suricata
app-layer-smb.c
Go to the documentation of this file.
1 /* Copyright (C) 2017 Open Information Security Foundation
2  *
3  * You can copy, redistribute or modify this Program under the terms of
4  * the GNU General Public License version 2 as published by the Free
5  * Software Foundation.
6  *
7  * This program is distributed in the hope that it will be useful,
8  * but WITHOUT ANY WARRANTY; without even the implied warranty of
9  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
10  * GNU General Public License for more details.
11  *
12  * You should have received a copy of the GNU General Public License
13  * version 2 along with this program; if not, write to the Free Software
14  * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA
15  * 02110-1301, USA.
16  */
17 
18 #include "suricata-common.h"
19 #include "suricata.h"
20 
21 #include "app-layer-protos.h"
22 #include "app-layer-detect-proto.h"
23 #include "app-layer-parser.h"
24 
25 #include "util-unittest.h"
26 
27 #include "rust.h"
28 #include "app-layer-smb.h"
29 #include "rust-smb-smb-gen.h"
30 #include "rust-smb-files-gen.h"
31 #include "util-misc.h"
32 
33 #define MIN_REC_SIZE 32+4 // SMB hdr + nbss hdr
34 
35 static int SMBTCPParseRequest(Flow *f, void *state,
36  AppLayerParserState *pstate, const uint8_t *input, uint32_t input_len,
37  void *local_data, const uint8_t flags)
38 {
39  SCLogDebug("SMBTCPParseRequest");
40  uint16_t file_flags = FileFlowToFlags(f, STREAM_TOSERVER);
41  rs_smb_setfileflags(0, state, file_flags|FILE_USE_DETECT);
42 
43  int res;
44  if (input == NULL && input_len > 0) {
45  res = rs_smb_parse_request_tcp_gap(state, input_len);
46  } else {
47  res = rs_smb_parse_request_tcp(f, state, pstate, input, input_len,
48  local_data, flags);
49  }
50  if (res != 1) {
51  SCLogDebug("SMB request%s of %u bytes, retval %d",
52  (input == NULL && input_len > 0) ? " is GAP" : "", input_len, res);
53  }
54  return res;
55 }
56 
57 static int SMBTCPParseResponse(Flow *f, void *state,
58  AppLayerParserState *pstate, const uint8_t *input, uint32_t input_len,
59  void *local_data, const uint8_t flags)
60 {
61  SCLogDebug("SMBTCPParseResponse");
62  uint16_t file_flags = FileFlowToFlags(f, STREAM_TOCLIENT);
63  rs_smb_setfileflags(1, state, file_flags|FILE_USE_DETECT);
64 
65  SCLogDebug("SMBTCPParseResponse %p/%u", input, input_len);
66  int res;
67  if (input == NULL && input_len > 0) {
68  res = rs_smb_parse_response_tcp_gap(state, input_len);
69  } else {
70  res = rs_smb_parse_response_tcp(f, state, pstate, input, input_len,
71  local_data, flags);
72  }
73  if (res != 1) {
74  SCLogDebug("SMB response%s of %u bytes, retval %d",
75  (input == NULL && input_len > 0) ? " is GAP" : "", input_len, res);
76  }
77  return res;
78 }
79 
80 static uint16_t SMBTCPProbe(Flow *f, uint8_t direction,
