suricata
app-layer-smb.c
Go to the documentation of this file.
1 /* Copyright (C) 2017-2020 Open Information Security Foundation
2  *
3  * You can copy, redistribute or modify this Program under the terms of
4  * the GNU General Public License version 2 as published by the Free
5  * Software Foundation.
6  *
7  * This program is distributed in the hope that it will be useful,
8  * but WITHOUT ANY WARRANTY; without even the implied warranty of
9  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
10  * GNU General Public License for more details.
11  *
12  * You should have received a copy of the GNU General Public License
13  * version 2 along with this program; if not, write to the Free Software
14  * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA
15  * 02110-1301, USA.
16  */
17 
18 #include "suricata-common.h"
19 #include "suricata.h"
20 
21 #include "app-layer-protos.h"
22 #include "app-layer-detect-proto.h"
23 #include "app-layer-parser.h"
24 
25 #include "util-unittest.h"
26 
27 #include "rust.h"
28 #include "app-layer-smb.h"
29 #include "util-misc.h"
30 
31 #define MIN_REC_SIZE 32+4 // SMB hdr + nbss hdr
32 
33 static AppLayerResult SMBTCPParseRequest(Flow *f, void *state,
34  AppLayerParserState *pstate, const uint8_t *input, uint32_t input_len,
35  void *local_data, const uint8_t flags)
36 {
37  SCLogDebug("SMBTCPParseRequest");
38  uint16_t file_flags = FileFlowToFlags(f, STREAM_TOSERVER);
39  rs_smb_setfileflags(0, state, file_flags|FILE_USE_DETECT);
40 
41  if (input == NULL && input_len > 0) {
42  AppLayerResult res = rs_smb_parse_request_tcp_gap(state, input_len);
43  SCLogDebug("SMB request GAP of %u bytes, retval %d", input_len, res.status);
45  } else {
46  AppLayerResult res = rs_smb_parse_request_tcp(f, state, pstate,
47  input, input_len, local_data, flags);
48  SCLogDebug("SMB request%s of %u bytes, retval %d",
49  (input == NULL && input_len > 0) ? " is GAP" : "", input_len, res.status);
51  }
52 }
53 
54 static AppLayerResult SMBTCPParseResponse(Flow *f, void *state,
55  AppLayerParserState *pstate, const uint8_t *input, uint32_t input_len,
56  void *local_data, const uint8_t flags)
57 {
58  SCLogDebug("SMBTCPParseResponse");
59  uint16_t file_flags = FileFlowToFlags(f, STREAM_TOCLIENT);
60  rs_smb_setfileflags(1, state, file_flags|FILE_USE_DETECT);
61 
62  SCLogDebug("SMBTCPParseResponse %p/%u", input, input_len);
63  if (input == NULL && input_len > 0) {
64  AppLayerResult res = rs_smb_parse_response_tcp_gap(state, input_len);
65  SCLogDebug("SMB response GAP of %u bytes, retval %d", input_len, res.status);
67  } else {
68  AppLayerResult res = rs_smb_parse_response_tcp(f, state, pstate,
69  input, input_len, local_data, flags);
71  }
72 }
73 
74 static uint16_t SMBTCPProbe(Flow *f, uint8_t direction,
75  const uint8_t *input, uint32_t len, uint8_t *rdir)
76 {
77  SCLogDebug("SMBTCPProbe");
78 
79  if (len < MIN_REC_SIZE) {
80  return ALPROTO_UNKNOWN;
81  }
82 
83  const int r = rs_smb_probe_tcp(direction, input, len, rdir);
84  switch (r) {
85  case 1:
86  return ALPROTO_SMB;
87  case 0:
88  return ALPROTO_UNKNOWN;
89  case -1:
90  default:
91  return ALPROTO_FAILED;
92  }
93 }
94 
95 /** \internal
96  * \brief as SMB3 records have no direction indicator, fall
