note consumed (c) should never be more than the input len
87  * needed (n) + consumed (c) should be more than the input len
88  */
89 #define APP_LAYER_INCOMPLETE(c,n) (AppLayerResult) { 1, (c), (n) }
90 
91 int AppLayerParserProtoIsRegistered(uint8_t ipproto, AppProto alproto);
92 
93 /***** transaction handling *****/
94 
95 int AppLayerParserSetup(void);
98 
100 
101 /**
102  * \brief Gets a new app layer protocol's parser thread context.
103  *
104  * \retval Non-NULL pointer on success.
105  * NULL pointer on failure.
106  */
108 
109 /**
110  * \brief Destroys the app layer parser thread context obtained
111  * using AppLayerParserThreadCtxAlloc().
112  *
113  * \param tctx Pointer to the thread context to be destroyed.
114  */
116 
117 /**
118  * \brief Given a protocol name, checks if the parser is enabled in
119  * the conf file.
120  *
121  * \param alproto_name Name of the app layer protocol.
122  *
123  * \retval 1 If enabled.
124  * \retval 0 If disabled.
125  */
126 int SCAppLayerParserConfParserEnabled(const char *ipproto, const char *alproto_name);
127 
129 
130 /** \brief Prototype for parsing functions */
131 typedef AppLayerResult (*AppLayerParserFPtr)(Flow *f, void *protocol_state,
132  AppLayerParserState *pstate, StreamSlice stream_slice, void *local_storage);
133 
134 typedef struct AppLayerGetTxIterState {
135  union {
136  void *ptr;
137  uint64_t u64;
138  } un;
140 
141 /** \brief tx iterator prototype */
143  (const uint8_t ipproto, const AppProto alproto,
144  void *alstate, uint64_t min_tx_id, uint64_t max_tx_id,
145  AppLayerGetTxIterState *state);
146 
147 /***** Parser related registration *****/
148 
149 /**
150  * \param name progress name to get the id for
151  * \param direction STREAM_TOSERVER/STREAM_TOCLIENT
152  */
153 typedef int (*AppLayerParserGetStateIdByNameFn)(const char *name, const uint8_t direction);
154 /**
155  * \param id progress value id to get the name for
156  * \param direction STREAM_TOSERVER/STREAM_TOCLIENT
157  */
158 typedef const char *(*AppLayerParserGetStateNameByIdFn)(const int id, const uint8_t direction);
159 
160 typedef int (*AppLayerParserGetFrameIdByNameFn)(const char *frame_name);
161 typedef const char *(*AppLayerParserGetFrameNameByIdFn)(const uint8_t id);
162 
163 int AppLayerParserPreRegister(void (*Register)(void));
164 /**
165  * \brief Register app layer parser for the protocol.
166  *
167  * \retval 0 On success.
168  * \retval -1 On failure.
169  */
170 int AppLayerParserRegisterParser(uint8_t ipproto, AppProto alproto,
171  uint8_t direction,
172  AppLayerParserFPtr Parser);
174  uint8_t ipproto, AppProto alproto, uint8_t direction);
175 void AppLayerParserRegisterOptionFlags(uint8_t ipproto, AppProto alproto,
176  uint32_t flags);
177 void AppLayerParserRegisterStateFuncs(uint8_t ipproto, AppProto alproto,
178  void *(*StateAlloc)(void *, AppProto), void (*StateFree)(void *));
180  void *(*LocalStorageAlloc)(void), void (*LocalStorageFree)(void *));
181 // void AppLayerParserRegisterGetEventsFunc(uint8_t ipproto, AppProto proto,
182 // AppLayerDecoderEvents *(*StateGetEvents)(void *) __attribute__((nonnull)));
184  uint8_t ipproto, AppProto alproto, AppLayerGetFileState (*GetTxFiles)(void *, uint8_t));
185 void SCAppLayerParserRegisterLogger(uint8_t ipproto, AppProto alproto);
186 void AppLayerParserRegisterLoggerBits(uint8_t ipproto, AppProto alproto, LoggerId bits);
