suricata
app-layer.c
Go to the documentation of this file.
1 /* Copyright (C) 2007-2024 Open Information Security Foundation
2  *
3  * You can copy, redistribute or modify this Program under the terms of
4  * the GNU General Public License version 2 as published by the Free
5  * Software Foundation.
6  *
7  * This program is distributed in the hope that it will be useful,
8  * but WITHOUT ANY WARRANTY; without even the implied warranty of
9  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
10  * GNU General Public License for more details.
11  *
12  * You should have received a copy of the GNU General Public License
13  * version 2 along with this program; if not, write to the Free Software
14  * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA
15  * 02110-1301, USA.
16  */
17 
18 /**
19  * \file
20  *
21  * \author Victor Julien <victor@inliniac.net>
22  * \author Anoop Saldanha <anoopsaldanha@gmail.com>
23  *
24  * Generic App-layer functions
25  */
26 
27 #include "suricata-common.h"
28 #include "suricata.h"
29 #include "app-layer.h"
30 #include "app-layer-parser.h"
31 #include "app-layer-protos.h"
32 #include "app-layer-expectation.h"
33 #include "app-layer-ftp.h"
34 #include "app-layer-htp-range.h"
35 #include "app-layer-detect-proto.h"
36 #include "app-layer-frames.h"
37 #include "stream-tcp-reassemble.h"
38 #include "stream-tcp-private.h"
39 #include "stream-tcp-inline.h"
40 #include "stream-tcp.h"
41 #include "flow.h"
42 #include "flow-util.h"
43 #include "flow-private.h"
44 #include "ippair.h"
45 #include "util-debug.h"
46 #include "util-print.h"
47 #include "util-profiling.h"
48 #include "util-validate.h"
49 #include "decode-events.h"
50 #include "app-layer-htp-mem.h"
51 #include "util-exception-policy.h"
52 
54 /**
55  * \brief This is for the app layer in general and it contains per thread
56  * context relevant to both the alpd and alp.
57  */
59  /* App layer protocol detection thread context, from AppLayerProtoDetectGetCtxThread(). */
61  /* App layer parser thread context, from AppLayerParserThreadCtxAlloc(). */
63 
64 #ifdef PROFILING
65  uint64_t ticks_start;
66  uint64_t ticks_end;
67  uint64_t ticks_spent;
72 #endif
73 };
74 
75 #define FLOW_PROTO_CHANGE_MAX_DEPTH 4096
76 
77 #define MAX_COUNTER_SIZE 64
78 typedef struct AppLayerCounterNames_ {
87 
88 typedef struct AppLayerCounters_ {
89  uint16_t counter_id;
90  uint16_t counter_tx_id;
91  uint16_t gap_error_id;
92  uint16_t parser_error_id;
94  uint16_t alloc_error_id;
97 
98 /* counter names. Only used at init. */
100 /* counter id's. Used that runtime. */
102 /* Exception policy global counters ids */
104 
105 /* Settings order as in the enum */
106 // clang-format off
108  .valid_settings_ids = {
109  /* EXCEPTION_POLICY_NOT_SET */ false,
110  /* EXCEPTION_POLICY_AUTO */ false,
111  /* EXCEPTION_POLICY_PASS_PACKET */ true,
112  /* EXCEPTION_POLICY_PASS_FLOW */ true,
113  /* EXCEPTION_POLICY_BYPASS_FLOW */ true,
114  /* EXCEPTION_POLICY_DROP_PACKET */ false,
115  /* EXCEPTION_POLICY_DROP_FLOW */ false,
116  /* EXCEPTION_POLICY_REJECT */ true,
117  },
118  .valid_settings_ips = {
119  /* EXCEPTION_POLICY_NOT_SET */ false,
120  /* EXCEPTION_POLICY_AUTO */ false,
121  /* EXCEPTION_POLICY_PASS_PACKET */ true,
122  /* EXCEPTION_POLICY_PASS_FLOW */ true,
123  /* EXCEPTION_POLICY_BYPASS_FLOW */ true,
124  /* EXCEPTION_POLICY_DROP_PACKET */ true,
125  /* EXCEPTION_POLICY_DROP_FLOW */ true,
126  /* EXCEPTION_POLICY_REJECT */ true,
127  },
128 };
129 // clang-format on
130 
131 void AppLayerSetupCounters(void);
132 void AppLayerDeSetupCounters(void);
133 
134 /***** L7 layer dispatchers *****/
135 
136 static inline int ProtoDetectDone(const Flow *f, const TcpSession *ssn, uint8_t direction) {
137  const TcpStream *stream = (direction & STREAM_TOSERVER) ? &ssn->client : &ssn->server;
139  (FLOW_IS_PM_DONE(f, direction) && FLOW_IS_PP_DONE(f, direction)));
140 }
141 
142 /**
143  * \note id can be 0 if protocol parser is disabled but detection
144  * is enabled.
145  */
146 static void AppLayerIncFlowCounter(ThreadVars *tv, Flow *f)
147 {
148  const uint16_t id = applayer_counters[f->alproto][f->protomap].counter_id;
149  if (likely(tv && id > 0)) {
150  StatsIncr(tv, id);
151  }
152 }
153 
154 void AppLayerIncTxCounter(ThreadVars *tv, Flow *f, uint64_t step)
155 {
156  const uint16_t id = applayer_counters[f->alproto][f->protomap].counter_tx_id;
157  if (likely(tv && id > 0)) {
158  StatsAddUI64(tv, id, step);
159  }
160 }
161 
163 {
164  const uint16_t id = applayer_counters[f->alproto][f->protomap].gap_error_id;
165  if (likely(tv && id > 0)) {
166  StatsIncr(tv, id);
167  }
168 }
169 
171 {
172  const uint16_t id = applayer_counters[f->alproto][f->protomap].alloc_error_id;
173  if (likely(tv && id > 0)) {
174  StatsIncr(tv, id);
175  }
176 }
177 
179 {
180  const uint16_t id = applayer_counters[f->alproto][f->protomap].parser_error_id;
181  if (likely(tv && id > 0)) {
182  StatsIncr(tv, id);
183  }
184 }
185 
187 {
188  const uint16_t id = applayer_counters[f->alproto][f->protomap].internal_error_id;
189  if (likely(tv && id > 0)) {
190  StatsIncr(tv, id);
191  }
192 }
193 
194 static void AppLayerIncrErrorExcPolicyCounter(ThreadVars *tv, Flow *f, enum ExceptionPolicy policy)
195 {
196 #ifdef UNITTESTS
197  if (tv == NULL) {
198  return;
199  }
200 #endif
201  uint16_t id = applayer_counters[f->alproto][f->protomap].eps_error.eps_id[policy];
202  /* for the summary values */
203  uint16_t g_id = eps_error_summary.eps_id[policy];
204 
205  if (likely(id > 0)) {
206  StatsIncr(tv, id);
207  }
208  if (likely(g_id > 0)) {
209  StatsIncr(tv, g_id);
210  }
211 }
212 
213 /* in IDS mode protocol detection is done in reverse order:
214  * when TCP data is ack'd. We want to flag the correct packet,
215  * so in this case we set a flag in the flow so that the first
216  * packet in the correct direction can be tagged.
217  *
218  * For IPS we update packet and flow. */
219 static inline void FlagPacketFlow(Packet *p, Flow *f, uint8_t flags)
220 {
221  if (p->proto != IPPROTO_TCP || EngineModeIsIPS()) {
222  if (flags & STREAM_TOSERVER) {
223  if (p->flowflags & FLOW_PKT_TOSERVER) {
226  } else {
228  }
229  } else {
230  if (p->flowflags & FLOW_PKT_TOCLIENT) {
233  } else {
235  }
236  }
237  } else {
238  if (flags & STREAM_TOSERVER) {
240  } else {
242  }
243  }
244 }
245 
246 static void DisableAppLayer(ThreadVars *tv, Flow *f, Packet *p)
247 {
248  SCLogDebug("disable app layer for flow %p alproto %u ts %u tc %u",
249  f, f->alproto, f->alproto_ts, f->alproto_tc);
252  TcpSession *ssn = f->protoctx;
254  f->alproto = ALPROTO_FAILED;
255  AppLayerIncFlowCounter(tv, f);
256 
257  if (f->alproto_tc != ALPROTO_FAILED) {
258  if (f->alproto_tc == ALPROTO_UNKNOWN) {
260  }
261  FlagPacketFlow(p, f, STREAM_TOCLIENT);
262  }
263  if (f->alproto_ts != ALPROTO_FAILED) {
264  if (f->alproto_ts == ALPROTO_UNKNOWN) {
266  }
267  FlagPacketFlow(p, f, STREAM_TOSERVER);
268  }
269  SCLogDebug("disabled app layer for flow %p alproto %u ts %u tc %u",
270  f, f->alproto, f->alproto_ts, f->alproto_tc);
271 }
272 
273 /* See if we're going to have to give up:
274  *
275  * If we're getting a lot of data in one direction and the
276  * proto for this direction is unknown, proto detect will
277  * hold up segments in the segment list in the stream.
278  * They are held so that if we detect the protocol on the
279  * opposing stream, we can still parse this side of the stream
280  * as well. However, some sessions are very unbalanced. FTP
281  * data channels, large PUT/POST request and many others, can
282  * lead to cases where we would have to store many megabytes
283  * worth of segments before we see the opposing stream. This
284  * leads to risks of resource starvation.
285  *
286  * Here a cutoff point is enforced. If we've stored 100k in
287  * one direction and we've seen no data in the other direction,
288  * we give up.
289  *
290  * Giving up means we disable applayer an set an applayer event
291  */
292 static void TCPProtoDetectCheckBailConditions(ThreadVars *tv,
293  Flow *f, TcpSession *ssn, Packet *p)
294 {
295  if (ssn->state < TCP_ESTABLISHED) {
296  SCLogDebug("skip as long as TCP is not ESTABLISHED (TCP fast open)");
297  return;
298  }
299 
300  const uint32_t size_ts = StreamDataAvailableForProtoDetect(&ssn->client);
301  const uint32_t size_tc = StreamDataAvailableForProtoDetect(&ssn->server);
302  SCLogDebug("size_ts %" PRIu32 ", size_tc %" PRIu32, size_ts, size_tc);
303 
304  /* at least 100000 whatever the conditions
305  * and can be more if window is bigger and if configuration allows it */
306  const uint32_t size_tc_limit =
308  const uint32_t size_ts_limit =
310 
311  if (ProtoDetectDone(f, ssn, STREAM_TOSERVER) &&
312  ProtoDetectDone(f, ssn, STREAM_TOCLIENT))
313  {
314  goto failure;
315 
316  /* we bail out whatever the pp and pm states if
317  * we received too much data */
318  } else if (size_tc > 2 * size_tc_limit || size_ts > 2 * size_ts_limit) {
320  goto failure;
321 
322  } else if (FLOW_IS_PM_DONE(f, STREAM_TOSERVER) && FLOW_IS_PP_DONE(f, STREAM_TOSERVER) &&
323  size_ts > size_ts_limit && size_tc == 0) {
326  goto failure;
327 
328  } else if (FLOW_IS_PM_DONE(f, STREAM_TOCLIENT) && FLOW_IS_PP_DONE(f, STREAM_TOCLIENT) &&
329  size_tc > size_tc_limit && size_ts == 0) {
332  goto failure;
333 
334  /* little data in ts direction, pp done, pm not done (max
335  * depth not reached), ts direction done, lots of data in
336  * tc direction. */
337  } else if (size_tc > size_tc_limit && FLOW_IS_PP_DONE(f, STREAM_TOSERVER) &&
338  !(FLOW_IS_PM_DONE(f, STREAM_TOSERVER)) && FLOW_IS_PM_DONE(f, STREAM_TOCLIENT) &&
339  FLOW_IS_PP_DONE(f, STREAM_TOCLIENT)) {
342  goto failure;
343 
344  /* little data in tc direction, pp done, pm not done (max
345  * depth not reached), tc direction done, lots of data in
346  * ts direction. */
347  } else if (size_ts > size_ts_limit && FLOW_IS_PP_DONE(f, STREAM_TOCLIENT) &&
348  !(FLOW_IS_PM_DONE(f, STREAM_TOCLIENT)) && FLOW_IS_PM_DONE(f, STREAM_TOSERVER) &&
349  FLOW_IS_PP_DONE(f, STREAM_TOSERVER)) {
352  goto failure;
353  }
354  return;
355 
356 failure:
357  DisableAppLayer(tv, f, p);
358 }
359 
360 static int TCPProtoDetectTriggerOpposingSide(ThreadVars *tv, TcpReassemblyThreadCtx *ra_ctx,
361  Packet *p, TcpSession *ssn, const TcpStream *stream)
362 {
363  TcpStream *opposing_stream = NULL;
364  if (stream == &ssn->client) {
365  opposing_stream = &ssn->server;
366  } else {
367  opposing_stream = &ssn->client;
368  }
369 
370  /* if the opposing side is not going to work, then
371  * we just have to give up. */
372  if (opposing_stream->flags & STREAMTCP_STREAM_FLAG_NOREASSEMBLY) {
373  SCLogDebug("opposing dir has STREAMTCP_STREAM_FLAG_NOREASSEMBLY set");
374  return -1;
375  }
376 
377  enum StreamUpdateDir dir = StreamTcpInlineMode() ?
380  int ret = StreamTcpReassembleAppLayer(tv, ra_ctx, ssn,
381  opposing_stream, p, dir);
382  return ret;
383 }
384 
386 
387 /** \todo data const
388  * \retval int -1 error
389  * \retval int 0 ok
390  */
391 static int TCPProtoDetect(ThreadVars *tv, TcpReassemblyThreadCtx *ra_ctx,
392  AppLayerThreadCtx *app_tctx, Packet *p, Flow *f, TcpSession *ssn, TcpStream **stream,
393  uint8_t *data, uint32_t data_len, uint8_t flags, enum StreamUpdateDir app_update_dir)
394 {
395  AppProto *alproto;
396  AppProto *alproto_otherdir;
397  uint8_t direction = (flags & STREAM_TOSERVER) ? 0 : 1;
398 
399  if (flags & STREAM_TOSERVER) {
400  alproto = &f->alproto_ts;
401  alproto_otherdir = &f->alproto_tc;
402  } else {
403  alproto = &f->alproto_tc;
404  alproto_otherdir = &f->alproto_ts;
405  }
406 
407  SCLogDebug("Stream initializer (len %" PRIu32 ")", data_len);
408 #ifdef PRINT
409  if (data_len > 0) {
410  printf("=> Init Stream Data (app layer) -- start %s%s\n",
411  flags & STREAM_TOCLIENT ? "toclient" : "",
412  flags & STREAM_TOSERVER ? "toserver" : "");
413  PrintRawDataFp(stdout, data, data_len);
414  printf("=> Init Stream Data -- end\n");
415  }
416 #endif
417 
418  bool reverse_flow = false;
419  DEBUG_VALIDATE_BUG_ON(data == NULL && data_len > 0);
421  *alproto = AppLayerProtoDetectGetProto(app_tctx->alpd_tctx,
422  f, data, data_len,
423  IPPROTO_TCP, flags, &reverse_flow);
424  PACKET_PROFILING_APP_PD_END(app_tctx);
425  SCLogDebug("alproto %u rev %s", *alproto, reverse_flow ? "true" : "false");
426 
427  if (*alproto != ALPROTO_UNKNOWN) {
428  if (*alproto_otherdir != ALPROTO_UNKNOWN && *alproto_otherdir != *alproto) {
431 
433  /* if we already invoked the parser, we go with that proto */
434  f->alproto = *alproto_otherdir;
435  } else {
436  /* no data sent to parser yet, we can still choose
437  * we're trusting the server more. */
438  if (flags & STREAM_TOCLIENT)
439  f->alproto = *alproto;
440  else
441  f->alproto = *alproto_otherdir;
442  }
443  } else {
444  f->alproto = *alproto;
445  }
446 
450  FlagPacketFlow(p, f, flags);
451 
452  /* if protocol detection indicated that we need to reverse
453  * the direction of the flow, do it now. We flip the flow,
454  * packet and the direction flags */
455  if (reverse_flow &&
458  /* but only if we didn't already detect it on the other side. */
459  if (*alproto_otherdir == ALPROTO_UNKNOWN) {
460  SCLogDebug("reversing flow after proto detect told us so");
461  PacketSwap(p);
462  FlowSwap(f);
463  // Will reset signature groups in DetectRunSetup
464  f->de_ctx_version = UINT32_MAX;
465  SWAP_FLAGS(flags, STREAM_TOSERVER, STREAM_TOCLIENT);
466  if (*stream == &ssn->client) {
467  *stream = &ssn->server;
468  } else {
469  *stream = &ssn->client;
470  }
471  direction = 1 - direction;
472  } else {
473  // TODO event, error?
474  }
475  }
476 
477  /* account flow if we have both sides */
478  if (*alproto_otherdir != ALPROTO_UNKNOWN) {
479  AppLayerIncFlowCounter(tv, f);
480  }
481 
482  /* if we have seen data from the other direction first, send
483  * data for that direction first to the parser. This shouldn't
484  * be an issue, since each stream processing happens
485  * independently of the other stream direction. At this point of
486  * call, you need to know that this function's already being
487  * called by the very same StreamReassembly() function that we
488  * will now call shortly for the opposing direction. */
489  if ((ssn->data_first_seen_dir & (STREAM_TOSERVER | STREAM_TOCLIENT)) &&
490  !(flags & ssn->data_first_seen_dir))
491  {
492  SCLogDebug("protocol %s needs first data in other direction",
493  AppProtoToString(*alproto));
494 
495  if (TCPProtoDetectTriggerOpposingSide(tv, ra_ctx,
496  p, ssn, *stream) != 0)
497  {
498  goto detect_error;
499  }
500  if (FlowChangeProto(f)) {
501  /* We have the first data which requested a protocol change from P1 to P2
502  * even if it was not recognized at first as being P1
503  * As the second data was recognized as P1, the protocol did not change !
504  */
508  }
509  }
510 
511  /* if the parser operates such that it needs to see data from
512  * a particular direction first, we check if we have seen
513  * data from that direction first for the flow. IF it is not
514  * the same, we set an event and exit.
515  *
516  * \todo We need to figure out a more robust solution for this,
517  * as this can lead to easy evasion tactics, where the
518  * attacker can first send some dummy data in the wrong
519  * direction first to mislead our proto detection process.
520  * While doing this we need to update the parsers as well,
521  * since the parsers must be robust to see such wrong
522  * direction data.
523  * Either ways the moment we see the
524  * APPLAYER_WRONG_DIRECTION_FIRST_DATA event set for the
525  * flow, it shows something's fishy.
526  */
528  uint8_t first_data_dir;
529  first_data_dir = AppLayerParserGetFirstDataDir(f->proto, f->alproto);
530 
531  if (first_data_dir && !(first_data_dir & ssn->data_first_seen_dir)) {
534  goto detect_error;
535  }
536  /* This can happen if the current direction is not the
537  * right direction, and the data from the other(also
538  * the right direction) direction is available to be sent
539  * to the app layer, but it is not ack'ed yet and hence
540  * the forced call to STreamTcpAppLayerReassemble still
541  * hasn't managed to send data from the other direction
542  * to the app layer. */
543  if (first_data_dir && !(first_data_dir & flags)) {
549  SCReturnInt(-1);
550  }
551  }
552 
553  /* Set a value that is neither STREAM_TOSERVER, nor STREAM_TOCLIENT */
555 
556  /* finally, invoke the parser */
557  PACKET_PROFILING_APP_START(app_tctx, f->alproto);
558  int r = AppLayerParserParse(tv, app_tctx->alp_tctx, f, f->alproto,
559  flags, data, data_len);
560  PACKET_PROFILING_APP_END(app_tctx);
561  p->app_update_direction = (uint8_t)app_update_dir;
562  if (r != 1) {
563  StreamTcpUpdateAppLayerProgress(ssn, direction, data_len);
564  }
565  if (r == 0) {
566  if (*alproto_otherdir == ALPROTO_UNKNOWN) {
567  TcpStream *opposing_stream;
568  if (*stream == &ssn->client) {
569  opposing_stream = &ssn->server;
570  } else {
571  opposing_stream = &ssn->client;
572  }
574  // can happen in detection-only
575  AppLayerIncFlowCounter(tv, f);
576  }
577  }
578  }
579  if (r < 0) {
580  goto parser_error;
581  }
582  } else {
583  /* if the ssn is midstream, we may end up with a case where the
584  * start of an HTTP request is missing. We won't detect HTTP based
585  * on the request. However, the reply is fine, so we detect
586  * HTTP anyway. This leads to passing the incomplete request to
587  * the htp parser.
588  *
589  * This has been observed, where the http parser then saw many
590  * bogus requests in the incomplete data.
591  *
592  * To counter this case, a midstream session MUST find it's
593  * protocol in the toserver direction. If not, we assume the
594  * start of the request/toserver is incomplete and no reliable
595  * detection and parsing is possible. So we give up.
