suricata
app-layer-parser.h
Go to the documentation of this file.
1 /* Copyright (C) 2007-2013 Open Information Security Foundation
2  *
3  * You can copy, redistribute or modify this Program under the terms of
4  * the GNU General Public License version 2 as published by the Free
5  * Software Foundation.
6  *
7  * This program is distributed in the hope that it will be useful,
8  * but WITHOUT ANY WARRANTY; without even the implied warranty of
9  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
10  * GNU General Public License for more details.
11  *
12  * You should have received a copy of the GNU General Public License
13  * version 2 along with this program; if not, write to the Free Software
14  * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA
15  * 02110-1301, USA.
16  */
17 
18 /**
19  * \file
20  *
21  * \author Victor Julien <victor@inliniac.net>
22  * \author Anoop Saldanha <anoopsaldanha@gmail.com>
23  */
24 
25 #ifndef __APP_LAYER_PARSER_H__
26 #define __APP_LAYER_PARSER_H__
27 
28 #include "app-layer-events.h"
29 #include "detect-engine-state.h"
30 #include "util-file.h"
31 #include "stream-tcp-private.h"
32 
33 /* Flags for AppLayerParserState. */
34 #define APP_LAYER_PARSER_EOF BIT_U8(0)
35 #define APP_LAYER_PARSER_NO_INSPECTION BIT_U8(1)
36 #define APP_LAYER_PARSER_NO_REASSEMBLY BIT_U8(2)
37 #define APP_LAYER_PARSER_NO_INSPECTION_PAYLOAD BIT_U8(3)
38 #define APP_LAYER_PARSER_BYPASS_READY BIT_U8(4)
39 
40 /* Flags for AppLayerParserProtoCtx. */
41 #define APP_LAYER_PARSER_OPT_ACCEPT_GAPS BIT_U32(0)
42 
43 #define APP_LAYER_PARSER_INT_STREAM_DEPTH_SET BIT_U32(0)
44 
45 /* applies to DetectFlags uint64_t field */
46 
47 /** is tx fully inspected? */
48 #define APP_LAYER_TX_INSPECTED_FLAG BIT_U64(63)
49 /** other 63 bits are for tracking which prefilter engine is already
50  * completely inspected */
51 #define APP_LAYER_TX_PREFILTER_MASK ~APP_LAYER_TX_INSPECTED_FLAG
52 
53 int AppLayerParserProtoIsRegistered(uint8_t ipproto, AppProto alproto);
54 
55 /***** transaction handling *****/
56 
57 int AppLayerParserSetup(void);
59 int AppLayerParserDeSetup(void);
60 
62 
63 /**
64  * \brief Gets a new app layer protocol's parser thread context.
65  *
66  * \retval Non-NULL pointer on success.
67  * NULL pointer on failure.
68  */
70 
71 /**
72  * \brief Destroys the app layer parser thread context obtained
73  * using AppLayerParserThreadCtxAlloc().
74  *
75  * \param tctx Pointer to the thread context to be destroyed.
76  */
78 
79 /**
80  * \brief Given a protocol name, checks if the parser is enabled in
81  * the conf file.
82  *
83  * \param alproto_name Name of the app layer protocol.
84  *
85  * \retval 1 If enabled.
86  * \retval 0 If disabled.
87  */
88 int AppLayerParserConfParserEnabled(const char *ipproto,
89  const char *alproto_name);
90 
91 /** \brief Prototype for parsing functions */
92 typedef int (*AppLayerParserFPtr)(Flow *f, void *protocol_state,
93  AppLayerParserState *pstate,
94  const uint8_t *buf, uint32_t buf_len,
95  void *local_storage, const uint8_t flags);
96 
97 typedef struct AppLayerGetTxIterTuple {
98  void *tx_ptr;
99  uint64_t tx_id;
100  bool has_next;
102 
103 typedef struct AppLayerGetTxIterState {
104  union {
105  void *ptr;
106  uint64_t u64;
107  } un;
109 
110 /** \brief tx iterator prototype */
112  (const uint8_t ipproto, const AppProto alproto,
113  void *alstate, uint64_t min_tx_id, uint64_t max_tx_id,
114  AppLayerGetTxIterState *state);
115 
116 /***** Parser related registration *****/
117 
118 /**
119  * \brief Register app layer parser for the protocol.
