suricata
app-layer-smb.c
Go to the documentation of this file.
1 /* Copyright (C) 2017 Open Information Security Foundation
2  *
3  * You can copy, redistribute or modify this Program under the terms of
4  * the GNU General Public License version 2 as published by the Free
5  * Software Foundation.
6  *
7  * This program is distributed in the hope that it will be useful,
8  * but WITHOUT ANY WARRANTY; without even the implied warranty of
9  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
10  * GNU General Public License for more details.
11  *
12  * You should have received a copy of the GNU General Public License
13  * version 2 along with this program; if not, write to the Free Software
14  * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA
15  * 02110-1301, USA.
16  */
17 
18 #include "suricata-common.h"
19 #include "suricata.h"
20 
21 #include "app-layer-protos.h"
22 #include "app-layer-detect-proto.h"
23 #include "app-layer-parser.h"
24 
25 #include "util-unittest.h"
26 
27 #include "rust.h"
28 #include "app-layer-smb.h"
29 #include "rust-smb-smb-gen.h"
30 #include "rust-smb-files-gen.h"
31 #include "util-misc.h"
32 
33 #define MIN_REC_SIZE 32+4 // SMB hdr + nbss hdr
34 
35 static int SMBTCPParseRequest(Flow *f, void *state,
36  AppLayerParserState *pstate, uint8_t *input, uint32_t input_len,
37  void *local_data, const uint8_t flags)
38 {
39  SCLogDebug("SMBTCPParseRequest");
40  uint16_t file_flags = FileFlowToFlags(f, STREAM_TOSERVER);
41  rs_smb_setfileflags(0, state, file_flags|FILE_USE_DETECT);
42 
43  int res;
44  if (input == NULL && input_len > 0) {
45  res = rs_smb_parse_request_tcp_gap(state, input_len);
46  } else {
47  res = rs_smb_parse_request_tcp(f, state, pstate, input, input_len,
48  local_data, flags);
49  }
50  if (res != 1) {
51  SCLogDebug("SMB request%s of %u bytes, retval %d",
52  (input == NULL && input_len > 0) ? " is GAP" : "", input_len, res);
53  }
54  return res;
55 }
56 
57 static int SMBTCPParseResponse(Flow *f, void *state,
58  AppLayerParserState *pstate, uint8_t *input, uint32_t input_len,
59  void *local_data, const uint8_t flags)
60 {
61  SCLogDebug("SMBTCPParseResponse");
62  uint16_t file_flags = FileFlowToFlags(f, STREAM_TOCLIENT);
63  rs_smb_setfileflags(1, state, file_flags|FILE_USE_DETECT);
64 
65  SCLogDebug("SMBTCPParseResponse %p/%u", input, input_len);
66  int res;
67  if (input == NULL && input_len > 0) {
68  res = rs_smb_parse_response_tcp_gap(state, input_len);
69  } else {
70  res = rs_smb_parse_response_tcp(f, state, pstate, input, input_len,
71  local_data, flags);
72  }
73  if (res != 1) {
74  SCLogDebug("SMB response%s of %u bytes, retval %d",
75  (input == NULL && input_len > 0) ? " is GAP" : "", input_len, res);
76  }
77  return res;
78 }
79 