596  */
597  if ((ssn->flags & STREAMTCP_FLAG_MIDSTREAM) &&
599  {
600  if (FLOW_IS_PM_DONE(f, STREAM_TOSERVER) && FLOW_IS_PP_DONE(f, STREAM_TOSERVER)) {
601  SCLogDebug("midstream end pd %p", ssn);
602  /* midstream and toserver detection failed: give up */
603  DisableAppLayer(tv, f, p);
604  SCReturnInt(0);
605  }
606  }
607 
608  if (*alproto_otherdir != ALPROTO_UNKNOWN) {
609  uint8_t first_data_dir;
610  first_data_dir = AppLayerParserGetFirstDataDir(f->proto, *alproto_otherdir);
611 
612  /* this would handle this test case -
613  * http parser which says it wants to see toserver data first only.
614  * tcp handshake
615  * toclient data first received. - RUBBISH DATA which
616  * we don't detect as http
617  * toserver data next sent - we detect this as http.
618  * at this stage we see that toclient is the first data seen
619  * for this session and we try and redetect the app protocol,
620  * but we are unable to detect the app protocol like before.
621  * But since we have managed to detect the protocol for the
622  * other direction as http, we try to use that. At this
623  * stage we check if the direction of this stream matches
624  * to that acceptable by the app parser. If it is not the
625  * acceptable direction we error out.
626  */
628  (first_data_dir) && !(first_data_dir & flags))
629  {
630  goto detect_error;
631  }
632 
633  /* if protocol detection is marked done for our direction we
634  * pass our data on. We're only succeeded in finding one
635  * direction: the opposing stream
636  *
637  * If PD was not yet complete, we don't do anything.
638  */
639  if (FLOW_IS_PM_DONE(f, flags) && FLOW_IS_PP_DONE(f, flags)) {
640  if (data_len > 0)
642 
643  if (*alproto_otherdir != ALPROTO_FAILED) {
644  PACKET_PROFILING_APP_START(app_tctx, f->alproto);
645  int r = AppLayerParserParse(tv, app_tctx->alp_tctx, f,
646  f->alproto, flags,
647  data, data_len);
648  PACKET_PROFILING_APP_END(app_tctx);
649  p->app_update_direction = (uint8_t)app_update_dir;
650  if (r != 1) {
651  StreamTcpUpdateAppLayerProgress(ssn, direction, data_len);
652  }
653 
658  AppLayerIncFlowCounter(tv, f);
659 
660  *alproto = *alproto_otherdir;
661  SCLogDebug("packet %"PRIu64": pd done(us %u them %u), parser called (r==%d), APPLAYER_DETECT_PROTOCOL_ONLY_ONE_DIRECTION set",
662  p->pcap_cnt, *alproto, *alproto_otherdir, r);
663  if (r < 0) {
664  goto parser_error;
665  }
666  }
667  *alproto = ALPROTO_FAILED;
669  FlagPacketFlow(p, f, flags);
670 
671  } else if (flags & STREAM_EOF) {
672  *alproto = f->alproto;
674  AppLayerIncFlowCounter(tv, f);
675  }
676  } else {
677  /* both sides unknown, let's see if we need to give up */
678  if (FlowChangeProto(f)) {
679  /* TCPProtoDetectCheckBailConditions does not work well because
680  * size_tc from STREAM_RIGHT_EDGE is not reset to zero
681  * so, we set a lower limit to the data we inspect
682  * We could instead have set ssn->server.sb.stream_offset = 0;
683  */
684  if (data_len >= FLOW_PROTO_CHANGE_MAX_DEPTH || (flags & STREAM_EOF)) {
685  DisableAppLayer(tv, f, p);
686  }
687  } else {
688  TCPProtoDetectCheckBailConditions(tv, f, ssn, p);
689  }
690  }
691  }
692  SCReturnInt(0);
693 parser_error:
695  AppLayerIncrErrorExcPolicyCounter(tv, f, g_applayerparser_error_policy);
696  SCReturnInt(-1);
697 detect_error:
698  DisableAppLayer(tv, f, p);
699  SCReturnInt(-2);
700 }
701 
702 /** \brief handle TCP data for the app-layer.
703  *
704  * First run protocol detection and then when the protocol is known invoke
705  * the app layer parser.
706  *
707  * \param stream ptr-to-ptr to stream object. Might change if flow dir is
708  * reversed.
709  */
711  TcpSession *ssn, TcpStream **stream, uint8_t *data, uint32_t data_len, uint8_t flags,
712  enum StreamUpdateDir app_update_dir)
713 {
714  SCEnter();
715 
717  DEBUG_VALIDATE_BUG_ON(data_len > (uint32_t)INT_MAX);
718 
719  AppLayerThreadCtx *app_tctx = ra_ctx->app_tctx;
720  AppProto alproto;
721  int r = 0;
722 
723  SCLogDebug("data_len %u flags %02X", data_len, flags);
725  SCLogDebug("STREAMTCP_FLAG_APP_LAYER_DISABLED is set");
726  goto end;
727  }
728 
729  const uint8_t direction = (flags & STREAM_TOSERVER) ? 0 : 1;
730 
731  if (flags & STREAM_TOSERVER) {
732  alproto = f->alproto_ts;
733  } else {
734  alproto = f->alproto_tc;
735  }
736 
737  /* If a gap notification, relay the notification on to the
738  * app-layer if known. */
739  if (flags & STREAM_GAP) {
740  SCLogDebug("GAP of size %u", data_len);
741  if (alproto == ALPROTO_UNKNOWN) {
743  SCLogDebug("ALPROTO_UNKNOWN flow %p, due to GAP in stream start", f);
744  /* if the other side didn't already find the proto, we're done */
745  if (f->alproto == ALPROTO_UNKNOWN) {
746  goto failure;
747  }
748  AppLayerIncFlowCounter(tv, f);
749  }
750  if (FlowChangeProto(f)) {
752  SCLogDebug("Cannot handle gap while changing protocol");
753  goto failure;
754  }
755  PACKET_PROFILING_APP_START(app_tctx, f->alproto);
756  r = AppLayerParserParse(tv, app_tctx->alp_tctx, f, f->alproto,
757  flags, data, data_len);
758  PACKET_PROFILING_APP_END(app_tctx);
759  p->app_update_direction = (uint8_t)app_update_dir;
760  /* ignore parser result for gap */
761  StreamTcpUpdateAppLayerProgress(ssn, direction, data_len);
762  if (r < 0) {
764  AppLayerIncrErrorExcPolicyCounter(tv, f, g_applayerparser_error_policy);
765  SCReturnInt(-1);
766  }
767  goto end;
768  }
769 
770  /* if we don't know the proto yet and we have received a stream
771  * initializer message, we run proto detection.
772  * We receive 2 stream init msgs (one for each direction), we
773  * only run the proto detection for both and emit an event
774  * in the case protocols mismatch. */
775  if (alproto == ALPROTO_UNKNOWN && (flags & STREAM_START)) {
777  /* run protocol detection */
778  if (TCPProtoDetect(tv, ra_ctx, app_tctx, p, f, ssn, stream, data, data_len, flags,
779  app_update_dir) != 0) {
780  goto failure;
781  }
782  } else if (alproto != ALPROTO_UNKNOWN && FlowChangeProto(f)) {
783  SCLogDebug("protocol change, old %s", AppProtoToString(f->alproto_orig));
784  void *alstate_orig = f->alstate;
785  AppLayerParserState *alparser = f->alparser;
786  // we delay AppLayerParserStateCleanup because we may need previous parser state
790  /* rerun protocol detection */
791  int rd = TCPProtoDetect(
792  tv, ra_ctx, app_tctx, p, f, ssn, stream, data, data_len, flags, app_update_dir);
793  if (f->alproto == ALPROTO_UNKNOWN) {
794  DEBUG_VALIDATE_BUG_ON(alstate_orig != f->alstate);
795  // not enough data, revert AppLayerProtoDetectReset to rerun detection
796  f->alparser = alparser;
797  f->alproto = f->alproto_orig;
798  f->alproto_tc = f->alproto_orig;
799  f->alproto_ts = f->alproto_orig;
800  } else {
802  AppLayerParserStateProtoCleanup(f->protomap, f->alproto_orig, alstate_orig, alparser);
803  if (alstate_orig == f->alstate) {
804  // we just freed it
805  f->alstate = NULL;
806  }
807  }
808  if (rd != 0) {
809  SCLogDebug("proto detect failure");
810  goto failure;
811  }
812  SCLogDebug("protocol change, old %s, new %s",
814 
816  f->alproto != f->alproto_expect) {
819 
820  if (f->alproto_expect == ALPROTO_TLS && f->alproto != ALPROTO_TLS) {
823 
824  }
825  }
826  } else {
827  SCLogDebug("stream data (len %" PRIu32 " alproto "
828  "%"PRIu16" (flow %p)", data_len, f->alproto, f);
829 #ifdef PRINT
830  if (data_len > 0) {
831  printf("=> Stream Data (app layer) -- start %s%s\n",
832  flags & STREAM_TOCLIENT ? "toclient" : "",
833  flags & STREAM_TOSERVER ? "toserver" : "");
834  PrintRawDataFp(stdout, data, data_len);
835  printf("=> Stream Data -- end\n");
836  }
837 #endif
838  /* if we don't have a data object here we are not getting it
839  * a start msg should have gotten us one */
840  if (f->alproto != ALPROTO_UNKNOWN) {
841  PACKET_PROFILING_APP_START(app_tctx, f->alproto);
842  r = AppLayerParserParse(tv, app_tctx->alp_tctx, f, f->alproto,
843  flags, data, data_len);
844  PACKET_PROFILING_APP_END(app_tctx);
845  p->app_update_direction = (uint8_t)app_update_dir;
846  if (r != 1) {
847  StreamTcpUpdateAppLayerProgress(ssn, direction, data_len);
848  if (r < 0) {
851  AppLayerIncrErrorExcPolicyCounter(tv, f, g_applayerparser_error_policy);
852  SCReturnInt(-1);
853  }
854  }
855  }
856  }
857 
858  goto end;
859  failure:
860  r = -1;
861  end:
862  SCReturnInt(r);
863 }
864 
865 /**
866  * \brief Handle a app layer UDP message
867  *
868  * If the protocol is yet unknown, the proto detection code is run first.
869  *
870  * \param dp_ctx Thread app layer detect context
871  * \param f *locked* flow
872  * \param p UDP packet
873  *
874  * \retval 0 ok
875  * \retval -1 error
876  */
878 {
879  SCEnter();
880  AppProto *alproto;
881  AppProto *alproto_otherdir;
882 
883  if (f->alproto_ts == ALPROTO_FAILED && f->alproto_tc == ALPROTO_FAILED) {
884  SCReturnInt(0);
885  }
886 
887  int r = 0;
888  uint8_t flags = 0;
889  if (p->flowflags & FLOW_PKT_TOSERVER) {
890  flags |= STREAM_TOSERVER;
891  alproto = &f->alproto_ts;
892  alproto_otherdir = &f->alproto_tc;
893  } else {
894  flags |= STREAM_TOCLIENT;
895  alproto = &f->alproto_tc;
896  alproto_otherdir = &f->alproto_ts;
897  }
898 
900 
901  /* if the protocol is still unknown, run detection */
902  if (*alproto == ALPROTO_UNKNOWN) {
903  SCLogDebug("Detecting AL proto on udp mesg (len %" PRIu32 ")",
904  p->payload_len);
905 
906  bool reverse_flow = false;
908  *alproto = AppLayerProtoDetectGetProto(
909  tctx->alpd_tctx, f, p->payload, p->payload_len, IPPROTO_UDP, flags, &reverse_flow);
911 
912  switch (*alproto) {
913  case ALPROTO_UNKNOWN:
914  if (*alproto_otherdir != ALPROTO_UNKNOWN) {
915  // Use recognized side
916  f->alproto = *alproto_otherdir;
917  // do not keep ALPROTO_UNKNOWN for this side so as not to loop
918  *alproto = *alproto_otherdir;
919  if (*alproto_otherdir == ALPROTO_FAILED) {
920  SCLogDebug("ALPROTO_UNKNOWN flow %p", f);
921  }
922  } else {
923  // First side of protocol is unknown
924  *alproto = ALPROTO_FAILED;
925  }
926  break;
927  case ALPROTO_FAILED:
928  if (*alproto_otherdir != ALPROTO_UNKNOWN) {
929  // Use recognized side
930  f->alproto = *alproto_otherdir;
931  if (*alproto_otherdir == ALPROTO_FAILED) {
932  SCLogDebug("ALPROTO_UNKNOWN flow %p", f);
933  }
934  }
935  // else wait for second side of protocol
936  break;
937  default:
938  if (*alproto_otherdir != ALPROTO_UNKNOWN && *alproto_otherdir != ALPROTO_FAILED) {
939  if (*alproto_otherdir != *alproto) {
942  // data already sent to parser, we cannot change the protocol to use the one
943  // of the server
944  }
945  } else {
946  f->alproto = *alproto;
947  }
948  }
949  if (*alproto_otherdir == ALPROTO_UNKNOWN) {
950  if (f->alproto == ALPROTO_UNKNOWN) {
951  // so as to increase stat about .app_layer.flow.failed_udp
952  f->alproto = ALPROTO_FAILED;
953  }
954  // If the other side is unknown, this is the first packet of the flow
955  AppLayerIncFlowCounter(tv, f);
956  }
957 
958  // parse the data if we recognized one protocol
959  if (f->alproto != ALPROTO_UNKNOWN && f->alproto != ALPROTO_FAILED) {
960  if (reverse_flow) {
961  SCLogDebug("reversing flow after proto detect told us so");
962  PacketSwap(p);
963  FlowSwap(f);
964  SWAP_FLAGS(flags, STREAM_TOSERVER, STREAM_TOCLIENT);
965  }
966 
968  r = AppLayerParserParse(tv, tctx->alp_tctx, f, f->alproto,
969  flags, p->payload, p->payload_len);
972  }
974  /* we do only inspection in one direction, so flag both
975  * sides as done here */
976  FlagPacketFlow(p, f, STREAM_TOSERVER);
977  FlagPacketFlow(p, f, STREAM_TOCLIENT);
978  } else {
979  SCLogDebug("data (len %" PRIu32 " ), alproto "
980  "%"PRIu16" (flow %p)", p->payload_len, f->alproto, f);
981 
982  /* run the parser */
984  r = AppLayerParserParse(tv, tctx->alp_tctx, f, f->alproto,
985  flags, p->payload, p->payload_len);
989  }
990  if (r < 0) {
992  AppLayerIncrErrorExcPolicyCounter(tv, f, g_applayerparser_error_policy);
993  SCReturnInt(-1);
994  }
995 
996  SCReturnInt(r);
997 }
998 
999 /***** Utility *****/
1000 
1001 AppProto AppLayerGetProtoByName(const char *alproto_name)
1002 {
1003  SCEnter();
1004  AppProto r = AppLayerProtoDetectGetProtoByName(alproto_name);
1005  SCReturnCT(r, "AppProto");
1006 }
1007 
1008 const char *AppLayerGetProtoName(AppProto alproto)
1009 {
1010  SCEnter();
1011  const char * r = AppLayerProtoDetectGetProtoName(alproto);
1012  SCReturnCT(r, "char *");
1013 }
1014 
1016 {
1017  SCEnter();
1018 
1019  AppProto alproto;
1020  AppProto alprotos[g_alproto_max];
1021 
1023 
1024  printf("=========Supported App Layer Protocols=========\n");
1025  for (alproto = 0; alproto < g_alproto_max; alproto++) {
1026  if (alprotos[alproto] == 1)
1027  printf("%s\n", AppLayerGetProtoName(alproto));
1028  }
1029 
1030  SCReturn;
1031 }
1032 
1033 /***** Setup/General Registration *****/
1034 static void AppLayerNamesSetup(void)
1035 {
1074 }
1075 
1076 int AppLayerSetup(void)
1077 {
1078  SCEnter();
1079 
1080  AppLayerNamesSetup();
1083 
1086 
1088  FrameConfigInit();
1089 
1090  SCReturnInt(0);
1091 }
1092 
1094 {
1095  SCEnter();
1096 
1099 
1102 
1103  SCReturnInt(0);
1104 }
1105 
1107 {
1108  SCEnter();
1109 
1110  AppLayerThreadCtx *app_tctx = SCCalloc(1, sizeof(*app_tctx));
1111  if (app_tctx == NULL)
1112  goto error;
1113 
1114  if ((app_tctx->alpd_tctx = AppLayerProtoDetectGetCtxThread()) == NULL)
1115  goto error;
1116  if ((app_tctx->alp_tctx = AppLayerParserThreadCtxAlloc()) == NULL)
1117  goto error;
1118 
1119  goto done;
1120  error:
1121  AppLayerDestroyCtxThread(app_tctx);
1122  app_tctx = NULL;
1123  done:
1124  SCReturnPtr(app_tctx, "void *");
1125 }
1126 
1128 {
1129  SCEnter();
1130 
1131  if (app_tctx == NULL)
