suricata
app-layer-smb.c
Go to the documentation of this file.
1 /* Copyright (C) 2017-2020 Open Information Security Foundation
2  *
3  * You can copy, redistribute or modify this Program under the terms of
4  * the GNU General Public License version 2 as published by the Free
5  * Software Foundation.
6  *
7  * This program is distributed in the hope that it will be useful,
8  * but WITHOUT ANY WARRANTY; without even the implied warranty of
9  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
10  * GNU General Public License for more details.
11  *
12  * You should have received a copy of the GNU General Public License
13  * version 2 along with this program; if not, write to the Free Software
14  * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA
15  * 02110-1301, USA.
16  */
17 
18 #include "suricata-common.h"
19 #include "suricata.h"
20 
21 #include "app-layer-protos.h"
22 #include "app-layer-detect-proto.h"
23 #include "app-layer-parser.h"
24 
25 #include "util-unittest.h"
26 
27 #include "rust.h"
28 #include "app-layer-smb.h"
29 #include "util-misc.h"
30 
31 #define MIN_REC_SIZE 32+4 // SMB hdr + nbss hdr
32 
33 static AppLayerResult SMBTCPParseRequest(Flow *f, void *state,
34  AppLayerParserState *pstate, const uint8_t *input, uint32_t input_len,
35  void *local_data, const uint8_t flags)
36 {
37  SCLogDebug("SMBTCPParseRequest");
38  uint16_t file_flags = FileFlowToFlags(f, STREAM_TOSERVER);
39  rs_smb_setfileflags(0, state, file_flags|FILE_USE_DETECT);
40 
41  if (input == NULL && input_len > 0) {
42  AppLayerResult res = rs_smb_parse_request_tcp_gap(state, input_len);
43  SCLogDebug("SMB request GAP of %u bytes, retval %d", input_len, res.status);
45  } else {
46  AppLayerResult res = rs_smb_parse_request_tcp(f, state, pstate,
47  input, input_len, local_data, flags);
48  SCLogDebug("SMB request%s of %u bytes, retval %d",
49  (input == NULL && input_len > 0) ? " is GAP" : "", input_len, res.status);
51  }
52 }
53 
54 static AppLayerResult SMBTCPParseResponse(Flow *f, void *state,
55  AppLayerParserState *pstate, const uint8_t *input, uint32_t input_len,
56  void *local_data, const uint8_t flags)
57 {
58  SCLogDebug("SMBTCPParseResponse");
59  uint16_t file_flags = FileFlowToFlags(f, STREAM_TOCLIENT);
60  rs_smb_setfileflags(1, state, file_flags|FILE_USE_DETECT);
61 
62  SCLogDebug("SMBTCPParseResponse %p/%u", input, input_len);
63  if (input == NULL && input_len > 0) {
64  AppLayerResult res = rs_smb_parse_response_tcp_gap(state, input_len);
65  SCLogDebug("SMB response GAP of %u bytes, retval %d", input_len, res.status);
67  } else {
68  AppLayerResult res = rs_smb_parse_response_tcp(f, state, pstate,
69  input, input_len, local_data, flags);
71  }
72 }
73 
74 static uint16_t SMBTCPProbe(Flow *f, uint8_t direction,
75  const uint8_t *input, uint32_t len, uint8_t *rdir)
76 {
77  SCLogDebug("SMBTCPProbe");
78 
79  if (len < MIN_REC_SIZE) {
80  return ALPROTO_UNKNOWN;
81  }
82 
83  const int r = rs_smb_probe_tcp(direction, input, len, rdir);
84  switch (r) {
85  case 1:
86  return ALPROTO_SMB;
87  case 0:
88  return ALPROTO_UNKNOWN;
89  case -1:
90  default:
91  return ALPROTO_FAILED;
92  }
93 }
94 
95 /** \internal
96  * \brief as SMB3 records have no direction indicator, fall
97  * back to the port numbers for a hint
98  */
99 static uint16_t SMB3TCPProbe(Flow *f, uint8_t direction,
100  const uint8_t *input, uint32_t len, uint8_t *rdir)
101 {
102  SCEnter();
103 
104  AppProto p = SMBTCPProbe(f, direction, input, len, rdir);
105  if (p != ALPROTO_SMB) {
106  SCReturnUInt(p);
107  }
108 
109  uint16_t fsp = (f->flags & FLOW_DIR_REVERSED) ? f->dp : f->sp;
110  uint16_t fdp = (f->flags & FLOW_DIR_REVERSED) ? f->sp : f->dp;
111  SCLogDebug("direction %s flow sp %u dp %u fsp %u fdp %u",
112  (direction & STREAM_TOSERVER) ? "toserver" : "toclient",
113  f->sp, f->dp, fsp, fdp);
114 
115  if (fsp == 445 && fdp != 445) {
116  if (direction & STREAM_TOSERVER) {
117  *rdir = STREAM_TOCLIENT;
118  } else {
119  *rdir = STREAM_TOSERVER;
120  }
121  }
122  SCLogDebug("returning ALPROTO_SMB for dir %s with rdir %s",
123  (direction & STREAM_TOSERVER) ? "toserver" : "toclient",
124  (*rdir == STREAM_TOSERVER) ? "toserver" : "toclient");
126 }
127 
128 static int SMBGetAlstateProgress(void *tx, uint8_t direction)
129 {
130  return rs_smb_tx_get_alstate_progress(tx, direction);
131 }
132 
133 static uint64_t SMBGetTxCnt(void *alstate)
134 {
135  return rs_smb_state_get_tx_count(alstate);
136 }
137 
138 static void *SMBGetTx(void *alstate, uint64_t tx_id)
139 {
140  return rs_smb_state_get_tx(alstate, tx_id);
141 }
142 
143 static AppLayerGetTxIterTuple SMBGetTxIterator(
144  const uint8_t ipproto, const AppProto alproto,
145  void *alstate, uint64_t min_tx_id, uint64_t max_tx_id,
146  AppLayerGetTxIterState *istate)
147 {
148  return rs_smb_state_get_tx_iterator(alstate, min_tx_id, (uint64_t *)istate);
149 }
150 
151 
152 static void SMBStateTransactionFree(void *state, uint64_t tx_id)
153 {
154  rs_smb_state_tx_free(state, tx_id);
155 }
156 
157 static DetectEngineState *SMBGetTxDetectState(void *tx)
158 {
159  return rs_smb_state_get_tx_detect_state(tx);
160 }
161 
162 static int SMBSetTxDetectState(void *tx, DetectEngineState *s)
163 {
164  rs_smb_state_set_tx_detect_state(tx, s);
165  return 0;
166 }
167 
168 static FileContainer *SMBGetFiles(void *state, uint8_t direction)
169 {
170  return rs_smb_getfiles(direction, state);
171 }
172 
173 static AppLayerDecoderEvents *SMBGetEvents(void *tx)
174 {
175  return rs_smb_state_get_events(tx);
176 }
177 
178 static int SMBGetEventInfoById(int event_id, const char **event_name,
179  AppLayerEventType *event_type)
180 {
181  return rs_smb_state_get_event_info_by_id(event_id, event_name, event_type);
182 }
183 
184 static int SMBGetEventInfo(const char *event_name, int *event_id,
185  AppLayerEventType *event_type)
186 {
187  return rs_smb_state_get_event_info(event_name, event_id, event_type);
188 }
189 
190 static void SMBStateTruncate(void *state, uint8_t direction)
191 {
192  return rs_smb_state_truncate(state, direction);
193 }
194 
195 static int SMBRegisterPatternsForProtocolDetection(void)
196 {
197  int r = 0;
198  /* SMB1 */
200  "|ff|SMB", 8, 4, STREAM_TOSERVER, SMBTCPProbe,
203  "|ff|SMB", 8, 4, STREAM_TOCLIENT, SMBTCPProbe,