97  * back to the port numbers for a hint
98  */
99 static uint16_t SMB3TCPProbe(Flow *f, uint8_t direction,
100  const uint8_t *input, uint32_t len, uint8_t *rdir)
101 {
102  SCEnter();
103 
104  AppProto p = SMBTCPProbe(f, direction, input, len, rdir);
105  if (p != ALPROTO_SMB) {
106  SCReturnUInt(p);
107  }
108 
109  uint16_t fsp = (f->flags & FLOW_DIR_REVERSED) ? f->dp : f->sp;
110  uint16_t fdp = (f->flags & FLOW_DIR_REVERSED) ? f->sp : f->dp;
111  SCLogDebug("direction %s flow sp %u dp %u fsp %u fdp %u",
112  (direction & STREAM_TOSERVER) ? "toserver" : "toclient",
113  f->sp, f->dp, fsp, fdp);
114 
115  if (fsp == 445 && fdp != 445) {
116  if (direction & STREAM_TOSERVER) {
117  *rdir = STREAM_TOCLIENT;
118  } else {
119  *rdir = STREAM_TOSERVER;
120  }
121  }
122  SCLogDebug("returning ALPROTO_SMB for dir %s with rdir %s",
123  (direction & STREAM_TOSERVER) ? "toserver" : "toclient",
124  (*rdir == STREAM_TOSERVER) ? "toserver" : "toclient");
126 }
127 
128 static int SMBGetAlstateProgress(void *tx, uint8_t direction)
129 {
130  return rs_smb_tx_get_alstate_progress(tx, direction);
131 }
132 
133 static uint64_t SMBGetTxCnt(void *alstate)
134 {
135  return rs_smb_state_get_tx_count(alstate);
136 }
137 
138 static void *SMBGetTx(void *alstate, uint64_t tx_id)
139 {
140  return rs_smb_state_get_tx(alstate, tx_id);
141 }
142 
143 static AppLayerGetTxIterTuple SMBGetTxIterator(
144  const uint8_t ipproto, const AppProto alproto,
145  void *alstate, uint64_t min_tx_id, uint64_t max_tx_id,
146  AppLayerGetTxIterState *istate)
147 {
148  return rs_smb_state_get_tx_iterator(alstate, min_tx_id, (uint64_t *)istate);
149 }
150 
151 
152 static void SMBSetTxLogged(void *alstate, void *tx, uint32_t logger)
153 {
154  rs_smb_tx_set_logged(alstate, tx, logger);
155 }
156 
157 static LoggerId SMBGetTxLogged(void *alstate, void *tx)
158 {
159  return rs_smb_tx_get_logged(alstate, tx);
160 }
161 
162 static void SMBStateTransactionFree(void *state, uint64_t tx_id)
163 {
164  rs_smb_state_tx_free(state, tx_id);
165 }
166 
167 static DetectEngineState *SMBGetTxDetectState(void *tx)
168 {
169  return rs_smb_state_get_tx_detect_state(tx);
170 }
171 
172 static int SMBSetTxDetectState(void *tx, DetectEngineState *s)
173 {
174  rs_smb_state_set_tx_detect_state(tx, s);
175  return 0;
176 }
177 
178 static FileContainer *SMBGetFiles(void *state, uint8_t direction)
179 {
180  return rs_smb_getfiles(direction, state);
181 }
182 
183 static AppLayerDecoderEvents *SMBGetEvents(void *tx)
184 {
185  return rs_smb_state_get_events(tx);
186 }
187 
188 static int SMBGetEventInfoById(int event_id, const char **event_name,
189  AppLayerEventType *event_type)
190 {
191  return rs_smb_state_get_event_info_by_id(event_id, event_name, event_type);
192 }
193 
194 static int SMBGetEventInfo(const char *event_name, int *event_id,
195  AppLayerEventType *event_type)
196 {
197  return rs_smb_state_get_event_info(event_name, event_id, event_type);
198 }
199 
200 static void SMBSetDetectFlags(void *tx, uint8_t dir, uint64_t flags)
201 {
202  rs_smb_tx_set_detect_flags(tx, dir, flags);
203 }
204 
205 static uint64_t SMBGetDetectFlags(void *tx, uint8_t dir)
206 {
207  return rs_smb_tx_get_detect_flags(tx, dir);
208 }
209 