1132  SCReturn;
1133 
1134  if (app_tctx->alpd_tctx != NULL)
1136  if (app_tctx->alp_tctx != NULL)
1138  SCFree(app_tctx);
1139 
1140  SCReturn;
1141 }
1142 
1143 #ifdef PROFILING
1145 {
1146  PACKET_PROFILING_APP_RESET(app_tctx);
1147 }
1148 
1150 {
1151  PACKET_PROFILING_APP_STORE(app_tctx, p);
1152 }
1153 #endif
1154 
1155 /** \brief HACK to work around our broken unix manager (re)init loop
1156  */
1158 {
1163  StatsRegisterGlobalCounter("app_layer.expectations", ExpectationGetCounter);
1166  StatsRegisterGlobalCounter("ippair.memuse", IPPairGetMemuse);
1167  StatsRegisterGlobalCounter("ippair.memcap", IPPairGetMemuse);
1168  StatsRegisterGlobalCounter("host.memuse", HostGetMemuse);
1169  StatsRegisterGlobalCounter("host.memcap", HostGetMemcap);
1170 }
1171 
1172 static bool IsAppLayerErrorExceptionPolicyStatsValid(enum ExceptionPolicy policy)
1173 {
1174  if (EngineModeIsIPS()) {
1176  }
1178 }
1179 
1180 static void AppLayerSetupExceptionPolicyPerProtoCounters(
1181  uint8_t ipproto_map, AppProto alproto, const char *alproto_str, const char *ipproto_suffix)
1182 {
1185  for (enum ExceptionPolicy i = EXCEPTION_POLICY_NOT_SET + 1; i < EXCEPTION_POLICY_MAX; i++) {
1186  if (IsAppLayerErrorExceptionPolicyStatsValid(i)) {
1187  snprintf(applayer_counter_names[alproto][ipproto_map].eps_name[i],
1188  sizeof(applayer_counter_names[alproto][ipproto_map].eps_name[i]),
1189  "app_layer.error.%s%s.exception_policy.%s", alproto_str, ipproto_suffix,
1190  ExceptionPolicyEnumToString(i, true));
1191  }
1192  }
1193  }
1194 }
1195 
1197 {
1198  const uint8_t ipprotos[] = { IPPROTO_TCP, IPPROTO_UDP };
1199  AppProto alprotos[g_alproto_max];
1200  const char *str = "app_layer.flow.";
1201  const char *estr = "app_layer.error.";
1202 
1205  if (unlikely(applayer_counter_names == NULL)) {
1206  FatalError("Unable to alloc applayer_counter_names.");
1207  }
1209  if (unlikely(applayer_counters == NULL)) {
1210  FatalError("Unable to alloc applayer_counters.");
1211  }
1212  /* We don't log stats counters if exception policy is `ignore`/`not set` */
1214  /* Register global counters for app layer error exception policy summary */
1215  const char *eps_default_str = "exception_policy.app_layer.error.";
1216  for (enum ExceptionPolicy i = EXCEPTION_POLICY_NOT_SET + 1; i < EXCEPTION_POLICY_MAX; i++) {
1217  if (IsAppLayerErrorExceptionPolicyStatsValid(i)) {
1218  snprintf(app_layer_error_eps_stats.eps_name[i],
1219  sizeof(app_layer_error_eps_stats.eps_name[i]), "%s%s", eps_default_str,
1220  ExceptionPolicyEnumToString(i, true));
1221  }
1222  }
1223  }
1224 
1226 
1227  for (uint8_t p = 0; p < FLOW_PROTO_APPLAYER_MAX; p++) {
1228  const uint8_t ipproto = ipprotos[p];
1229  const uint8_t ipproto_map = FlowGetProtoMapping(ipproto);
1230  const char *ipproto_suffix = (ipproto == IPPROTO_TCP) ? "_tcp" : "_udp";
1231  uint8_t ipprotos_all[256 / 8];
1232 
1233  for (AppProto alproto = 0; alproto < g_alproto_max; alproto++) {
1234  if (alprotos[alproto] == 1) {
1235  const char *tx_str = "app_layer.tx.";
1236  const char *alproto_str = AppLayerGetProtoName(alproto);
1237 
1238  memset(ipprotos_all, 0, sizeof(ipprotos_all));
1239  AppLayerProtoDetectSupportedIpprotos(alproto, ipprotos_all);
1240  if ((ipprotos_all[IPPROTO_TCP / 8] & (1 << (IPPROTO_TCP % 8))) &&
1241  (ipprotos_all[IPPROTO_UDP / 8] & (1 << (IPPROTO_UDP % 8)))) {
1242  snprintf(applayer_counter_names[alproto][ipproto_map].name,
1243  sizeof(applayer_counter_names[alproto][ipproto_map].name), "%s%s%s",
1244  str, alproto_str, ipproto_suffix);
1245  snprintf(applayer_counter_names[alproto][ipproto_map].tx_name,
1246  sizeof(applayer_counter_names[alproto][ipproto_map].tx_name), "%s%s%s",
1247  tx_str, alproto_str, ipproto_suffix);
1248 
1249  if (ipproto == IPPROTO_TCP) {
1250  snprintf(applayer_counter_names[alproto][ipproto_map].gap_error,
1251  sizeof(applayer_counter_names[alproto][ipproto_map].gap_error),
1252  "%s%s%s.gap", estr, alproto_str, ipproto_suffix);
1253  }
1254  snprintf(applayer_counter_names[alproto][ipproto_map].alloc_error,
1255  sizeof(applayer_counter_names[alproto][ipproto_map].alloc_error),
1256  "%s%s%s.alloc", estr, alproto_str, ipproto_suffix);
1257  snprintf(applayer_counter_names[alproto][ipproto_map].parser_error,
1258  sizeof(applayer_counter_names[alproto][ipproto_map].parser_error),
1259  "%s%s%s.parser", estr, alproto_str, ipproto_suffix);
1260  snprintf(applayer_counter_names[alproto][ipproto_map].internal_error,
1261  sizeof(applayer_counter_names[alproto][ipproto_map].internal_error),
1262  "%s%s%s.internal", estr, alproto_str, ipproto_suffix);
1263 
1264  AppLayerSetupExceptionPolicyPerProtoCounters(
1265  ipproto_map, alproto, alproto_str, ipproto_suffix);
1266  } else {
1267  snprintf(applayer_counter_names[alproto][ipproto_map].name,
1268  sizeof(applayer_counter_names[alproto][ipproto_map].name), "%s%s", str,
1269  alproto_str);
1270  snprintf(applayer_counter_names[alproto][ipproto_map].tx_name,
1271  sizeof(applayer_counter_names[alproto][ipproto_map].tx_name), "%s%s",
1272  tx_str, alproto_str);
1273 
1274  if (ipproto == IPPROTO_TCP) {
1275  snprintf(applayer_counter_names[alproto][ipproto_map].gap_error,
1276  sizeof(applayer_counter_names[alproto][ipproto_map].gap_error),
1277  "%s%s.gap", estr, alproto_str);
1278  }
1279  snprintf(applayer_counter_names[alproto][ipproto_map].alloc_error,
1280  sizeof(applayer_counter_names[alproto][ipproto_map].alloc_error),
1281  "%s%s.alloc", estr, alproto_str);
1282  snprintf(applayer_counter_names[alproto][ipproto_map].parser_error,
1283  sizeof(applayer_counter_names[alproto][ipproto_map].parser_error),
1284  "%s%s.parser", estr, alproto_str);
1285  snprintf(applayer_counter_names[alproto][ipproto_map].internal_error,
1286  sizeof(applayer_counter_names[alproto][ipproto_map].internal_error),
1287  "%s%s.internal", estr, alproto_str);
1288  AppLayerSetupExceptionPolicyPerProtoCounters(
1289  ipproto_map, alproto, alproto_str, "");
1290  }
1291  } else if (alproto == ALPROTO_FAILED) {
1292  snprintf(applayer_counter_names[alproto][ipproto_map].name,
1293  sizeof(applayer_counter_names[alproto][ipproto_map].name), "%s%s%s", str,
1294  "failed", ipproto_suffix);
1295  if (ipproto == IPPROTO_TCP) {
1296  snprintf(applayer_counter_names[alproto][ipproto_map].gap_error,
1297  sizeof(applayer_counter_names[alproto][ipproto_map].gap_error),
1298  "%sfailed%s.gap", estr, ipproto_suffix);
1299  }
1300  }
1301  }
1302  }
1303 }
1304 
1306 {
1307  const uint8_t ipprotos[] = { IPPROTO_TCP, IPPROTO_UDP };
1308  AppProto alprotos[g_alproto_max];
1310 
1311  /* We don't log stats counters if exception policy is `ignore`/`not set` */
1313  /* Register global counters for app layer error exception policy summary */
1314  for (enum ExceptionPolicy i = EXCEPTION_POLICY_NOT_SET + 1; i < EXCEPTION_POLICY_MAX; i++) {
1315  if (IsAppLayerErrorExceptionPolicyStatsValid(i)) {
1318  }
1319  }
1320  }
1321 
1322  for (uint8_t p = 0; p < FLOW_PROTO_APPLAYER_MAX; p++) {
1323  const uint8_t ipproto = ipprotos[p];
1324  const uint8_t ipproto_map = FlowGetProtoMapping(ipproto);
1325 
1326  for (AppProto alproto = 0; alproto < g_alproto_max; alproto++) {
1327  if (alprotos[alproto] == 1) {
1328  applayer_counters[alproto][ipproto_map].counter_id =
1329  StatsRegisterCounter(applayer_counter_names[alproto][ipproto_map].name, tv);
1330 
1331  applayer_counters[alproto][ipproto_map].counter_tx_id = StatsRegisterCounter(
1332  applayer_counter_names[alproto][ipproto_map].tx_name, tv);
1333 
1334  if (ipproto == IPPROTO_TCP) {
1335  applayer_counters[alproto][ipproto_map].gap_error_id = StatsRegisterCounter(
1336  applayer_counter_names[alproto][ipproto_map].gap_error, tv);
1337  }
1338  applayer_counters[alproto][ipproto_map].alloc_error_id = StatsRegisterCounter(
1339  applayer_counter_names[alproto][ipproto_map].alloc_error, tv);
1340  applayer_counters[alproto][ipproto_map].parser_error_id = StatsRegisterCounter(
1341  applayer_counter_names[alproto][ipproto_map].parser_error, tv);
1343  applayer_counter_names[alproto][ipproto_map].internal_error, tv);
1344  /* We don't log stats counters if exception policy is `ignore`/`not set` */
1347  for (enum ExceptionPolicy i = EXCEPTION_POLICY_NOT_SET + 1;
1348  i < EXCEPTION_POLICY_MAX; i++) {
1349  if (IsAppLayerErrorExceptionPolicyStatsValid(i)) {
1350  applayer_counters[alproto][ipproto_map]
1352  applayer_counter_names[alproto][ipproto_map].eps_name[i], tv);
1353  }
1354  }
1355  }
1356  } else if (alproto == ALPROTO_FAILED) {
1357  applayer_counters[alproto][ipproto_map].counter_id =
1358  StatsRegisterCounter(applayer_counter_names[alproto][ipproto_map].name, tv);
1359 
1360  if (ipproto == IPPROTO_TCP) {
1361  applayer_counters[alproto][ipproto_map].gap_error_id = StatsRegisterCounter(
1362  applayer_counter_names[alproto][ipproto_map].gap_error, tv);
1363  }
1364  }
1365  }
1366  }
1367 }
1368 
1370 {
1373 }
1374 
1375 /***** Unittests *****/
1376 
1377 #ifdef UNITTESTS
1378 #include "pkt-var.h"
1379 #include "stream-tcp-util.h"
1380 #include "stream.h"
1381 #include "util-unittest.h"
1382 
1383 #define TEST_START \
1384  Packet *p = PacketGetFromAlloc(); \
1385  FAIL_IF_NULL(p); \
1386  Flow f; \
1387  ThreadVars tv; \
1388  StreamTcpThread *stt = NULL; \
1389  TCPHdr tcph; \
1390  PacketQueueNoLock pq; \
1391  memset(&pq, 0, sizeof(PacketQueueNoLock)); \
1392  memset(&f, 0, sizeof(Flow)); \
1393  memset(&tv, 0, sizeof(ThreadVars)); \
1394  memset(&tcph, 0, sizeof(TCPHdr)); \
1395  \
1396  FLOW_INITIALIZE(&f); \
1397  f.flags = FLOW_IPV4; \
1398  f.proto = IPPROTO_TCP; \
1399  p->flow = &f; \
1400  PacketSetTCP(p, (uint8_t *)&tcph); \
1401  \
1402  StreamTcpInitConfig(true); \
1403  IPPairInitConfig(true); \
1404  StreamTcpThreadInit(&tv, NULL, (void **)&stt); \
1405  \
1406  /* handshake */ \
1407  tcph.th_win = htons(5480); \
1408  tcph.th_flags = TH_SYN; \
1409  p->flowflags = FLOW_PKT_TOSERVER; \
1410  p->payload_len = 0; \
1411  p->payload = NULL; \
1412  FAIL_IF(StreamTcpPacket(&tv, p, stt, &pq) == -1); \
1413  TcpSession *ssn = (TcpSession *)f.protoctx; \
1414  \
1415  FAIL_IF(StreamTcpIsSetStreamFlagAppProtoDetectionCompleted(&ssn->server)); \
1416  FAIL_IF(StreamTcpIsSetStreamFlagAppProtoDetectionCompleted(&ssn->client)); \
1417  FAIL_IF(f.alproto != ALPROTO_UNKNOWN); \
1418  FAIL_IF(f.alproto_ts != ALPROTO_UNKNOWN); \
1419  FAIL_IF(f.alproto_tc != ALPROTO_UNKNOWN); \
1420  FAIL_IF(ssn->flags &STREAMTCP_FLAG_APP_LAYER_DISABLED); \
1421  FAIL_IF(FLOW_IS_PM_DONE(&f, STREAM_TOSERVER)); \
1422  FAIL_IF(FLOW_IS_PP_DONE(&f, STREAM_TOSERVER)); \
1423  FAIL_IF(FLOW_IS_PM_DONE(&f, STREAM_TOCLIENT)); \
1424  FAIL_IF(FLOW_IS_PP_DONE(&f, STREAM_TOCLIENT)); \
1425  FAIL_IF(ssn->data_first_seen_dir != 0); \
1426  \
1427  /* handshake */ \
1428  tcph.th_ack = htonl(1); \
1429  tcph.th_flags = TH_SYN | TH_ACK; \
1430  p->flowflags = FLOW_PKT_TOCLIENT; \
1431  p->payload_len = 0; \
1432  p->payload = NULL; \
1433  FAIL_IF(StreamTcpPacket(&tv, p, stt, &pq) == -1); \
1434  FAIL_IF(StreamTcpIsSetStreamFlagAppProtoDetectionCompleted(&ssn->server)); \
1435  FAIL_IF(StreamTcpIsSetStreamFlagAppProtoDetectionCompleted(&ssn->client)); \
1436  FAIL_IF(f.alproto != ALPROTO_UNKNOWN); \
1437  FAIL_IF(f.alproto_ts != ALPROTO_UNKNOWN); \
1438  FAIL_IF(f.alproto_tc != ALPROTO_UNKNOWN); \
1439  FAIL_IF(ssn->flags &STREAMTCP_FLAG_APP_LAYER_DISABLED); \
1440  FAIL_IF(FLOW_IS_PM_DONE(&f, STREAM_TOSERVER)); \
1441  FAIL_IF(FLOW_IS_PP_DONE(&f, STREAM_TOSERVER)); \
1442  FAIL_IF(FLOW_IS_PM_DONE(&f, STREAM_TOCLIENT)); \
1443  FAIL_IF(FLOW_IS_PP_DONE(&f, STREAM_TOCLIENT)); \
1444  FAIL_IF(ssn->data_first_seen_dir != 0); \
1445  \
1446  /* handshake */ \
1447  tcph.th_ack = htonl(1); \
1448  tcph.th_seq = htonl(1); \
1449  tcph.th_flags = TH_ACK; \
1450  p->flowflags = FLOW_PKT_TOSERVER; \
1451  p->payload_len = 0; \
1452  p->payload = NULL; \
1453  FAIL_IF(StreamTcpPacket(&tv, p, stt, &pq) == -1); \
1454  FAIL_IF(StreamTcpIsSetStreamFlagAppProtoDetectionCompleted(&ssn->server)); \
1455  FAIL_IF(StreamTcpIsSetStreamFlagAppProtoDetectionCompleted(&ssn->client)); \
1456  FAIL_IF(f.alproto != ALPROTO_UNKNOWN); \
1457  FAIL_IF(f.alproto_ts != ALPROTO_UNKNOWN); \
1458  FAIL_IF(f.alproto_tc != ALPROTO_UNKNOWN); \
1459  FAIL_IF(ssn->flags &STREAMTCP_FLAG_APP_LAYER_DISABLED); \
1460  FAIL_IF(FLOW_IS_PM_DONE(&f, STREAM_TOSERVER)); \
1461  FAIL_IF(FLOW_IS_PP_DONE(&f, STREAM_TOSERVER)); \
1462  FAIL_IF(FLOW_IS_PM_DONE(&f, STREAM_TOCLIENT)); \
1463  FAIL_IF(FLOW_IS_PP_DONE(&f, STREAM_TOCLIENT)); \
1464  FAIL_IF(ssn->data_first_seen_dir != 0);
1465 #define TEST_END \
1466  StreamTcpSessionClear(p->flow->protoctx); \
1467  StreamTcpThreadDeinit(&tv, (void *)stt); \
1468  StreamTcpFreeConfig(true); \
1469  PacketFree(p); \
1470  FLOW_DESTROY(&f); \
1471  StatsThreadCleanup(&tv);
1472 
1473 /**
1474  * \test GET -> HTTP/1.1
1475  */
1476 static int AppLayerTest01(void)
1477 {
1478  TEST_START;
1479 
1480  /* full request */
1481  uint8_t request[] = {
1482  0x47, 0x45, 0x54, 0x20, 0x2f, 0x69, 0x6e, 0x64,
1483  0x65, 0x78, 0x2e, 0x68, 0x74, 0x6d, 0x6c, 0x20,
1484  0x48, 0x54, 0x54, 0x50, 0x2f, 0x31, 0x2e, 0x30,
1485  0x0d, 0x0a, 0x48, 0x6f, 0x73, 0x74, 0x3a, 0x20,
1486  0x6c, 0x6f, 0x63, 0x61, 0x6c, 0x68, 0x6f, 0x73,
1487  0x74, 0x0d, 0x0a, 0x55, 0x73, 0x65, 0x72, 0x2d,
1488  0x41, 0x67, 0x65, 0x6e, 0x74, 0x3a, 0x20, 0x41,
1489  0x70, 0x61, 0x63, 0x68, 0x65, 0x42, 0x65, 0x6e,
1490  0x63, 0x68, 0x2f, 0x32, 0x2e, 0x33, 0x0d, 0x0a,
1491  0x41, 0x63, 0x63, 0x65, 0x70, 0x74, 0x3a, 0x20,
1492  0x2a, 0x2f, 0x2a, 0x0d, 0x0a, 0x0d, 0x0a };
1493  tcph.th_ack = htonl(1);
1494  tcph.th_seq = htonl(1);
1495  tcph.th_flags = TH_PUSH | TH_ACK;
1497  p->payload_len = sizeof(request);