205 
206  /* SMB2/3 */
208  "|fe|SMB", 8, 4, STREAM_TOSERVER, SMBTCPProbe,
211  "|fe|SMB", 8, 4, STREAM_TOCLIENT, SMBTCPProbe,
213 
214  /* SMB3 encrypted records */
216  "|fd|SMB", 8, 4, STREAM_TOSERVER, SMB3TCPProbe,
219  "|fd|SMB", 8, 4, STREAM_TOCLIENT, SMB3TCPProbe,
221  return r == 0 ? 0 : -1;
222 }
223 
225 static SuricataFileContext sfc = { &sbcfg };
226 
227 #define SMB_CONFIG_DEFAULT_STREAM_DEPTH 0
228 
229 #ifdef UNITTESTS
230 static void SMBParserRegisterTests(void);
231 #endif
232 
233 static uint32_t stream_depth = SMB_CONFIG_DEFAULT_STREAM_DEPTH;
234 
236 {
237  const char *proto_name = "smb";
238 
239  /** SMB */
240  if (AppLayerProtoDetectConfProtoDetectionEnabled("tcp", proto_name)) {
242  if (SMBRegisterPatternsForProtocolDetection() < 0)
243  return;
244 
245  rs_smb_init(&sfc);
246 
247  if (RunmodeIsUnittests()) {
248  AppLayerProtoDetectPPRegister(IPPROTO_TCP, "445", ALPROTO_SMB, 0,
249  MIN_REC_SIZE, STREAM_TOSERVER, SMBTCPProbe,
250  SMBTCPProbe);
251  } else {
252  int have_cfg = AppLayerProtoDetectPPParseConfPorts("tcp",
253  IPPROTO_TCP, proto_name, ALPROTO_SMB, 0,
254  MIN_REC_SIZE, SMBTCPProbe, SMBTCPProbe);
255  /* if we have no config, we enable the default port 445 */
256  if (!have_cfg) {
257  SCLogConfig("no SMB TCP config found, enabling SMB detection "
258  "on port 445.");
259  AppLayerProtoDetectPPRegister(IPPROTO_TCP, "445", ALPROTO_SMB, 0,
260  MIN_REC_SIZE, STREAM_TOSERVER, SMBTCPProbe,
261  SMBTCPProbe);
262  }
263  }
264  } else {
265  SCLogConfig("Protocol detection and parser disabled for %s protocol.",
266  proto_name);
267  return;
268  }
269 
270  if (AppLayerParserConfParserEnabled("tcp", proto_name)) {
272  SMBTCPParseRequest);
274  SMBTCPParseResponse);
276  rs_smb_state_new, rs_smb_state_free);
278  SMBStateTransactionFree);
279 
281  SMBGetEvents);
283  SMBGetEventInfo);
285  SMBGetEventInfoById);
286 
288  SMBGetTxDetectState, SMBSetTxDetectState);
289  AppLayerParserRegisterGetTx(IPPROTO_TCP, ALPROTO_SMB, SMBGetTx);
290  AppLayerParserRegisterGetTxIterator(IPPROTO_TCP, ALPROTO_SMB, SMBGetTxIterator);
292  SMBGetTxCnt);
294  SMBGetAlstateProgress);
296  rs_smb_state_progress_completion_status);
298  SMBStateTruncate);
299  AppLayerParserRegisterGetFilesFunc(IPPROTO_TCP, ALPROTO_SMB, SMBGetFiles);
300 
301  AppLayerParserRegisterTxDataFunc(IPPROTO_TCP, ALPROTO_SMB, rs_smb_get_tx_data);
302 
303  /* This parser accepts gaps. */
306 
307  ConfNode *p = ConfGetNode("app-layer.protocols.smb.stream-depth");
308  if (p != NULL) {
309  uint32_t value;
310  if (ParseSizeStringU32(p->val, &value) < 0) {
311  SCLogError(SC_ERR_SMB_CONFIG, "invalid value for stream-depth %s", p->val);
312  } else {
313  stream_depth = value;
314  }
315  }
316  SCLogConfig("SMB stream depth: %u", stream_depth);
317 
318  AppLayerParserSetStreamDepth(IPPROTO_TCP, ALPROTO_SMB, stream_depth);
319  } else {
320  SCLogConfig("Parsed disabled for %s protocol. Protocol detection"
321  "still on.", proto_name);
322  }
323 #ifdef UNITTESTS
324  AppLayerParserRegisterProtocolUnittests(IPPROTO_TCP, ALPROTO_SMB, SMBParserRegisterTests);
325 #endif
326 
327  return;