210 static void SMBStateTruncate(void *state, uint8_t direction)
211 {
212  return rs_smb_state_truncate(state, direction);
213 }
214 
215 static int SMBRegisterPatternsForProtocolDetection(void)
216 {
217  int r = 0;
218  /* SMB1 */
220  "|ff|SMB", 8, 4, STREAM_TOSERVER, SMBTCPProbe,
223  "|ff|SMB", 8, 4, STREAM_TOCLIENT, SMBTCPProbe,
225 
226  /* SMB2/3 */
228  "|fe|SMB", 8, 4, STREAM_TOSERVER, SMBTCPProbe,
231  "|fe|SMB", 8, 4, STREAM_TOCLIENT, SMBTCPProbe,
233 
234  /* SMB3 encrypted records */
236  "|fd|SMB", 8, 4, STREAM_TOSERVER, SMB3TCPProbe,
239  "|fd|SMB", 8, 4, STREAM_TOCLIENT, SMB3TCPProbe,
241  return r == 0 ? 0 : -1;
242 }
243 
245 static SuricataFileContext sfc = { &sbcfg };
246 
247 #define SMB_CONFIG_DEFAULT_STREAM_DEPTH 0
248 
249 #ifdef UNITTESTS
250 static void SMBParserRegisterTests(void);
251 #endif
252 
253 static uint32_t stream_depth = SMB_CONFIG_DEFAULT_STREAM_DEPTH;
254 
256 {
257  const char *proto_name = "smb";
258 
259  /** SMB */
260  if (AppLayerProtoDetectConfProtoDetectionEnabled("tcp", proto_name)) {
262  if (SMBRegisterPatternsForProtocolDetection() < 0)
263  return;
264 
265  rs_smb_init(&sfc);
266 
267  if (RunmodeIsUnittests()) {
268  AppLayerProtoDetectPPRegister(IPPROTO_TCP, "445", ALPROTO_SMB, 0,
269  MIN_REC_SIZE, STREAM_TOSERVER, SMBTCPProbe,
270  SMBTCPProbe);
271  } else {
272  int have_cfg = AppLayerProtoDetectPPParseConfPorts("tcp",
273  IPPROTO_TCP, proto_name, ALPROTO_SMB, 0,
274  MIN_REC_SIZE, SMBTCPProbe, SMBTCPProbe);
275  /* if we have no config, we enable the default port 445 */
276  if (!have_cfg) {
277  SCLogConfig("no SMB TCP config found, enabling SMB detection "
278  "on port 445.");
279  AppLayerProtoDetectPPRegister(IPPROTO_TCP, "445", ALPROTO_SMB, 0,
280  MIN_REC_SIZE, STREAM_TOSERVER, SMBTCPProbe,
281  SMBTCPProbe);
282  }
283  }
284  } else {
285  SCLogConfig("Protocol detection and parser disabled for %s protocol.",
286  proto_name);
287  return;
288  }
289 
290  if (AppLayerParserConfParserEnabled("tcp", proto_name)) {
292  SMBTCPParseRequest);
294  SMBTCPParseResponse);
296  rs_smb_state_new, rs_smb_state_free);
298  SMBStateTransactionFree);
299 
301  SMBGetEvents);
303  SMBGetEventInfo);
305  SMBGetEventInfoById);
306 
308  SMBGetTxDetectState, SMBSetTxDetectState);
309  AppLayerParserRegisterGetTx(IPPROTO_TCP, ALPROTO_SMB, SMBGetTx);
310  AppLayerParserRegisterGetTxIterator(IPPROTO_TCP, ALPROTO_SMB, SMBGetTxIterator);
312  SMBGetTxCnt);
314  SMBGetTxLogged, SMBSetTxLogged);
316  SMBGetAlstateProgress);
318  rs_smb_state_progress_completion_status);
320  SMBGetDetectFlags, SMBSetDetectFlags);
322  SMBStateTruncate);
323  AppLayerParserRegisterGetFilesFunc(IPPROTO_TCP, ALPROTO_SMB, SMBGetFiles);
324 
325  /* This parser accepts gaps. */
328 
329  ConfNode *p = ConfGetNode("app-layer.protocols.smb.stream-depth");
330  if (p != NULL) {
331  uint32_t value;
332  if (ParseSizeStringU32(p->val, &value) < 0) {
333  SCLogError(SC_ERR_SMB_CONFIG, "invalid value for stream-depth %s", p->val);
334  } else {
335  stream_depth = value;
336  }
337  }
338  SCLogConfig("SMB stream depth: %u", stream_depth);
339 
340  AppLayerParserSetStreamDepth(IPPROTO_TCP, ALPROTO_SMB, stream_depth);
341  } else {
342  SCLogConfig("Parsed disabled for %s protocol. Protocol detection"