1498  p->payload = request;
1499  FAIL_IF(StreamTcpPacket(&tv, p, stt, &pq) == -1);
1506  FAIL_IF(FLOW_IS_PM_DONE(&f, STREAM_TOSERVER));
1507  FAIL_IF(FLOW_IS_PP_DONE(&f, STREAM_TOSERVER));
1508  FAIL_IF(FLOW_IS_PM_DONE(&f, STREAM_TOCLIENT));
1509  FAIL_IF(FLOW_IS_PP_DONE(&f, STREAM_TOCLIENT));
1510  FAIL_IF(ssn->data_first_seen_dir != STREAM_TOSERVER);
1511 
1512  /* full response - request ack */
1513  uint8_t response[] = {
1514  0x48, 0x54, 0x54, 0x50, 0x2f, 0x31, 0x2e, 0x31,
1515  0x20, 0x32, 0x30, 0x30, 0x20, 0x4f, 0x4b, 0x0d,
1516  0x0a, 0x44, 0x61, 0x74, 0x65, 0x3a, 0x20, 0x46,
1517  0x72, 0x69, 0x2c, 0x20, 0x32, 0x33, 0x20, 0x53,
1518  0x65, 0x70, 0x20, 0x32, 0x30, 0x31, 0x31, 0x20,
1519  0x30, 0x36, 0x3a, 0x32, 0x39, 0x3a, 0x33, 0x39,
1520  0x20, 0x47, 0x4d, 0x54, 0x0d, 0x0a, 0x53, 0x65,
1521  0x72, 0x76, 0x65, 0x72, 0x3a, 0x20, 0x41, 0x70,
1522  0x61, 0x63, 0x68, 0x65, 0x2f, 0x32, 0x2e, 0x32,
1523  0x2e, 0x31, 0x35, 0x20, 0x28, 0x55, 0x6e, 0x69,
1524  0x78, 0x29, 0x20, 0x44, 0x41, 0x56, 0x2f, 0x32,
1525  0x0d, 0x0a, 0x4c, 0x61, 0x73, 0x74, 0x2d, 0x4d,
1526  0x6f, 0x64, 0x69, 0x66, 0x69, 0x65, 0x64, 0x3a,
1527  0x20, 0x54, 0x68, 0x75, 0x2c, 0x20, 0x30, 0x34,
1528  0x20, 0x4e, 0x6f, 0x76, 0x20, 0x32, 0x30, 0x31,
1529  0x30, 0x20, 0x31, 0x35, 0x3a, 0x30, 0x34, 0x3a,
1530  0x34, 0x36, 0x20, 0x47, 0x4d, 0x54, 0x0d, 0x0a,
1531  0x45, 0x54, 0x61, 0x67, 0x3a, 0x20, 0x22, 0x61,
1532  0x62, 0x38, 0x39, 0x36, 0x35, 0x2d, 0x32, 0x63,
1533  0x2d, 0x34, 0x39, 0x34, 0x33, 0x62, 0x37, 0x61,
1534  0x37, 0x66, 0x37, 0x66, 0x38, 0x30, 0x22, 0x0d,
1535  0x0a, 0x41, 0x63, 0x63, 0x65, 0x70, 0x74, 0x2d,
1536  0x52, 0x61, 0x6e, 0x67, 0x65, 0x73, 0x3a, 0x20,
1537  0x62, 0x79, 0x74, 0x65, 0x73, 0x0d, 0x0a, 0x43,
1538  0x6f, 0x6e, 0x74, 0x65, 0x6e, 0x74, 0x2d, 0x4c,
1539  0x65, 0x6e, 0x67, 0x74, 0x68, 0x3a, 0x20, 0x34,
1540  0x34, 0x0d, 0x0a, 0x43, 0x6f, 0x6e, 0x6e, 0x65,
1541  0x63, 0x74, 0x69, 0x6f, 0x6e, 0x3a, 0x20, 0x63,
1542  0x6c, 0x6f, 0x73, 0x65, 0x0d, 0x0a, 0x43, 0x6f,
1543  0x6e, 0x74, 0x65, 0x6e, 0x74, 0x2d, 0x54, 0x79,
1544  0x70, 0x65, 0x3a, 0x20, 0x74, 0x65, 0x78, 0x74,
1545  0x2f, 0x68, 0x74, 0x6d, 0x6c, 0x0d, 0x0a, 0x58,
1546  0x2d, 0x50, 0x61, 0x64, 0x3a, 0x20, 0x61, 0x76,
1547  0x6f, 0x69, 0x64, 0x20, 0x62, 0x72, 0x6f, 0x77,
1548  0x73, 0x65, 0x72, 0x20, 0x62, 0x75, 0x67, 0x0d,
1549  0x0a, 0x0d, 0x0a, 0x3c, 0x68, 0x74, 0x6d, 0x6c,
1550  0x3e, 0x3c, 0x62, 0x6f, 0x64, 0x79, 0x3e, 0x3c,
1551  0x68, 0x31, 0x3e, 0x49, 0x74, 0x20, 0x77, 0x6f,
1552  0x72, 0x6b, 0x73, 0x21, 0x3c, 0x2f, 0x68, 0x31,
1553  0x3e, 0x3c, 0x2f, 0x62, 0x6f, 0x64, 0x79, 0x3e,
1554  0x3c, 0x2f, 0x68, 0x74, 0x6d, 0x6c, 0x3e };
1555  tcph.th_ack = htonl(88);
1556  tcph.th_seq = htonl(1);
1557  tcph.th_flags = TH_PUSH | TH_ACK;
1559  p->payload_len = sizeof(response);
1560  p->payload = response;
1561  FAIL_IF(StreamTcpPacket(&tv, p, stt, &pq) == -1);
1568  FAIL_IF(!FLOW_IS_PM_DONE(&f, STREAM_TOSERVER));
1569  FAIL_IF(FLOW_IS_PP_DONE(&f, STREAM_TOSERVER));
1570  FAIL_IF(FLOW_IS_PM_DONE(&f, STREAM_TOCLIENT));
1571  FAIL_IF(FLOW_IS_PP_DONE(&f, STREAM_TOCLIENT));
1573 
1574  /* response ack */
1575  tcph.th_ack = htonl(328);
1576  tcph.th_seq = htonl(88);
1577  tcph.th_flags = TH_ACK;
1579  p->payload_len = 0;
1580  p->payload = NULL;
1581  FAIL_IF(StreamTcpPacket(&tv, p, stt, &pq) == -1);
1588  FAIL_IF(!FLOW_IS_PM_DONE(&f, STREAM_TOSERVER));
1589  FAIL_IF(FLOW_IS_PP_DONE(&f, STREAM_TOSERVER));
1590  FAIL_IF(!FLOW_IS_PM_DONE(&f, STREAM_TOCLIENT));
1591  FAIL_IF(FLOW_IS_PP_DONE(&f, STREAM_TOCLIENT));
1593 
1594  TEST_END;
1595  PASS;
1596 }
1597 
1598 /**
1599  * \test GE -> T -> HTTP/1.1
1600  */
1601 static int AppLayerTest02(void)
1602 {
1603  TEST_START;
1604 
1605  /* partial request */
1606  uint8_t request1[] = { 0x47, 0x45, };
1607  tcph.th_ack = htonl(1);
1608  tcph.th_seq = htonl(1);
1609  tcph.th_flags = TH_PUSH | TH_ACK;
1611  p->payload_len = sizeof(request1);
1612  p->payload = request1;
1613  FAIL_IF(StreamTcpPacket(&tv, p, stt, &pq) == -1);
1620  FAIL_IF(FLOW_IS_PM_DONE(&f, STREAM_TOSERVER));
1621  FAIL_IF(FLOW_IS_PP_DONE(&f, STREAM_TOSERVER));
1622  FAIL_IF(FLOW_IS_PM_DONE(&f, STREAM_TOCLIENT));
1623  FAIL_IF(FLOW_IS_PP_DONE(&f, STREAM_TOCLIENT));
1624  FAIL_IF(ssn->data_first_seen_dir != STREAM_TOSERVER);
1625 
1626  /* response ack against partial request */
1627  tcph.th_ack = htonl(3);
1628  tcph.th_seq = htonl(1);
1629  tcph.th_flags = TH_ACK;
1631  p->payload_len = 0;
1632  p->payload = NULL;
1633  FAIL_IF(StreamTcpPacket(&tv, p, stt, &pq) == -1);
1640  FAIL_IF(FLOW_IS_PM_DONE(&f, STREAM_TOSERVER));
1641  FAIL_IF(!FLOW_IS_PP_DONE(&f, STREAM_TOSERVER));
1642  FAIL_IF(FLOW_IS_PM_DONE(&f, STREAM_TOCLIENT));
1643  FAIL_IF(FLOW_IS_PP_DONE(&f, STREAM_TOCLIENT));
1644  FAIL_IF(ssn->data_first_seen_dir != STREAM_TOSERVER);
1645 
1646  /* complete partial request */
1647  uint8_t request2[] = {
1648  0x54, 0x20, 0x2f, 0x69, 0x6e, 0x64,
1649  0x65, 0x78, 0x2e, 0x68, 0x74, 0x6d, 0x6c, 0x20,
1650  0x48, 0x54, 0x54, 0x50, 0x2f, 0x31, 0x2e, 0x30,
1651  0x0d, 0x0a, 0x48, 0x6f, 0x73, 0x74, 0x3a, 0x20,
1652  0x6c, 0x6f, 0x63, 0x61, 0x6c, 0x68, 0x6f, 0x73,
1653  0x74, 0x0d, 0x0a, 0x55, 0x73, 0x65, 0x72, 0x2d,
1654  0x41, 0x67, 0x65, 0x6e, 0x74, 0x3a, 0x20, 0x41,
1655  0x70, 0x61, 0x63, 0x68, 0x65, 0x42, 0x65, 0x6e,
1656  0x63, 0x68, 0x2f, 0x32, 0x2e, 0x33, 0x0d, 0x0a,
1657  0x41, 0x63, 0x63, 0x65, 0x70, 0x74, 0x3a, 0x20,
1658  0x2a, 0x2f, 0x2a, 0x0d, 0x0a, 0x0d, 0x0a };
1659  tcph.th_ack = htonl(1);
1660  tcph.th_seq = htonl(3);
1661  tcph.th_flags = TH_PUSH | TH_ACK;
1663  p->payload_len = sizeof(request2);
1664  p->payload = request2;
1665  FAIL_IF(StreamTcpPacket(&tv, p, stt, &pq) == -1);
1672  FAIL_IF(FLOW_IS_PM_DONE(&f, STREAM_TOSERVER));
1673  FAIL_IF(!FLOW_IS_PP_DONE(&f, STREAM_TOSERVER));
1674  FAIL_IF(FLOW_IS_PM_DONE(&f, STREAM_TOCLIENT));
1675  FAIL_IF(FLOW_IS_PP_DONE(&f, STREAM_TOCLIENT));
1676  FAIL_IF(ssn->data_first_seen_dir != STREAM_TOSERVER);
1677 
1678  /* response - request ack */
1679  uint8_t response[] = {
1680  0x48, 0x54, 0x54, 0x50, 0x2f, 0x31, 0x2e, 0x31,
1681  0x20, 0x32, 0x30, 0x30, 0x20, 0x4f, 0x4b, 0x0d,
1682  0x0a, 0x44, 0x61, 0x74, 0x65, 0x3a, 0x20, 0x46,
1683  0x72, 0x69, 0x2c, 0x20, 0x32, 0x33, 0x20, 0x53,
1684  0x65, 0x70, 0x20, 0x32, 0x30, 0x31, 0x31, 0x20,
1685  0x30, 0x36, 0x3a, 0x32, 0x39, 0x3a, 0x33, 0x39,
1686  0x20, 0x47, 0x4d, 0x54, 0x0d, 0x0a, 0x53, 0x65,
1687  0x72, 0x76, 0x65, 0x72, 0x3a, 0x20, 0x41, 0x70,
1688  0x61, 0x63, 0x68, 0x65, 0x2f, 0x32, 0x2e, 0x32,
1689  0x2e, 0x31, 0x35, 0x20, 0x28, 0x55, 0x6e, 0x69,
1690  0x78, 0x29, 0x20, 0x44, 0x41, 0x56, 0x2f, 0x32,
1691  0x0d, 0x0a, 0x4c, 0x61, 0x73, 0x74, 0x2d, 0x4d,
1692  0x6f, 0x64, 0x69, 0x66, 0x69, 0x65, 0x64, 0x3a,
1693  0x20, 0x54, 0x68, 0x75, 0x2c, 0x20, 0x30, 0x34,
1694  0x20, 0x4e, 0x6f, 0x76, 0x20, 0x32, 0x30, 0x31,
1695  0x30, 0x20, 0x31, 0x35, 0x3a, 0x30, 0x34, 0x3a,
1696  0x34, 0x36, 0x20, 0x47, 0x4d, 0x54, 0x0d, 0x0a,
1697  0x45, 0x54, 0x61, 0x67, 0x3a, 0x20, 0x22, 0x61,
1698  0x62, 0x38, 0x39, 0x36, 0x35, 0x2d, 0x32, 0x63,
1699  0x2d, 0x34, 0x39, 0x34, 0x33, 0x62, 0x37, 0x61,
1700  0x37, 0x66, 0x37, 0x66, 0x38, 0x30, 0x22, 0x0d,
1701  0x0a, 0x41, 0x63, 0x63, 0x65, 0x70, 0x74, 0x2d,
1702  0x52, 0x61, 0x6e, 0x67, 0x65, 0x73, 0x3a, 0x20,
1703  0x62, 0x79, 0x74, 0x65, 0x73, 0x0d, 0x0a, 0x43,
1704  0x6f, 0x6e, 0x74, 0x65, 0x6e, 0x74, 0x2d, 0x4c,
1705  0x65, 0x6e, 0x67, 0x74, 0x68, 0x3a, 0x20, 0x34,
1706  0x34, 0x0d, 0x0a, 0x43, 0x6f, 0x6e, 0x6e, 0x65,
1707  0x63, 0x74, 0x69, 0x6f, 0x6e, 0x3a, 0x20, 0x63,
1708  0x6c, 0x6f, 0x73, 0x65, 0x0d, 0x0a, 0x43, 0x6f,
1709  0x6e, 0x74, 0x65, 0x6e, 0x74, 0x2d, 0x54, 0x79,
1710  0x70, 0x65, 0x3a, 0x20, 0x74, 0x65, 0x78, 0x74,
1711  0x2f, 0x68, 0x74, 0x6d, 0x6c, 0x0d, 0x0a, 0x58,
1712  0x2d, 0x50, 0x61, 0x64, 0x3a, 0x20, 0x61, 0x76,
1713  0x6f, 0x69, 0x64, 0x20, 0x62, 0x72, 0x6f, 0x77,
1714  0x73, 0x65, 0x72, 0x20, 0x62, 0x75, 0x67, 0x0d,
1715  0x0a, 0x0d, 0x0a, 0x3c, 0x68, 0x74, 0x6d, 0x6c,
1716  0x3e, 0x3c, 0x62, 0x6f, 0x64, 0x79, 0x3e, 0x3c,
1717  0x68, 0x31, 0x3e, 0x49, 0x74, 0x20, 0x77, 0x6f,
1718  0x72, 0x6b, 0x73, 0x21, 0x3c, 0x2f, 0x68, 0x31,
1719  0x3e, 0x3c, 0x2f, 0x62, 0x6f, 0x64, 0x79, 0x3e,
1720  0x3c, 0x2f, 0x68, 0x74, 0x6d, 0x6c, 0x3e };
1721  tcph.th_ack = htonl(88);
1722  tcph.th_seq = htonl(1);
1723  tcph.th_flags = TH_PUSH | TH_ACK;
1725  p->payload_len = sizeof(response);
1726  p->payload = response;
1727  FAIL_IF(StreamTcpPacket(&tv, p, stt, &pq) == -1);
1734  FAIL_IF(!FLOW_IS_PM_DONE(&f, STREAM_TOSERVER));
1735  FAIL_IF(!FLOW_IS_PP_DONE(&f, STREAM_TOSERVER));
1736  FAIL_IF(FLOW_IS_PM_DONE(&f, STREAM_TOCLIENT));
1737  FAIL_IF(FLOW_IS_PP_DONE(&f, STREAM_TOCLIENT));
1739 
1740  /* response ack */
1741  tcph.th_ack = htonl(328);
1742  tcph.th_seq = htonl(88);
1743  tcph.th_flags = TH_ACK;
1745  p->payload_len = 0;
1746  p->payload = NULL;
1747  FAIL_IF(StreamTcpPacket(&tv, p, stt, &pq) == -1);
1754  FAIL_IF(!FLOW_IS_PM_DONE(&f, STREAM_TOSERVER));
1755  FAIL_IF(!FLOW_IS_PP_DONE(&f, STREAM_TOSERVER));
1756  FAIL_IF(!FLOW_IS_PM_DONE(&f, STREAM_TOCLIENT));
1757  FAIL_IF(FLOW_IS_PP_DONE(&f, STREAM_TOCLIENT));
1759 
1760  TEST_END;
1761  PASS;
1762 }
1763 
1764 /**
1765  * \test GET -> RUBBISH(PM AND PP DONE IN ONE GO)
1766  */
1767 static int AppLayerTest03(void)
1768 {
1769  TEST_START;
1770 
1771  /* request */
1772  uint8_t request[] = {
1773  0x47, 0x45, 0x54, 0x20, 0x2f, 0x69, 0x6e, 0x64,
1774  0x65, 0x78, 0x2e, 0x68, 0x74, 0x6d, 0x6c, 0x20,
1775  0x48, 0x54, 0x54, 0x50, 0x2f, 0x31, 0x2e, 0x30,
1776  0x0d, 0x0a, 0x48, 0x6f, 0x73, 0x74, 0x3a, 0x20,
1777  0x6c, 0x6f, 0x63, 0x61, 0x6c, 0x68, 0x6f, 0x73,
1778  0x74, 0x0d, 0x0a, 0x55, 0x73, 0x65, 0x72, 0x2d,
1779  0x41, 0x67, 0x65, 0x6e, 0x74, 0x3a, 0x20, 0x41,
1780  0x70, 0x61, 0x63, 0x68, 0x65, 0x42, 0x65, 0x6e,
1781  0x63, 0x68, 0x2f, 0x32, 0x2e, 0x33, 0x0d, 0x0a,
1782  0x41, 0x63, 0x63, 0x65, 0x70, 0x74, 0x3a, 0x20,
1783  0x2a, 0x2f, 0x2a, 0x0d, 0x0a, 0x0d, 0x0a };
1784  tcph.th_ack = htonl(1);
1785  tcph.th_seq = htonl(1);
1786  tcph.th_flags = TH_PUSH | TH_ACK;
1788  p->payload_len = sizeof(request);
1789  p->payload = request;
1790  FAIL_IF(StreamTcpPacket(&tv, p, stt, &pq) == -1);
1797  FAIL_IF(FLOW_IS_PM_DONE(&f, STREAM_TOSERVER));
1798  FAIL_IF(FLOW_IS_PP_DONE(&f, STREAM_TOSERVER));
1799  FAIL_IF(FLOW_IS_PM_DONE(&f, STREAM_TOCLIENT));
1800  FAIL_IF(FLOW_IS_PP_DONE(&f, STREAM_TOCLIENT));
1801  FAIL_IF(ssn->data_first_seen_dir != STREAM_TOSERVER);
1802 
1803  /* rubbish response */
1804  uint8_t response[] = {
1805  0x58, 0x54, 0x54, 0x50, 0x2f, 0x31, 0x2e, 0x31,
1806  0x20, 0x32, 0x30, 0x30, 0x20, 0x4f, 0x4b, 0x0d,
1807  0x0a, 0x44, 0x61, 0x74, 0x65, 0x3a, 0x20, 0x46,
1808  0x72, 0x69, 0x2c, 0x20, 0x32, 0x33, 0x20, 0x53,
1809  0x65, 0x70, 0x20, 0x32, 0x30, 0x31, 0x31, 0x20,
1810  0x30, 0x36, 0x3a, 0x32, 0x39, 0x3a, 0x33, 0x39,
1811  0x20, 0x47, 0x4d, 0x54, 0x0d, 0x0a, 0x53, 0x65,
1812  0x72, 0x76, 0x65, 0x72, 0x3a, 0x20, 0x41, 0x70,
1813  0x61, 0x63, 0x68, 0x65, 0x2f, 0x32, 0x2e, 0x32,
1814  0x2e, 0x31, 0x35, 0x20, 0x28, 0x55, 0x6e, 0x69,
1815  0x78, 0x29, 0x20, 0x44, 0x41, 0x56, 0x2f, 0x32,
1816  0x0d, 0x0a, 0x4c, 0x61, 0x73, 0x74, 0x2d, 0x4d,
1817  0x6f, 0x64, 0x69, 0x66, 0x69, 0x65, 0x64, 0x3a,
1818  0x20, 0x54, 0x68, 0x75, 0x2c, 0x20, 0x30, 0x34,
1819  0x20, 0x4e, 0x6f, 0x76, 0x20, 0x32, 0x30, 0x31,
1820  0x30, 0x20, 0x31, 0x35, 0x3a, 0x30, 0x34, 0x3a,
1821  0x34, 0x36, 0x20, 0x47, 0x4d, 0x54, 0x0d, 0x0a,
1822  0x45, 0x54, 0x61, 0x67, 0x3a, 0x20, 0x22, 0x61,
1823  0x62, 0x38, 0x39, 0x36, 0x35, 0x2d, 0x32, 0x63,
1824  0x2d, 0x34, 0x39, 0x34, 0x33, 0x62, 0x37, 0x61,
1825  0x37, 0x66, 0x37, 0x66, 0x38, 0x30, 0x22, 0x0d,
1826  0x0a, 0x41, 0x63, 0x63, 0x65, 0x70, 0x74, 0x2d,
1827  0x52, 0x61, 0x6e, 0x67, 0x65, 0x73, 0x3a, 0x20,
1828  0x62, 0x79, 0x74, 0x65, 0x73, 0x0d, 0x0a, 0x43,
1829  0x6f, 0x6e, 0x74, 0x65, 0x6e, 0x74, 0x2d, 0x4c,
1830  0x65, 0x6e, 0x67, 0x74, 0x68, 0x3a, 0x20, 0x34,
1831  0x34, 0x0d, 0x0a, 0x43, 0x6f, 0x6e, 0x6e, 0x65,
1832  0x63, 0x74, 0x69, 0x6f, 0x6e, 0x3a, 0x20, 0x63,
1833  0x6c, 0x6f, 0x73, 0x65, 0x0d, 0x0a, 0x43, 0x6f,
1834  0x6e, 0x74, 0x65, 0x6e, 0x74, 0x2d, 0x54, 0x79,
1835  0x70, 0x65, 0x3a, 0x20, 0x74, 0x65, 0x78, 0x74,
1836  0x2f, 0x68, 0x74, 0x6d, 0x6c, 0x0d, 0x0a, 0x58,
1837  0x2d, 0x50, 0x61, 0x64, 0x3a, 0x20, 0x61, 0x76,
1838  0x6f, 0x69, 0x64, 0x20, 0x62, 0x72, 0x6f, 0x77,
1839  0x73, 0x65, 0x72, 0x20, 0x62, 0x75, 0x67, 0x0d,
1840  0x0a, 0x0d, 0x0a, 0x3c, 0x68, 0x74, 0x6d, 0x6c,
1841  0x3e, 0x3c, 0x62, 0x6f, 0x64, 0x79, 0x3e, 0x3c,
1842  0x68, 0x31, 0x3e, 0x49, 0x74, 0x20, 0x77, 0x6f,
1843  0x72, 0x6b, 0x73, 0x21, 0x3c, 0x2f, 0x68, 0x31,
1844  0x3e, 0x3c, 0x2f, 0x62, 0x6f, 0x64, 0x79, 0x3e,
1845  0x3c, 0x2f, 0x68, 0x74, 0x6d, 0x6c, 0x3e };
1846  tcph.th_ack = htonl(88);
1847  tcph.th_seq = htonl(1);
1848  tcph.th_flags = TH_PUSH | TH_ACK;
1850  p->payload_len = sizeof(response);
1851  p->payload = response;
1852  FAIL_IF(StreamTcpPacket(&tv, p, stt, &pq) == -1);
1859  FAIL_IF(!FLOW_IS_PM_DONE(&f, STREAM_TOSERVER));
1860  FAIL_IF(FLOW_IS_PP_DONE(&f, STREAM_TOSERVER));
1861  FAIL_IF(FLOW_IS_PM_DONE(&f, STREAM_TOCLIENT));
1862  FAIL_IF(FLOW_IS_PP_DONE(&f, STREAM_TOCLIENT));
1864 
1865  /* response ack */
1866  tcph.th_ack = htonl(328);
1867  tcph.th_seq = htonl(88);
1868  tcph.th_flags = TH_ACK;
1870  p->payload_len = 0;
1871  p->payload = NULL;
1872  FAIL_IF(StreamTcpPacket(&tv, p, stt, &pq) == -1);
1879  FAIL_IF(!FLOW_IS_PM_DONE(&f, STREAM_TOSERVER));
1880  FAIL_IF(FLOW_IS_PP_DONE(&f, STREAM_TOSERVER));
1881  FAIL_IF(!FLOW_IS_PM_DONE(&f, STREAM_TOCLIENT));
1882  FAIL_IF(!FLOW_IS_PP_DONE(&f, STREAM_TOCLIENT));
1884 
1885  TEST_END;
1886  PASS;
1887 }
1888 
1889 /**
1890  * \test GE -> RUBBISH(TC - PM AND PP NOT DONE) -> RUBBISH(TC - PM AND PP DONE).