120  *
121  * \retval 0 On success.
122  * \retval -1 On failure.
123  */
124 int AppLayerParserRegisterParser(uint8_t ipproto, AppProto alproto,
125  uint8_t direction,
126  AppLayerParserFPtr Parser);
128  AppProto alproto,
129  uint8_t direction);
130 void AppLayerParserRegisterOptionFlags(uint8_t ipproto, AppProto alproto,
131  uint32_t flags);
132 void AppLayerParserRegisterStateFuncs(uint8_t ipproto, AppProto alproto,
133  void *(*StateAlloc)(void),
134  void (*StateFree)(void *));
136  void *(*LocalStorageAlloc)(void),
137  void (*LocalStorageFree)(void *));
138 void AppLayerParserRegisterGetFilesFunc(uint8_t ipproto, AppProto alproto,
139  FileContainer *(*StateGetFiles)(void *, uint8_t));
140 void AppLayerParserRegisterGetEventsFunc(uint8_t ipproto, AppProto proto,
141  AppLayerDecoderEvents *(*StateGetEvents)(void *) __attribute__((nonnull)));
142 void AppLayerParserRegisterLoggerFuncs(uint8_t ipproto, AppProto alproto,
143  LoggerId (*StateGetTxLogged)(void *, void *),
144  void (*StateSetTxLogged)(void *, void *, LoggerId));
145 void AppLayerParserRegisterLogger(uint8_t ipproto, AppProto alproto);
146 void AppLayerParserRegisterLoggerBits(uint8_t ipproto, AppProto alproto, LoggerId bits);
147 void AppLayerParserRegisterTruncateFunc(uint8_t ipproto, AppProto alproto,
148  void (*Truncate)(void *, uint8_t));
149 void AppLayerParserRegisterGetStateProgressFunc(uint8_t ipproto, AppProto alproto,
150  int (*StateGetStateProgress)(void *alstate, uint8_t direction));
151 void AppLayerParserRegisterTxFreeFunc(uint8_t ipproto, AppProto alproto,
152  void (*StateTransactionFree)(void *, uint64_t));
153 void AppLayerParserRegisterGetTxCnt(uint8_t ipproto, AppProto alproto,
154  uint64_t (*StateGetTxCnt)(void *alstate));
155 void AppLayerParserRegisterGetTx(uint8_t ipproto, AppProto alproto,
156  void *(StateGetTx)(void *alstate, uint64_t tx_id));
157 void AppLayerParserRegisterGetTxIterator(uint8_t ipproto, AppProto alproto,
160  int (*StateGetStateProgressCompletionStatus)(uint8_t direction));
161 void AppLayerParserRegisterGetEventInfo(uint8_t ipproto, AppProto alproto,
162  int (*StateGetEventInfo)(const char *event_name, int *event_id,
164 void AppLayerParserRegisterGetEventInfoById(uint8_t ipproto, AppProto alproto,
165  int (*StateGetEventInfoById)(int event_id, const char **event_name,
167 void AppLayerParserRegisterDetectStateFuncs(uint8_t ipproto, AppProto alproto,
168  DetectEngineState *(*GetTxDetectState)(void *tx),
169  int (*SetTxDetectState)(void *tx, DetectEngineState *));
170 void AppLayerParserRegisterGetStreamDepth(uint8_t ipproto,
171  AppProto alproto,
172  uint32_t (*GetStreamDepth)(void));
173 void AppLayerParserRegisterMpmIDsFuncs(uint8_t ipproto, AppProto alproto,
174  uint64_t (*GetTxMpmIDs)(void *tx),
175  int (*SetTxMpmIDs)(void *tx, uint64_t));
176 void AppLayerParserRegisterDetectFlagsFuncs(uint8_t ipproto, AppProto alproto,
177  uint64_t(*GetTxDetectFlags)(void *tx, uint8_t dir),
178  void (*SetTxDetectFlags)(void *tx, uint8_t dir, uint64_t));
179 void AppLayerParserRegisterSetStreamDepthFlag(uint8_t ipproto, AppProto alproto,
180  void (*SetStreamDepthFlag)(void *tx, uint8_t flags));
181 
182 /***** Get and transaction functions *****/
183 
185  const AppProto alproto);
186 
187 void *AppLayerParserGetProtocolParserLocalStorage(uint8_t ipproto, AppProto alproto);
188 void AppLayerParserDestroyProtocolParserLocalStorage(uint8_t ipproto, AppProto alproto,
189  void *local_data);
190 
191 
194 