187 void AppLayerParserRegisterGetStateProgressFunc(uint8_t ipproto, AppProto alproto,
188  int (*StateGetStateProgress)(void *alstate, uint8_t direction));
189 void AppLayerParserRegisterTxFreeFunc(uint8_t ipproto, AppProto alproto,
190  void (*StateTransactionFree)(void *, uint64_t));
191 void AppLayerParserRegisterGetTxCnt(uint8_t ipproto, AppProto alproto,
192  uint64_t (*StateGetTxCnt)(void *alstate));
193 void AppLayerParserRegisterGetTx(uint8_t ipproto, AppProto alproto,
194  void *(StateGetTx)(void *alstate, uint64_t tx_id));
195 void AppLayerParserRegisterGetTxIterator(uint8_t ipproto, AppProto alproto,
198  AppProto alproto, const int ts, const int tc);
199 void AppLayerParserRegisterGetEventInfo(uint8_t ipproto, AppProto alproto,
200  int (*StateGetEventInfo)(
201  const char *event_name, uint8_t *event_id, AppLayerEventType *event_type));
202 void AppLayerParserRegisterGetEventInfoById(uint8_t ipproto, AppProto alproto,
203  int (*StateGetEventInfoById)(
204  uint8_t event_id, const char **event_name, AppLayerEventType *event_type));
205 void AppLayerParserRegisterGetFrameFuncs(uint8_t ipproto, AppProto alproto,
206  AppLayerParserGetFrameIdByNameFn GetFrameIdByName,
207  AppLayerParserGetFrameNameByIdFn GetFrameNameById);
208 void AppLayerParserRegisterSetStreamDepthFlag(uint8_t ipproto, AppProto alproto,
209  void (*SetStreamDepthFlag)(void *tx, uint8_t flags));
210 void AppLayerParserRegisterGetStateFuncs(uint8_t ipproto, AppProto alproto,
211  AppLayerParserGetStateIdByNameFn GetStateIdByName,
212  AppLayerParserGetStateNameByIdFn GetStateNameById);
213 
214 void AppLayerParserRegisterTxDataFunc(uint8_t ipproto, AppProto alproto,
215  AppLayerTxData *(*GetTxData)(void *tx));
216 void AppLayerParserRegisterApplyTxConfigFunc(uint8_t ipproto, AppProto alproto,
217  bool (*ApplyTxConfig)(void *state, void *tx, int mode, AppLayerTxConfig));
219  uint8_t ipproto, AppProto alproto, AppLayerStateData *(*GetStateData)(void *state));
220 
221 /***** Get and transaction functions *****/
222 
224  const AppProto alproto);
225 
226 void *AppLayerParserGetProtocolParserLocalStorage(uint8_t ipproto, AppProto alproto);
227 void AppLayerParserDestroyProtocolParserLocalStorage(uint8_t ipproto, AppProto alproto,
228  void *local_data);
229 
230 
232 void AppLayerParserSetTransactionLogId(AppLayerParserState *pstate, uint64_t tx_id);
233 
234 uint64_t AppLayerParserGetTransactionInspectId(AppLayerParserState *pstate, uint8_t direction);
236  void *alstate, const uint8_t flags, bool tag_txs_as_inspected);
237 
239 AppLayerDecoderEvents *AppLayerParserGetEventsByTx(uint8_t ipproto, AppProto alproto, void *tx);
240 AppLayerGetFileState AppLayerParserGetTxFiles(const Flow *f, void *tx, const uint8_t direction);
241 int AppLayerParserGetStateProgress(uint8_t ipproto, AppProto alproto,
242  void *alstate, uint8_t direction);
243 uint64_t AppLayerParserGetTxCnt(const Flow *, void *alstate);
244 void *AppLayerParserGetTx(uint8_t ipproto, AppProto alproto, void *alstate, uint64_t tx_id);
245 int AppLayerParserGetStateProgressCompletionStatus(AppProto alproto, uint8_t direction);
246 int AppLayerParserGetEventInfo(uint8_t ipproto, AppProto alproto, const char *event_name,
247  uint8_t *event_id, AppLayerEventType *event_type);
248 int AppLayerParserGetEventInfoById(uint8_t ipproto, AppProto alproto, uint8_t event_id,
249  const char **event_name, AppLayerEventType *event_type);
250 