343  "still on.", proto_name);
344  }
345 #ifdef UNITTESTS
346  AppLayerParserRegisterProtocolUnittests(IPPROTO_TCP, ALPROTO_SMB, SMBParserRegisterTests);
347 #endif
348 
349  return;
350 }
351 
352 #ifdef UNITTESTS
353 #include "stream-tcp.h"
354 #include "util-unittest-helper.h"
355 
356 /** \test multi transactions and cleanup */
357 static int SMBParserTxCleanupTest(void)
358 {
359  uint64_t ret[4];
362 
364  TcpSession ssn;
365  memset(&ssn, 0, sizeof(ssn));
366 
367  Flow *f = UTHBuildFlow(AF_INET, "1.2.3.4", "1.2.3.5", 1024, 445);
368  FAIL_IF_NULL(f);
369  f->protoctx = &ssn;
370  f->proto = IPPROTO_TCP;
371  f->alproto = ALPROTO_SMB;
372 
373  char req_str[] ="\x00\x00\x00\x79\xfe\x53\x4d\x42\x40\x00\x01\x00\x00\x00\x00\x00" \
374  "\x05\x00\xe0\x1e\x10\x00\x00\x00\x00\x00\x00\x00\x0b\x00\x00\x00" \
375  "\x00\x00\x00\x00\x00\x00\x00\x00\x10\x72\xd2\x9f\x36\xc2\x08\x14" \
376  "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00" \
377  "\x00\x00\x00\x00\x39\x00\x00\x00\x02\x00\x00\x00\x00\x00\x00\x00" \
378  "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x80\x00\x00\x00" \
379  "\x00\x00\x00\x00\x07\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00" \
380  "\x78\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00";
381  req_str[28] = 0x01;
382  int r = AppLayerParserParse(NULL, alp_tctx, f, ALPROTO_SMB,
383  STREAM_TOSERVER | STREAM_START, (uint8_t *)req_str, sizeof(req_str));
384  FAIL_IF_NOT(r == 0);
385  req_str[28]++;
387  STREAM_TOSERVER, (uint8_t *)req_str, sizeof(req_str));
388  FAIL_IF_NOT(r == 0);
389  req_str[28]++;
391  STREAM_TOSERVER, (uint8_t *)req_str, sizeof(req_str));
392  FAIL_IF_NOT(r == 0);
393  req_str[28]++;
395  STREAM_TOSERVER, (uint8_t *)req_str, sizeof(req_str));
396  FAIL_IF_NOT(r == 0);
397  req_str[28]++;
399  STREAM_TOSERVER, (uint8_t *)req_str, sizeof(req_str));
400  FAIL_IF_NOT(r == 0);
401  req_str[28]++;
403  STREAM_TOSERVER, (uint8_t *)req_str, sizeof(req_str));
404  FAIL_IF_NOT(r == 0);
405  req_str[28]++;
407  STREAM_TOSERVER, (uint8_t *)req_str, sizeof(req_str));
408  FAIL_IF_NOT(r == 0);
409  req_str[28]++;
411  STREAM_TOSERVER, (uint8_t *)req_str, sizeof(req_str));
412  FAIL_IF_NOT(r == 0);
413  req_str[28]++;
414 
416  UTHAppLayerParserStateGetIds(f->alparser, &ret[0], &ret[1], &ret[2], &ret[3]);
417  FAIL_IF_NOT(ret[0] == 0); // inspect_id[0]
418  FAIL_IF_NOT(ret[1] == 0); // inspect_id[1]
419  FAIL_IF_NOT(ret[2] == 0); // log_id
420  FAIL_IF_NOT(ret[3] == 0); // min_id
421 
422  char resp_str[] = "\x00\x00\x00\x98\xfe\x53\x4d\x42\x40\x00\x01\x00\x00\x00\x00\x00" \
423  "\x05\x00\x21\x00\x11\x00\x00\x00\x00\x00\x00\x00\x0b\x00\x00\x00" \
424  "\x00\x00\x00\x00\x00\x00\x00\x00\x10\x72\xd2\x9f\x36\xc2\x08\x14" \
425  "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00" \
426  "\x00\x00\x00\x00\x59\x00\x00\x00\x01\x00\x00\x00\x48\x38\x40\xb3" \
427  "\x0f\xa8\xd3\x01\x84\x9a\x2b\x46\xf7\xa8\xd3\x01\x48\x38\x40\xb3" \
428  "\x0f\xa8\xd3\x01\x48\x38\x40\xb3\x0f\xa8\xd3\x01\x00\x00\x00\x00" \
429  "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x10\x00\x00\x00" \
430  "\x00\x00\x00\x00\x9e\x8f\xb8\x91\x00\x00\x00\x00\x01\x5b\x11\xbb" \
431  "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00";