1891  */
1892 static int AppLayerTest04(void)
1893 {
1894  TEST_START;
1895 
1896  /* request */
1897  uint8_t request[] = {
1898  0x47, 0x45, 0x54, 0x20, 0x2f, 0x69, 0x6e, 0x64,
1899  0x65, 0x78, 0x2e, 0x68, 0x74, 0x6d, 0x6c, 0x20,
1900  0x48, 0x54, 0x54, 0x50, 0x2f, 0x31, 0x2e, 0x30,
1901  0x0d, 0x0a, 0x48, 0x6f, 0x73, 0x74, 0x3a, 0x20,
1902  0x6c, 0x6f, 0x63, 0x61, 0x6c, 0x68, 0x6f, 0x73,
1903  0x74, 0x0d, 0x0a, 0x55, 0x73, 0x65, 0x72, 0x2d,
1904  0x41, 0x67, 0x65, 0x6e, 0x74, 0x3a, 0x20, 0x41,
1905  0x70, 0x61, 0x63, 0x68, 0x65, 0x42, 0x65, 0x6e,
1906  0x63, 0x68, 0x2f, 0x32, 0x2e, 0x33, 0x0d, 0x0a,
1907  0x41, 0x63, 0x63, 0x65, 0x70, 0x74, 0x3a, 0x20,
1908  0x2a, 0x2f, 0x2a, 0x0d, 0x0a, 0x0d, 0x0a };
1909  PrintRawDataFp(stdout, request, sizeof(request));
1910  tcph.th_ack = htonl(1);
1911  tcph.th_seq = htonl(1);
1912  tcph.th_flags = TH_PUSH | TH_ACK;
1914  p->payload_len = sizeof(request);
1915  p->payload = request;
1916  FAIL_IF(StreamTcpPacket(&tv, p, stt, &pq) == -1);
1923  FAIL_IF(FLOW_IS_PM_DONE(&f, STREAM_TOSERVER));
1924  FAIL_IF(FLOW_IS_PP_DONE(&f, STREAM_TOSERVER));
1925  FAIL_IF(FLOW_IS_PM_DONE(&f, STREAM_TOCLIENT));
1926  FAIL_IF(FLOW_IS_PP_DONE(&f, STREAM_TOCLIENT));
1927  FAIL_IF(ssn->data_first_seen_dir != STREAM_TOSERVER); // TOSERVER data now seen
1928 
1929  /* partial response */
1930  uint8_t response1[] = { 0x58, 0x54, 0x54, 0x50, };
1931  PrintRawDataFp(stdout, response1, sizeof(response1));
1932  tcph.th_ack = htonl(88);
1933  tcph.th_seq = htonl(1);
1934  tcph.th_flags = TH_PUSH | TH_ACK;
1936  p->payload_len = sizeof(response1);
1937  p->payload = response1;
1938  FAIL_IF(StreamTcpPacket(&tv, p, stt, &pq) == -1);
1941  FAIL_IF(f.alproto != ALPROTO_HTTP1); // http based on ts
1942  FAIL_IF(f.alproto_ts != ALPROTO_HTTP1); // ts complete
1945  FAIL_IF(!FLOW_IS_PM_DONE(&f, STREAM_TOSERVER));
1946  FAIL_IF(FLOW_IS_PP_DONE(&f, STREAM_TOSERVER));
1947  FAIL_IF(FLOW_IS_PM_DONE(&f, STREAM_TOCLIENT));
1948  FAIL_IF(FLOW_IS_PP_DONE(&f, STREAM_TOCLIENT));
1949  FAIL_IF(ssn->data_first_seen_dir != APP_LAYER_DATA_ALREADY_SENT_TO_APP_LAYER); // first data sent to applayer
1950 
1951  /* partial response ack */
1952  tcph.th_ack = htonl(5);
1953  tcph.th_seq = htonl(88);
1954  tcph.th_flags = TH_ACK;
1956  p->payload_len = 0;
1957  p->payload = NULL;
1958  FAIL_IF(StreamTcpPacket(&tv, p, stt, &pq) == -1);
1961  FAIL_IF(f.alproto != ALPROTO_HTTP1); // http based on ts
1962  FAIL_IF(f.alproto_ts != ALPROTO_HTTP1); // ts complete
1965  FAIL_IF(!FLOW_IS_PM_DONE(&f, STREAM_TOSERVER));
1966  FAIL_IF(FLOW_IS_PP_DONE(&f, STREAM_TOSERVER));
1967  FAIL_IF(FLOW_IS_PM_DONE(&f, STREAM_TOCLIENT));
1968  FAIL_IF(!FLOW_IS_PP_DONE(&f, STREAM_TOCLIENT)); // to client pp got nothing
1969  FAIL_IF(ssn->data_first_seen_dir != APP_LAYER_DATA_ALREADY_SENT_TO_APP_LAYER); // first data sent to applayer
1970 
1971  /* remaining response */
1972  uint8_t response2[] = {
1973  0x2f, 0x31, 0x2e, 0x31,
1974  0x20, 0x32, 0x30, 0x30, 0x20, 0x4f, 0x4b, 0x0d,
1975  0x0a, 0x44, 0x61, 0x74, 0x65, 0x3a, 0x20, 0x46,
1976  0x72, 0x69, 0x2c, 0x20, 0x32, 0x33, 0x20, 0x53,
1977  0x65, 0x70, 0x20, 0x32, 0x30, 0x31, 0x31, 0x20,
1978  0x30, 0x36, 0x3a, 0x32, 0x39, 0x3a, 0x33, 0x39,
1979  0x20, 0x47, 0x4d, 0x54, 0x0d, 0x0a, 0x53, 0x65,
1980  0x72, 0x76, 0x65, 0x72, 0x3a, 0x20, 0x41, 0x70,
1981  0x61, 0x63, 0x68, 0x65, 0x2f, 0x32, 0x2e, 0x32,
1982  0x2e, 0x31, 0x35, 0x20, 0x28, 0x55, 0x6e, 0x69,
1983  0x78, 0x29, 0x20, 0x44, 0x41, 0x56, 0x2f, 0x32,
1984  0x0d, 0x0a, 0x4c, 0x61, 0x73, 0x74, 0x2d, 0x4d,
1985  0x6f, 0x64, 0x69, 0x66, 0x69, 0x65, 0x64, 0x3a,
1986  0x20, 0x54, 0x68, 0x75, 0x2c, 0x20, 0x30, 0x34,
1987  0x20, 0x4e, 0x6f, 0x76, 0x20, 0x32, 0x30, 0x31,
1988  0x30, 0x20, 0x31, 0x35, 0x3a, 0x30, 0x34, 0x3a,
1989  0x34, 0x36, 0x20, 0x47, 0x4d, 0x54, 0x0d, 0x0a,
1990  0x45, 0x54, 0x61, 0x67, 0x3a, 0x20, 0x22, 0x61,
1991  0x62, 0x38, 0x39, 0x36, 0x35, 0x2d, 0x32, 0x63,
1992  0x2d, 0x34, 0x39, 0x34, 0x33, 0x62, 0x37, 0x61,
1993  0x37, 0x66, 0x37, 0x66, 0x38, 0x30, 0x22, 0x0d,
1994  0x0a, 0x41, 0x63, 0x63, 0x65, 0x70, 0x74, 0x2d,
1995  0x52, 0x61, 0x6e, 0x67, 0x65, 0x73, 0x3a, 0x20,
1996  0x62, 0x79, 0x74, 0x65, 0x73, 0x0d, 0x0a, 0x43,
1997  0x6f, 0x6e, 0x74, 0x65, 0x6e, 0x74, 0x2d, 0x4c,
1998  0x65, 0x6e, 0x67, 0x74, 0x68, 0x3a, 0x20, 0x34,
1999  0x34, 0x0d, 0x0a, 0x43, 0x6f, 0x6e, 0x6e, 0x65,
2000  0x63, 0x74, 0x69, 0x6f, 0x6e, 0x3a, 0x20, 0x63,
2001  0x6c, 0x6f, 0x73, 0x65, 0x0d, 0x0a, 0x43, 0x6f,
2002  0x6e, 0x74, 0x65, 0x6e, 0x74, 0x2d, 0x54, 0x79,
2003  0x70, 0x65, 0x3a, 0x20, 0x74, 0x65, 0x78, 0x74,
2004  0x2f, 0x68, 0x74, 0x6d, 0x6c, 0x0d, 0x0a, 0x58,
2005  0x2d, 0x50, 0x61, 0x64, 0x3a, 0x20, 0x61, 0x76,
2006  0x6f, 0x69, 0x64, 0x20, 0x62, 0x72, 0x6f, 0x77,
2007  0x73, 0x65, 0x72, 0x20, 0x62, 0x75, 0x67, 0x0d,
2008  0x0a, 0x0d, 0x0a, 0x3c, 0x68, 0x74, 0x6d, 0x6c,
2009  0x3e, 0x3c, 0x62, 0x6f, 0x64, 0x79, 0x3e, 0x3c,
2010  0x68, 0x31, 0x3e, 0x49, 0x74, 0x20, 0x77, 0x6f,
2011  0x72, 0x6b, 0x73, 0x21, 0x3c, 0x2f, 0x68, 0x31,
2012  0x3e, 0x3c, 0x2f, 0x62, 0x6f, 0x64, 0x79, 0x3e,
2013  0x3c, 0x2f, 0x68, 0x74, 0x6d, 0x6c, 0x3e };
2014  PrintRawDataFp(stdout, response2, sizeof(response2));
2015  tcph.th_ack = htonl(88);
2016  tcph.th_seq = htonl(5);
2017  tcph.th_flags = TH_PUSH | TH_ACK;
2019  p->payload_len = sizeof(response2);
2020  p->payload = response2;
2021  FAIL_IF(StreamTcpPacket(&tv, p, stt, &pq) == -1);
2024  FAIL_IF(f.alproto != ALPROTO_HTTP1); // http based on ts
2025  FAIL_IF(f.alproto_ts != ALPROTO_HTTP1); // ts complete
2028  FAIL_IF(!FLOW_IS_PM_DONE(&f, STREAM_TOSERVER));
2029  FAIL_IF(FLOW_IS_PP_DONE(&f, STREAM_TOSERVER));
2030  FAIL_IF(FLOW_IS_PM_DONE(&f, STREAM_TOCLIENT));
2031  FAIL_IF(!FLOW_IS_PP_DONE(&f, STREAM_TOCLIENT)); // to client pp got nothing
2032  FAIL_IF(ssn->data_first_seen_dir != APP_LAYER_DATA_ALREADY_SENT_TO_APP_LAYER); // first data sent to applayer
2033 
2034  /* response ack */
2035  tcph.th_ack = htonl(328);
2036  tcph.th_seq = htonl(88);
2037  tcph.th_flags = TH_ACK;
2039  p->payload_len = 0;
2040  p->payload = NULL;
2041  FAIL_IF(StreamTcpPacket(&tv, p, stt, &pq) == -1);
2042  FAIL_IF(!StreamTcpIsSetStreamFlagAppProtoDetectionCompleted(&ssn->server)); // toclient complete (failed)
2044  FAIL_IF(f.alproto != ALPROTO_HTTP1); // http based on ts
2045  FAIL_IF(f.alproto_ts != ALPROTO_HTTP1); // ts complete
2046  FAIL_IF(f.alproto_tc != ALPROTO_FAILED); // tc failed
2048  FAIL_IF(!FLOW_IS_PM_DONE(&f, STREAM_TOSERVER));
2049  FAIL_IF(FLOW_IS_PP_DONE(&f, STREAM_TOSERVER));
2050  FAIL_IF(!FLOW_IS_PM_DONE(&f, STREAM_TOCLIENT));
2051  FAIL_IF(!FLOW_IS_PP_DONE(&f, STREAM_TOCLIENT)); // to client pp got nothing
2052  FAIL_IF(ssn->data_first_seen_dir != APP_LAYER_DATA_ALREADY_SENT_TO_APP_LAYER); // first data sent to applayer
2053 
2054  TEST_END;
2055  PASS;
2056 }
2057 
2058 /**
2059  * \test RUBBISH -> HTTP/1.1
2060  */
2061 static int AppLayerTest05(void)
2062 {
2063  TEST_START;
2064 
2065  /* full request */
2066  uint8_t request[] = {
2067  0x48, 0x45, 0x54, 0x20, 0x2f, 0x69, 0x6e, 0x64,
2068  0x65, 0x78, 0x2e, 0x68, 0x74, 0x6d, 0x6c, 0x20,
2069  0x48, 0x54, 0x54, 0x50, 0x2f, 0x31, 0x2e, 0x30,
2070  0x0d, 0x0a, 0x48, 0x6f, 0x73, 0x74, 0x3a, 0x20,
2071  0x6c, 0x6f, 0x63, 0x61, 0x6c, 0x68, 0x6f, 0x73,
2072  0x74, 0x0d, 0x0a, 0x55, 0x73, 0x65, 0x72, 0x2d,
2073  0x41, 0x67, 0x65, 0x6e, 0x74, 0x3a, 0x20, 0x41,
2074  0x70, 0x61, 0x63, 0x68, 0x65, 0x42, 0x65, 0x6e,
2075  0x63, 0x68, 0x2f, 0x32, 0x2e, 0x33, 0x0d, 0x0a,
2076  0x41, 0x63, 0x63, 0x65, 0x70, 0x74, 0x3a, 0x20,
2077  0x2a, 0x2f, 0x2a, 0x0d, 0x0a, 0x0d, 0x0a };
2078  PrintRawDataFp(stdout, request, sizeof(request));
2079  tcph.th_ack = htonl(1);
2080  tcph.th_seq = htonl(1);
2081  tcph.th_flags = TH_PUSH | TH_ACK;
2083  p->payload_len = sizeof(request);
2084  p->payload = request;
2085  FAIL_IF(StreamTcpPacket(&tv, p, stt, &pq) == -1);
2092  FAIL_IF(FLOW_IS_PM_DONE(&f, STREAM_TOSERVER));
2093  FAIL_IF(FLOW_IS_PP_DONE(&f, STREAM_TOSERVER));
2094  FAIL_IF(FLOW_IS_PM_DONE(&f, STREAM_TOCLIENT));
2095  FAIL_IF(FLOW_IS_PP_DONE(&f, STREAM_TOCLIENT));
2096  FAIL_IF(ssn->data_first_seen_dir != STREAM_TOSERVER);
2097 
2098  /* full response - request ack */
2099  uint8_t response[] = {
2100  0x48, 0x54, 0x54, 0x50, 0x2f, 0x31, 0x2e, 0x31,
2101  0x20, 0x32, 0x30, 0x30, 0x20, 0x4f, 0x4b, 0x0d,
2102  0x0a, 0x44, 0x61, 0x74, 0x65, 0x3a, 0x20, 0x46,
2103  0x72, 0x69, 0x2c, 0x20, 0x32, 0x33, 0x20, 0x53,
2104  0x65, 0x70, 0x20, 0x32, 0x30, 0x31, 0x31, 0x20,
2105  0x30, 0x36, 0x3a, 0x32, 0x39, 0x3a, 0x33, 0x39,
2106  0x20, 0x47, 0x4d, 0x54, 0x0d, 0x0a, 0x53, 0x65,
2107  0x72, 0x76, 0x65, 0x72, 0x3a, 0x20, 0x41, 0x70,
2108  0x61, 0x63, 0x68, 0x65, 0x2f, 0x32, 0x2e, 0x32,
2109  0x2e, 0x31, 0x35, 0x20, 0x28, 0x55, 0x6e, 0x69,
2110  0x78, 0x29, 0x20, 0x44, 0x41, 0x56, 0x2f, 0x32,
2111  0x0d, 0x0a, 0x4c, 0x61, 0x73, 0x74, 0x2d, 0x4d,
2112  0x6f, 0x64, 0x69, 0x66, 0x69, 0x65, 0x64, 0x3a,
2113  0x20, 0x54, 0x68, 0x75, 0x2c, 0x20, 0x30, 0x34,
2114  0x20, 0x4e, 0x6f, 0x76, 0x20, 0x32, 0x30, 0x31,
2115  0x30, 0x20, 0x31, 0x35, 0x3a, 0x30, 0x34, 0x3a,
2116  0x34, 0x36, 0x20, 0x47, 0x4d, 0x54, 0x0d, 0x0a,
2117  0x45, 0x54, 0x61, 0x67, 0x3a, 0x20, 0x22, 0x61,
2118  0x62, 0x38, 0x39, 0x36, 0x35, 0x2d, 0x32, 0x63,
2119  0x2d, 0x34, 0x39, 0x34, 0x33, 0x62, 0x37, 0x61,
2120  0x37, 0x66, 0x37, 0x66, 0x38, 0x30, 0x22, 0x0d,
2121  0x0a, 0x41, 0x63, 0x63, 0x65, 0x70, 0x74, 0x2d,
2122  0x52, 0x61, 0x6e, 0x67, 0x65, 0x73, 0x3a, 0x20,
2123  0x62, 0x79, 0x74, 0x65, 0x73, 0x0d, 0x0a, 0x43,
2124  0x6f, 0x6e, 0x74, 0x65, 0x6e, 0x74, 0x2d, 0x4c,
2125  0x65, 0x6e, 0x67, 0x74, 0x68, 0x3a, 0x20, 0x34,
2126  0x34, 0x0d, 0x0a, 0x43, 0x6f, 0x6e, 0x6e, 0x65,
2127  0x63, 0x74, 0x69, 0x6f, 0x6e, 0x3a, 0x20, 0x63,
2128  0x6c, 0x6f, 0x73, 0x65, 0x0d, 0x0a, 0x43, 0x6f,
2129  0x6e, 0x74, 0x65, 0x6e, 0x74, 0x2d, 0x54, 0x79,
2130  0x70, 0x65, 0x3a, 0x20, 0x74, 0x65, 0x78, 0x74,
2131  0x2f, 0x68, 0x74, 0x6d, 0x6c, 0x0d, 0x0a, 0x58,
2132  0x2d, 0x50, 0x61, 0x64, 0x3a, 0x20, 0x61, 0x76,
2133  0x6f, 0x69, 0x64, 0x20, 0x62, 0x72, 0x6f, 0x77,
2134  0x73, 0x65, 0x72, 0x20, 0x62, 0x75, 0x67, 0x0d,
2135  0x0a, 0x0d, 0x0a, 0x3c, 0x68, 0x74, 0x6d, 0x6c,
2136  0x3e, 0x3c, 0x62, 0x6f, 0x64, 0x79, 0x3e, 0x3c,
2137  0x68, 0x31, 0x3e, 0x49, 0x74, 0x20, 0x77, 0x6f,
2138  0x72, 0x6b, 0x73, 0x21, 0x3c, 0x2f, 0x68, 0x31,
2139  0x3e, 0x3c, 0x2f, 0x62, 0x6f, 0x64, 0x79, 0x3e,
2140  0x3c, 0x2f, 0x68, 0x74, 0x6d, 0x6c, 0x3e };
2141  PrintRawDataFp(stdout, response, sizeof(response));
2142  tcph.th_ack = htonl(88);
2143  tcph.th_seq = htonl(1);
2144  tcph.th_flags = TH_PUSH | TH_ACK;
2146  p->payload_len = sizeof(response);
2147  p->payload = response;
2148  FAIL_IF(StreamTcpPacket(&tv, p, stt, &pq) == -1);
2155  FAIL_IF(!FLOW_IS_PM_DONE(&f, STREAM_TOSERVER));
2156  FAIL_IF(!FLOW_IS_PP_DONE(&f, STREAM_TOSERVER));
2157  FAIL_IF(FLOW_IS_PM_DONE(&f, STREAM_TOCLIENT));
2158  FAIL_IF(FLOW_IS_PP_DONE(&f, STREAM_TOCLIENT));
2159  FAIL_IF(ssn->data_first_seen_dir != STREAM_TOSERVER);
2160 
2161  /* response ack */
2162  tcph.th_ack = htonl(328);
2163  tcph.th_seq = htonl(88);
2164  tcph.th_flags = TH_ACK;
2166  p->payload_len = 0;
2167  p->payload = NULL;
2168  FAIL_IF(StreamTcpPacket(&tv, p, stt, &pq) == -1);
2175  FAIL_IF(!FLOW_IS_PM_DONE(&f, STREAM_TOSERVER));
2176  FAIL_IF(!FLOW_IS_PP_DONE(&f, STREAM_TOSERVER));
2177  FAIL_IF(!FLOW_IS_PM_DONE(&f, STREAM_TOCLIENT));
2178  FAIL_IF(FLOW_IS_PP_DONE(&f, STREAM_TOCLIENT));
2180 
2181  TEST_END;
2182  PASS;
2183 }
2184 
2185 /**
2186  * \test HTTP/1.1 -> GET
2187  */
2188 static int AppLayerTest06(void)
2189 {
2190  TEST_START;
2191 
2192  /* full response - request ack */
2193  uint8_t response[] = {
2194  0x48, 0x54, 0x54, 0x50, 0x2f, 0x31, 0x2e, 0x31,
2195  0x20, 0x32, 0x30, 0x30, 0x20, 0x4f, 0x4b, 0x0d,
2196  0x0a, 0x44, 0x61, 0x74, 0x65, 0x3a, 0x20, 0x46,
2197  0x72, 0x69, 0x2c, 0x20, 0x32, 0x33, 0x20, 0x53,
2198  0x65, 0x70, 0x20, 0x32, 0x30, 0x31, 0x31, 0x20,
2199  0x30, 0x36, 0x3a, 0x32, 0x39, 0x3a, 0x33, 0x39,
2200  0x20, 0x47, 0x4d, 0x54, 0x0d, 0x0a, 0x53, 0x65,
2201  0x72, 0x76, 0x65, 0x72, 0x3a, 0x20, 0x41, 0x70,
2202  0x61, 0x63, 0x68, 0x65, 0x2f, 0x32, 0x2e, 0x32,
2203  0x2e, 0x31, 0x35, 0x20, 0x28, 0x55, 0x6e, 0x69,
2204  0x78, 0x29, 0x20, 0x44, 0x41, 0x56, 0x2f, 0x32,
2205  0x0d, 0x0a, 0x4c, 0x61, 0x73, 0x74, 0x2d, 0x4d,
2206  0x6f, 0x64, 0x69, 0x66, 0x69, 0x65, 0x64, 0x3a,
2207  0x20, 0x54, 0x68, 0x75, 0x2c, 0x20, 0x30, 0x34,