251 uint64_t AppLayerParserGetTransactionActive(const Flow *f, AppLayerParserState *pstate, uint8_t direction);
252 
253 uint8_t AppLayerParserGetFirstDataDir(uint8_t ipproto, AppProto alproto);
254 
255 bool AppLayerParserSupportsFiles(uint8_t ipproto, AppProto alproto);
256 
257 AppLayerTxData *AppLayerParserGetTxData(uint8_t ipproto, AppProto alproto, void *tx);
258 uint8_t AppLayerParserGetTxDetectProgress(AppLayerTxData *txd, const uint8_t dir);
259 AppLayerStateData *AppLayerParserGetStateData(uint8_t ipproto, AppProto alproto, void *state);
260 void AppLayerParserApplyTxConfig(uint8_t ipproto, AppProto alproto,
261  void *state, void *tx, enum ConfigAction mode, AppLayerTxConfig);
262 
263 /** \brief check if tx (possibly) has files in this tx for the direction */
264 #define AppLayerParserHasFilesInDir(txd, direction) \
265  ((txd)->files_opened && ((txd)->file_tx & (direction)) != 0)
266 
267 /***** General *****/
268 
270  uint8_t flags, const uint8_t *input, uint32_t input_len);
273 int AppLayerParserProtocolHasLogger(uint8_t ipproto, AppProto alproto);
274 LoggerId AppLayerParserProtocolGetLoggerBits(uint8_t ipproto, AppProto alproto);
275 void AppLayerParserTriggerRawStreamInspection(Flow *f, int direction);
276 void SCAppLayerParserSetStreamDepth(uint8_t ipproto, AppProto alproto, uint32_t stream_depth);
277 uint32_t AppLayerParserGetStreamDepth(const Flow *f);
278 void AppLayerParserSetStreamDepthFlag(uint8_t ipproto, AppProto alproto, void *state, uint64_t tx_id, uint8_t flags);
279 int AppLayerParserIsEnabled(AppProto alproto);
280 int AppLayerParserGetFrameIdByName(uint8_t ipproto, AppProto alproto, const char *name);
281 const char *AppLayerParserGetFrameNameById(uint8_t ipproto, AppProto alproto, const uint8_t id);
282 /**
283  * \param name progress name to get the id for
284  * \param direction STREAM_TOSERVER/STREAM_TOCLIENT
285  */
287  uint8_t ipproto, AppProto alproto, const char *name, uint8_t direction);
288 /**
289  * \param id progress value id to get the name for
290  * \param direction STREAM_TOSERVER/STREAM_TOCLIENT
291  */
293  uint8_t ipproto, AppProto alproto, const int id, uint8_t direction);
294 
295 /***** Cleanup *****/
296 
298  uint8_t protomap, AppProto alproto, void *alstate, AppLayerParserState *pstate);
299 void AppLayerParserStateCleanup(const Flow *f, void *alstate, AppLayerParserState *pstate);
300 
302 
303 void SCAppLayerParserStateSetFlag(AppLayerParserState *pstate, uint16_t flag);
304 uint16_t SCAppLayerParserStateIssetFlag(AppLayerParserState *pstate, uint16_t flag);
305 
308 
309 void AppLayerParserTransactionsCleanup(Flow *f, const uint8_t pkt_dir);
310 
311 /***** Unittests *****/
312 
313 #ifdef UNITTESTS
314 void AppLayerParserRegisterProtocolUnittests(uint8_t ipproto, AppProto alproto,
315  void (*RegisterUnittests)(void));
317 void UTHAppLayerParserStateGetIds(void *ptr, uint64_t *i1, uint64_t *i2, uint64_t *log, uint64_t *min);
318 #endif
319 
321 void FileApplyTxFlags(const AppLayerTxData *txd, const uint8_t direction, File *file);
322 
323 #endif /* SURICATA_APP_LAYER_PARSER_H */
AppLayerParserGetStateProgress
int AppLayerParserGetStateProgress(uint8_t ipproto, AppProto alproto, void *alstate, uint8_t direction)
get the progress value for a tx/protocol
Definition: app-layer-parser.c:1087
AppLayerParserThreadCtxFree
void AppLayerParserThreadCtxFree(AppLayerParserThreadCtx *tctx)
Destroys the app layer parser thread context obtained using AppLayerParserThreadCtxAlloc().