432 
433  resp_str[28] = 0x01;
435  STREAM_TOCLIENT | STREAM_START, (uint8_t *)resp_str, sizeof(resp_str));
436  FAIL_IF_NOT(r == 0);
437  resp_str[28] = 0x04;
439  STREAM_TOCLIENT, (uint8_t *)resp_str, sizeof(resp_str));
440  FAIL_IF_NOT(r == 0);
441  resp_str[28] = 0x05;
443  STREAM_TOCLIENT, (uint8_t *)resp_str, sizeof(resp_str));
444  FAIL_IF_NOT(r == 0);
445  resp_str[28] = 0x06;
447  STREAM_TOCLIENT, (uint8_t *)resp_str, sizeof(resp_str));
448  FAIL_IF_NOT(r == 0);
449  resp_str[28] = 0x08;
451  STREAM_TOCLIENT, (uint8_t *)resp_str, sizeof(resp_str));
452  FAIL_IF_NOT(r == 0);
453  resp_str[28] = 0x02;
455  STREAM_TOCLIENT, (uint8_t *)resp_str, sizeof(resp_str));
456  FAIL_IF_NOT(r == 0);
457  resp_str[28] = 0x07;
459  STREAM_TOCLIENT, (uint8_t *)resp_str, sizeof(resp_str));
460  FAIL_IF_NOT(r == 0);
462 
463  UTHAppLayerParserStateGetIds(f->alparser, &ret[0], &ret[1], &ret[2], &ret[3]);
464  FAIL_IF_NOT(ret[0] == 2); // inspect_id[0]
465  FAIL_IF_NOT(ret[1] == 2); // inspect_id[1]
466  FAIL_IF_NOT(ret[2] == 2); // log_id
467  FAIL_IF_NOT(ret[3] == 2); // min_id
468 
469  resp_str[28] = 0x03;
471  STREAM_TOCLIENT, (uint8_t *)resp_str, sizeof(resp_str));
472  FAIL_IF_NOT(r == 0);
474 
475  UTHAppLayerParserStateGetIds(f->alparser, &ret[0], &ret[1], &ret[2], &ret[3]);
476  FAIL_IF_NOT(ret[0] == 8); // inspect_id[0]
477  FAIL_IF_NOT(ret[1] == 8); // inspect_id[1]
478  FAIL_IF_NOT(ret[2] == 8); // log_id
479  FAIL_IF_NOT(ret[3] == 8); // min_id
480 
481  req_str[28] = 0x09;
483  STREAM_TOSERVER | STREAM_EOF, (uint8_t *)req_str, sizeof(req_str));
484  FAIL_IF_NOT(r == 0);
486 
487  UTHAppLayerParserStateGetIds(f->alparser, &ret[0], &ret[1], &ret[2], &ret[3]);
488  FAIL_IF_NOT(ret[0] == 8); // inspect_id[0] not updated by ..Cleanup() until full tx is done
489  FAIL_IF_NOT(ret[1] == 8); // inspect_id[1]
490  FAIL_IF_NOT(ret[2] == 8); // log_id
491  FAIL_IF_NOT(ret[3] == 8); // min_id
492 
493  resp_str[28] = 0x09;
495  STREAM_TOCLIENT | STREAM_EOF, (uint8_t *)resp_str, sizeof(resp_str));
496  FAIL_IF_NOT(r == 0);
498 
499  UTHAppLayerParserStateGetIds(f->alparser, &ret[0], &ret[1], &ret[2], &ret[3]);
500  FAIL_IF_NOT(ret[0] == 9); // inspect_id[0]
501  FAIL_IF_NOT(ret[1] == 9); // inspect_id[1]
502  FAIL_IF_NOT(ret[2] == 9); // log_id
503  FAIL_IF_NOT(ret[3] == 9); // min_id
504 
507  UTHFreeFlow(f);
508 
509  PASS;
510 }
511 
512 static void SMBParserRegisterTests(void)
513 {
514  UtRegisterTest("SMBParserTxCleanupTest", SMBParserTxCleanupTest);
515 }
516 
517 #endif /* UNITTESTS */
AppLayerParserRegisterGetStateProgressFunc
void AppLayerParserRegisterGetStateProgressFunc(uint8_t ipproto, AppProto alproto, int(*StateGetProgress)(void *alstate, uint8_t direction))
Definition: app-layer-parser.c:490
AppLayerProtoDetectPPParseConfPorts
int AppLayerProtoDetectPPParseConfPorts(const char *ipproto_name, uint8_t ipproto, const char *alproto_name, AppProto alproto, uint16_t min_depth, uint16_t max_depth, ProbingParserFPtr ProbingParserTs, ProbingParserFPtr ProbingParserTc)
Definition: app-layer-detect-proto.c:1645
FileContainer_
Definition: util-file.h:100
len
uint8_t len
Definition: app-layer-dnp3.h:2
FAIL_IF_NULL
#define FAIL_IF_NULL(expr)
Fail a test if expression evaluates to NULL.