80 static uint16_t SMBTCPProbe(Flow *f, uint8_t direction,
81  uint8_t *input, uint32_t len, uint8_t *rdir)
82 {
83  SCLogDebug("SMBTCPProbe");
84 
85  if (len < MIN_REC_SIZE) {
86  return ALPROTO_UNKNOWN;
87  }
88 
89  const int r = rs_smb_probe_tcp(direction, input, len, rdir);
90  switch (r) {
91  case 1:
92  return ALPROTO_SMB;
93  case 0:
94  return ALPROTO_UNKNOWN;
95  case -1:
96  default:
97  return ALPROTO_FAILED;
98  }
99 }
100 
101 /** \internal
102  * \brief as SMB3 records have no direction indicator, fall
103  * back to the port numbers for a hint
104  */
105 static uint16_t SMB3TCPProbe(Flow *f, uint8_t direction,
106  uint8_t *input, uint32_t len, uint8_t *rdir)
107 {
108  SCEnter();
109 
110  AppProto p = SMBTCPProbe(f, direction, input, len, rdir);
111  if (p != ALPROTO_SMB) {
112  SCReturnUInt(p);
113  }
114 
115  uint16_t fsp = (f->flags & FLOW_DIR_REVERSED) ? f->dp : f->sp;
116  uint16_t fdp = (f->flags & FLOW_DIR_REVERSED) ? f->sp : f->dp;
117  SCLogDebug("direction %s flow sp %u dp %u fsp %u fdp %u",
118  (direction & STREAM_TOSERVER) ? "toserver" : "toclient",
119  f->sp, f->dp, fsp, fdp);
120 
121  if (fsp == 445 && fdp != 445) {
122  if (direction & STREAM_TOSERVER) {
123  *rdir = STREAM_TOCLIENT;
124  } else {
125  *rdir = STREAM_TOSERVER;
126  }
127  }
128  SCLogDebug("returning ALPROTO_SMB for dir %s with rdir %s",
129  (direction & STREAM_TOSERVER) ? "toserver" : "toclient",
130  (*rdir == STREAM_TOSERVER) ? "toserver" : "toclient");
132 }
133 
134 static int SMBGetAlstateProgress(void *tx, uint8_t direction)
135 {
136  return rs_smb_tx_get_alstate_progress(tx, direction);
137 }
138 
139 static uint64_t SMBGetTxCnt(void *alstate)
140 {
141  return rs_smb_state_get_tx_count(alstate);
142 }
143 
144 static void *SMBGetTx(void *alstate, uint64_t tx_id)
145 {
146  return rs_smb_state_get_tx(alstate, tx_id);
147 }
148 
149 static AppLayerGetTxIterTuple SMBGetTxIterator(
150  const uint8_t ipproto, const AppProto alproto,
151  void *alstate, uint64_t min_tx_id, uint64_t max_tx_id,
152  AppLayerGetTxIterState *istate)
153 {
154  return rs_smb_state_get_tx_iterator(alstate, min_tx_id, (uint64_t *)istate);
155 }
156 
157 
158 static void SMBSetTxLogged(void *alstate, void *tx, uint32_t logger)
159 {
160  rs_smb_tx_set_logged(alstate, tx, logger);
161 }
162 
163 static LoggerId SMBGetTxLogged(void *alstate, void *tx)
164 {
165  return rs_smb_tx_get_logged(alstate, tx);
166 }
167 
168 static void SMBStateTransactionFree(void *state, uint64_t tx_id)
169 {
170  rs_smb_state_tx_free(state, tx_id);
171 }
172 
173 static DetectEngineState *SMBGetTxDetectState(void *tx)
174 {
175  return rs_smb_state_get_tx_detect_state(tx);
176 }
177 
178 static int SMBSetTxDetectState(void *tx, DetectEngineState *s)
179 {
180  rs_smb_state_set_tx_detect_state(tx, s);