Definition: app-layer-parser.c:324
AppLayerParserGetTx
void * AppLayerParserGetTx(uint8_t ipproto, AppProto alproto, void *alstate, uint64_t tx_id)
Definition: app-layer-parser.c:1109
AppLayerParserPostStreamSetup
void AppLayerParserPostStreamSetup(void)
Definition: app-layer-parser.c:272
AppLayerParserGetDecoderEvents
AppLayerDecoderEvents * AppLayerParserGetDecoderEvents(AppLayerParserState *pstate)
Definition: app-layer-parser.c:849
AppLayerParserRegisterGetTx
void AppLayerParserRegisterGetTx(uint8_t ipproto, AppProto alproto, void *(StateGetTx)(void *alstate, uint64_t tx_id))
Definition: app-layer-parser.c:530
ts
uint64_t ts
Definition: source-erf-file.c:55
AppLayerParserRegisterLoggerBits
void AppLayerParserRegisterLoggerBits(uint8_t ipproto, AppProto alproto, LoggerId bits)
Definition: app-layer-parser.c:482
AppLayerGetTxIterState::ptr
void * ptr
Definition: app-layer-parser.h:136
AppLayerParserStateAlloc
AppLayerParserState * AppLayerParserStateAlloc(void)
Definition: app-layer-parser.c:235
AppLayerParserSetEOF
void AppLayerParserSetEOF(AppLayerParserState *pstate)
Definition: app-layer-parser.c:1497
AppLayerParserRegisterGetTxCnt
void AppLayerParserRegisterGetTxCnt(uint8_t ipproto, AppProto alproto, uint64_t(*StateGetTxCnt)(void *alstate))
Definition: app-layer-parser.c:520
StreamSlice
struct StreamSlice StreamSlice
Definition: app-layer-parser.h:38
AppLayerParserRegisterGetFrameFuncs
void AppLayerParserRegisterGetFrameFuncs(uint8_t ipproto, AppProto alproto, AppLayerParserGetFrameIdByNameFn GetFrameIdByName, AppLayerParserGetFrameNameByIdFn GetFrameNameById)
Definition: app-layer-parser.c:585
AppLayerParserGetStreamDepth
uint32_t AppLayerParserGetStreamDepth(const Flow *f)
Definition: app-layer-parser.c:1579
AppProto
uint16_t AppProto
Definition: app-layer-protos.h:86
AppLayerParserRegisterSetStreamDepthFlag
void AppLayerParserRegisterSetStreamDepthFlag(uint8_t ipproto, AppProto alproto, void(*SetStreamDepthFlag)(void *tx, uint8_t flags))
Definition: app-layer-parser.c:636
Flow_
Flow data structure.
Definition: flow.h:356
LoggerId
LoggerId
Definition: suricata-common.h:477
SCAppLayerParserConfParserEnabled
int SCAppLayerParserConfParserEnabled(const char *ipproto, const char *alproto_name)
Given a protocol name, checks if the parser is enabled in the conf file.