81  const uint8_t *input, uint32_t len, uint8_t *rdir)
82 {
83  SCLogDebug("SMBTCPProbe");
84 
85  if (len < MIN_REC_SIZE) {
86  return ALPROTO_UNKNOWN;
87  }
88 
89  const int r = rs_smb_probe_tcp(direction, input, len, rdir);
90  switch (r) {
91  case 1:
92  return ALPROTO_SMB;
93  case 0:
94  return ALPROTO_UNKNOWN;
95  case -1:
96  default:
97  return ALPROTO_FAILED;
98  }
99 }
100 
101 /** \internal
102  * \brief as SMB3 records have no direction indicator, fall
103  * back to the port numbers for a hint
104  */
105 static uint16_t SMB3TCPProbe(Flow *f, uint8_t direction,
106  const uint8_t *input, uint32_t len, uint8_t *rdir)
107 {
108  SCEnter();
109 
110  AppProto p = SMBTCPProbe(f, direction, input, len, rdir);
111  if (p != ALPROTO_SMB) {
112  SCReturnUInt(p);
113  }
114 
115  uint16_t fsp = (f->flags & FLOW_DIR_REVERSED) ? f->dp : f->sp;
116  uint16_t fdp = (f->flags & FLOW_DIR_REVERSED) ? f->sp : f->dp;
117  SCLogDebug("direction %s flow sp %u dp %u fsp %u fdp %u",
118  (direction & STREAM_TOSERVER) ? "toserver" : "toclient",
119  f->sp, f->dp, fsp, fdp);
120 
121  if (fsp == 445 && fdp != 445) {
122  if (direction & STREAM_TOSERVER) {
123  *rdir = STREAM_TOCLIENT;
124  } else {
125  *rdir = STREAM_TOSERVER;
126  }
127  }
128  SCLogDebug("returning ALPROTO_SMB for dir %s with rdir %s",
129  (direction & STREAM_TOSERVER) ? "toserver" : "toclient",
130  (*rdir == STREAM_TOSERVER) ? "toserver" : "toclient");
132 }
133 
134 static int SMBGetAlstateProgress(void *tx, uint8_t direction)
135 {
136  return rs_smb_tx_get_alstate_progress(tx, direction);
137 }
138 
139 static uint64_t SMBGetTxCnt(void *alstate)
140 {
141  return rs_smb_state_get_tx_count(alstate);
142 }
143 
144 static void *SMBGetTx(void *alstate, uint64_t tx_id)
145 {
146  return rs_smb_state_get_tx(alstate, tx_id);
147 }
148 
149 static AppLayerGetTxIterTuple SMBGetTxIterator(
150  const uint8_t ipproto, const AppProto alproto,
151  void *alstate, uint64_t min_tx_id, uint64_t max_tx_id,
152  AppLayerGetTxIterState *istate)
153 {
154  return rs_smb_state_get_tx_iterator(alstate, min_tx_id, (uint64_t *)istate);
155 }
156 
157 
158 static void SMBSetTxLogged(void *alstate, void *tx, uint32_t logger)
159 {
160  rs_smb_tx_set_logged(alstate, tx, logger);
161 }
162 
163 static LoggerId SMBGetTxLogged(void *alstate, void *tx)
164 {
165  return rs_smb_tx_get_logged(alstate, tx);
166 }
167 
168 static void SMBStateTransactionFree(void *state, uint64_t tx_id)
169 {
170  rs_smb_state_tx_free(state, tx_id);
171 }
172 
173 static DetectEngineState *SMBGetTxDetectState(void *tx)
174 {
175  return rs_smb_state_get_tx_detect_state(tx);
176 }
177 
178 static int SMBSetTxDetectState(void *tx, DetectEngineState *s)
179 {
180  rs_smb_state_set_tx_detect_state(tx, s);
181  return 0;
182 }