181  return 0;
182 }
183 
184 static FileContainer *SMBGetFiles(void *state, uint8_t direction)
185 {
186  return rs_smb_getfiles(direction, state);
187 }
188 
189 static AppLayerDecoderEvents *SMBGetEvents(void *state, uint64_t id)
190 {
191  return rs_smb_state_get_events(state, id);
192 }
193 
194 static int SMBGetEventInfo(const char *event_name, int *event_id,
196 {
197  return rs_smb_state_get_event_info(event_name, event_id, event_type);
198 }
199 
200 static void SMBSetDetectFlags(void *tx, uint8_t dir, uint64_t flags)
201 {
202  rs_smb_tx_set_detect_flags(tx, dir, flags);
203 }
204 
205 static uint64_t SMBGetDetectFlags(void *tx, uint8_t dir)
206 {
207  return rs_smb_tx_get_detect_flags(tx, dir);
208 }
209 
210 static void SMBStateTruncate(void *state, uint8_t direction)
211 {
212  return rs_smb_state_truncate(state, direction);
213 }
214 
215 static int SMBRegisterPatternsForProtocolDetection(void)
216 {
217  int r = 0;
218  /* SMB1 */
220  "|ff|SMB", 8, 4, STREAM_TOSERVER, SMBTCPProbe,
223  "|ff|SMB", 8, 4, STREAM_TOCLIENT, SMBTCPProbe,
225 
226  /* SMB2/3 */
228  "|fe|SMB", 8, 4, STREAM_TOSERVER, SMBTCPProbe,
231  "|fe|SMB", 8, 4, STREAM_TOCLIENT, SMBTCPProbe,
233 
234  /* SMB3 encrypted records */
236  "|fd|SMB", 8, 4, STREAM_TOSERVER, SMB3TCPProbe,
239  "|fd|SMB", 8, 4, STREAM_TOCLIENT, SMB3TCPProbe,
241  return r == 0 ? 0 : -1;
242 }
243 
245 static SuricataFileContext sfc = { &sbcfg };
246 
247 #define SMB_CONFIG_DEFAULT_STREAM_DEPTH 0
248 
249 #ifdef UNITTESTS
250 static void SMBParserRegisterTests(void);
251 #endif
252 
253 static uint32_t stream_depth = SMB_CONFIG_DEFAULT_STREAM_DEPTH;
254 
256 {
257  const char *proto_name = "smb";
258 
259  /** SMB */
260  if (AppLayerProtoDetectConfProtoDetectionEnabled("tcp", proto_name)) {
262  if (SMBRegisterPatternsForProtocolDetection() < 0)
263  return;
264 
265  rs_smb_init(&sfc);
266 
267  if (RunmodeIsUnittests()) {
268  AppLayerProtoDetectPPRegister(IPPROTO_TCP, "445", ALPROTO_SMB, 0,
269  MIN_REC_SIZE, STREAM_TOSERVER, SMBTCPProbe,
270  NULL);
271  } else {
272  int have_cfg = AppLayerProtoDetectPPParseConfPorts("tcp",
273  IPPROTO_TCP, proto_name, ALPROTO_SMB, 0,
274  MIN_REC_SIZE, SMBTCPProbe, SMBTCPProbe);
275  /* if we have no config, we enable the default port 445 */
276  if (!have_cfg) {
277  SCLogWarning(SC_ERR_SMB_CONFIG, "no SMB TCP config found, "
278  "enabling SMB detection on "
279  "port 445.");
280  AppLayerProtoDetectPPRegister(IPPROTO_TCP, "445", ALPROTO_SMB, 0,
281  MIN_REC_SIZE, STREAM_TOSERVER, SMBTCPProbe,
282  SMBTCPProbe);
283  }
284  }
285  } else {
286  SCLogInfo("Protocol detection and parser disabled for %s protocol.",
287  proto_name);
288  return;
289  }
290 
291  if (AppLayerParserConfParserEnabled("tcp", proto_name)) {