195 void AppLayerParserSetTxLogged(uint8_t ipproto, AppProto alproto, void *alstate,
196  void *tx, LoggerId logged);
197 LoggerId AppLayerParserGetTxLogged(const Flow *f, void *alstate, void *tx);
198 
199 uint64_t AppLayerParserGetTransactionInspectId(AppLayerParserState *pstate, uint8_t direction);
201  void *alstate, const uint8_t flags, bool tag_txs_as_inspected);
202 
205 AppLayerDecoderEvents *AppLayerParserGetEventsByTx(uint8_t ipproto, AppProto alproto, void *tx);
206 FileContainer *AppLayerParserGetFiles(uint8_t ipproto, AppProto alproto,
207  void *alstate, uint8_t direction);
208 int AppLayerParserGetStateProgress(uint8_t ipproto, AppProto alproto,
209  void *alstate, uint8_t direction);
210 uint64_t AppLayerParserGetTxCnt(const Flow *, void *alstate);
211 void *AppLayerParserGetTx(uint8_t ipproto, AppProto alproto, void *alstate, uint64_t tx_id);
212 int AppLayerParserGetStateProgressCompletionStatus(AppProto alproto, uint8_t direction);
213 int AppLayerParserGetEventInfo(uint8_t ipproto, AppProto alproto, const char *event_name,
214  int *event_id, AppLayerEventType *event_type);
215 int AppLayerParserGetEventInfoById(uint8_t ipproto, AppProto alproto, int event_id,
216  const char **event_name, AppLayerEventType *event_type);
217 
218 uint64_t AppLayerParserGetTransactionActive(const Flow *f, AppLayerParserState *pstate, uint8_t direction);
219 
220 uint8_t AppLayerParserGetFirstDataDir(uint8_t ipproto, AppProto alproto);
221 
222 int AppLayerParserSupportsFiles(uint8_t ipproto, AppProto alproto);
223 int AppLayerParserSupportsTxDetectState(uint8_t ipproto, AppProto alproto);
224 int AppLayerParserHasTxDetectState(uint8_t ipproto, AppProto alproto, void *alstate);
225 DetectEngineState *AppLayerParserGetTxDetectState(uint8_t ipproto, AppProto alproto, void *tx);
226 int AppLayerParserSetTxDetectState(const Flow *f, void *tx, DetectEngineState *s);
227 
228 uint64_t AppLayerParserGetTxDetectFlags(uint8_t ipproto, AppProto alproto, void *tx, uint8_t dir);
229 void AppLayerParserSetTxDetectFlags(uint8_t ipproto, AppProto alproto, void *tx, uint8_t dir, uint64_t);
231 
232 /***** General *****/
233 
235  uint8_t flags, const uint8_t *input, uint32_t input_len);
238 int AppLayerParserIsTxAware(AppProto alproto);
239 int AppLayerParserProtocolIsTxEventAware(uint8_t ipproto, AppProto alproto);
240 int AppLayerParserProtocolHasLogger(uint8_t ipproto, AppProto alproto);
241 LoggerId AppLayerParserProtocolGetLoggerBits(uint8_t ipproto, AppProto alproto);
242 void AppLayerParserTriggerRawStreamReassembly(Flow *f, int direction);
243 void AppLayerParserSetStreamDepth(uint8_t ipproto, AppProto alproto, uint32_t stream_depth);
244 uint32_t AppLayerParserGetStreamDepth(const Flow *f);
245 void AppLayerParserSetStreamDepthFlag(uint8_t ipproto, AppProto alproto, void *state, uint64_t tx_id, uint8_t flags);
246 
247 /***** Cleanup *****/
248 
249 void AppLayerParserStateCleanup(const Flow *f, void *alstate, AppLayerParserState *pstate);
250 
252 
253 
254 void AppLayerParserStateSetFlag(AppLayerParserState *pstate, uint8_t flag);
255 int AppLayerParserStateIssetFlag(AppLayerParserState *pstate, uint8_t flag);
256 
257 void AppLayerParserStreamTruncated(uint8_t ipproto, AppProto alproto, void *alstate,
258  uint8_t direction);
259 
260 
261 
264 
266 
267 #ifdef DEBUG
268 void AppLayerParserStatePrintDetails(AppLayerParserState *pstate);
269 #endif
270 
271 #ifdef AFLFUZZ_APPLAYER
272 int AppLayerParserRequestFromFile(uint8_t ipproto, AppProto alproto, char *filename);