183 
184 static FileContainer *SMBGetFiles(void *state, uint8_t direction)
185 {
186  return rs_smb_getfiles(direction, state);
187 }
188 
189 static AppLayerDecoderEvents *SMBGetEvents(void *tx)
190 {
191  return rs_smb_state_get_events(tx);
192 }
193 
194 static int SMBGetEventInfoById(int event_id, const char **event_name,
196 {
197  return rs_smb_state_get_event_info_by_id(event_id, event_name, event_type);
198 }
199 
200 static int SMBGetEventInfo(const char *event_name, int *event_id,
202 {
203  return rs_smb_state_get_event_info(event_name, event_id, event_type);
204 }
205 
206 static void SMBSetDetectFlags(void *tx, uint8_t dir, uint64_t flags)
207 {
208  rs_smb_tx_set_detect_flags(tx, dir, flags);
209 }
210 
211 static uint64_t SMBGetDetectFlags(void *tx, uint8_t dir)
212 {
213  return rs_smb_tx_get_detect_flags(tx, dir);
214 }
215 
216 static void SMBStateTruncate(void *state, uint8_t direction)
217 {
218  return rs_smb_state_truncate(state, direction);
219 }
220 
221 static int SMBRegisterPatternsForProtocolDetection(void)
222 {
223  int r = 0;
224  /* SMB1 */
226  "|ff|SMB", 8, 4, STREAM_TOSERVER, SMBTCPProbe,
229  "|ff|SMB", 8, 4, STREAM_TOCLIENT, SMBTCPProbe,
231 
232  /* SMB2/3 */
234  "|fe|SMB", 8, 4, STREAM_TOSERVER, SMBTCPProbe,
237  "|fe|SMB", 8, 4, STREAM_TOCLIENT, SMBTCPProbe,
239 
240  /* SMB3 encrypted records */
242  "|fd|SMB", 8, 4, STREAM_TOSERVER, SMB3TCPProbe,
245  "|fd|SMB", 8, 4, STREAM_TOCLIENT, SMB3TCPProbe,
247  return r == 0 ? 0 : -1;
248 }
249 
251 static SuricataFileContext sfc = { &sbcfg };
252 
253 #define SMB_CONFIG_DEFAULT_STREAM_DEPTH 0
254 
255 #ifdef UNITTESTS
256 static void SMBParserRegisterTests(void);
257 #endif
258 
259 static uint32_t stream_depth = SMB_CONFIG_DEFAULT_STREAM_DEPTH;
260 
262 {
263  const char *proto_name = "smb";
264 
265  /** SMB */
266  if (AppLayerProtoDetectConfProtoDetectionEnabled("tcp", proto_name)) {
268  if (SMBRegisterPatternsForProtocolDetection() < 0)
269  return;
270 
271  rs_smb_init(&sfc);
272 
273  if (RunmodeIsUnittests()) {
274  AppLayerProtoDetectPPRegister(IPPROTO_TCP, "445", ALPROTO_SMB, 0,
275  MIN_REC_SIZE, STREAM_TOSERVER, SMBTCPProbe,
276  SMBTCPProbe);
277  } else {
278  int have_cfg = AppLayerProtoDetectPPParseConfPorts("tcp",
279  IPPROTO_TCP, proto_name, ALPROTO_SMB, 0,
280  MIN_REC_SIZE, SMBTCPProbe, SMBTCPProbe);
281  /* if we have no config, we enable the default port 445 */
282  if (!have_cfg) {
283  SCLogConfig("no SMB TCP config found, enabling SMB detection "
284  "on port 445.");
285  AppLayerProtoDetectPPRegister(IPPROTO_TCP, "445", ALPROTO_SMB, 0,
286  MIN_REC_SIZE, STREAM_TOSERVER, SMBTCPProbe,
287  SMBTCPProbe);
288  }
289  }
290  } else {
291  SCLogConfig("Protocol detection and parser disabled for %s protocol.",
292  proto_name);
293  return;
294  }
295 