293  SMBTCPParseRequest);
295  SMBTCPParseResponse);
297  rs_smb_state_new, rs_smb_state_free);
299  SMBStateTransactionFree);
300 
302  SMBGetEvents);
304  SMBGetEventInfo);
305 
307  SMBGetTxDetectState, SMBSetTxDetectState);
308  AppLayerParserRegisterGetTx(IPPROTO_TCP, ALPROTO_SMB, SMBGetTx);
309  AppLayerParserRegisterGetTxIterator(IPPROTO_TCP, ALPROTO_SMB, SMBGetTxIterator);
311  SMBGetTxCnt);
313  SMBGetTxLogged, SMBSetTxLogged);
315  SMBGetAlstateProgress);
317  rs_smb_state_progress_completion_status);
319  SMBGetDetectFlags, SMBSetDetectFlags);
321  SMBStateTruncate);
322  AppLayerParserRegisterGetFilesFunc(IPPROTO_TCP, ALPROTO_SMB, SMBGetFiles);
323 
324  /* This parser accepts gaps. */
327 
328  ConfNode *p = ConfGetNode("app-layer.protocols.smb.stream-depth");
329  if (p != NULL) {
330  uint32_t value;
331  if (ParseSizeStringU32(p->val, &value) < 0) {
332  SCLogError(SC_ERR_SMB_CONFIG, "invalid value for stream-depth %s", p->val);
333  } else {
334  stream_depth = value;
335  }
336  }
337  SCLogConfig("SMB stream depth: %u", stream_depth);
338 
339  AppLayerParserSetStreamDepth(IPPROTO_TCP, ALPROTO_SMB, stream_depth);
340  } else {
341  SCLogInfo("Parsed disabled for %s protocol. Protocol detection"
342  "still on.", proto_name);
343  }
344 #ifdef UNITTESTS
345  AppLayerParserRegisterProtocolUnittests(IPPROTO_TCP, ALPROTO_SMB, SMBParserRegisterTests);
346 #endif
347 
348  return;
349 }
350 
351 #ifdef UNITTESTS
352 #include "stream-tcp.h"
353 #include "util-unittest-helper.h"
354 
355 /** \test multi transactions and cleanup */
356 static int SMBParserTxCleanupTest(void)
357 {
358  uint64_t ret[4];
360  FAIL_IF_NULL(alp_tctx);
361 
363  TcpSession ssn;
364  memset(&ssn, 0, sizeof(ssn));
365 
366  Flow *f = UTHBuildFlow(AF_INET, "1.2.3.4", "1.2.3.5", 1024, 445);
367  FAIL_IF_NULL(f);
368  f->protoctx = &ssn;
369  f->proto = IPPROTO_TCP;
370  f->alproto = ALPROTO_SMB;
371 
372  char req_str[] ="\x00\x00\x00\x79\xfe\x53\x4d\x42\x40\x00\x01\x00\x00\x00\x00\x00" \
373  "\x05\x00\xe0\x1e\x10\x00\x00\x00\x00\x00\x00\x00\x0b\x00\x00\x00" \
374  "\x00\x00\x00\x00\x00\x00\x00\x00\x10\x72\xd2\x9f\x36\xc2\x08\x14" \
375  "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00" \
376  "\x00\x00\x00\x00\x39\x00\x00\x00\x02\x00\x00\x00\x00\x00\x00\x00" \
377  "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x80\x00\x00\x00" \
378  "\x00\x00\x00\x00\x07\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00" \
379  "\x78\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00";
380  req_str[28] = 0x01;
381  int r = AppLayerParserParse(NULL, alp_tctx, f, ALPROTO_SMB,
382  STREAM_TOSERVER | STREAM_START, (uint8_t *)req_str, sizeof(req_str));
383  FAIL_IF_NOT(r == 0);
384  req_str[28]++;
385  r = AppLayerParserParse(NULL, alp_tctx, f, ALPROTO_SMB,