328 }
329 
330 #ifdef UNITTESTS
331 #include "stream-tcp.h"
332 #include "util-unittest-helper.h"
333 
334 /** \test multi transactions and cleanup */
335 static int SMBParserTxCleanupTest(void)
336 {
337  uint64_t ret[4];
340 
342  TcpSession ssn;
343  memset(&ssn, 0, sizeof(ssn));
344 
345  Flow *f = UTHBuildFlow(AF_INET, "1.2.3.4", "1.2.3.5", 1024, 445);
346  FAIL_IF_NULL(f);
347  f->protoctx = &ssn;
348  f->proto = IPPROTO_TCP;
349  f->alproto = ALPROTO_SMB;
350 
351  char req_str[] ="\x00\x00\x00\x79\xfe\x53\x4d\x42\x40\x00\x01\x00\x00\x00\x00\x00" \
352  "\x05\x00\xe0\x1e\x10\x00\x00\x00\x00\x00\x00\x00\x0b\x00\x00\x00" \
353  "\x00\x00\x00\x00\x00\x00\x00\x00\x10\x72\xd2\x9f\x36\xc2\x08\x14" \
354  "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00" \
355  "\x00\x00\x00\x00\x39\x00\x00\x00\x02\x00\x00\x00\x00\x00\x00\x00" \
356  "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x80\x00\x00\x00" \
357  "\x00\x00\x00\x00\x07\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00" \
358  "\x78\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00";
359  req_str[28] = 0x01;
360  int r = AppLayerParserParse(NULL, alp_tctx, f, ALPROTO_SMB,
361  STREAM_TOSERVER | STREAM_START, (uint8_t *)req_str, sizeof(req_str));
362  FAIL_IF_NOT(r == 0);
363  req_str[28]++;
365  STREAM_TOSERVER, (uint8_t *)req_str, sizeof(req_str));
366  FAIL_IF_NOT(r == 0);
367  req_str[28]++;
369  STREAM_TOSERVER, (uint8_t *)req_str, sizeof(req_str));
370  FAIL_IF_NOT(r == 0);
371  req_str[28]++;
373  STREAM_TOSERVER, (uint8_t *)req_str, sizeof(req_str));
374  FAIL_IF_NOT(r == 0);
375  req_str[28]++;
377  STREAM_TOSERVER, (uint8_t *)req_str, sizeof(req_str));
378  FAIL_IF_NOT(r == 0);
379  req_str[28]++;
381  STREAM_TOSERVER, (uint8_t *)req_str, sizeof(req_str));
382  FAIL_IF_NOT(r == 0);
383  req_str[28]++;
385  STREAM_TOSERVER, (uint8_t *)req_str, sizeof(req_str));
386  FAIL_IF_NOT(r == 0);
387  req_str[28]++;
389  STREAM_TOSERVER, (uint8_t *)req_str, sizeof(req_str));
390  FAIL_IF_NOT(r == 0);
391  req_str[28]++;
392 
394  UTHAppLayerParserStateGetIds(f->alparser, &ret[0], &ret[1], &ret[2], &ret[3]);
395  FAIL_IF_NOT(ret[0] == 0); // inspect_id[0]
396  FAIL_IF_NOT(ret[1] == 0); // inspect_id[1]
397  FAIL_IF_NOT(ret[2] == 0); // log_id
398  FAIL_IF_NOT(ret[3] == 0); // min_id
399 
400  char resp_str[] = "\x00\x00\x00\x98\xfe\x53\x4d\x42\x40\x00\x01\x00\x00\x00\x00\x00" \
401  "\x05\x00\x21\x00\x11\x00\x00\x00\x00\x00\x00\x00\x0b\x00\x00\x00" \
402  "\x00\x00\x00\x00\x00\x00\x00\x00\x10\x72\xd2\x9f\x36\xc2\x08\x14" \
403  "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00" \
404  "\x00\x00\x00\x00\x59\x00\x00\x00\x01\x00\x00\x00\x48\x38\x40\xb3" \
405  "\x0f\xa8\xd3\x01\x84\x9a\x2b\x46\xf7\xa8\xd3\x01\x48\x38\x40\xb3" \
406  "\x0f\xa8\xd3\x01\x48\x38\x40\xb3\x0f\xa8\xd3\x01\x00\x00\x00\x00" \
407  "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x10\x00\x00\x00" \
408  "\x00\x00\x00\x00\x9e\x8f\xb8\x91\x00\x00\x00\x00\x01\x5b\x11\xbb" \
409  "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00";
410 
411  resp_str[28] = 0x01;
413  STREAM_TOCLIENT | STREAM_START, (uint8_t *)resp_str, sizeof(resp_str));