273 int AppLayerParserRequestFromFileSerie(uint8_t ipproto, AppProto alproto, char *prefix);
274 int AppLayerParserFromFile(uint8_t ipproto, AppProto alproto, char *filename);
275 int AppLayerParserFromFileSerie(uint8_t ipproto, AppProto alproto, char *prefix);
276 #endif
277 
278 /***** Unittests *****/
279 
280 #ifdef UNITTESTS
281 void AppLayerParserRegisterProtocolUnittests(uint8_t ipproto, AppProto alproto,
282  void (*RegisterUnittests)(void));
286 void UTHAppLayerParserStateGetIds(void *ptr, uint64_t *i1, uint64_t *i2, uint64_t *log, uint64_t *min);
287 #endif
288 
289 #endif /* __APP_LAYER_PARSER_H__ */
enum AppLayerEventType_ AppLayerEventType
int AppLayerParserParse(ThreadVars *tv, AppLayerParserThreadCtx *tctx, Flow *f, AppProto alproto, uint8_t flags, const uint8_t *input, uint32_t input_len)
AppLayerDecoderEvents * AppLayerParserGetEventsByTx(uint8_t ipproto, AppProto alproto, void *tx)
int AppLayerParserGetEventInfoById(uint8_t ipproto, AppProto alproto, int event_id, const char **event_name, AppLayerEventType *event_type)
uint16_t flags
void AppLayerParserSetDecoderEvents(AppLayerParserState *pstate, AppLayerDecoderEvents *devents)
struct AppLayerGetTxIterTuple AppLayerGetTxIterTuple
void AppLayerParserRegisterLogger(uint8_t ipproto, AppProto alproto)
void AppLayerParserSetEOF(AppLayerParserState *pstate)
uint64_t AppLayerParserGetTransactionActive(const Flow *f, AppLayerParserState *pstate, uint8_t direction)
void AppLayerParserTransactionsCleanup(Flow *f)
remove obsolete (inspected and logged) transactions
void AppLayerParserRegisterGetTxCnt(uint8_t ipproto, AppProto alproto, uint64_t(*StateGetTxCnt)(void *alstate))
void AppLayerParserRegisterStateFuncs(uint8_t ipproto, AppProto alproto, void *(*StateAlloc)(void), void(*StateFree)(void *))
uint32_t event_type
LoggerId
DetectEngineState * AppLayerParserGetTxDetectState(uint8_t ipproto, AppProto alproto, void *tx)
int logged
int AppLayerParserSetTxDetectState(const Flow *f, void *tx, DetectEngineState *s)
void AppLayerParserRegisterGetStreamDepth(uint8_t ipproto, AppProto alproto, uint32_t(*GetStreamDepth)(void))
void AppLayerParserRegisterGetFilesFunc(uint8_t ipproto, AppProto alproto, FileContainer *(*StateGetFiles)(void *, uint8_t))
int AppLayerParserProtoIsRegistered(uint8_t ipproto, AppProto alproto)
int AppLayerParserHasTxDetectState(uint8_t ipproto, AppProto alproto, void *alstate)
void AppLayerParserRegisterMpmIDsFuncs(uint8_t ipproto, AppProto alproto, uint64_t(*GetTxMpmIDs)(void *tx), int(*SetTxMpmIDs)(void *tx, uint64_t))
void AppLayerParserPostStreamSetup(void)
AppLayerDecoderEvents * AppLayerParserGetDecoderEvents(AppLayerParserState *pstate)
void AppLayerParserSetStreamDepth(uint8_t ipproto, AppProto alproto, uint32_t stream_depth)
void * AppLayerParserGetProtocolParserLocalStorage(uint8_t ipproto, AppProto alproto)
LoggerId AppLayerParserGetTxLogged(const Flow *f, void *alstate, void *tx)
uint16_t AppProto
void AppLayerParserRegisterSetStreamDepthFlag(uint8_t ipproto, AppProto alproto, void(*SetStreamDepthFlag)(void *tx, uint8_t flags))
void UTHAppLayerParserStateGetIds(void *ptr, uint64_t *i1, uint64_t *i2, uint64_t *log, uint64_t *min)
LoggerId AppLayerParserProtocolGetLoggerBits(uint8_t ipproto, AppProto alproto)
int(* AppLayerParserFPtr)(Flow *f, void *protocol_state, AppLayerParserState *pstate, const uint8_t *buf, uint32_t buf_len, void *local_storage, const uint8_t flags)
Prototype for parsing functions.