Definition: app-layer-parser.c:345
UTHAppLayerParserStateGetIds
void UTHAppLayerParserStateGetIds(void *ptr, uint64_t *i1, uint64_t *i2, uint64_t *log, uint64_t *min)
Definition: app-layer-parser.c:214
AppLayerErrorGetExceptionPolicy
enum ExceptionPolicy AppLayerErrorGetExceptionPolicy(void)
Definition: app-layer-parser.c:162
AppLayerTxData
struct AppLayerTxData AppLayerTxData
Definition: app-layer-parser.h:42
AppLayerEventType
enum AppLayerEventType AppLayerEventType
Definition: app-layer-parser.h:43
proto
uint8_t proto
Definition: decode-template.h:0
AppLayerParserProtocolGetLoggerBits
LoggerId AppLayerParserProtocolGetLoggerBits(uint8_t ipproto, AppProto alproto)
Definition: app-layer-parser.c:1549
AppLayerParserGetFrameIdByName
int AppLayerParserGetFrameIdByName(uint8_t ipproto, AppProto alproto, const char *name)
Definition: app-layer-parser.c:1627
AppLayerParserRegisterGetEventInfoById
void AppLayerParserRegisterGetEventInfoById(uint8_t ipproto, AppProto alproto, int(*StateGetEventInfoById)(uint8_t event_id, const char **event_name, AppLayerEventType *event_type))
Definition: app-layer-parser.c:563
AppLayerGetTxIterState::u64
uint64_t u64
Definition: app-layer-parser.h:137
AppLayerParserSetup
int AppLayerParserSetup(void)
Definition: app-layer-parser.c:259
AppLayerParserRegisterProtocolUnittests
void AppLayerParserRegisterProtocolUnittests(uint8_t ipproto, AppProto alproto, void(*RegisterUnittests)(void))
Definition: app-layer-parser.c:1840
LoggerId
enum LoggerId LoggerId
Definition: app-layer-parser.h:36
AppLayerDecoderEvents_
Data structure to store app layer decoder events.
Definition: app-layer-events.h:36
AppLayerTxConfig
struct AppLayerTxConfig AppLayerTxConfig
Definition: app-layer-parser.h:45
AppLayerParserGetProtocolParserLocalStorage
void * AppLayerParserGetProtocolParserLocalStorage(uint8_t ipproto, AppProto alproto)
Definition: app-layer-parser.c:648
AppLayerParserRegisterGetTxFilesFunc
void AppLayerParserRegisterGetTxFilesFunc(uint8_t ipproto, AppProto alproto, AppLayerGetFileState(*GetTxFiles)(void *, uint8_t))
Definition: app-layer-parser.c:472
AppLayerParserFPtr
AppLayerResult(* AppLayerParserFPtr)(Flow *f, void *protocol_state, AppLayerParserState *pstate, StreamSlice stream_slice, void *local_storage)
Prototype for parsing functions.
Definition: app-layer-parser.h:131
AppLayerParserGetTxDetectProgress
uint8_t AppLayerParserGetTxDetectProgress(AppLayerTxData *txd, const uint8_t dir)
Definition: app-layer-parser.c:743
FileApplyTxFlags
void FileApplyTxFlags(const AppLayerTxData *txd, const uint8_t direction, File *file)
Definition: util-file.c:278
AppLayerResult
struct AppLayerResult AppLayerResult
Definition: app-layer-parser.h:39
SCAppLayerParserStateSetFlag
void SCAppLayerParserStateSetFlag(AppLayerParserState *pstate, uint16_t flag)
Definition: app-layer-parser.c:1821
AppLayerParserState_
Definition: app-layer-parser.c:135
AppLayerParserGetTransactionLogId
uint64_t AppLayerParserGetTransactionLogId(AppLayerParserState *pstate)
Definition: app-layer-parser.c:715
AppLayerParserRegisterLocalStorageFunc
void AppLayerParserRegisterLocalStorageFunc(uint8_t ipproto, AppProto proto, void *(*LocalStorageAlloc)(void), void(*LocalStorageFree)(void *))
Definition: app-layer-parser.c:460
AppLayerParserRegisterStateProgressCompletionStatus
void AppLayerParserRegisterStateProgressCompletionStatus(AppProto alproto, const int ts, const int tc)
Definition: app-layer-parser.c:548
AppLayerGetTxIterTuple
struct AppLayerGetTxIterTuple AppLayerGetTxIterTuple
Definition: app-layer-parser.h:40
AppLayerParserProtoIsRegistered
int AppLayerParserProtoIsRegistered(uint8_t ipproto, AppProto alproto)
Definition: app-layer-parser.c:228
AppLayerParserRegisterGetStateFuncs
void AppLayerParserRegisterGetStateFuncs(uint8_t ipproto, AppProto alproto, AppLayerParserGetStateIdByNameFn GetStateIdByName, AppLayerParserGetStateNameByIdFn GetStateNameById)
Definition: app-layer-parser.c:575
AppLayerGetFileState
struct AppLayerGetFileState AppLayerGetFileState
Definition: app-layer-parser.h:41
SCAppLayerParserStateIssetFlag
uint16_t SCAppLayerParserStateIssetFlag(AppLayerParserState *pstate, uint16_t flag)
Definition: app-layer-parser.c:1829
ThreadVars_
Per thread variable structure.