2208  0x20, 0x4e, 0x6f, 0x76, 0x20, 0x32, 0x30, 0x31,
2209  0x30, 0x20, 0x31, 0x35, 0x3a, 0x30, 0x34, 0x3a,
2210  0x34, 0x36, 0x20, 0x47, 0x4d, 0x54, 0x0d, 0x0a,
2211  0x45, 0x54, 0x61, 0x67, 0x3a, 0x20, 0x22, 0x61,
2212  0x62, 0x38, 0x39, 0x36, 0x35, 0x2d, 0x32, 0x63,
2213  0x2d, 0x34, 0x39, 0x34, 0x33, 0x62, 0x37, 0x61,
2214  0x37, 0x66, 0x37, 0x66, 0x38, 0x30, 0x22, 0x0d,
2215  0x0a, 0x41, 0x63, 0x63, 0x65, 0x70, 0x74, 0x2d,
2216  0x52, 0x61, 0x6e, 0x67, 0x65, 0x73, 0x3a, 0x20,
2217  0x62, 0x79, 0x74, 0x65, 0x73, 0x0d, 0x0a, 0x43,
2218  0x6f, 0x6e, 0x74, 0x65, 0x6e, 0x74, 0x2d, 0x4c,
2219  0x65, 0x6e, 0x67, 0x74, 0x68, 0x3a, 0x20, 0x34,
2220  0x34, 0x0d, 0x0a, 0x43, 0x6f, 0x6e, 0x6e, 0x65,
2221  0x63, 0x74, 0x69, 0x6f, 0x6e, 0x3a, 0x20, 0x63,
2222  0x6c, 0x6f, 0x73, 0x65, 0x0d, 0x0a, 0x43, 0x6f,
2223  0x6e, 0x74, 0x65, 0x6e, 0x74, 0x2d, 0x54, 0x79,
2224  0x70, 0x65, 0x3a, 0x20, 0x74, 0x65, 0x78, 0x74,
2225  0x2f, 0x68, 0x74, 0x6d, 0x6c, 0x0d, 0x0a, 0x58,
2226  0x2d, 0x50, 0x61, 0x64, 0x3a, 0x20, 0x61, 0x76,
2227  0x6f, 0x69, 0x64, 0x20, 0x62, 0x72, 0x6f, 0x77,
2228  0x73, 0x65, 0x72, 0x20, 0x62, 0x75, 0x67, 0x0d,
2229  0x0a, 0x0d, 0x0a, 0x3c, 0x68, 0x74, 0x6d, 0x6c,
2230  0x3e, 0x3c, 0x62, 0x6f, 0x64, 0x79, 0x3e, 0x3c,
2231  0x68, 0x31, 0x3e, 0x49, 0x74, 0x20, 0x77, 0x6f,
2232  0x72, 0x6b, 0x73, 0x21, 0x3c, 0x2f, 0x68, 0x31,
2233  0x3e, 0x3c, 0x2f, 0x62, 0x6f, 0x64, 0x79, 0x3e,
2234  0x3c, 0x2f, 0x68, 0x74, 0x6d, 0x6c, 0x3e };
2235  tcph.th_ack = htonl(1);
2236  tcph.th_seq = htonl(1);
2237  tcph.th_flags = TH_PUSH | TH_ACK;
2239  p->payload_len = sizeof(response);
2240  p->payload = response;
2241  FAIL_IF(StreamTcpPacket(&tv, p, stt, &pq) == -1);
2248  FAIL_IF(FLOW_IS_PM_DONE(&f, STREAM_TOSERVER));
2249  FAIL_IF(FLOW_IS_PP_DONE(&f, STREAM_TOSERVER));
2250  FAIL_IF(FLOW_IS_PM_DONE(&f, STREAM_TOCLIENT));
2251  FAIL_IF(FLOW_IS_PP_DONE(&f, STREAM_TOCLIENT));
2252  FAIL_IF(ssn->data_first_seen_dir != STREAM_TOCLIENT);
2253 
2254  /* full request - response ack*/
2255  uint8_t request[] = {
2256  0x47, 0x45, 0x54, 0x20, 0x2f, 0x69, 0x6e, 0x64,
2257  0x65, 0x78, 0x2e, 0x68, 0x74, 0x6d, 0x6c, 0x20,
2258  0x48, 0x54, 0x54, 0x50, 0x2f, 0x31, 0x2e, 0x30,
2259  0x0d, 0x0a, 0x48, 0x6f, 0x73, 0x74, 0x3a, 0x20,
2260  0x6c, 0x6f, 0x63, 0x61, 0x6c, 0x68, 0x6f, 0x73,
2261  0x74, 0x0d, 0x0a, 0x55, 0x73, 0x65, 0x72, 0x2d,
2262  0x41, 0x67, 0x65, 0x6e, 0x74, 0x3a, 0x20, 0x41,
2263  0x70, 0x61, 0x63, 0x68, 0x65, 0x42, 0x65, 0x6e,
2264  0x63, 0x68, 0x2f, 0x32, 0x2e, 0x33, 0x0d, 0x0a,
2265  0x41, 0x63, 0x63, 0x65, 0x70, 0x74, 0x3a, 0x20,
2266  0x2a, 0x2f, 0x2a, 0x0d, 0x0a, 0x0d, 0x0a };
2267  tcph.th_ack = htonl(328);
2268  tcph.th_seq = htonl(1);
2269  tcph.th_flags = TH_PUSH | TH_ACK;
2271  p->payload_len = sizeof(request);
2272  p->payload = request;
2273  FAIL_IF(StreamTcpPacket(&tv, p, stt, &pq) == -1);
2280  FAIL_IF(FLOW_IS_PM_DONE(&f, STREAM_TOSERVER));
2281  FAIL_IF(FLOW_IS_PP_DONE(&f, STREAM_TOSERVER));
2282  FAIL_IF(!FLOW_IS_PM_DONE(&f, STREAM_TOCLIENT));
2283  FAIL_IF(FLOW_IS_PP_DONE(&f, STREAM_TOCLIENT));
2285 
2286  tcph.th_ack = htonl(1 + sizeof(request));
2287  tcph.th_seq = htonl(328);
2288  tcph.th_flags = TH_PUSH | TH_ACK;
2290  p->payload_len = 0;
2291  p->payload = NULL;
2292  FAIL_IF(StreamTcpPacket(&tv, p, stt, &pq) == -1);
2299  FAIL_IF(!FLOW_IS_PM_DONE(&f, STREAM_TOSERVER));
2300  FAIL_IF(FLOW_IS_PP_DONE(&f, STREAM_TOSERVER));
2301  FAIL_IF(!FLOW_IS_PM_DONE(&f, STREAM_TOCLIENT));
2302  FAIL_IF(FLOW_IS_PP_DONE(&f, STREAM_TOCLIENT));
2304 
2305  TEST_END;
2306  PASS;
2307 }
2308 
2309 /**
2310  * \test GET -> DCERPC
2311  */
2312 static int AppLayerTest07(void)
2313 {
2314  TEST_START;
2315 
2316  /* full request */
2317  uint8_t request[] = {
2318  0x47, 0x45, 0x54, 0x20, 0x2f, 0x69, 0x6e, 0x64,
2319  0x65, 0x78, 0x2e, 0x68, 0x74, 0x6d, 0x6c, 0x20,
2320  0x48, 0x54, 0x54, 0x50, 0x2f, 0x31, 0x2e, 0x30,
2321  0x0d, 0x0a, 0x48, 0x6f, 0x73, 0x74, 0x3a, 0x20,
2322  0x6c, 0x6f, 0x63, 0x61, 0x6c, 0x68, 0x6f, 0x73,
2323  0x74, 0x0d, 0x0a, 0x55, 0x73, 0x65, 0x72, 0x2d,
2324  0x41, 0x67, 0x65, 0x6e, 0x74, 0x3a, 0x20, 0x41,
2325  0x70, 0x61, 0x63, 0x68, 0x65, 0x42, 0x65, 0x6e,
2326  0x63, 0x68, 0x2f, 0x32, 0x2e, 0x33, 0x0d, 0x0a,
2327  0x41, 0x63, 0x63, 0x65, 0x70, 0x74, 0x3a, 0x20,
2328  0x2a, 0x2f, 0x2a, 0x0d, 0x0a, 0x0d, 0x0a };
2329  tcph.th_ack = htonl(1);
2330  tcph.th_seq = htonl(1);
2331  tcph.th_flags = TH_PUSH | TH_ACK;
2333  p->payload_len = sizeof(request);
2334  p->payload = request;
2335  FAIL_IF(StreamTcpPacket(&tv, p, stt, &pq) == -1);
2342  FAIL_IF(FLOW_IS_PM_DONE(&f, STREAM_TOSERVER));
2343  FAIL_IF(FLOW_IS_PP_DONE(&f, STREAM_TOSERVER));
2344  FAIL_IF(FLOW_IS_PM_DONE(&f, STREAM_TOCLIENT));
2345  FAIL_IF(FLOW_IS_PP_DONE(&f, STREAM_TOCLIENT));
2346  FAIL_IF(ssn->data_first_seen_dir != STREAM_TOSERVER);
2347 
2348  /* full response - request ack */
2349  uint8_t response[] = { 0x05, 0x00, 0x4d, 0x42, 0x00, 0x01, 0x2e, 0x31, 0x20, 0x32, 0x30, 0x30,
2350  0x20, 0x4f, 0x4b, 0x0d, 0x0a, 0x44, 0x61, 0x74, 0x65, 0x3a, 0x20, 0x46, 0x72, 0x69, 0x2c,
2351  0x20, 0x32, 0x33, 0x20, 0x53, 0x65, 0x70, 0x20, 0x32, 0x30, 0x31, 0x31, 0x20, 0x30, 0x36,
2352  0x3a, 0x32, 0x39, 0x3a, 0x33, 0x39, 0x20, 0x47, 0x4d, 0x54, 0x0d, 0x0a, 0x53, 0x65, 0x72,
2353  0x76, 0x65, 0x72, 0x3a, 0x20, 0x41, 0x70, 0x61, 0x63, 0x68, 0x65, 0x2f, 0x32, 0x2e, 0x32,
2354  0x2e, 0x31, 0x35, 0x20, 0x28, 0x55, 0x6e, 0x69, 0x78, 0x29, 0x20, 0x44, 0x41, 0x56, 0x2f,
2355  0x32, 0x0d, 0x0a, 0x4c, 0x61, 0x73, 0x74, 0x2d, 0x4d, 0x6f, 0x64, 0x69, 0x66, 0x69, 0x65,
2356  0x64, 0x3a, 0x20, 0x54, 0x68, 0x75, 0x2c, 0x20, 0x30, 0x34, 0x20, 0x4e, 0x6f, 0x76, 0x20,
2357  0x32, 0x30, 0x31, 0x30, 0x20, 0x31, 0x35, 0x3a, 0x30, 0x34, 0x3a, 0x34, 0x36, 0x20, 0x47,
2358  0x4d, 0x54, 0x0d, 0x0a, 0x45, 0x54, 0x61, 0x67, 0x3a, 0x20, 0x22, 0x61, 0x62, 0x38, 0x39,
2359  0x36, 0x35, 0x2d, 0x32, 0x63, 0x2d, 0x34, 0x39, 0x34, 0x33, 0x62, 0x37, 0x61, 0x37, 0x66,
2360  0x37, 0x66, 0x38, 0x30, 0x22, 0x0d, 0x0a, 0x41, 0x63, 0x63, 0x65, 0x70, 0x74, 0x2d, 0x52,
2361  0x61, 0x6e, 0x67, 0x65, 0x73, 0x3a, 0x20, 0x62, 0x79, 0x74, 0x65, 0x73, 0x0d, 0x0a, 0x43,
2362  0x6f, 0x6e, 0x74, 0x65, 0x6e, 0x74, 0x2d, 0x4c, 0x65, 0x6e, 0x67, 0x74, 0x68, 0x3a, 0x20,
2363  0x34, 0x34, 0x0d, 0x0a, 0x43, 0x6f, 0x6e, 0x6e, 0x65, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x3a,
2364  0x20, 0x63, 0x6c, 0x6f, 0x73, 0x65, 0x0d, 0x0a, 0x43, 0x6f, 0x6e, 0x74, 0x65, 0x6e, 0x74,
2365  0x2d, 0x54, 0x79, 0x70, 0x65, 0x3a, 0x20, 0x74, 0x65, 0x78, 0x74, 0x2f, 0x68, 0x74, 0x6d,
2366  0x6c, 0x0d, 0x0a, 0x58, 0x2d, 0x50, 0x61, 0x64, 0x3a, 0x20, 0x61, 0x76, 0x6f, 0x69, 0x64,
2367  0x20, 0x62, 0x72, 0x6f, 0x77, 0x73, 0x65, 0x72, 0x20, 0x62, 0x75, 0x67, 0x0d, 0x0a, 0x0d,
2368  0x0a, 0x3c, 0x68, 0x74, 0x6d, 0x6c, 0x3e, 0x3c, 0x62, 0x6f, 0x64, 0x79, 0x3e, 0x3c, 0x68,
2369  0x31, 0x3e, 0x49, 0x74, 0x20, 0x77, 0x6f, 0x72, 0x6b, 0x73, 0x21, 0x3c, 0x2f, 0x68, 0x31,
2370  0x3e, 0x3c, 0x2f, 0x62, 0x6f, 0x64, 0x79, 0x3e, 0x3c, 0x2f, 0x68, 0x74, 0x6d, 0x6c, 0x3e };
2371  tcph.th_ack = htonl(88);
2372  tcph.th_seq = htonl(1);
2373  tcph.th_flags = TH_PUSH | TH_ACK;
2375  p->payload_len = sizeof(response);
2376  p->payload = response;
2377  FAIL_IF(StreamTcpPacket(&tv, p, stt, &pq) == -1);
2384  FAIL_IF(!FLOW_IS_PM_DONE(&f, STREAM_TOSERVER));
2385  FAIL_IF(FLOW_IS_PP_DONE(&f, STREAM_TOSERVER));
2386  FAIL_IF(FLOW_IS_PM_DONE(&f, STREAM_TOCLIENT));
2387  FAIL_IF(FLOW_IS_PP_DONE(&f, STREAM_TOCLIENT));
2389 
2390  /* response ack */
2391  tcph.th_ack = htonl(328);
2392  tcph.th_seq = htonl(88);
2393  tcph.th_flags = TH_ACK;
2395  p->payload_len = 0;
2396  p->payload = NULL;
2397  FAIL_IF(StreamTcpPacket(&tv, p, stt, &pq) == -1);
2404  FAIL_IF(!FLOW_IS_PM_DONE(&f, STREAM_TOSERVER));
2405  FAIL_IF(FLOW_IS_PP_DONE(&f, STREAM_TOSERVER));
2406  FAIL_IF(!FLOW_IS_PM_DONE(&f, STREAM_TOCLIENT));
2407  FAIL_IF(FLOW_IS_PP_DONE(&f, STREAM_TOCLIENT));
2409 
2410  TEST_END;
2411  PASS;
2412 }
2413 
2414 /**
2415  * \test RUBBISH(TC - PM and PP NOT DONE) ->
2416  * RUBBISH(TC - PM and PP DONE) ->
2417  * RUBBISH(TS - PM and PP DONE)
2418  */
2419 static int AppLayerTest09(void)
2420 {
2421  TEST_START;
2422 
2423  /* full request */
2424  uint8_t request1[] = {
2425  0x47, 0x47, 0x49, 0x20, 0x2f, 0x69, 0x6e, 0x64 };
2426  tcph.th_ack = htonl(1);
2427  tcph.th_seq = htonl(1);
2428  tcph.th_flags = TH_PUSH | TH_ACK;
2430  p->payload_len = sizeof(request1);
2431  p->payload = request1;
2432  FAIL_IF(StreamTcpPacket(&tv, p, stt, &pq) == -1);
2439  FAIL_IF(FLOW_IS_PM_DONE(&f, STREAM_TOSERVER));
2440  FAIL_IF(FLOW_IS_PP_DONE(&f, STREAM_TOSERVER));
2441  FAIL_IF(FLOW_IS_PM_DONE(&f, STREAM_TOCLIENT));
2442  FAIL_IF(FLOW_IS_PP_DONE(&f, STREAM_TOCLIENT));
2443  FAIL_IF(ssn->data_first_seen_dir != STREAM_TOSERVER);
2444 
2445  /* response - request ack */
2446  tcph.th_ack = htonl(9);
2447  tcph.th_seq = htonl(1);
2448  tcph.th_flags = TH_PUSH | TH_ACK;
2450  p->payload_len = 0;
2451  p->payload = NULL;
2452  FAIL_IF(StreamTcpPacket(&tv, p, stt, &pq) == -1);
2459  FAIL_IF(FLOW_IS_PM_DONE(&f, STREAM_TOSERVER));
2460  FAIL_IF(!FLOW_IS_PP_DONE(&f, STREAM_TOSERVER));
2461  FAIL_IF(FLOW_IS_PM_DONE(&f, STREAM_TOCLIENT));
2462  FAIL_IF(FLOW_IS_PP_DONE(&f, STREAM_TOCLIENT));
2463  FAIL_IF(ssn->data_first_seen_dir != STREAM_TOSERVER);
2464 
2465  /* full request */
2466  uint8_t request2[] = {
2467  0x44, 0x44, 0x45, 0x20, 0x2f, 0x69, 0x6e, 0x64, 0xff };
2468  tcph.th_ack = htonl(1);
2469  tcph.th_seq = htonl(9);
2470  tcph.th_flags = TH_PUSH | TH_ACK;
2472  p->payload_len = sizeof(request2);
2473  p->payload = request2;
2474  FAIL_IF(StreamTcpPacket(&tv, p, stt, &pq) == -1);
2481  FAIL_IF(FLOW_IS_PM_DONE(&f, STREAM_TOSERVER));
2482  FAIL_IF(!FLOW_IS_PP_DONE(&f, STREAM_TOSERVER));
2483  FAIL_IF(FLOW_IS_PM_DONE(&f, STREAM_TOCLIENT));
2484  FAIL_IF(FLOW_IS_PP_DONE(&f, STREAM_TOCLIENT));
2485  FAIL_IF(ssn->data_first_seen_dir != STREAM_TOSERVER);
2486 
2487  /* full response - request ack */
2488  uint8_t response[] = {
2489  0x55, 0x74, 0x54, 0x50, 0x2f, 0x31, 0x2e, 0x31,
2490  0x20, 0x32, 0x30, 0x30, 0x20, 0x4f, 0x4b, 0x0d,
2491  0x0a, 0x44, 0x61, 0x74, 0x65, 0x3a, 0x20, 0x46,
2492  0x72, 0x69, 0x2c, 0x20, 0x32, 0x33, 0x20, 0x53,
2493  0x65, 0x70, 0x20, 0x32, 0x30, 0x31, 0x31, 0x20,
2494  0x30, 0x36, 0x3a, 0x32, 0x39, 0x3a, 0x33, 0x39,
2495  0x20, 0x47, 0x4d, 0x54, 0x0d, 0x0a, 0x53, 0x65,
2496  0x72, 0x76, 0x65, 0x72, 0x3a, 0x20, 0x41, 0x70,
2497  0x61, 0x63, 0x68, 0x65, 0x2f, 0x32, 0x2e, 0x32,
2498  0x2e, 0x31, 0x35, 0x20, 0x28, 0x55, 0x6e, 0x69,
2499  0x78, 0x29, 0x20, 0x44, 0x41, 0x56, 0x2f, 0x32,
2500  0x0d, 0x0a, 0x4c, 0x61, 0x73, 0x74, 0x2d, 0x4d,
2501  0x6f, 0x64, 0x69, 0x66, 0x69, 0x65, 0x64, 0x3a,
2502  0x20, 0x54, 0x68, 0x75, 0x2c, 0x20, 0x30, 0x34,
2503  0x20, 0x4e, 0x6f, 0x76, 0x20, 0x32, 0x30, 0x31,
2504  0x30, 0x20, 0x31, 0x35, 0x3a, 0x30, 0x34, 0x3a,
2505  0x34, 0x36, 0x20, 0x47, 0x4d, 0x54, 0x0d, 0x0a,
2506  0x45, 0x54, 0x61, 0x67, 0x3a, 0x20, 0x22, 0x61,
2507  0x62, 0x38, 0x39, 0x36, 0x35, 0x2d, 0x32, 0x63,
2508  0x2d, 0x34, 0x39, 0x34, 0x33, 0x62, 0x37, 0x61,
2509  0x37, 0x66, 0x37, 0x66, 0x38, 0x30, 0x22, 0x0d,
2510  0x0a, 0x41, 0x63, 0x63, 0x65, 0x70, 0x74, 0x2d,
2511  0x52, 0x61, 0x6e, 0x67, 0x65, 0x73, 0x3a, 0x20,
2512  0x62, 0x79, 0x74, 0x65, 0x73, 0x0d, 0x0a, 0x43,
2513  0x6f, 0x6e, 0x74, 0x65, 0x6e, 0x74, 0x2d, 0x4c,
2514  0x65, 0x6e, 0x67, 0x74, 0x68, 0x3a, 0x20, 0x34,
2515  0x34, 0x0d, 0x0a, 0x43, 0x6f, 0x6e, 0x6e, 0x65,
2516  0x63, 0x74, 0x69, 0x6f, 0x6e, 0x3a, 0x20, 0x63,
2517  0x6c, 0x6f, 0x73, 0x65, 0x0d, 0x0a, 0x43, 0x6f,
2518  0x6e, 0x74, 0x65, 0x6e, 0x74, 0x2d, 0x54, 0x79,
2519  0x70, 0x65, 0x3a, 0x20, 0x74, 0x65, 0x78, 0x74,
2520  0x2f, 0x68, 0x74, 0x6d, 0x6c, 0x0d, 0x0a, 0x58,
2521  0x2d, 0x50, 0x61, 0x64, 0x3a, 0x20, 0x61, 0x76,
2522  0x6f, 0x69, 0x64, 0x20, 0x62, 0x72, 0x6f, 0x77,
2523  0x73, 0x65, 0x72, 0x20, 0x62, 0x75, 0x67, 0x0d,
2524  0x0a, 0x0d, 0x0a, 0x3c, 0x68, 0x74, 0x6d, 0x6c,
2525  0x3e, 0x3c, 0x62, 0x6f, 0x64, 0x79, 0x3e, 0x3c,
2526  0x68, 0x31, 0x3e, 0x49, 0x74, 0x20, 0x77, 0x6f,
2527  0x72, 0x6b, 0x73, 0x21, 0x3c, 0x2f, 0x68, 0x31,
2528  0x3e, 0x3c, 0x2f, 0x62, 0x6f, 0x64, 0x79, 0x3e,
2529  0x3c, 0x2f, 0x68, 0x74, 0x6d, 0x6c, 0x3e };
2530  tcph.th_ack = htonl(18);
2531  tcph.th_seq = htonl(1);
2532  tcph.th_flags = TH_PUSH | TH_ACK;
2534  p->payload_len = sizeof(response);
2535  p->payload = response;
2536  FAIL_IF(StreamTcpPacket(&tv, p, stt, &pq) == -1);