386  STREAM_TOSERVER, (uint8_t *)req_str, sizeof(req_str));
387  FAIL_IF_NOT(r == 0);
388  req_str[28]++;
389  r = AppLayerParserParse(NULL, alp_tctx, f, ALPROTO_SMB,
390  STREAM_TOSERVER, (uint8_t *)req_str, sizeof(req_str));
391  FAIL_IF_NOT(r == 0);
392  req_str[28]++;
393  r = AppLayerParserParse(NULL, alp_tctx, f, ALPROTO_SMB,
394  STREAM_TOSERVER, (uint8_t *)req_str, sizeof(req_str));
395  FAIL_IF_NOT(r == 0);
396  req_str[28]++;
397  r = AppLayerParserParse(NULL, alp_tctx, f, ALPROTO_SMB,
398  STREAM_TOSERVER, (uint8_t *)req_str, sizeof(req_str));
399  FAIL_IF_NOT(r == 0);
400  req_str[28]++;
401  r = AppLayerParserParse(NULL, alp_tctx, f, ALPROTO_SMB,
402  STREAM_TOSERVER, (uint8_t *)req_str, sizeof(req_str));
403  FAIL_IF_NOT(r == 0);
404  req_str[28]++;
405  r = AppLayerParserParse(NULL, alp_tctx, f, ALPROTO_SMB,
406  STREAM_TOSERVER, (uint8_t *)req_str, sizeof(req_str));
407  FAIL_IF_NOT(r == 0);
408  req_str[28]++;
409  r = AppLayerParserParse(NULL, alp_tctx, f, ALPROTO_SMB,
410  STREAM_TOSERVER, (uint8_t *)req_str, sizeof(req_str));
411  FAIL_IF_NOT(r == 0);
412  req_str[28]++;
413 
415  UTHAppLayerParserStateGetIds(f->alparser, &ret[0], &ret[1], &ret[2], &ret[3]);
416  FAIL_IF_NOT(ret[0] == 0); // inspect_id[0]
417  FAIL_IF_NOT(ret[1] == 0); // inspect_id[1]
418  FAIL_IF_NOT(ret[2] == 0); // log_id
419  FAIL_IF_NOT(ret[3] == 0); // min_id
420 
421  char resp_str[] = "\x00\x00\x00\x98\xfe\x53\x4d\x42\x40\x00\x01\x00\x00\x00\x00\x00" \
422  "\x05\x00\x21\x00\x11\x00\x00\x00\x00\x00\x00\x00\x0b\x00\x00\x00" \
423  "\x00\x00\x00\x00\x00\x00\x00\x00\x10\x72\xd2\x9f\x36\xc2\x08\x14" \
424  "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00" \
425  "\x00\x00\x00\x00\x59\x00\x00\x00\x01\x00\x00\x00\x48\x38\x40\xb3" \
426  "\x0f\xa8\xd3\x01\x84\x9a\x2b\x46\xf7\xa8\xd3\x01\x48\x38\x40\xb3" \
427  "\x0f\xa8\xd3\x01\x48\x38\x40\xb3\x0f\xa8\xd3\x01\x00\x00\x00\x00" \
428  "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x10\x00\x00\x00" \
429  "\x00\x00\x00\x00\x9e\x8f\xb8\x91\x00\x00\x00\x00\x01\x5b\x11\xbb" \
430  "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00";
431 
432  resp_str[28] = 0x01;
433  r = AppLayerParserParse(NULL, alp_tctx, f, ALPROTO_SMB,
434  STREAM_TOCLIENT | STREAM_START, (uint8_t *)resp_str, sizeof(resp_str));
435  FAIL_IF_NOT(r == 0);
436  resp_str[28] = 0x04;
437  r = AppLayerParserParse(NULL, alp_tctx, f, ALPROTO_SMB,
438  STREAM_TOCLIENT, (uint8_t *)resp_str, sizeof(resp_str));
439  FAIL_IF_NOT(r == 0);
440  resp_str[28] = 0x05;
441  r = AppLayerParserParse(NULL, alp_tctx, f, ALPROTO_SMB,
442  STREAM_TOCLIENT, (uint8_t *)resp_str, sizeof(resp_str));
443  FAIL_IF_NOT(r == 0);
444  resp_str[28] = 0x06;
445  r = AppLayerParserParse(NULL, alp_tctx, f, ALPROTO_SMB,