296  if (AppLayerParserConfParserEnabled("tcp", proto_name)) {
298  SMBTCPParseRequest);
300  SMBTCPParseResponse);
302  rs_smb_state_new, rs_smb_state_free);
304  SMBStateTransactionFree);
305 
307  SMBGetEvents);
309  SMBGetEventInfo);
311  SMBGetEventInfoById);
312 
314  SMBGetTxDetectState, SMBSetTxDetectState);
315  AppLayerParserRegisterGetTx(IPPROTO_TCP, ALPROTO_SMB, SMBGetTx);
316  AppLayerParserRegisterGetTxIterator(IPPROTO_TCP, ALPROTO_SMB, SMBGetTxIterator);
318  SMBGetTxCnt);
320  SMBGetTxLogged, SMBSetTxLogged);
322  SMBGetAlstateProgress);
324  rs_smb_state_progress_completion_status);
326  SMBGetDetectFlags, SMBSetDetectFlags);
328  SMBStateTruncate);
329  AppLayerParserRegisterGetFilesFunc(IPPROTO_TCP, ALPROTO_SMB, SMBGetFiles);
330 
331  /* This parser accepts gaps. */
334 
335  ConfNode *p = ConfGetNode("app-layer.protocols.smb.stream-depth");
336  if (p != NULL) {
337  uint32_t value;
338  if (ParseSizeStringU32(p->val, &value) < 0) {
339  SCLogError(SC_ERR_SMB_CONFIG, "invalid value for stream-depth %s", p->val);
340  } else {
341  stream_depth = value;
342  }
343  }
344  SCLogConfig("SMB stream depth: %u", stream_depth);
345 
346  AppLayerParserSetStreamDepth(IPPROTO_TCP, ALPROTO_SMB, stream_depth);
347  } else {
348  SCLogConfig("Parsed disabled for %s protocol. Protocol detection"
349  "still on.", proto_name);
350  }
351 #ifdef UNITTESTS
352  AppLayerParserRegisterProtocolUnittests(IPPROTO_TCP, ALPROTO_SMB, SMBParserRegisterTests);
353 #endif
354 
355  return;
356 }
357 
358 #ifdef UNITTESTS
359 #include "stream-tcp.h"
360 #include "util-unittest-helper.h"
361 
362 /** \test multi transactions and cleanup */
363 static int SMBParserTxCleanupTest(void)
364 {
365  uint64_t ret[4];
367  FAIL_IF_NULL(alp_tctx);
368 
370  TcpSession ssn;
371  memset(&ssn, 0, sizeof(ssn));
372 
373  Flow *f = UTHBuildFlow(AF_INET, "1.2.3.4", "1.2.3.5", 1024, 445);
374  FAIL_IF_NULL(f);
375  f->protoctx = &ssn;
376  f->proto = IPPROTO_TCP;
377  f->alproto = ALPROTO_SMB;
378 
379  char req_str[] ="\x00\x00\x00\x79\xfe\x53\x4d\x42\x40\x00\x01\x00\x00\x00\x00\x00" \
380  "\x05\x00\xe0\x1e\x10\x00\x00\x00\x00\x00\x00\x00\x0b\x00\x00\x00" \
381  "\x00\x00\x00\x00\x00\x00\x00\x00\x10\x72\xd2\x9f\x36\xc2\x08\x14" \
382  "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00" \
383  "\x00\x00\x00\x00\x39\x00\x00\x00\x02\x00\x00\x00\x00\x00\x00\x00" \
384  "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x80\x00\x00\x00" \
385  "\x00\x00\x00\x00\x07\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00" \
386  "\x78\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00";
387  req_str[28] = 0x01;
388  int r = AppLayerParserParse(NULL, alp_tctx, f, ALPROTO_SMB,
389  STREAM_TOSERVER | STREAM_START, (uint8_t *)req_str, sizeof(req_str));
390  FAIL_IF_NOT(r == 0);