Definition: util-unittest.h:89
RegisterSMBParsers
void RegisterSMBParsers(void)
Definition: app-layer-smb.c:255
AppLayerParserRegisterOptionFlags
void AppLayerParserRegisterOptionFlags(uint8_t ipproto, AppProto alproto, uint32_t flags)
Definition: app-layer-parser.c:387
AppLayerParserRegisterStateFuncs
void AppLayerParserRegisterStateFuncs(uint8_t ipproto, AppProto alproto, void *(*StateAlloc)(void), void(*StateFree)(void *))
Definition: app-layer-parser.c:397
AppLayerParserSetStreamDepth
void AppLayerParserSetStreamDepth(uint8_t ipproto, AppProto alproto, uint32_t stream_depth)
Definition: app-layer-parser.c:1408
DetectEngineState_
Definition: detect-engine-state.h:92
ConfNode_::val
char * val
Definition: conf.h:34
stream-tcp.h
UtRegisterTest
void UtRegisterTest(const char *name, int(*TestFn)(void))
Register unit test.
Definition: util-unittest.c:103
SCLogDebug
#define SCLogDebug(...)
Definition: util-debug.h:298
AppLayerParserRegisterDetectFlagsFuncs
void AppLayerParserRegisterDetectFlagsFuncs(uint8_t ipproto, AppProto alproto, uint64_t(*GetTxDetectFlags)(void *tx, uint8_t dir), void(*SetTxDetectFlags)(void *tx, uint8_t dir, uint64_t))
Definition: app-layer-parser.c:589
AppLayerParserRegisterLoggerFuncs
void AppLayerParserRegisterLoggerFuncs(uint8_t ipproto, AppProto alproto, LoggerId(*StateGetTxLogged)(void *, void *), void(*StateSetTxLogged)(void *, void *, LoggerId))
Definition: app-layer-parser.c:447
Flow_::proto
uint8_t proto
Definition: flow.h:361
AppProto
uint16_t AppProto
Definition: app-layer-protos.h:71
AppLayerParserConfParserEnabled
int AppLayerParserConfParserEnabled(const char *ipproto, const char *alproto_name)
check if a parser is enabled in the config Returns enabled always if: were running unittests
Definition: app-layer-parser.c:302
STREAMING_BUFFER_CONFIG_INITIALIZER
#define STREAMING_BUFFER_CONFIG_INITIALIZER
Definition: util-streaming-buffer.h:77
ConfGetNode
ConfNode * ConfGetNode(const char *name)
Get a ConfNode by name.
Definition: conf.c:176
Flow_
Flow data structure.
Definition: flow.h:343
AppLayerEventType
enum AppLayerEventType_ AppLayerEventType
AppLayerParserRegisterGetEventsFunc
void AppLayerParserRegisterGetEventsFunc(uint8_t ipproto, AppProto alproto, AppLayerDecoderEvents *(*StateGetEvents)(void *))
Definition: app-layer-parser.c:436
LoggerId
LoggerId
Definition: suricata-common.h:439
AppLayerParserRegisterTruncateFunc
void AppLayerParserRegisterTruncateFunc(uint8_t ipproto, AppProto alproto, void(*Truncate)(void *, uint8_t))
Definition: app-layer-parser.c:480
AppLayerParserRegisterTxFreeFunc
void AppLayerParserRegisterTxFreeFunc(uint8_t ipproto, AppProto alproto, void(*StateTransactionFree)(void *, uint64_t))
Definition: app-layer-parser.c:501
AppLayerParserThreadCtxFree
void AppLayerParserThreadCtxFree(AppLayerParserThreadCtx *tctx)
Destroys the app layer parser thread context obtained using AppLayerParserThreadCtxAlloc().
Definition: app-layer-parser.c:279
rust.h
AppLayerParserRegisterDetectStateFuncs
void AppLayerParserRegisterDetectStateFuncs(uint8_t ipproto, AppProto alproto, DetectEngineState *(*GetTxDetectState)(void *tx), int(*SetTxDetectState)(void *tx, DetectEngineState *))
Definition: app-layer-parser.c:577
Flow_::dp
Port dp
Definition: flow.h:355
Flow_::protoctx
void * protoctx
Definition: flow.h:416
AppLayerDecoderEvents_
Data structure to store app layer decoder events.