414  FAIL_IF_NOT(r == 0);
415  resp_str[28] = 0x04;
417  STREAM_TOCLIENT, (uint8_t *)resp_str, sizeof(resp_str));
418  FAIL_IF_NOT(r == 0);
419  resp_str[28] = 0x05;
421  STREAM_TOCLIENT, (uint8_t *)resp_str, sizeof(resp_str));
422  FAIL_IF_NOT(r == 0);
423  resp_str[28] = 0x06;
425  STREAM_TOCLIENT, (uint8_t *)resp_str, sizeof(resp_str));
426  FAIL_IF_NOT(r == 0);
427  resp_str[28] = 0x08;
429  STREAM_TOCLIENT, (uint8_t *)resp_str, sizeof(resp_str));
430  FAIL_IF_NOT(r == 0);
431  resp_str[28] = 0x02;
433  STREAM_TOCLIENT, (uint8_t *)resp_str, sizeof(resp_str));
434  FAIL_IF_NOT(r == 0);
435  resp_str[28] = 0x07;
437  STREAM_TOCLIENT, (uint8_t *)resp_str, sizeof(resp_str));
438  FAIL_IF_NOT(r == 0);
440 
441  UTHAppLayerParserStateGetIds(f->alparser, &ret[0], &ret[1], &ret[2], &ret[3]);
442  FAIL_IF_NOT(ret[0] == 2); // inspect_id[0]
443  FAIL_IF_NOT(ret[1] == 2); // inspect_id[1]
444  FAIL_IF_NOT(ret[2] == 2); // log_id
445  FAIL_IF_NOT(ret[3] == 2); // min_id
446 
447  resp_str[28] = 0x03;
449  STREAM_TOCLIENT, (uint8_t *)resp_str, sizeof(resp_str));
450  FAIL_IF_NOT(r == 0);
452 
453  UTHAppLayerParserStateGetIds(f->alparser, &ret[0], &ret[1], &ret[2], &ret[3]);
454  FAIL_IF_NOT(ret[0] == 8); // inspect_id[0]
455  FAIL_IF_NOT(ret[1] == 8); // inspect_id[1]
456  FAIL_IF_NOT(ret[2] == 8); // log_id
457  FAIL_IF_NOT(ret[3] == 8); // min_id
458 
459  req_str[28] = 0x09;
461  STREAM_TOSERVER | STREAM_EOF, (uint8_t *)req_str, sizeof(req_str));
462  FAIL_IF_NOT(r == 0);
464 
465  UTHAppLayerParserStateGetIds(f->alparser, &ret[0], &ret[1], &ret[2], &ret[3]);
466  FAIL_IF_NOT(ret[0] == 8); // inspect_id[0] not updated by ..Cleanup() until full tx is done
467  FAIL_IF_NOT(ret[1] == 8); // inspect_id[1]
468  FAIL_IF_NOT(ret[2] == 8); // log_id
469  FAIL_IF_NOT(ret[3] == 8); // min_id
470 
471  resp_str[28] = 0x09;
473  STREAM_TOCLIENT | STREAM_EOF, (uint8_t *)resp_str, sizeof(resp_str));
474  FAIL_IF_NOT(r == 0);
476 
477  UTHAppLayerParserStateGetIds(f->alparser, &ret[0], &ret[1], &ret[2], &ret[3]);
478  FAIL_IF_NOT(ret[0] == 9); // inspect_id[0]
479  FAIL_IF_NOT(ret[1] == 9); // inspect_id[1]
480  FAIL_IF_NOT(ret[2] == 9); // log_id
481  FAIL_IF_NOT(ret[3] == 9); // min_id
482 
485  UTHFreeFlow(f);
486 
487  PASS;
488 }
489 
490 static void SMBParserRegisterTests(void)
491 {
492  UtRegisterTest("SMBParserTxCleanupTest", SMBParserTxCleanupTest);
493 }
494 
495 #endif /* UNITTESTS */
AppLayerParserRegisterGetStateProgressFunc
void AppLayerParserRegisterGetStateProgressFunc(uint8_t ipproto, AppProto alproto, int(*StateGetProgress)(void *alstate, uint8_t direction))
Definition: app-layer-parser.c:475
AppLayerProtoDetectPPParseConfPorts
int AppLayerProtoDetectPPParseConfPorts(const char *ipproto_name, uint8_t ipproto, const char *alproto_name, AppProto alproto, uint16_t min_depth, uint16_t max_depth, ProbingParserFPtr ProbingParserTs, ProbingParserFPtr ProbingParserTc)
Definition: app-layer-detect-proto.c:1649
FileContainer_
Definition: util-file.h:100
len
uint8_t len
Definition: app-layer-dnp3.h:2
FAIL_IF_NULL
#define FAIL_IF_NULL(expr)
Fail a test if expression evaluates to NULL.