2543  FAIL_IF(!FLOW_IS_PM_DONE(&f, STREAM_TOSERVER));
2544  FAIL_IF(!FLOW_IS_PP_DONE(&f, STREAM_TOSERVER));
2545  FAIL_IF(FLOW_IS_PM_DONE(&f, STREAM_TOCLIENT));
2546  FAIL_IF(FLOW_IS_PP_DONE(&f, STREAM_TOCLIENT));
2547  FAIL_IF(ssn->data_first_seen_dir != STREAM_TOSERVER);
2548 
2549  /* response ack */
2550  tcph.th_ack = htonl(328);
2551  tcph.th_seq = htonl(18);
2552  tcph.th_flags = TH_ACK;
2554  p->payload_len = 0;
2555  p->payload = NULL;
2556  FAIL_IF(StreamTcpPacket(&tv, p, stt, &pq) == -1);
2563  FAIL_IF(!FLOW_IS_PM_DONE(&f, STREAM_TOSERVER));
2564  FAIL_IF(!FLOW_IS_PP_DONE(&f, STREAM_TOSERVER));
2565  FAIL_IF(!FLOW_IS_PM_DONE(&f, STREAM_TOCLIENT));
2566  FAIL_IF(!FLOW_IS_PP_DONE(&f, STREAM_TOCLIENT));
2568 
2569  TEST_END;
2570  PASS;
2571 }
2572 
2573 /**
2574  * \test RUBBISH(TC - PM and PP DONE) ->
2575  * RUBBISH(TS - PM and PP DONE)
2576  */
2577 static int AppLayerTest10(void)
2578 {
2579  TEST_START;
2580 
2581  /* full request */
2582  uint8_t request1[] = {
2583  0x47, 0x47, 0x49, 0x20, 0x2f, 0x69, 0x6e, 0x64,
2584  0x47, 0x47, 0x49, 0x20, 0x2f, 0x69, 0x6e, 0x64, 0xff };
2585  tcph.th_ack = htonl(1);
2586  tcph.th_seq = htonl(1);
2587  tcph.th_flags = TH_PUSH | TH_ACK;
2589  p->payload_len = sizeof(request1);
2590  p->payload = request1;
2591  FAIL_IF(StreamTcpPacket(&tv, p, stt, &pq) == -1);
2598  FAIL_IF(FLOW_IS_PM_DONE(&f, STREAM_TOSERVER));
2599  FAIL_IF(FLOW_IS_PP_DONE(&f, STREAM_TOSERVER));
2600  FAIL_IF(FLOW_IS_PM_DONE(&f, STREAM_TOCLIENT));
2601  FAIL_IF(FLOW_IS_PP_DONE(&f, STREAM_TOCLIENT));
2602  FAIL_IF(ssn->data_first_seen_dir != STREAM_TOSERVER);
2603 
2604  /* response - request ack */
2605  tcph.th_ack = htonl(18);
2606  tcph.th_seq = htonl(1);
2607  tcph.th_flags = TH_PUSH | TH_ACK;
2609  p->payload_len = 0;
2610  p->payload = NULL;
2611  FAIL_IF(StreamTcpPacket(&tv, p, stt, &pq) == -1);
2618  FAIL_IF(!FLOW_IS_PM_DONE(&f, STREAM_TOSERVER));
2619  FAIL_IF(!FLOW_IS_PP_DONE(&f, STREAM_TOSERVER));
2620  FAIL_IF(FLOW_IS_PM_DONE(&f, STREAM_TOCLIENT));
2621  FAIL_IF(FLOW_IS_PP_DONE(&f, STREAM_TOCLIENT));
2622  FAIL_IF(ssn->data_first_seen_dir != STREAM_TOSERVER);
2623 
2624  /* full response - request ack */
2625  uint8_t response[] = {
2626  0x55, 0x74, 0x54, 0x50, 0x2f, 0x31, 0x2e, 0x31,
2627  0x20, 0x32, 0x30, 0x30, 0x20, 0x4f, 0x4b, 0x0d,
2628  0x0a, 0x44, 0x61, 0x74, 0x65, 0x3a, 0x20, 0x46,
2629  0x72, 0x69, 0x2c, 0x20, 0x32, 0x33, 0x20, 0x53,
2630  0x65, 0x70, 0x20, 0x32, 0x30, 0x31, 0x31, 0x20,
2631  0x30, 0x36, 0x3a, 0x32, 0x39, 0x3a, 0x33, 0x39,
2632  0x20, 0x47, 0x4d, 0x54, 0x0d, 0x0a, 0x53, 0x65,
2633  0x72, 0x76, 0x65, 0x72, 0x3a, 0x20, 0x41, 0x70,
2634  0x61, 0x63, 0x68, 0x65, 0x2f, 0x32, 0x2e, 0x32,
2635  0x2e, 0x31, 0x35, 0x20, 0x28, 0x55, 0x6e, 0x69,
2636  0x78, 0x29, 0x20, 0x44, 0x41, 0x56, 0x2f, 0x32,
2637  0x0d, 0x0a, 0x4c, 0x61, 0x73, 0x74, 0x2d, 0x4d,
2638  0x6f, 0x64, 0x69, 0x66, 0x69, 0x65, 0x64, 0x3a,
2639  0x20, 0x54, 0x68, 0x75, 0x2c, 0x20, 0x30, 0x34,
2640  0x20, 0x4e, 0x6f, 0x76, 0x20, 0x32, 0x30, 0x31,
2641  0x30, 0x20, 0x31, 0x35, 0x3a, 0x30, 0x34, 0x3a,
2642  0x34, 0x36, 0x20, 0x47, 0x4d, 0x54, 0x0d, 0x0a,
2643  0x45, 0x54, 0x61, 0x67, 0x3a, 0x20, 0x22, 0x61,
2644  0x62, 0x38, 0x39, 0x36, 0x35, 0x2d, 0x32, 0x63,
2645  0x2d, 0x34, 0x39, 0x34, 0x33, 0x62, 0x37, 0x61,
2646  0x37, 0x66, 0x37, 0x66, 0x38, 0x30, 0x22, 0x0d,
2647  0x0a, 0x41, 0x63, 0x63, 0x65, 0x70, 0x74, 0x2d,
2648  0x52, 0x61, 0x6e, 0x67, 0x65, 0x73, 0x3a, 0x20,
2649  0x62, 0x79, 0x74, 0x65, 0x73, 0x0d, 0x0a, 0x43,
2650  0x6f, 0x6e, 0x74, 0x65, 0x6e, 0x74, 0x2d, 0x4c,
2651  0x65, 0x6e, 0x67, 0x74, 0x68, 0x3a, 0x20, 0x34,
2652  0x34, 0x0d, 0x0a, 0x43, 0x6f, 0x6e, 0x6e, 0x65,
2653  0x63, 0x74, 0x69, 0x6f, 0x6e, 0x3a, 0x20, 0x63,
2654  0x6c, 0x6f, 0x73, 0x65, 0x0d, 0x0a, 0x43, 0x6f,
2655  0x6e, 0x74, 0x65, 0x6e, 0x74, 0x2d, 0x54, 0x79,
2656  0x70, 0x65, 0x3a, 0x20, 0x74, 0x65, 0x78, 0x74,
2657  0x2f, 0x68, 0x74, 0x6d, 0x6c, 0x0d, 0x0a, 0x58,
2658  0x2d, 0x50, 0x61, 0x64, 0x3a, 0x20, 0x61, 0x76,
2659  0x6f, 0x69, 0x64, 0x20, 0x62, 0x72, 0x6f, 0x77,
2660  0x73, 0x65, 0x72, 0x20, 0x62, 0x75, 0x67, 0x0d,
2661  0x0a, 0x0d, 0x0a, 0x3c, 0x68, 0x74, 0x6d, 0x6c,
2662  0x3e, 0x3c, 0x62, 0x6f, 0x64, 0x79, 0x3e, 0x3c,
2663  0x68, 0x31, 0x3e, 0x49, 0x74, 0x20, 0x77, 0x6f,
2664  0x72, 0x6b, 0x73, 0x21, 0x3c, 0x2f, 0x68, 0x31,
2665  0x3e, 0x3c, 0x2f, 0x62, 0x6f, 0x64, 0x79, 0x3e,
2666  0x3c, 0x2f, 0x68, 0x74, 0x6d, 0x6c, 0x3e };
2667  tcph.th_ack = htonl(18);
2668  tcph.th_seq = htonl(1);
2669  tcph.th_flags = TH_PUSH | TH_ACK;
2671  p->payload_len = sizeof(response);
2672  p->payload = response;
2673  FAIL_IF(StreamTcpPacket(&tv, p, stt, &pq) == -1);
2680  FAIL_IF(!FLOW_IS_PM_DONE(&f, STREAM_TOSERVER));
2681  FAIL_IF(!FLOW_IS_PP_DONE(&f, STREAM_TOSERVER));
2682  FAIL_IF(FLOW_IS_PM_DONE(&f, STREAM_TOCLIENT));
2683  FAIL_IF(FLOW_IS_PP_DONE(&f, STREAM_TOCLIENT));
2684  FAIL_IF(ssn->data_first_seen_dir != STREAM_TOSERVER);
2685 
2686  /* response ack */
2687  tcph.th_ack = htonl(328);
2688  tcph.th_seq = htonl(18);
2689  tcph.th_flags = TH_ACK;
2691  p->payload_len = 0;
2692  p->payload = NULL;
2693  FAIL_IF(StreamTcpPacket(&tv, p, stt, &pq) == -1);
2700  FAIL_IF(!FLOW_IS_PM_DONE(&f, STREAM_TOSERVER));
2701  FAIL_IF(!FLOW_IS_PP_DONE(&f, STREAM_TOSERVER));
2702  FAIL_IF(!FLOW_IS_PM_DONE(&f, STREAM_TOCLIENT));
2703  FAIL_IF(!FLOW_IS_PP_DONE(&f, STREAM_TOCLIENT));
2705 
2706  TEST_END;
2707  PASS;
2708 }
2709 
2710 /**
2711  * \test RUBBISH(TC - PM and PP DONE) ->
2712  * RUBBISH(TS - PM and PP NOT DONE) ->
2713  * RUBBISH(TS - PM and PP DONE)
2714  */
2715 static int AppLayerTest11(void)
2716 {
2717  TEST_START;
2718 
2719  /* full request */
2720  uint8_t request1[] = {
2721  0x47, 0x47, 0x49, 0x20, 0x2f, 0x69, 0x6e, 0x64,
2722  0x47, 0x47, 0x49, 0x20, 0x2f, 0x69, 0x6e, 0x64, 0xff };
2723  tcph.th_ack = htonl(1);
2724  tcph.th_seq = htonl(1);
2725  tcph.th_flags = TH_PUSH | TH_ACK;
2727  p->payload_len = sizeof(request1);
2728  p->payload = request1;
2729  FAIL_IF(StreamTcpPacket(&tv, p, stt, &pq) == -1);
2736  FAIL_IF(FLOW_IS_PM_DONE(&f, STREAM_TOSERVER));
2737  FAIL_IF(FLOW_IS_PP_DONE(&f, STREAM_TOSERVER));
2738  FAIL_IF(FLOW_IS_PM_DONE(&f, STREAM_TOCLIENT));
2739  FAIL_IF(FLOW_IS_PP_DONE(&f, STREAM_TOCLIENT));
2740  FAIL_IF(ssn->data_first_seen_dir != STREAM_TOSERVER);
2741 
2742  /* response - request ack */
2743  tcph.th_ack = htonl(18);
2744  tcph.th_seq = htonl(1);
2745  tcph.th_flags = TH_PUSH | TH_ACK;
2747  p->payload_len = 0;
2748  p->payload = NULL;
2749  FAIL_IF(StreamTcpPacket(&tv, p, stt, &pq) == -1);
2756  FAIL_IF(!FLOW_IS_PM_DONE(&f, STREAM_TOSERVER));
2757  FAIL_IF(!FLOW_IS_PP_DONE(&f, STREAM_TOSERVER));
2758  FAIL_IF(FLOW_IS_PM_DONE(&f, STREAM_TOCLIENT));
2759  FAIL_IF(FLOW_IS_PP_DONE(&f, STREAM_TOCLIENT));
2760  FAIL_IF(ssn->data_first_seen_dir != STREAM_TOSERVER);
2761 
2762  /* full response - request ack */
2763  uint8_t response1[] = {
2764  0x55, 0x74, 0x54, 0x50, };
2765  tcph.th_ack = htonl(18);
2766  tcph.th_seq = htonl(1);
2767  tcph.th_flags = TH_PUSH | TH_ACK;
2769  p->payload_len = sizeof(response1);
2770  p->payload = response1;
2771  FAIL_IF(StreamTcpPacket(&tv, p, stt, &pq) == -1);
2778  FAIL_IF(!FLOW_IS_PM_DONE(&f, STREAM_TOSERVER));
2779  FAIL_IF(!FLOW_IS_PP_DONE(&f, STREAM_TOSERVER));
2780  FAIL_IF(FLOW_IS_PM_DONE(&f, STREAM_TOCLIENT));
2781  FAIL_IF(FLOW_IS_PP_DONE(&f, STREAM_TOCLIENT));
2782  FAIL_IF(ssn->data_first_seen_dir != STREAM_TOSERVER);
2783 
2784  /* response ack from request */
2785  tcph.th_ack = htonl(5);
2786  tcph.th_seq = htonl(18);
2787  tcph.th_flags = TH_ACK;
2789  p->payload_len = 0;
2790  p->payload = NULL;
2791  FAIL_IF(StreamTcpPacket(&tv, p, stt, &pq) == -1);
2798  FAIL_IF(!FLOW_IS_PM_DONE(&f, STREAM_TOSERVER));
2799  FAIL_IF(!FLOW_IS_PP_DONE(&f, STREAM_TOSERVER));
2800  FAIL_IF(FLOW_IS_PM_DONE(&f, STREAM_TOCLIENT));
2801  FAIL_IF(!FLOW_IS_PP_DONE(&f, STREAM_TOCLIENT));
2802  FAIL_IF(ssn->data_first_seen_dir != STREAM_TOSERVER);
2803 
2804  uint8_t response2[] = {
2805  0x2f, 0x31, 0x2e, 0x31,
2806  0x20, 0x32, 0x30, 0x30, 0x20, 0x4f, 0x4b, 0x0d,
2807  0x0a, 0x44, 0x61, 0x74, 0x65, 0x3a, 0x20, 0x46,
2808  0x72, 0x69, 0x2c, 0x20, 0x32, 0x33, 0x20, 0x53,
2809  0x65, 0x70, 0x20, 0x32, 0x30, 0x31, 0x31, 0x20,
2810  0x30, 0x36, 0x3a, 0x32, 0x39, 0x3a, 0x33, 0x39,
2811  0x20, 0x47, 0x4d, 0x54, 0x0d, 0x0a, 0x53, 0x65,
2812  0x72, 0x76, 0x65, 0x72, 0x3a, 0x20, 0x41, 0x70,
2813  0x61, 0x63, 0x68, 0x65, 0x2f, 0x32, 0x2e, 0x32,
2814  0x2e, 0x31, 0x35, 0x20, 0x28, 0x55, 0x6e, 0x69,
2815  0x78, 0x29, 0x20, 0x44, 0x41, 0x56, 0x2f, 0x32,
2816  0x0d, 0x0a, 0x4c, 0x61, 0x73, 0x74, 0x2d, 0x4d,
2817  0x6f, 0x64, 0x69, 0x66, 0x69, 0x65, 0x64, 0x3a,
2818  0x20, 0x54, 0x68, 0x75, 0x2c, 0x20, 0x30, 0x34,
2819  0x20, 0x4e, 0x6f, 0x76, 0x20, 0x32, 0x30, 0x31,
2820  0x30, 0x20, 0x31, 0x35, 0x3a, 0x30, 0x34, 0x3a,
2821  0x34, 0x36, 0x20, 0x47, 0x4d, 0x54, 0x0d, 0x0a,
2822  0x45, 0x54, 0x61, 0x67, 0x3a, 0x20, 0x22, 0x61,
2823  0x62, 0x38, 0x39, 0x36, 0x35, 0x2d, 0x32, 0x63,
2824  0x2d, 0x34, 0x39, 0x34, 0x33, 0x62, 0x37, 0x61,
2825  0x37, 0x66, 0x37, 0x66, 0x38, 0x30, 0x22, 0x0d,
2826  0x0a, 0x41, 0x63, 0x63, 0x65, 0x70, 0x74, 0x2d,
2827  0x52, 0x61, 0x6e, 0x67, 0x65, 0x73, 0x3a, 0x20,
2828  0x62, 0x79, 0x74, 0x65, 0x73, 0x0d, 0x0a, 0x43,
2829  0x6f, 0x6e, 0x74, 0x65, 0x6e, 0x74, 0x2d, 0x4c,
2830  0x65, 0x6e, 0x67, 0x74, 0x68, 0x3a, 0x20, 0x34,
2831  0x34, 0x0d, 0x0a, 0x43, 0x6f, 0x6e, 0x6e, 0x65,
2832  0x63, 0x74, 0x69, 0x6f, 0x6e, 0x3a, 0x20, 0x63,
2833  0x6c, 0x6f, 0x73, 0x65, 0x0d, 0x0a, 0x43, 0x6f,
2834  0x6e, 0x74, 0x65, 0x6e, 0x74, 0x2d, 0x54, 0x79,
2835  0x70, 0x65, 0x3a, 0x20, 0x74, 0x65, 0x78, 0x74,
2836  0x2f, 0x68, 0x74, 0x6d, 0x6c, 0x0d, 0x0a, 0x58,
2837  0x2d, 0x50, 0x61, 0x64, 0x3a, 0x20, 0x61, 0x76,
2838  0x6f, 0x69, 0x64, 0x20, 0x62, 0x72, 0x6f, 0x77,
2839  0x73, 0x65, 0x72, 0x20, 0x62, 0x75, 0x67, 0x0d,
2840  0x0a, 0x0d, 0x0a, 0x3c, 0x68, 0x74, 0x6d, 0x6c,
2841  0x3e, 0x3c, 0x62, 0x6f, 0x64, 0x79, 0x3e, 0x3c,
2842  0x68, 0x31, 0x3e, 0x49, 0x74, 0x20, 0x77, 0x6f,
2843  0x72, 0x6b, 0x73, 0x21, 0x3c, 0x2f, 0x68, 0x31,
2844  0x3e, 0x3c, 0x2f, 0x62, 0x6f, 0x64, 0x79, 0x3e,
2845  0x3c, 0x2f, 0x68, 0x74, 0x6d, 0x6c, 0x3e };
2846  tcph.th_ack = htonl(18);
2847  tcph.th_seq = htonl(5);
2848  tcph.th_flags = TH_PUSH | TH_ACK;
2850  p->payload_len = sizeof(response2);
2851  p->payload = response2;
2852  FAIL_IF(StreamTcpPacket(&tv, p, stt, &pq) == -1);
2859  FAIL_IF(!FLOW_IS_PM_DONE(&f, STREAM_TOSERVER));
2860  FAIL_IF(!FLOW_IS_PP_DONE(&f, STREAM_TOSERVER));
2861  FAIL_IF(FLOW_IS_PM_DONE(&f, STREAM_TOCLIENT));
2862  FAIL_IF(!FLOW_IS_PP_DONE(&f, STREAM_TOCLIENT));
2863  FAIL_IF(ssn->data_first_seen_dir != STREAM_TOSERVER);
2864 
2865  /* response ack from request */
2866  tcph.th_ack = htonl(328);
2867  tcph.th_seq = htonl(18);
2868  tcph.th_flags = TH_ACK;
2870  p->payload_len = 0;
2871  p->payload = NULL;
2872  FAIL_IF(StreamTcpPacket(&tv, p, stt, &pq) == -1);
2879  FAIL_IF(!FLOW_IS_PM_DONE(&f, STREAM_TOSERVER));
2880  FAIL_IF(!FLOW_IS_PP_DONE(&f, STREAM_TOSERVER));
2881  FAIL_IF(!FLOW_IS_PM_DONE(&f, STREAM_TOCLIENT));
2882  FAIL_IF(!FLOW_IS_PP_DONE(&f, STREAM_TOCLIENT));
2884 
2885  TEST_END;
2886  PASS;
2887 }
2888 
2890 {
2891  SCEnter();
2892 
2893  UtRegisterTest("AppLayerTest01", AppLayerTest01);
2894  UtRegisterTest("AppLayerTest02", AppLayerTest02);
2895  UtRegisterTest("AppLayerTest03", AppLayerTest03);
2896  UtRegisterTest("AppLayerTest04", AppLayerTest04);
2897  UtRegisterTest("AppLayerTest05", AppLayerTest05);
2898  UtRegisterTest("AppLayerTest06", AppLayerTest06);
2899  UtRegisterTest("AppLayerTest07", AppLayerTest07);
2900  UtRegisterTest("AppLayerTest09", AppLayerTest09);
2901  UtRegisterTest("AppLayerTest10", AppLayerTest10);
2902  UtRegisterTest("AppLayerTest11", AppLayerTest11);
2903 
2904  SCReturn;
2905 }
2906 
2907 #endif /* UNITTESTS */
AppLayerCounters_::alloc_error_id
uint16_t alloc_error_id
Definition: app-layer.c:94
APP_LAYER_DATA_ALREADY_SENT_TO_APP_LAYER
#define APP_LAYER_DATA_ALREADY_SENT_TO_APP_LAYER
Definition: app-layer.h:40
AppLayerCounters_::counter_id
uint16_t counter_id
Definition: app-layer.c:89
FLOW_RESET_PP_DONE
#define FLOW_RESET_PP_DONE(f, dir)
Definition: flow.h:287
UPDATE_DIR_PACKET
@ UPDATE_DIR_PACKET
Definition: stream-tcp-reassemble.h:56
FlowUnsetChangeProtoFlag
void FlowUnsetChangeProtoFlag(Flow *f)
Unset flag to indicate to change proto for the flow.