446  STREAM_TOCLIENT, (uint8_t *)resp_str, sizeof(resp_str));
447  FAIL_IF_NOT(r == 0);
448  resp_str[28] = 0x08;
449  r = AppLayerParserParse(NULL, alp_tctx, f, ALPROTO_SMB,
450  STREAM_TOCLIENT, (uint8_t *)resp_str, sizeof(resp_str));
451  FAIL_IF_NOT(r == 0);
452  resp_str[28] = 0x02;
453  r = AppLayerParserParse(NULL, alp_tctx, f, ALPROTO_SMB,
454  STREAM_TOCLIENT, (uint8_t *)resp_str, sizeof(resp_str));
455  FAIL_IF_NOT(r == 0);
456  resp_str[28] = 0x07;
457  r = AppLayerParserParse(NULL, alp_tctx, f, ALPROTO_SMB,
458  STREAM_TOCLIENT, (uint8_t *)resp_str, sizeof(resp_str));
459  FAIL_IF_NOT(r == 0);
461 
462  UTHAppLayerParserStateGetIds(f->alparser, &ret[0], &ret[1], &ret[2], &ret[3]);
463  FAIL_IF_NOT(ret[0] == 2); // inspect_id[0]
464  FAIL_IF_NOT(ret[1] == 2); // inspect_id[1]
465  FAIL_IF_NOT(ret[2] == 2); // log_id
466  FAIL_IF_NOT(ret[3] == 2); // min_id
467 
468  resp_str[28] = 0x03;
469  r = AppLayerParserParse(NULL, alp_tctx, f, ALPROTO_SMB,
470  STREAM_TOCLIENT, (uint8_t *)resp_str, sizeof(resp_str));
471  FAIL_IF_NOT(r == 0);
473 
474  UTHAppLayerParserStateGetIds(f->alparser, &ret[0], &ret[1], &ret[2], &ret[3]);
475  FAIL_IF_NOT(ret[0] == 8); // inspect_id[0]
476  FAIL_IF_NOT(ret[1] == 8); // inspect_id[1]
477  FAIL_IF_NOT(ret[2] == 8); // log_id
478  FAIL_IF_NOT(ret[3] == 8); // min_id
479 
480  req_str[28] = 0x09;
481  r = AppLayerParserParse(NULL, alp_tctx, f, ALPROTO_SMB,
482  STREAM_TOSERVER | STREAM_EOF, (uint8_t *)req_str, sizeof(req_str));
483  FAIL_IF_NOT(r == 0);
485 
486  UTHAppLayerParserStateGetIds(f->alparser, &ret[0], &ret[1], &ret[2], &ret[3]);
487  FAIL_IF_NOT(ret[0] == 8); // inspect_id[0] not updated by ..Cleanup() until full tx is done
488  FAIL_IF_NOT(ret[1] == 8); // inspect_id[1]
489  FAIL_IF_NOT(ret[2] == 8); // log_id
490  FAIL_IF_NOT(ret[3] == 8); // min_id
491 
492  resp_str[28] = 0x09;
493  r = AppLayerParserParse(NULL, alp_tctx, f, ALPROTO_SMB,
494  STREAM_TOCLIENT | STREAM_EOF, (uint8_t *)resp_str, sizeof(resp_str));
495  FAIL_IF_NOT(r == 0);
497 
498  UTHAppLayerParserStateGetIds(f->alparser, &ret[0], &ret[1], &ret[2], &ret[3]);
499  FAIL_IF_NOT(ret[0] == 9); // inspect_id[0]
500  FAIL_IF_NOT(ret[1] == 9); // inspect_id[1]
501  FAIL_IF_NOT(ret[2] == 9); // log_id
502  FAIL_IF_NOT(ret[3] == 9); // min_id
503 
504  AppLayerParserThreadCtxFree(alp_tctx);
506  UTHFreeFlow(f);
507 
508  PASS;
509 }
510 
511 static void SMBParserRegisterTests(void)
512 {
513  UtRegisterTest("SMBParserTxCleanupTest", SMBParserTxCleanupTest);
514 }
515 
516 #endif /* UNITTESTS */
void RegisterSMBParsers(void)
void AppLayerParserSetStreamDepth(uint8_t ipproto, AppProto alproto, uint32_t stream_depth)
#define STREAMING_BUFFER_CONFIG_INITIALIZER
enum AppLayerEventType_ AppLayerEventType
uint16_t flags
#define SCLogDebug(...)