Definition: util-unittest.h:89
RegisterSMBParsers
void RegisterSMBParsers(void)
Definition: app-layer-smb.c:235
AppLayerParserRegisterOptionFlags
void AppLayerParserRegisterOptionFlags(uint8_t ipproto, AppProto alproto, uint32_t flags)
Definition: app-layer-parser.c:382
AppLayerParserSetStreamDepth
void AppLayerParserSetStreamDepth(uint8_t ipproto, AppProto alproto, uint32_t stream_depth)
Definition: app-layer-parser.c:1420
DetectEngineState_
Definition: detect-engine-state.h:92
ConfNode_::val
char * val
Definition: conf.h:34
stream-tcp.h
UtRegisterTest
void UtRegisterTest(const char *name, int(*TestFn)(void))
Register unit test.
Definition: util-unittest.c:103
SCLogDebug
#define SCLogDebug(...)
Definition: util-debug.h:298
Flow_::proto
uint8_t proto
Definition: flow.h:365
AppProto
uint16_t AppProto
Definition: app-layer-protos.h:73
AppLayerParserConfParserEnabled
int AppLayerParserConfParserEnabled(const char *ipproto, const char *alproto_name)
check if a parser is enabled in the config Returns enabled always if: were running unittests
Definition: app-layer-parser.c:301
STREAMING_BUFFER_CONFIG_INITIALIZER
#define STREAMING_BUFFER_CONFIG_INITIALIZER
Definition: util-streaming-buffer.h:77
ConfGetNode
ConfNode * ConfGetNode(const char *name)
Get a ConfNode by name.
Definition: conf.c:175
Flow_
Flow data structure.
Definition: flow.h:347
AppLayerEventType
enum AppLayerEventType_ AppLayerEventType
AppLayerParserRegisterGetEventsFunc
void AppLayerParserRegisterGetEventsFunc(uint8_t ipproto, AppProto alproto, AppLayerDecoderEvents *(*StateGetEvents)(void *))
Definition: app-layer-parser.c:436
AppLayerParserRegisterTruncateFunc
void AppLayerParserRegisterTruncateFunc(uint8_t ipproto, AppProto alproto, void(*Truncate)(void *, uint8_t))
Definition: app-layer-parser.c:465
AppLayerParserRegisterTxFreeFunc
void AppLayerParserRegisterTxFreeFunc(uint8_t ipproto, AppProto alproto, void(*StateTransactionFree)(void *, uint64_t))
Definition: app-layer-parser.c:486
AppLayerParserThreadCtxFree
void AppLayerParserThreadCtxFree(AppLayerParserThreadCtx *tctx)
Destroys the app layer parser thread context obtained using AppLayerParserThreadCtxAlloc().
Definition: app-layer-parser.c:278
rust.h
AppLayerParserRegisterDetectStateFuncs
void AppLayerParserRegisterDetectStateFuncs(uint8_t ipproto, AppProto alproto, DetectEngineState *(*GetTxDetectState)(void *tx), int(*SetTxDetectState)(void *tx, DetectEngineState *))
Definition: app-layer-parser.c:562
Flow_::dp
Port dp
Definition: flow.h:359
Flow_::protoctx
void * protoctx
Definition: flow.h:441
AppLayerDecoderEvents_
Data structure to store app layer decoder events.
Definition: app-layer-events.h:34
util-unittest.h
util-unittest-helper.h
FAIL_IF_NOT
#define FAIL_IF_NOT(expr)
Fail a test if expression to true.
Definition: util-unittest.h:82
STREAM_START
#define STREAM_START
Definition: stream.h:29
AppLayerProtoDetectPPRegister
void AppLayerProtoDetectPPRegister(uint8_t ipproto, const char *portstr, AppProto alproto, uint16_t min_depth, uint16_t max_depth, uint8_t direction, ProbingParserFPtr ProbingParser1, ProbingParserFPtr ProbingParser2)
register parser at a port
Definition: app-layer-detect-proto.c:1615
Flow_::alparser
AppLayerParserState * alparser
Definition: flow.h:475
SC_ERR_SMB_CONFIG
@ SC_ERR_SMB_CONFIG
Definition: util-error.h:340
app-layer-detect-proto.h
UTHBuildFlow
Flow * UTHBuildFlow(int family, const char *src, const char *dst, Port sp, Port dp)
Definition: util-unittest-helper.c:521
AppLayerParserState_
Definition: app-layer-parser.c:154
PASS
#define PASS
Pass the test.