391  req_str[28]++;
392  r = AppLayerParserParse(NULL, alp_tctx, f, ALPROTO_SMB,
393  STREAM_TOSERVER, (uint8_t *)req_str, sizeof(req_str));
394  FAIL_IF_NOT(r == 0);
395  req_str[28]++;
396  r = AppLayerParserParse(NULL, alp_tctx, f, ALPROTO_SMB,
397  STREAM_TOSERVER, (uint8_t *)req_str, sizeof(req_str));
398  FAIL_IF_NOT(r == 0);
399  req_str[28]++;
400  r = AppLayerParserParse(NULL, alp_tctx, f, ALPROTO_SMB,
401  STREAM_TOSERVER, (uint8_t *)req_str, sizeof(req_str));
402  FAIL_IF_NOT(r == 0);
403  req_str[28]++;
404  r = AppLayerParserParse(NULL, alp_tctx, f, ALPROTO_SMB,
405  STREAM_TOSERVER, (uint8_t *)req_str, sizeof(req_str));
406  FAIL_IF_NOT(r == 0);
407  req_str[28]++;
408  r = AppLayerParserParse(NULL, alp_tctx, f, ALPROTO_SMB,
409  STREAM_TOSERVER, (uint8_t *)req_str, sizeof(req_str));
410  FAIL_IF_NOT(r == 0);
411  req_str[28]++;
412  r = AppLayerParserParse(NULL, alp_tctx, f, ALPROTO_SMB,
413  STREAM_TOSERVER, (uint8_t *)req_str, sizeof(req_str));
414  FAIL_IF_NOT(r == 0);
415  req_str[28]++;
416  r = AppLayerParserParse(NULL, alp_tctx, f, ALPROTO_SMB,
417  STREAM_TOSERVER, (uint8_t *)req_str, sizeof(req_str));
418  FAIL_IF_NOT(r == 0);
419  req_str[28]++;
420 
422  UTHAppLayerParserStateGetIds(f->alparser, &ret[0], &ret[1], &ret[2], &ret[3]);
423  FAIL_IF_NOT(ret[0] == 0); // inspect_id[0]
424  FAIL_IF_NOT(ret[1] == 0); // inspect_id[1]
425  FAIL_IF_NOT(ret[2] == 0); // log_id
426  FAIL_IF_NOT(ret[3] == 0); // min_id
427 
428  char resp_str[] = "\x00\x00\x00\x98\xfe\x53\x4d\x42\x40\x00\x01\x00\x00\x00\x00\x00" \
429  "\x05\x00\x21\x00\x11\x00\x00\x00\x00\x00\x00\x00\x0b\x00\x00\x00" \
430  "\x00\x00\x00\x00\x00\x00\x00\x00\x10\x72\xd2\x9f\x36\xc2\x08\x14" \
431  "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00" \
432  "\x00\x00\x00\x00\x59\x00\x00\x00\x01\x00\x00\x00\x48\x38\x40\xb3" \
433  "\x0f\xa8\xd3\x01\x84\x9a\x2b\x46\xf7\xa8\xd3\x01\x48\x38\x40\xb3" \
434  "\x0f\xa8\xd3\x01\x48\x38\x40\xb3\x0f\xa8\xd3\x01\x00\x00\x00\x00" \
435  "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x10\x00\x00\x00" \
436  "\x00\x00\x00\x00\x9e\x8f\xb8\x91\x00\x00\x00\x00\x01\x5b\x11\xbb" \
437  "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00";
438 
439  resp_str[28] = 0x01;
440  r = AppLayerParserParse(NULL, alp_tctx, f, ALPROTO_SMB,
441  STREAM_TOCLIENT | STREAM_START, (uint8_t *)resp_str, sizeof(resp_str));
442  FAIL_IF_NOT(r == 0);
443  resp_str[28] = 0x04;
444  r = AppLayerParserParse(NULL, alp_tctx, f, ALPROTO_SMB,
445  STREAM_TOCLIENT, (uint8_t *)resp_str, sizeof(resp_str));
446  FAIL_IF_NOT(r == 0);
447  resp_str[28] = 0x05;
448  r = AppLayerParserParse(NULL, alp_tctx, f, ALPROTO_SMB,
449  STREAM_TOCLIENT, (uint8_t *)resp_str, sizeof(resp_str));
450  FAIL_IF_NOT(r == 0);
451  resp_str[28] = 0x06;
452  r = AppLayerParserParse(NULL, alp_tctx, f, ALPROTO_SMB,