Definition: util-debug.h:335
void AppLayerParserRegisterOptionFlags(uint8_t ipproto, AppProto alproto, uint32_t flags)
void AppLayerProtoDetectPPRegister(uint8_t ipproto, const char *portstr, AppProto alproto, uint16_t min_depth, uint16_t max_depth, uint8_t direction, ProbingParserFPtr ProbingParser1, ProbingParserFPtr ProbingParser2)
register parser at a port
void AppLayerParserRegisterGetStateProgressFunc(uint8_t ipproto, AppProto alproto, int(*StateGetProgress)(void *alstate, uint8_t direction))
uint32_t event_type
uint8_t proto
Definition: flow.h:343
LoggerId
Port sp
Definition: flow.h:330
#define PASS
Pass the test.
int AppLayerProtoDetectConfProtoDetectionEnabled(const char *ipproto, const char *alproto)
Given a protocol name, checks if proto detection is enabled in the conf file.
void AppLayerParserRegisterDetectFlagsFuncs(uint8_t ipproto, AppProto alproto, uint64_t(*GetTxDetectFlags)(void *tx, uint8_t dir), void(*SetTxDetectFlags)(void *tx, uint8_t dir, uint64_t))
void AppLayerParserRegisterDetectStateFuncs(uint8_t ipproto, AppProto alproto, DetectEngineState *(*GetTxDetectState)(void *tx), int(*SetTxDetectState)(void *tx, DetectEngineState *))
void AppLayerParserRegisterTruncateFunc(uint8_t ipproto, AppProto alproto, void(*Truncate)(void *, uint8_t))
void AppLayerParserThreadCtxFree(AppLayerParserThreadCtx *tctx)
Destroys the app layer parser thread context obtained using AppLayerParserThreadCtxAlloc().
#define FLOW_DIR_REVERSED
Definition: flow.h:105
#define SCReturnUInt(x)
Definition: util-debug.h:343
void StreamTcpFreeConfig(char quiet)
Definition: stream-tcp.c:669
void AppLayerParserRegisterLoggerFuncs(uint8_t ipproto, AppProto alproto, LoggerId(*StateGetTxLogged)(void *, void *), void(*StateSetTxLogged)(void *, void *, LoggerId))
uint16_t AppProto
char * val
Definition: conf.h:34
#define TRUE
int AppLayerProtoDetectPMRegisterPatternCSwPP(uint8_t ipproto, AppProto alproto, const char *pattern, uint16_t depth, uint16_t offset, uint8_t direction, ProbingParserFPtr PPFunc, uint16_t pp_min_depth, uint16_t pp_max_depth)
void * protoctx
Definition: flow.h:395
int AppLayerParserConfParserEnabled(const char *ipproto, const char *alproto_name)
check if a parser is enabled in the config Returns enabled always if: were running unittests and when...
Flow * UTHBuildFlow(int family, const char *src, const char *dst, Port sp, Port dp)
Data structure to store app layer decoder events.
int AppLayerParserRegisterParser(uint8_t ipproto, AppProto alproto, uint8_t direction, AppLayerParserFPtr Parser)
Register app layer parser for the protocol.
void AppLayerParserRegisterGetTx(uint8_t ipproto, AppProto alproto, void *(StateGetTx)(void *alstate, uint64_t tx_id))
void AppLayerParserRegisterGetFilesFunc(uint8_t ipproto, AppProto alproto, FileContainer *(*StateGetFiles)(void *, uint8_t))
int AppLayerProtoDetectPPParseConfPorts(const char *ipproto_name, uint8_t ipproto, const char *alproto_name, AppProto alproto, uint16_t min_depth, uint16_t max_depth, ProbingParserFPtr ProbingParserTs, ProbingParserFPtr ProbingParserTc)
void AppLayerParserRegisterGetEventInfo(uint8_t ipproto, AppProto alproto, int(*StateGetEventInfo)(const char *event_name, int *event_id, AppLayerEventType *event_type))
#define SCLogError(err_code,...)
Macro used to log ERROR messages.