Definition: util-unittest.h:105
FileFlowToFlags
uint16_t FileFlowToFlags(const Flow *flow, uint8_t direction)
Definition: util-file.c:231
STREAM_TOSERVER
#define STREAM_TOSERVER
Definition: stream.h:31
res
PoolThreadReserved res
Definition: stream-tcp-private.h:0
alp_tctx
AppLayerParserThreadCtx * alp_tctx
Definition: fuzz_applayerparserparse.c:19
AppLayerParserRegisterGetFilesFunc
void AppLayerParserRegisterGetFilesFunc(uint8_t ipproto, AppProto alproto, FileContainer *(*StateGetFiles)(void *, uint8_t))
Definition: app-layer-parser.c:425
SCEnter
#define SCEnter(...)
Definition: util-debug.h:300
AppLayerParserRegisterStateFuncs
void AppLayerParserRegisterStateFuncs(uint8_t ipproto, AppProto alproto, void *(*StateAlloc)(void *, AppProto), void(*StateFree)(void *))
Definition: app-layer-parser.c:398
AppLayerProtoDetectPMRegisterPatternCSwPP
int AppLayerProtoDetectPMRegisterPatternCSwPP(uint8_t ipproto, AppProto alproto, const char *pattern, uint16_t depth, uint16_t offset, uint8_t direction, ProbingParserFPtr PPFunc, uint16_t pp_min_depth, uint16_t pp_max_depth)
Definition: app-layer-detect-proto.c:1736
MIN_REC_SIZE
#define MIN_REC_SIZE
Definition: app-layer-smb.c:31
app-layer-parser.h
TRUE
#define TRUE
Definition: suricata-common.h:33
AppLayerParserRegisterProtocolUnittests
void AppLayerParserRegisterProtocolUnittests(uint8_t ipproto, AppProto alproto, void(*RegisterUnittests)(void))
Definition: app-layer-parser.c:1721
AppLayerGetTxIterState
Definition: app-layer-parser.h:118
StreamTcpFreeConfig
void StreamTcpFreeConfig(char quiet)
Definition: stream-tcp.c:668
SCReturnUInt
#define SCReturnUInt(x)
Definition: util-debug.h:306
AppLayerParserRegisterGetEventInfo
void AppLayerParserRegisterGetEventInfo(uint8_t ipproto, AppProto alproto, int(*StateGetEventInfo)(const char *event_name, int *event_id, AppLayerEventType *event_type))
Definition: app-layer-parser.c:550
AppLayerProtoDetectRegisterProtocol
void AppLayerProtoDetectRegisterProtocol(AppProto alproto, const char *alproto_name)
Registers a protocol for protocol detection phase.
Definition: app-layer-detect-proto.c:1825
RunmodeIsUnittests
int RunmodeIsUnittests(void)
Definition: suricata.c:264
AppLayerParserRegisterParser
int AppLayerParserRegisterParser(uint8_t ipproto, AppProto alproto, uint8_t direction, AppLayerParserFPtr Parser)
Register app layer parser for the protocol.
Definition: app-layer-parser.c:359
AppLayerParserRegisterGetStateProgressCompletionStatus
void AppLayerParserRegisterGetStateProgressCompletionStatus(AppProto alproto, int(*StateGetProgressCompletionStatus)(uint8_t direction))
Definition: app-layer-parser.c:527
UTHFreeFlow
void UTHFreeFlow(Flow *flow)
Definition: util-unittest-helper.c:526
AppLayerParserThreadCtxAlloc
AppLayerParserThreadCtx * AppLayerParserThreadCtxAlloc(void)
Gets a new app layer protocol's parser thread context.