Definition: app-layer-events.h:34
util-unittest.h
util-unittest-helper.h
FAIL_IF_NOT
#define FAIL_IF_NOT(expr)
Fail a test if expression to true.
Definition: util-unittest.h:82
STREAM_START
#define STREAM_START
Definition: stream.h:29
AppLayerProtoDetectPPRegister
void AppLayerProtoDetectPPRegister(uint8_t ipproto, const char *portstr, AppProto alproto, uint16_t min_depth, uint16_t max_depth, uint8_t direction, ProbingParserFPtr ProbingParser1, ProbingParserFPtr ProbingParser2)
register parser at a port
Definition: app-layer-detect-proto.c:1611
Flow_::alparser
AppLayerParserState * alparser
Definition: flow.h:453
SC_ERR_SMB_CONFIG
@ SC_ERR_SMB_CONFIG
Definition: util-error.h:340
app-layer-detect-proto.h
UTHBuildFlow
Flow * UTHBuildFlow(int family, const char *src, const char *dst, Port sp, Port dp)
Definition: util-unittest-helper.c:520
AppLayerParserState_
Definition: app-layer-parser.c:155
PASS
#define PASS
Pass the test.
Definition: util-unittest.h:105
FileFlowToFlags
uint16_t FileFlowToFlags(const Flow *flow, uint8_t direction)
Definition: util-file.c:231
STREAM_TOSERVER
#define STREAM_TOSERVER
Definition: stream.h:31
res
PoolThreadReserved res
Definition: stream-tcp-private.h:0
alp_tctx
AppLayerParserThreadCtx * alp_tctx
Definition: fuzz_applayerparserparse.c:19
AppLayerParserRegisterGetFilesFunc
void AppLayerParserRegisterGetFilesFunc(uint8_t ipproto, AppProto alproto, FileContainer *(*StateGetFiles)(void *, uint8_t))
Definition: app-layer-parser.c:425
SCEnter
#define SCEnter(...)
Definition: util-debug.h:300
AppLayerProtoDetectPMRegisterPatternCSwPP
int AppLayerProtoDetectPMRegisterPatternCSwPP(uint8_t ipproto, AppProto alproto, const char *pattern, uint16_t depth, uint16_t offset, uint8_t direction, ProbingParserFPtr PPFunc, uint16_t pp_min_depth, uint16_t pp_max_depth)
Definition: app-layer-detect-proto.c:1736
MIN_REC_SIZE
#define MIN_REC_SIZE
Definition: app-layer-smb.c:31
app-layer-parser.h
TRUE
#define TRUE
Definition: suricata-common.h:33
AppLayerParserRegisterProtocolUnittests
void AppLayerParserRegisterProtocolUnittests(uint8_t ipproto, AppProto alproto, void(*RegisterUnittests)(void))
Definition: app-layer-parser.c:1706
AppLayerGetTxIterState
Definition: app-layer-parser.h:114
StreamTcpFreeConfig
void StreamTcpFreeConfig(char quiet)
Definition: stream-tcp.c:669
SCReturnUInt
#define SCReturnUInt(x)
Definition: util-debug.h:306
AppLayerParserRegisterGetEventInfo
void AppLayerParserRegisterGetEventInfo(uint8_t ipproto, AppProto alproto, int(*StateGetEventInfo)(const char *event_name, int *event_id, AppLayerEventType *event_type))
Definition: app-layer-parser.c:565
AppLayerProtoDetectRegisterProtocol
void AppLayerProtoDetectRegisterProtocol(AppProto alproto, const char *alproto_name)
Registers a protocol for protocol detection phase.
Definition: app-layer-detect-proto.c:1826
RunmodeIsUnittests
int RunmodeIsUnittests(void)
Definition: suricata.c:264
AppLayerParserRegisterParser
int AppLayerParserRegisterParser(uint8_t ipproto, AppProto alproto, uint8_t direction, AppLayerParserFPtr Parser)
Register app layer parser for the protocol.
Definition: app-layer-parser.c:364
AppLayerParserRegisterGetStateProgressCompletionStatus
void AppLayerParserRegisterGetStateProgressCompletionStatus(AppProto alproto, int(*StateGetProgressCompletionStatus)(uint8_t direction))
Definition: app-layer-parser.c:542
UTHFreeFlow
void UTHFreeFlow(Flow *flow)
Definition: util-unittest-helper.c:525
AppLayerParserThreadCtxAlloc
AppLayerParserThreadCtx * AppLayerParserThreadCtxAlloc(void)
Gets a new app layer protocol's parser thread context.