Definition: threadvars.h:58
SCAppLayerParserRegisterParserAcceptableDataDirection
void SCAppLayerParserRegisterParserAcceptableDataDirection(uint8_t ipproto, AppProto alproto, uint8_t direction)
Definition: app-layer-parser.c:414
AppLayerParserRegisterOptionFlags
void AppLayerParserRegisterOptionFlags(uint8_t ipproto, AppProto alproto, uint32_t flags)
Definition: app-layer-parser.c:425
AppLayerParserRegisterStateDataFunc
void AppLayerParserRegisterStateDataFunc(uint8_t ipproto, AppProto alproto, AppLayerStateData *(*GetStateData)(void *state))
Definition: app-layer-parser.c:616
AppLayerParserGetTxData
AppLayerTxData * AppLayerParserGetTxData(uint8_t ipproto, AppProto alproto, void *tx)
Definition: app-layer-parser.c:1183
AppLayerParserRegisterTxDataFunc
void AppLayerParserRegisterTxDataFunc(uint8_t ipproto, AppProto alproto, AppLayerTxData *(*GetTxData)(void *tx))
Definition: app-layer-parser.c:606
AppLayerParserTransactionsCleanup
void AppLayerParserTransactionsCleanup(Flow *f, const uint8_t pkt_dir)
remove obsolete (inspected and logged) transactions
Definition: app-layer-parser.c:903
AppLayerParserDestroyProtocolParserLocalStorage
void AppLayerParserDestroyProtocolParserLocalStorage(uint8_t ipproto, AppProto alproto, void *local_data)
Definition: app-layer-parser.c:660
AppLayerGetTxIterState
Definition: app-layer-parser.h:134
AppLayerParserGetTransactionInspectId
uint64_t AppLayerParserGetTransactionInspectId(AppLayerParserState *pstate, uint8_t direction)
Definition: app-layer-parser.c:732
AppLayerParserHasDecoderEvents
bool AppLayerParserHasDecoderEvents(AppLayerParserState *pstate)
Definition: app-layer-parser.c:1513
AppLayerParserSetTransactionInspectId
void AppLayerParserSetTransactionInspectId(const Flow *f, AppLayerParserState *pstate, void *alstate, const uint8_t flags, bool tag_txs_as_inspected)
Definition: app-layer-parser.c:754
AppLayerParserRegisterGetTxIterator
void AppLayerParserRegisterGetTxIterator(uint8_t ipproto, AppProto alproto, AppLayerGetTxIteratorFunc Func)
Definition: app-layer-parser.c:540
AppLayerGetTxIterator
AppLayerGetTxIteratorFunc AppLayerGetTxIterator(const uint8_t ipproto, const AppProto alproto)
Definition: app-layer-parser.c:707
AppLayerParserGetStateNameById
const char * AppLayerParserGetStateNameById(uint8_t ipproto, AppProto alproto, const int id, uint8_t direction)
Definition: app-layer-parser.c:1617
AppLayerParserGetTxFiles
AppLayerGetFileState AppLayerParserGetTxFiles(const Flow *f, void *tx, const uint8_t direction)
Definition: app-layer-parser.c:873
name
const char * name
Definition: tm-threads.c:2163
AppLayerParserGetEventInfo
int AppLayerParserGetEventInfo(uint8_t ipproto, AppProto alproto, const char *event_name, uint8_t *event_id, AppLayerEventType *event_type)
Definition: app-layer-parser.c:1124
SCAppLayerParserSetStreamDepth
void SCAppLayerParserSetStreamDepth(uint8_t ipproto, AppProto alproto, uint32_t stream_depth)
Definition: app-layer-parser.c:1568
AppLayerGetTxIterState
struct AppLayerGetTxIterState AppLayerGetTxIterState
AppLayerParserRegisterTxFreeFunc
void AppLayerParserRegisterTxFreeFunc(uint8_t ipproto, AppProto alproto, void(*StateTransactionFree)(void *, uint64_t))
Definition: app-layer-parser.c:510
AppLayerParserDeSetup
int AppLayerParserDeSetup(void)
Definition: app-layer-parser.c:285
ConfigAction
ConfigAction
Definition: util-config.h:27
AppLayerParserGetFrameNameById
const char * AppLayerParserGetFrameNameById(uint8_t ipproto, AppProto alproto, const uint8_t id)
Definition: app-layer-parser.c:1636
AppLayerFramesFreeContainer
void AppLayerFramesFreeContainer(Flow *f)
Definition: app-layer-parser.c:176
File_
Definition: util-file.h:79
AppLayerParserIsEnabled
int AppLayerParserIsEnabled(AppProto alproto)
simple way to globally test if a alproto is registered and fully enabled in the configuration.