Definition: app-layer-parser.c:252
AppLayerParserRegisterGetTx
void AppLayerParserRegisterGetTx(uint8_t ipproto, AppProto alproto, void *(StateGetTx)(void *alstate, uint64_t tx_id))
Definition: app-layer-parser.c:508
SMB_CONFIG_DEFAULT_STREAM_DEPTH
#define SMB_CONFIG_DEFAULT_STREAM_DEPTH
Definition: app-layer-smb.c:227
SCReturnStruct
#define SCReturnStruct(x)
Definition: util-debug.h:320
AppLayerParserTransactionsCleanup
void AppLayerParserTransactionsCleanup(Flow *f)
remove obsolete (inspected and logged) transactions
Definition: app-layer-parser.c:876
flags
uint8_t flags
Definition: decode-gre.h:0
AppLayerParserParse
int AppLayerParserParse(ThreadVars *tv, AppLayerParserThreadCtx *alp_tctx, Flow *f, AppProto alproto, uint8_t flags, const uint8_t *input, uint32_t input_len)
Definition: app-layer-parser.c:1178
suricata-common.h
STREAM_TOCLIENT
#define STREAM_TOCLIENT
Definition: stream.h:32
SCLogError
#define SCLogError(err_code,...)
Macro used to log ERROR messages.
Definition: util-debug.h:257
AppLayerParserRegisterTxDataFunc
void AppLayerParserRegisterTxDataFunc(uint8_t ipproto, AppProto alproto, AppLayerTxData *(*GetTxData)(void *tx))
Definition: app-layer-parser.c:574
ParseSizeStringU32
int ParseSizeStringU32(const char *size, uint32_t *res)
Definition: util-misc.c:185
StreamingBufferConfig_
Definition: util-streaming-buffer.h:67
SCLogConfig
struct SCLogConfig_ SCLogConfig
Holds the config state used by the logging api.
APP_LAYER_PARSER_OPT_ACCEPT_GAPS
#define APP_LAYER_PARSER_OPT_ACCEPT_GAPS
Definition: app-layer-parser.h:45
AppLayerParserRegisterGetTxIterator
void AppLayerParserRegisterGetTxIterator(uint8_t ipproto, AppProto alproto, AppLayerGetTxIteratorFunc Func)
Definition: app-layer-parser.c:519
SuricataFileContext_
Definition: rust-context.h:53
ConfNode_
Definition: conf.h:32
Flow_::flags
uint32_t flags
Definition: flow.h:421
AppLayerParserRegisterGetEventInfoById
void AppLayerParserRegisterGetEventInfoById(uint8_t ipproto, AppProto alproto, int(*StateGetEventInfoById)(int event_id, const char **event_name, AppLayerEventType *event_type))
Definition: app-layer-parser.c:538
UTHAppLayerParserStateGetIds
void UTHAppLayerParserStateGetIds(void *ptr, uint64_t *i1, uint64_t *i2, uint64_t *log, uint64_t *min)
Definition: app-layer-parser.c:173
StreamTcpInitConfig
void StreamTcpInitConfig(char)
To initialize the stream global configuration data.
Definition: stream-tcp.c:365
ALPROTO_UNKNOWN
@ ALPROTO_UNKNOWN
Definition: app-layer-protos.h:29
ALPROTO_FAILED
@ ALPROTO_FAILED
Definition: app-layer-protos.h:63
STREAM_EOF
#define STREAM_EOF
Definition: stream.h:30
app-layer-protos.h
suricata.h
AppLayerParserRegisterGetTxCnt
void AppLayerParserRegisterGetTxCnt(uint8_t ipproto, AppProto alproto, uint64_t(*StateGetTxCnt)(void *alstate))
Definition: app-layer-parser.c:497
app-layer-smb.h
FILE_USE_DETECT
#define FILE_USE_DETECT
Definition: util-file.h:49
ALPROTO_SMB
@ ALPROTO_SMB
Definition: app-layer-protos.h:37
AppLayerParserThreadCtx_
Definition: app-layer-parser.c:87
Flow_::sp
Port sp
Definition: flow.h:352
TcpSession_
Definition: stream-tcp-private.h:261
util-misc.h
Flow_::alproto
AppProto alproto
application level protocol
Definition: flow.h:450
FLOW_DIR_REVERSED
#define FLOW_DIR_REVERSED
Definition: flow.h:107
AppLayerProtoDetectConfProtoDetectionEnabled
int AppLayerProtoDetectConfProtoDetectionEnabled(const char *ipproto, const char *alproto)
Given a protocol name, checks if proto detection is enabled in the conf file.
Definition: app-layer-detect-proto.c:1888