Definition: app-layer-parser.c:253
AppLayerParserRegisterGetTx
void AppLayerParserRegisterGetTx(uint8_t ipproto, AppProto alproto, void *(StateGetTx)(void *alstate, uint64_t tx_id))
Definition: app-layer-parser.c:523
SMB_CONFIG_DEFAULT_STREAM_DEPTH
#define SMB_CONFIG_DEFAULT_STREAM_DEPTH
Definition: app-layer-smb.c:247
SCReturnStruct
#define SCReturnStruct(x)
Definition: util-debug.h:320
AppLayerParserTransactionsCleanup
void AppLayerParserTransactionsCleanup(Flow *f)
remove obsolete (inspected and logged) transactions
Definition: app-layer-parser.c:882
flags
uint8_t flags
Definition: decode-gre.h:0
AppLayerParserParse
int AppLayerParserParse(ThreadVars *tv, AppLayerParserThreadCtx *alp_tctx, Flow *f, AppProto alproto, uint8_t flags, const uint8_t *input, uint32_t input_len)
Definition: app-layer-parser.c:1171
suricata-common.h
STREAM_TOCLIENT
#define STREAM_TOCLIENT
Definition: stream.h:32
SCLogError
#define SCLogError(err_code,...)
Macro used to log ERROR messages.
Definition: util-debug.h:257
ParseSizeStringU32
int ParseSizeStringU32(const char *size, uint32_t *res)
Definition: util-misc.c:186
StreamingBufferConfig_
Definition: util-streaming-buffer.h:67
SCLogConfig
struct SCLogConfig_ SCLogConfig
Holds the config state used by the logging api.
APP_LAYER_PARSER_OPT_ACCEPT_GAPS
#define APP_LAYER_PARSER_OPT_ACCEPT_GAPS
Definition: app-layer-parser.h:42
AppLayerParserRegisterGetTxIterator
void AppLayerParserRegisterGetTxIterator(uint8_t ipproto, AppProto alproto, AppLayerGetTxIteratorFunc Func)
Definition: app-layer-parser.c:534
SuricataFileContext_
Definition: rust-context.h:51
ConfNode_
Definition: conf.h:32
Flow_::flags
uint32_t flags
Definition: flow.h:396
AppLayerParserRegisterGetEventInfoById
void AppLayerParserRegisterGetEventInfoById(uint8_t ipproto, AppProto alproto, int(*StateGetEventInfoById)(int event_id, const char **event_name, AppLayerEventType *event_type))
Definition: app-layer-parser.c:553
UTHAppLayerParserStateGetIds
void UTHAppLayerParserStateGetIds(void *ptr, uint64_t *i1, uint64_t *i2, uint64_t *log, uint64_t *min)
Definition: app-layer-parser.c:174
StreamTcpInitConfig
void StreamTcpInitConfig(char)
To initialize the stream global configuration data.
Definition: stream-tcp.c:365
ALPROTO_UNKNOWN
@ ALPROTO_UNKNOWN
Definition: app-layer-protos.h:29
ALPROTO_FAILED
@ ALPROTO_FAILED
Definition: app-layer-protos.h:61
STREAM_EOF
#define STREAM_EOF
Definition: stream.h:30
app-layer-protos.h
suricata.h
AppLayerParserRegisterGetTxCnt
void AppLayerParserRegisterGetTxCnt(uint8_t ipproto, AppProto alproto, uint64_t(*StateGetTxCnt)(void *alstate))
Definition: app-layer-parser.c:512
app-layer-smb.h
FILE_USE_DETECT
#define FILE_USE_DETECT
Definition: util-file.h:49
ALPROTO_SMB
@ ALPROTO_SMB
Definition: app-layer-protos.h:37
AppLayerParserThreadCtx_
Definition: app-layer-parser.c:85
Flow_::sp
Port sp
Definition: flow.h:348
TcpSession_
Definition: stream-tcp-private.h:260
util-misc.h
Flow_::alproto
AppProto alproto
application level protocol
Definition: flow.h:425
FLOW_DIR_REVERSED
#define FLOW_DIR_REVERSED
Definition: flow.h:106
AppLayerProtoDetectConfProtoDetectionEnabled
int AppLayerProtoDetectConfProtoDetectionEnabled(const char *ipproto, const char *alproto)
Given a protocol name, checks if proto detection is enabled in the conf file.
Definition: app-layer-detect-proto.c:1890