453  STREAM_TOCLIENT, (uint8_t *)resp_str, sizeof(resp_str));
454  FAIL_IF_NOT(r == 0);
455  resp_str[28] = 0x08;
456  r = AppLayerParserParse(NULL, alp_tctx, f, ALPROTO_SMB,
457  STREAM_TOCLIENT, (uint8_t *)resp_str, sizeof(resp_str));
458  FAIL_IF_NOT(r == 0);
459  resp_str[28] = 0x02;
460  r = AppLayerParserParse(NULL, alp_tctx, f, ALPROTO_SMB,
461  STREAM_TOCLIENT, (uint8_t *)resp_str, sizeof(resp_str));
462  FAIL_IF_NOT(r == 0);
463  resp_str[28] = 0x07;
464  r = AppLayerParserParse(NULL, alp_tctx, f, ALPROTO_SMB,
465  STREAM_TOCLIENT, (uint8_t *)resp_str, sizeof(resp_str));
466  FAIL_IF_NOT(r == 0);
468 
469  UTHAppLayerParserStateGetIds(f->alparser, &ret[0], &ret[1], &ret[2], &ret[3]);
470  FAIL_IF_NOT(ret[0] == 2); // inspect_id[0]
471  FAIL_IF_NOT(ret[1] == 2); // inspect_id[1]
472  FAIL_IF_NOT(ret[2] == 2); // log_id
473  FAIL_IF_NOT(ret[3] == 2); // min_id
474 
475  resp_str[28] = 0x03;
476  r = AppLayerParserParse(NULL, alp_tctx, f, ALPROTO_SMB,
477  STREAM_TOCLIENT, (uint8_t *)resp_str, sizeof(resp_str));
478  FAIL_IF_NOT(r == 0);
480 
481  UTHAppLayerParserStateGetIds(f->alparser, &ret[0], &ret[1], &ret[2], &ret[3]);
482  FAIL_IF_NOT(ret[0] == 8); // inspect_id[0]
483  FAIL_IF_NOT(ret[1] == 8); // inspect_id[1]
484  FAIL_IF_NOT(ret[2] == 8); // log_id
485  FAIL_IF_NOT(ret[3] == 8); // min_id
486 
487  req_str[28] = 0x09;
488  r = AppLayerParserParse(NULL, alp_tctx, f, ALPROTO_SMB,
489  STREAM_TOSERVER | STREAM_EOF, (uint8_t *)req_str, sizeof(req_str));
490  FAIL_IF_NOT(r == 0);
492 
493  UTHAppLayerParserStateGetIds(f->alparser, &ret[0], &ret[1], &ret[2], &ret[3]);
494  FAIL_IF_NOT(ret[0] == 8); // inspect_id[0] not updated by ..Cleanup() until full tx is done
495  FAIL_IF_NOT(ret[1] == 8); // inspect_id[1]
496  FAIL_IF_NOT(ret[2] == 8); // log_id
497  FAIL_IF_NOT(ret[3] == 8); // min_id
498 
499  resp_str[28] = 0x09;
500  r = AppLayerParserParse(NULL, alp_tctx, f, ALPROTO_SMB,
501  STREAM_TOCLIENT | STREAM_EOF, (uint8_t *)resp_str, sizeof(resp_str));
502  FAIL_IF_NOT(r == 0);
504 
505  UTHAppLayerParserStateGetIds(f->alparser, &ret[0], &ret[1], &ret[2], &ret[3]);
506  FAIL_IF_NOT(ret[0] == 9); // inspect_id[0]
507  FAIL_IF_NOT(ret[1] == 9); // inspect_id[1]
508  FAIL_IF_NOT(ret[2] == 9); // log_id
509  FAIL_IF_NOT(ret[3] == 9); // min_id
510 
511  AppLayerParserThreadCtxFree(alp_tctx);
513  UTHFreeFlow(f);
514 
515  PASS;
516 }
517 
518 static void SMBParserRegisterTests(void)
519 {
520  UtRegisterTest("SMBParserTxCleanupTest", SMBParserTxCleanupTest);
521 }
522 
523 #endif /* UNITTESTS */
void RegisterSMBParsers(void)
void AppLayerParserSetStreamDepth(uint8_t ipproto, AppProto alproto, uint32_t stream_depth)
#define STREAMING_BUFFER_CONFIG_INITIALIZER
enum AppLayerEventType_ AppLayerEventType
uint16_t flags
#define SCLogDebug(...)