Definition: app-layer-parser.c:1531
flags
uint8_t flags
Definition: decode-gre.h:0
AppLayerParserGetFrameNameByIdFn
const char *(* AppLayerParserGetFrameNameByIdFn)(const uint8_t id)
Definition: app-layer-parser.h:161
AppLayerParserGetStateData
AppLayerStateData * AppLayerParserGetStateData(uint8_t ipproto, AppProto alproto, void *state)
Definition: app-layer-parser.c:1190
AppLayerParserApplyTxConfig
void AppLayerParserApplyTxConfig(uint8_t ipproto, AppProto alproto, void *state, void *tx, enum ConfigAction mode, AppLayerTxConfig)
Definition: app-layer-parser.c:1201
AppLayerParserSetTransactionLogId
void AppLayerParserSetTransactionLogId(AppLayerParserState *pstate, uint64_t tx_id)
Definition: app-layer-parser.c:722
AppLayerParserRegisterStateFuncs
void AppLayerParserRegisterStateFuncs(uint8_t ipproto, AppProto alproto, void *(*StateAlloc)(void *, AppProto), void(*StateFree)(void *))
Definition: app-layer-parser.c:435
AppLayerParserRegisterUnittests
void AppLayerParserRegisterUnittests(void)
Definition: app-layer-parser.c:1848
AppLayerParserGetStateNameByIdFn
const char *(* AppLayerParserGetStateNameByIdFn)(const int id, const uint8_t direction)
Definition: app-layer-parser.h:158
AppLayerParserStateCleanup
void AppLayerParserStateCleanup(const Flow *f, void *alstate, AppLayerParserState *pstate)
Definition: app-layer-parser.c:1664
AppLayerParserRegisterGetStateProgressFunc
void AppLayerParserRegisterGetStateProgressFunc(uint8_t ipproto, AppProto alproto, int(*StateGetStateProgress)(void *alstate, uint8_t direction))
Definition: app-layer-parser.c:500
tv
ThreadVars * tv
Definition: fuzz_decodepcapfile.c:32
AppLayerStateData
struct AppLayerStateData AppLayerStateData
Definition: app-layer-parser.h:44
AppLayerParserRegisterProtocolParsers
void AppLayerParserRegisterProtocolParsers(void)
Definition: app-layer-parser.c:1769
AppLayerParserGetFirstDataDir
uint8_t AppLayerParserGetFirstDataDir(uint8_t ipproto, AppProto alproto)
Definition: app-layer-parser.c:1149
AppLayerParserGetStateIdByNameFn
int(* AppLayerParserGetStateIdByNameFn)(const char *name, const uint8_t direction)
Definition: app-layer-parser.h:153
AppLayerParserGetTxCnt
uint64_t AppLayerParserGetTxCnt(const Flow *, void *alstate)
Definition: app-layer-parser.c:1102
SCAppLayerParserRegisterLogger
void SCAppLayerParserRegisterLogger(uint8_t ipproto, AppProto alproto)
Definition: app-layer-parser.c:491
AppLayerParserRegisterParser
int AppLayerParserRegisterParser(uint8_t ipproto, AppProto alproto, uint8_t direction, AppLayerParserFPtr Parser)
Register app layer parser for the protocol.