enum @34 __attribute__
DNP3 application header.
void AppLayerParserSetTxDetectFlags(uint8_t ipproto, AppProto alproto, void *tx, uint8_t dir, uint64_t)
void AppLayerParserStateSetFlag(AppLayerParserState *pstate, uint8_t flag)
int AppLayerParserSetup(void)
int AppLayerParserGetEventInfo(uint8_t ipproto, AppProto alproto, const char *event_name, int *event_id, AppLayerEventType *event_type)
void AppLayerParserSetTxLogged(uint8_t ipproto, AppProto alproto, void *alstate, void *tx, LoggerId logged)
Data structure to store app layer decoder events.
int AppLayerParserStateIssetFlag(AppLayerParserState *pstate, uint8_t flag)
void AppLayerParserRegisterTxFreeFunc(uint8_t ipproto, AppProto alproto, void(*StateTransactionFree)(void *, uint64_t))
void AppLayerParserRegisterDetectStateFuncs(uint8_t ipproto, AppProto alproto, DetectEngineState *(*GetTxDetectState)(void *tx), int(*SetTxDetectState)(void *tx, DetectEngineState *))
int AppLayerParserSupportsFiles(uint8_t ipproto, AppProto alproto)
void AppLayerParserSetTransactionInspectId(const Flow *f, AppLayerParserState *pstate, void *alstate, const uint8_t flags, bool tag_txs_as_inspected)
void AppLayerParserDestroyProtocolParserLocalStorage(uint8_t ipproto, AppProto alproto, void *local_data)
Data structures and function prototypes for keeping state for the detection engine.
void AppLayerParserRegisterOptionFlags(uint8_t ipproto, AppProto alproto, uint32_t flags)
void AppLayerParserRegisterLoggerFuncs(uint8_t ipproto, AppProto alproto, LoggerId(*StateGetTxLogged)(void *, void *), void(*StateSetTxLogged)(void *, void *, LoggerId))
void AppLayerParserBackupParserTable(void)
void AppLayerParserRegisterProtocolUnittests(uint8_t ipproto, AppProto alproto, void(*RegisterUnittests)(void))
bool AppLayerParserHasDecoderEvents(AppLayerParserState *pstate)
void AppLayerParserRegisterGetEventsFunc(uint8_t ipproto, AppProto proto, AppLayerDecoderEvents *(*StateGetEvents)(void *) __attribute__((nonnull)))
void AppLayerParserRegisterLocalStorageFunc(uint8_t ipproto, AppProto proto, void *(*LocalStorageAlloc)(void), void(*LocalStorageFree)(void *))
uint64_t AppLayerParserGetTransactionInspectId(AppLayerParserState *pstate, uint8_t direction)
void AppLayerParserRegisterGetTxIterator(uint8_t ipproto, AppProto alproto, AppLayerGetTxIteratorFunc Func)
uint8_t AppLayerParserGetFirstDataDir(uint8_t ipproto, AppProto alproto)
void AppLayerParserRegisterDetectFlagsFuncs(uint8_t ipproto, AppProto alproto, uint64_t(*GetTxDetectFlags)(void *tx, uint8_t dir), void(*SetTxDetectFlags)(void *tx, uint8_t dir, uint64_t))
uint8_t proto
int AppLayerParserConfParserEnabled(const char *ipproto, const char *alproto_name)
Given a protocol name, checks if the parser is enabled in the conf file.
void AppLayerParserTriggerRawStreamReassembly(Flow *f, int direction)
int AppLayerParserRegisterParser(uint8_t ipproto, AppProto alproto, uint8_t direction, AppLayerParserFPtr Parser)
Register app layer parser for the protocol.