Definition: util-debug.h:335
void AppLayerParserRegisterOptionFlags(uint8_t ipproto, AppProto alproto, uint32_t flags)
void AppLayerProtoDetectPPRegister(uint8_t ipproto, const char *portstr, AppProto alproto, uint16_t min_depth, uint16_t max_depth, uint8_t direction, ProbingParserFPtr ProbingParser1, ProbingParserFPtr ProbingParser2)
register parser at a port
void AppLayerParserRegisterGetStateProgressFunc(uint8_t ipproto, AppProto alproto, int(*StateGetProgress)(void *alstate, uint8_t direction))
uint32_t event_type
uint8_t proto
Definition: flow.h:344
LoggerId
Port sp
Definition: flow.h:331
#define PASS
Pass the test.
int AppLayerProtoDetectConfProtoDetectionEnabled(const char *ipproto, const char *alproto)
Given a protocol name, checks if proto detection is enabled in the conf file.
void AppLayerParserRegisterDetectFlagsFuncs(uint8_t ipproto, AppProto alproto, uint64_t(*GetTxDetectFlags)(void *tx, uint8_t dir), void(*SetTxDetectFlags)(void *tx, uint8_t dir, uint64_t))
void AppLayerParserRegisterDetectStateFuncs(uint8_t ipproto, AppProto alproto, DetectEngineState *(*GetTxDetectState)(void *tx), int(*SetTxDetectState)(void *tx, DetectEngineState *))
void AppLayerParserRegisterTruncateFunc(uint8_t ipproto, AppProto alproto, void(*Truncate)(void *, uint8_t))
void AppLayerParserThreadCtxFree(AppLayerParserThreadCtx *tctx)
Destroys the app layer parser thread context obtained using AppLayerParserThreadCtxAlloc().
#define FLOW_DIR_REVERSED
Definition: flow.h:106
#define SCReturnUInt(x)
Definition: util-debug.h:343
void StreamTcpFreeConfig(char quiet)
Definition: stream-tcp.c:668
void AppLayerParserRegisterGetEventsFunc(uint8_t ipproto, AppProto alproto, AppLayerDecoderEvents *(*StateGetEvents)(void *))
void AppLayerParserRegisterLoggerFuncs(uint8_t ipproto, AppProto alproto, LoggerId(*StateGetTxLogged)(void *, void *), void(*StateSetTxLogged)(void *, void *, LoggerId))
uint16_t AppProto
char * val
Definition: conf.h:34
#define TRUE
int AppLayerProtoDetectPMRegisterPatternCSwPP(uint8_t ipproto, AppProto alproto, const char *pattern, uint16_t depth, uint16_t offset, uint8_t direction, ProbingParserFPtr PPFunc, uint16_t pp_min_depth, uint16_t pp_max_depth)
void * protoctx
Definition: flow.h:400
int AppLayerParserConfParserEnabled(const char *ipproto, const char *alproto_name)
check if a parser is enabled in the config Returns enabled always if: were running unittests and when...
Flow * UTHBuildFlow(int family, const char *src, const char *dst, Port sp, Port dp)
Data structure to store app layer decoder events.
int AppLayerParserRegisterParser(uint8_t ipproto, AppProto alproto, uint8_t direction, AppLayerParserFPtr Parser)
Register app layer parser for the protocol.
void AppLayerParserRegisterGetTx(uint8_t ipproto, AppProto alproto, void *(StateGetTx)(void *alstate, uint64_t tx_id))
void AppLayerParserRegisterGetFilesFunc(uint8_t ipproto, AppProto alproto, FileContainer *(*StateGetFiles)(void *, uint8_t))
int AppLayerProtoDetectPPParseConfPorts(const char *ipproto_name, uint8_t ipproto, const char *alproto_name, AppProto alproto, uint16_t min_depth, uint16_t max_depth, ProbingParserFPtr ProbingParserTs, ProbingParserFPtr ProbingParserTc)
void AppLayerParserRegisterGetEventInfo(uint8_t ipproto, AppProto alproto, int(*StateGetEventInfo)(const char *event_name, int *event_id, AppLayerEventType *event_type))
#define SCLogError(err_code,...)