Definition: util-debug.h:294
#define STREAM_EOF
Definition: stream.h:30
void UtRegisterTest(const char *name, int(*TestFn)(void))
Register unit test.
#define SCEnter(...)
Definition: util-debug.h:337
void StreamTcpInitConfig(char)
To initialize the stream global configuration data.
Definition: stream-tcp.c:365
#define STREAM_TOCLIENT
Definition: stream.h:32
#define MIN_REC_SIZE
Definition: app-layer-smb.c:33
void AppLayerParserRegisterGetStateProgressCompletionStatus(AppProto alproto, int(*StateGetProgressCompletionStatus)(uint8_t direction))
AppLayerParserThreadCtx * AppLayerParserThreadCtxAlloc(void)
Gets a new app layer protocol&#39;s parser thread context.
int RunmodeIsUnittests(void)
Definition: suricata.c:259
#define SMB_CONFIG_DEFAULT_STREAM_DEPTH
#define SCLogWarning(err_code,...)
Macro used to log WARNING messages.
Definition: util-debug.h:281
Definition: conf.h:32
#define FILE_USE_DETECT
Definition: util-file.h:49
#define SCLogInfo(...)
Macro used to log INFORMATIONAL messages.
Definition: util-debug.h:254
void AppLayerParserTransactionsCleanup(Flow *f)
remove obsolete (inspected and logged) transactions
void AppLayerProtoDetectRegisterProtocol(AppProto alproto, const char *alproto_name)
Registers a protocol for protocol detection phase.
PoolThreadReserved res
Port dp
Definition: flow.h:337
uint16_t tx_id
void AppLayerParserRegisterGetEventsFunc(uint8_t ipproto, AppProto alproto, AppLayerDecoderEvents *(*StateGetEvents)(void *, uint64_t))
void AppLayerParserRegisterProtocolUnittests(uint8_t ipproto, AppProto alproto, void(*RegisterUnittests)(void))
#define STREAM_START
Definition: stream.h:29
#define STREAM_TOSERVER
Definition: stream.h:31
#define APP_LAYER_PARSER_OPT_ACCEPT_GAPS
void AppLayerParserRegisterGetTxIterator(uint8_t ipproto, AppProto alproto, AppLayerGetTxIteratorFunc Func)
uint16_t FileFlowToFlags(const Flow *flow, uint8_t direction)
Definition: util-file.c:217
ConfNode * ConfGetNode(const char *name)
Get a ConfNode by name.
Definition: conf.c:176
#define FAIL_IF_NULL(expr)
Fail a test if expression evaluates to NULL.
Definition: util-unittest.h:89
void AppLayerParserRegisterGetTxCnt(uint8_t ipproto, AppProto alproto, uint64_t(*StateGetTxCnt)(void *alstate))
void AppLayerParserRegisterStateFuncs(uint8_t ipproto, AppProto alproto, void *(*StateAlloc)(void), void(*StateFree)(void *))
uint8_t len
int ParseSizeStringU32(const char *size, uint32_t *res)
Definition: util-misc.c:186
AppProto alproto
application level protocol
Definition: flow.h:404
void UTHAppLayerParserStateGetIds(void *ptr, uint64_t *i1, uint64_t *i2, uint64_t *log, uint64_t *min)
struct SCLogConfig_ SCLogConfig
Holds the config state used by the logging api.
Flow data structure.
Definition: flow.h:324
uint32_t flags
Definition: flow.h:374
#define FAIL_IF_NOT(expr)
Fail a test if expression to true.
Definition: util-unittest.h:82
AppLayerParserState * alparser
Definition: flow.h:432
int AppLayerParserParse(ThreadVars *tv, AppLayerParserThreadCtx *alp_tctx, Flow *f, AppProto alproto, uint8_t flags, uint8_t *input, uint32_t input_len)
void UTHFreeFlow(Flow *flow)
void AppLayerParserRegisterTxFreeFunc(uint8_t ipproto, AppProto alproto, void(*StateTransactionFree)(void *, uint64_t))