uint64_t AppLayerParserGetTransactionLogId(AppLayerParserState *pstate)
int AppLayerParserProtocolIsTxEventAware(uint8_t ipproto, AppProto alproto)
void AppLayerParserSetStreamDepthFlag(uint8_t ipproto, AppProto alproto, void *state, uint64_t tx_id, uint8_t flags)
void AppLayerParserRegisterGetStateProgressCompletionStatus(AppProto alproto, int(*StateGetStateProgressCompletionStatus)(uint8_t direction))
void AppLayerParserRestoreParserTable(void)
AppLayerGetTxIteratorFunc AppLayerGetTxIterator(const uint8_t ipproto, const AppProto alproto)
void AppLayerParserRegisterGetEventInfo(uint8_t ipproto, AppProto alproto, int(*StateGetEventInfo)(const char *event_name, int *event_id, AppLayerEventType *event_type))
FileContainer * AppLayerParserGetFiles(uint8_t ipproto, AppProto alproto, void *alstate, uint8_t direction)
void AppLayerParserSetTransactionLogId(AppLayerParserState *pstate, uint64_t tx_id)
struct AppLayerGetTxIterState AppLayerGetTxIterState
int AppLayerParserIsTxAware(AppProto alproto)
simpler way to globally test if a alproto is registered and fully enabled in the configuration.
int AppLayerParserDeSetup(void)
void AppLayerParserRegisterProtocolParsers(void)
uint64_t AppLayerParserGetTxDetectFlags(uint8_t ipproto, AppProto alproto, void *tx, uint8_t dir)
void AppLayerParserRegisterGetStateProgressFunc(uint8_t ipproto, AppProto alproto, int(*StateGetStateProgress)(void *alstate, uint8_t direction))
AppLayerParserThreadCtx * AppLayerParserThreadCtxAlloc(void)
Gets a new app layer protocol&#39;s parser thread context.
void AppLayerParserRegisterTruncateFunc(uint8_t ipproto, AppProto alproto, void(*Truncate)(void *, uint8_t))
void * AppLayerParserGetTx(uint8_t ipproto, AppProto alproto, void *alstate, uint64_t tx_id)
void AppLayerParserStateCleanup(const Flow *f, void *alstate, AppLayerParserState *pstate)
void AppLayerParserRegisterGetTx(uint8_t ipproto, AppProto alproto, void *(StateGetTx)(void *alstate, uint64_t tx_id))
void AppLayerParserStateFree(AppLayerParserState *pstate)
uint64_t AppLayerParserGetTxCnt(const Flow *, void *alstate)
AppLayerParserState * AppLayerParserStateAlloc(void)
int AppLayerParserProtocolHasLogger(uint8_t ipproto, AppProto alproto)
Per thread variable structure.
Definition: threadvars.h:57
int AppLayerParserGetStateProgressCompletionStatus(AppProto alproto, uint8_t direction)
int AppLayerParserGetStateProgress(uint8_t ipproto, AppProto alproto, void *alstate, uint8_t direction)
get the progress value for a tx/protocol
void AppLayerParserRegisterUnittests(void)
bool AppLayerParserSupportsTxDetectFlags(AppProto alproto)
uint32_t AppLayerParserGetStreamDepth(const Flow *f)
void AppLayerParserStreamTruncated(uint8_t ipproto, AppProto alproto, void *alstate, uint8_t direction)
void AppLayerParserRegisterParserAcceptableDataDirection(uint8_t ipproto, AppProto alproto, uint8_t direction)
Flow data structure.
Definition: flow.h:325
int AppLayerParserSupportsTxDetectState(uint8_t ipproto, AppProto alproto)
void AppLayerParserRegisterLoggerBits(uint8_t ipproto, AppProto alproto, LoggerId bits)
void AppLayerParserThreadCtxFree(AppLayerParserThreadCtx *tctx)
Destroys the app layer parser thread context obtained using AppLayerParserThreadCtxAlloc().
void AppLayerParserRegisterGetEventInfoById(uint8_t ipproto, AppProto alproto, int(*StateGetEventInfoById)(int event_id, const char **event_name, AppLayerEventType *event_type))
AppLayerGetTxIterTuple(* AppLayerGetTxIteratorFunc)(const uint8_t ipproto, const AppProto alproto, void *alstate, uint64_t min_tx_id, uint64_t max_tx_id, AppLayerGetTxIterState *state)
tx iterator prototype