Macro used to log ERROR messages.
Definition: util-debug.h:294
#define STREAM_EOF
Definition: stream.h:30
void UtRegisterTest(const char *name, int(*TestFn)(void))
Register unit test.
#define SCEnter(...)
Definition: util-debug.h:337
void StreamTcpInitConfig(char)
To initialize the stream global configuration data.
Definition: stream-tcp.c:364
#define STREAM_TOCLIENT
Definition: stream.h:32
#define MIN_REC_SIZE
Definition: app-layer-smb.c:33
void AppLayerParserRegisterGetStateProgressCompletionStatus(AppProto alproto, int(*StateGetProgressCompletionStatus)(uint8_t direction))
AppLayerParserThreadCtx * AppLayerParserThreadCtxAlloc(void)
Gets a new app layer protocol&#39;s parser thread context.
int RunmodeIsUnittests(void)
Definition: suricata.c:267
#define SMB_CONFIG_DEFAULT_STREAM_DEPTH
void AppLayerParserRegisterGetEventInfoById(uint8_t ipproto, AppProto alproto, int(*StateGetEventInfoById)(int event_id, const char **event_name, AppLayerEventType *event_type))
Definition: conf.h:32
#define FILE_USE_DETECT
Definition: util-file.h:49
void AppLayerParserTransactionsCleanup(Flow *f)
remove obsolete (inspected and logged) transactions
void AppLayerProtoDetectRegisterProtocol(AppProto alproto, const char *alproto_name)
Registers a protocol for protocol detection phase.
PoolThreadReserved res
Port dp
Definition: flow.h:338
uint16_t tx_id
void AppLayerParserRegisterProtocolUnittests(uint8_t ipproto, AppProto alproto, void(*RegisterUnittests)(void))
int AppLayerParserParse(ThreadVars *tv, AppLayerParserThreadCtx *alp_tctx, Flow *f, AppProto alproto, uint8_t flags, const uint8_t *input, uint32_t input_len)
#define STREAM_START
Definition: stream.h:29
#define STREAM_TOSERVER
Definition: stream.h:31
#define APP_LAYER_PARSER_OPT_ACCEPT_GAPS
void AppLayerParserRegisterGetTxIterator(uint8_t ipproto, AppProto alproto, AppLayerGetTxIteratorFunc Func)
uint16_t FileFlowToFlags(const Flow *flow, uint8_t direction)
Definition: util-file.c:219
ConfNode * ConfGetNode(const char *name)
Get a ConfNode by name.
Definition: conf.c:176
#define FAIL_IF_NULL(expr)
Fail a test if expression evaluates to NULL.
Definition: util-unittest.h:89
void AppLayerParserRegisterGetTxCnt(uint8_t ipproto, AppProto alproto, uint64_t(*StateGetTxCnt)(void *alstate))
void AppLayerParserRegisterStateFuncs(uint8_t ipproto, AppProto alproto, void *(*StateAlloc)(void), void(*StateFree)(void *))
uint8_t len
int ParseSizeStringU32(const char *size, uint32_t *res)
Definition: util-misc.c:186
AppProto alproto
application level protocol
Definition: flow.h:409
void UTHAppLayerParserStateGetIds(void *ptr, uint64_t *i1, uint64_t *i2, uint64_t *log, uint64_t *min)
struct SCLogConfig_ SCLogConfig
Holds the config state used by the logging api.
Flow data structure.
Definition: flow.h:325
uint32_t flags
Definition: flow.h:379
#define FAIL_IF_NOT(expr)
Fail a test if expression to true.
Definition: util-unittest.h:82
AppLayerParserState * alparser
Definition: flow.h:437
void UTHFreeFlow(Flow *flow)
void AppLayerParserRegisterTxFreeFunc(uint8_t ipproto, AppProto alproto, void(*StateTransactionFree)(void *, uint64_t))