Definition: app-layer-parser.c:402
AppLayerParserGetStateIdByName
int AppLayerParserGetStateIdByName(uint8_t ipproto, AppProto alproto, const char *name, uint8_t direction)
Definition: app-layer-parser.c:1602
AppLayerParserProtocolHasLogger
int AppLayerParserProtocolHasLogger(uint8_t ipproto, AppProto alproto)
Definition: app-layer-parser.c:1541
app-layer-protos.h
AppLayerParserThreadCtxAlloc
AppLayerParserThreadCtx * AppLayerParserThreadCtxAlloc(void)
Gets a new app layer protocol's parser thread context.
Definition: app-layer-parser.c:297
AppLayerParserSetStreamDepthFlag
void AppLayerParserSetStreamDepthFlag(uint8_t ipproto, AppProto alproto, void *state, uint64_t tx_id, uint8_t flags)
Definition: app-layer-parser.c:1584
AppLayerGetTxIteratorFunc
AppLayerGetTxIterTuple(* AppLayerGetTxIteratorFunc)(const uint8_t ipproto, const AppProto alproto, void *alstate, uint64_t min_tx_id, uint64_t max_tx_id, AppLayerGetTxIterState *state)
tx iterator prototype
Definition: app-layer-parser.h:143
AppLayerParserPreRegister
int AppLayerParserPreRegister(void(*Register)(void))
Definition: app-layer-parser.c:1753
id
uint32_t id
Definition: detect-flowbits.c:938
AppLayerParserThreadCtx_
Definition: app-layer-parser.c:60
AppLayerParserStateFree
void AppLayerParserStateFree(AppLayerParserState *pstate)
Definition: app-layer-parser.c:247
AppLayerParserGetEventsByTx
AppLayerDecoderEvents * AppLayerParserGetEventsByTx(uint8_t ipproto, AppProto alproto, void *tx)
Definition: app-layer-parser.c:857
AppLayerParserRegisterGetEventInfo
void AppLayerParserRegisterGetEventInfo(uint8_t ipproto, AppProto alproto, int(*StateGetEventInfo)(const char *event_name, uint8_t *event_id, AppLayerEventType *event_type))
Definition: app-layer-parser.c:595
AppLayerParserTriggerRawStreamInspection
void AppLayerParserTriggerRawStreamInspection(Flow *f, int direction)
Definition: app-layer-parser.c:1557
ExceptionPolicy
ExceptionPolicy
Definition: util-exception-policy-types.h:25
AppLayerParserRegisterApplyTxConfigFunc
void AppLayerParserRegisterApplyTxConfigFunc(uint8_t ipproto, AppProto alproto, bool(*ApplyTxConfig)(void *state, void *tx, int mode, AppLayerTxConfig))
Definition: app-layer-parser.c:626
AppLayerParserParse
int AppLayerParserParse(ThreadVars *tv, AppLayerParserThreadCtx *tctx, Flow *f, AppProto alproto, uint8_t flags, const uint8_t *input, uint32_t input_len)
Definition: app-layer-parser.c:1291
AppLayerParserGetFrameIdByNameFn
int(* AppLayerParserGetFrameIdByNameFn)(const char *frame_name)
Definition: app-layer-parser.h:160
AppLayerParserSupportsFiles
bool AppLayerParserSupportsFiles(uint8_t ipproto, AppProto alproto)
Definition: app-layer-parser.c:1173
AppLayerParserGetStateProgressCompletionStatus
int AppLayerParserGetStateProgressCompletionStatus(AppProto alproto, uint8_t direction)
Definition: app-layer-parser.c:1116
AppLayerGetTxIterState::un
union AppLayerGetTxIterState::@7 un
AppLayerParserGetEventInfoById
int AppLayerParserGetEventInfoById(uint8_t ipproto, AppProto alproto, uint8_t event_id, const char **event_name, AppLayerEventType *event_type)
Definition: app-layer-parser.c:1136
AppLayerParserStateProtoCleanup
void AppLayerParserStateProtoCleanup(uint8_t protomap, AppProto alproto, void *alstate, AppLayerParserState *pstate)
Definition: app-layer-parser.c:1647
AppLayerParserGetTransactionActive
uint64_t AppLayerParserGetTransactionActive(const Flow *f, AppLayerParserState *pstate, uint8_t direction)
Definition: app-layer-parser.c:1156