Definition: flow.c:185
Packet_::proto
uint8_t proto
Definition: decode.h:506
AppLayerParserDeSetup
int AppLayerParserDeSetup(void)
Definition: app-layer-parser.c:283
TcpStream_
Definition: stream-tcp-private.h:106
APPLAYER_UNEXPECTED_PROTOCOL
@ APPLAYER_UNEXPECTED_PROTOCOL
Definition: app-layer-events.h:54
ExceptionPolicyApply
void ExceptionPolicyApply(Packet *p, enum ExceptionPolicy policy, enum PacketDropReason drop_reason)
Definition: util-exception-policy.c:136
AppLayerCounters_::gap_error_id
uint16_t gap_error_id
Definition: app-layer.c:91
AppLayerCounters_
Definition: app-layer.c:88
ippair.h
app-layer-htp-range.h
FlowCleanupAppLayer
void FlowCleanupAppLayer(Flow *f)
Definition: flow.c:138
AppLayerProtoDetectSetup
int AppLayerProtoDetectSetup(void)
The first function to be called. This initializes a global protocol detection context.
Definition: app-layer-detect-proto.c:1683
ALPROTO_IKE
@ ALPROTO_IKE
Definition: app-layer-protos.h:55
ExpectationGetCounter
uint64_t ExpectationGetCounter(void)
Definition: app-layer-expectation.c:140
AppLayerCounterNames_::eps_name
char eps_name[EXCEPTION_POLICY_MAX][MAX_COUNTER_SIZE]
Definition: app-layer.c:85
StatsIncr
void StatsIncr(ThreadVars *tv, uint16_t id)
Increments the local counter.
Definition: counters.c:166
AppLayerCounters_::counter_tx_id
uint16_t counter_tx_id
Definition: app-layer.c:90
AppLayerCounters
struct AppLayerCounters_ AppLayerCounters
stream-tcp-inline.h
ALPROTO_DCERPC
@ ALPROTO_DCERPC
Definition: app-layer-protos.h:44
flow-util.h
ALPROTO_DNS
@ ALPROTO_DNS
Definition: app-layer-protos.h:47
stream-tcp.h
ALPROTO_ENIP
@ ALPROTO_ENIP
Definition: app-layer-protos.h:49
StreamTcpInlineMode
bool StreamTcpInlineMode(void)
See if stream engine is operating in inline mode.
Definition: stream-tcp.c:7099
unlikely
#define unlikely(expr)
Definition: util-optimize.h:35
UtRegisterTest
void UtRegisterTest(const char *name, int(*TestFn)(void))
Register unit test.
Definition: util-unittest.c:103
AppLayerGetProtoByName
AppProto AppLayerGetProtoByName(const char *alproto_name)
Given a protocol string, returns the corresponding internal protocol id.
Definition: app-layer.c:1001
ALPROTO_TLS
@ ALPROTO_TLS
Definition: app-layer-protos.h:39
SCLogDebug
#define SCLogDebug(...)
Definition: util-debug.h:269
Packet_::pcap_cnt
uint64_t pcap_cnt
Definition: decode.h:609
AppLayerCounterNames_::parser_error
char parser_error[MAX_COUNTER_SIZE]
Definition: app-layer.c:82
StatsRegisterGlobalCounter
uint16_t StatsRegisterGlobalCounter(const char *name, uint64_t(*Func)(void))
Registers a counter, which represents a global value.
Definition: counters.c:1010
ALPROTO_MODBUS
@ ALPROTO_MODBUS
Definition: app-layer-protos.h:48
AppLayerProfilingStoreInternal
void AppLayerProfilingStoreInternal(AppLayerThreadCtx *app_tctx, Packet *p)
Definition: app-layer.c:1149
Flow_::proto
uint8_t proto
Definition: flow.h:378
AppProto
uint16_t AppProto
Definition: app-layer-protos.h:85
ALPROTO_QUIC
@ ALPROTO_QUIC
Definition: app-layer-protos.h:57
Packet_::payload
uint8_t * payload
Definition: decode.h:588
ALPROTO_POP3
@ ALPROTO_POP3
Definition: app-layer-protos.h:71
TcpReassemblyThreadCtx_::app_tctx
void * app_tctx
Definition: stream-tcp-reassemble.h:62
Packet_::flags
uint32_t flags
Definition: decode.h:527
AppLayerThreadCtx_::proto_detect_ticks_spent
uint64_t proto_detect_ticks_spent
Definition: app-layer.c:71
PACKET_PROFILING_APP_PD_END
#define PACKET_PROFILING_APP_PD_END(dp)
Definition: util-profiling.h:186
ALPROTO_JABBER
@ ALPROTO_JABBER
Definition: app-layer-protos.h:42
TcpStreamCnf_::reassembly_depth
uint32_t reassembly_depth
Definition: stream-tcp.h:75
AppLayerThreadCtx_::alp_tctx
AppLayerParserThreadCtx * alp_tctx
Definition: app-layer.c:62
flow-private.h
Flow_
Flow data structure.
Definition: flow.h:356
AppLayerIncGapErrorCounter
void AppLayerIncGapErrorCounter(ThreadVars *tv, Flow *f)
Definition: app-layer.c:162
AppLayerCounters_::internal_error_id
uint16_t internal_error_id
Definition: app-layer.c:93
Flow_::protomap
uint8_t protomap
Definition: flow.h:445
AppProtoToString
const char * AppProtoToString(AppProto alproto)
Maps the ALPROTO_*, to its string equivalent.
Definition: app-layer-protos.c:40
AppLayerThreadCtx_::ticks_spent
uint64_t ticks_spent
Definition: app-layer.c:67
ALPROTO_IRC
@ ALPROTO_IRC
Definition: app-layer-protos.h:45
ExceptionPolicyStatsSetts_
Definition: util-exception-policy-types.h:56
AppLayerParserGetFirstDataDir
uint8_t AppLayerParserGetFirstDataDir(uint8_t ipproto, AppProto alproto)
Definition: app-layer-parser.c:1158
g_stats_eps_per_app_proto_errors
bool g_stats_eps_per_app_proto_errors
Definition: suricata.c:219
StreamTcpReassembleAppLayer
int StreamTcpReassembleAppLayer(ThreadVars *tv, TcpReassemblyThreadCtx *ra_ctx, TcpSession *ssn, TcpStream *stream, Packet *p, enum StreamUpdateDir app_update_dir)
Update the stream reassembly upon receiving a packet.
Definition: stream-tcp-reassemble.c:1398
StreamTcpResetStreamFlagAppProtoDetectionCompleted
#define StreamTcpResetStreamFlagAppProtoDetectionCompleted(stream)
Definition: stream-tcp-private.h:305
AppLayerRegisterThreadCounters
void AppLayerRegisterThreadCounters(ThreadVars *tv)
Registers per flow counters for all protocols.
Definition: app-layer.c:1305
Flow_::alproto_orig
AppProto alproto_orig
Definition: flow.h:456
AppLayerProtoDetectSupportedIpprotos
void AppLayerProtoDetectSupportedIpprotos(AppProto alproto, uint8_t *ipprotos)
Definition: app-layer-detect-proto.c:2048
FTPMemuseGlobalCounter
uint64_t FTPMemuseGlobalCounter(void)
Definition: app-layer-ftp.c:77
ALPROTO_SIP
@ ALPROTO_SIP
Definition: app-layer-protos.h:59
AppLayerProfilingResetInternal
void AppLayerProfilingResetInternal(AppLayerThreadCtx *app_tctx)
Definition: app-layer.c:1144
AppLayerCounterNames_
Definition: app-layer.c:78
AppLayerParserStateProtoCleanup
void AppLayerParserStateProtoCleanup(uint8_t protomap, AppProto alproto, void *alstate, AppLayerParserState *pstate)
Definition: app-layer-parser.c:1656
AppLayerParserThreadCtxFree
void AppLayerParserThreadCtxFree(AppLayerParserThreadCtx *tctx)
Destroys the app layer parser thread context obtained using AppLayerParserThreadCtxAlloc().
Definition: app-layer-parser.c:322
AppLayerHandleTCPData
int AppLayerHandleTCPData(ThreadVars *tv, TcpReassemblyThreadCtx *ra_ctx, Packet *p, Flow *f, TcpSession *ssn, TcpStream **stream, uint8_t *data, uint32_t data_len, uint8_t flags, enum StreamUpdateDir app_update_dir)
handle TCP data for the app-layer.
Definition: app-layer.c:710
FLOW_PKT_TOSERVER
#define FLOW_PKT_TOSERVER
Definition: flow.h:233
ALPROTO_LDAP
@ ALPROTO_LDAP
Definition: app-layer-protos.h:65
TCP_ESTABLISHED
@ TCP_ESTABLISHED
Definition: stream-tcp-private.h:155
MIN
#define MIN(x, y)
Definition: suricata-common.h:400
StreamTcpUpdateAppLayerProgress
void StreamTcpUpdateAppLayerProgress(TcpSession *ssn, char direction, const uint32_t progress)
update reassembly progress
Definition: stream-tcp.c:6674
ALPROTO_FTP
@ ALPROTO_FTP
Definition: app-layer-protos.h:37
app_layer_error_eps_stats
ExceptionPolicyStatsSetts app_layer_error_eps_stats
Definition: app-layer.c:107
stream-tcp-reassemble.h
AppLayerThreadCtx_::proto_detect_ticks_end
uint64_t proto_detect_ticks_end
Definition: app-layer.c:70
TcpStream_::flags
uint16_t flags
Definition: stream-tcp-private.h:107
AppLayerUnittestsRegister
void AppLayerUnittestsRegister(void)
Definition: app-layer.c:2889
APPLAYER_PROTO_DETECTION_SKIPPED
@ APPLAYER_PROTO_DETECTION_SKIPPED
Definition: app-layer-events.h:52
HTPMemuseGlobalCounter
uint64_t HTPMemuseGlobalCounter(void)
Definition: app-layer-htp-mem.c:80
AppLayerListSupportedProtocols
void AppLayerListSupportedProtocols(void)
Definition: app-layer.c:1015
AppLayerSetupCounters
void AppLayerSetupCounters(void)
Definition: app-layer.c:1196
ALPROTO_SSH
@ ALPROTO_SSH
Definition: app-layer-protos.h:40
app-layer-ftp.h
ALPROTO_DHCP
@ ALPROTO_DHCP
Definition: app-layer-protos.h:58
Packet_::flowflags
uint8_t flowflags
Definition: decode.h:515
AppLayerThreadCtx_::alproto
AppProto alproto
Definition: app-layer.c:68
stream_config
TcpStreamCnf stream_config
Definition: stream-tcp.c:219
MAX
#define MAX(x, y)
Definition: suricata-common.h:404
Flow_::protoctx
void * protoctx
Definition: flow.h:441
AppLayerCounterNames_::tx_name
char tx_name[MAX_COUNTER_SIZE]
Definition: app-layer.c:80
AppLayerIncAllocErrorCounter
void AppLayerIncAllocErrorCounter(ThreadVars *tv, Flow *f)
Definition: app-layer.c:170
EXCEPTION_POLICY_NOT_SET
@ EXCEPTION_POLICY_NOT_SET
Definition: util-exception-policy-types.h:26
Packet_::payload_len
uint16_t payload_len
Definition: decode.h:589
Packet_::app_layer_events
AppLayerDecoderEvents * app_layer_events
Definition: decode.h:615
util-unittest.h
PACKET_PROFILING_APP_PD_START
#define PACKET_PROFILING_APP_PD_START(dp)
Definition: util-profiling.h:181
AppLayerCounters_::parser_error_id
uint16_t parser_error_id
Definition: app-layer.c:92
AppLayerDeSetup
int AppLayerDeSetup(void)
De initializes the app layer.
Definition: app-layer.c:1093
HostGetMemcap
uint64_t HostGetMemcap(void)
Return memcap value.
Definition: host.c:83
PKT_PROTO_DETECT_TS_DONE
#define PKT_PROTO_DETECT_TS_DONE
Definition: decode.h:1275
MAX_COUNTER_SIZE
#define MAX_COUNTER_SIZE
Definition: app-layer.c:77
ALPROTO_KRB5
@ ALPROTO_KRB5
Definition: app-layer-protos.h:56
STREAMTCP_FLAG_MIDSTREAM
#define STREAMTCP_FLAG_MIDSTREAM
Definition: stream-tcp-private.h:170
TcpSession_::flags
uint32_t flags
Definition: stream-tcp-private.h:294
FLOW_IS_PM_DONE
#define FLOW_IS_PM_DONE(f, dir)
Definition: flow.h:278
APPLAYER_NO_TLS_AFTER_STARTTLS
@ APPLAYER_NO_TLS_AFTER_STARTTLS
Definition: app-layer-events.h:53
Flow_::alparser
AppLayerParserState * alparser
Definition: flow.h:478
EXCEPTION_POLICY_MAX
#define EXCEPTION_POLICY_MAX
Definition: util-exception-policy-types.h:36
AppLayerParserRegisterProtocolParsers
void AppLayerParserRegisterProtocolParsers(void)
Definition: app-layer-parser.c:1778
AppLayerThreadCtx_::proto_detect_ticks_start
uint64_t proto_detect_ticks_start
Definition: app-layer.c:69
AppLayerSetup
int AppLayerSetup(void)
Setup the app layer.
Definition: app-layer.c:1076
app-layer-expectation.h
app-layer-detect-proto.h
AppLayerProtoDetectThreadCtx_
The app layer protocol detection thread context.
Definition: app-layer-detect-proto.c:179
util-debug.h
AppLayerParserState_
Definition: app-layer-parser.c:133
PASS
#define PASS
Pass the test.
Definition: util-unittest.h:105
ExceptionPolicyCounters_
Definition: util-exception-policy-types.h:51
APPLAYER_MISMATCH_PROTOCOL_BOTH_DIRECTIONS
@ APPLAYER_MISMATCH_PROTOCOL_BOTH_DIRECTIONS
Definition: app-layer-events.h:49
g_alproto_max
AppProto g_alproto_max
Definition: app-layer-protos.c:29
FLOW_IS_PP_DONE
#define FLOW_IS_PP_DONE(f, dir)
Definition: flow.h:279
AppLayerRegisterGlobalCounters
void AppLayerRegisterGlobalCounters(void)
HACK to work around our broken unix manager (re)init loop.
Definition: app-layer.c:1157
ALPROTO_DNP3
@ ALPROTO_DNP3
Definition: app-layer-protos.h:50
PKT_DROP_REASON_APPLAYER_ERROR
@ PKT_DROP_REASON_APPLAYER_ERROR
Definition: decode.h:372
AppLayerThreadCtx_::ticks_end
uint64_t ticks_end
Definition: app-layer.c:66
PacketSwap
void PacketSwap(Packet *p)
switch direction of a packet
Definition: decode.c:551
util-exception-policy.h
ALPROTO_SMTP
@ ALPROTO_SMTP
Definition: app-layer-protos.h:38
AppProtoRegisterProtoString
void AppProtoRegisterProtoString(AppProto alproto, const char *proto_name)
Definition: app-layer-protos.c:80
HTPByteRangeMemuseGlobalCounter
uint64_t HTPByteRangeMemuseGlobalCounter(void)
Definition: app-layer-htp-range.c:61
AppLayerThreadCtx_
This is for the app layer in general and it contains per thread context relevant to both the alpd and...
Definition: app-layer.c:58
ExceptionPolicyCounters_::eps_id
uint16_t eps_id[EXCEPTION_POLICY_MAX]
Definition: util-exception-policy-types.h:53
util-print.h
SCEnter
#define SCEnter(...)
Definition: util-debug.h:271
ThreadVars_
Per thread variable structure.
Definition: threadvars.h:58
pkt-var.h
StreamTcpPacket
int StreamTcpPacket(ThreadVars *tv, Packet *p, StreamTcpThread *stt, PacketQueueNoLock *pq)
Definition: stream-tcp.c:5542
AppLayerProtoDetectReset
void AppLayerProtoDetectReset(Flow *f)
Reset proto detect for flow.
Definition: app-layer-detect-proto.c:1875
TcpSession_::state
uint8_t state
Definition: stream-tcp-private.h:285
TEST_START
#define TEST_START
Definition: app-layer.c:1383
ExceptionPolicyStatsSetts_::valid_settings_ids
bool valid_settings_ids[EXCEPTION_POLICY_MAX]
Definition: util-exception-policy-types.h:58
TH_ACK
#define TH_ACK
Definition: decode-tcp.h:38
HostGetMemuse
uint64_t HostGetMemuse(void)
Return memuse value.
Definition: host.c:94
PACKET_PROFILING_APP_STORE
#define PACKET_PROFILING_APP_STORE(dp, p)
Definition: util-profiling.h:206
PrintRawDataFp
void PrintRawDataFp(FILE *fp, const uint8_t *buf, uint32_t buflen)
Definition: util-print.c:112
app-layer-parser.h
FLOW_PROTO_DETECT_TC_DONE
#define FLOW_PROTO_DETECT_TC_DONE
Definition: flow.h:105
AppLayerCounterNames
struct AppLayerCounterNames_ AppLayerCounterNames
util-profiling.h
AppLayerParserSetup
int AppLayerParserSetup(void)
Definition: app-layer-parser.c:257
SCReturn
#define SCReturn
Definition: util-debug.h:273
FLOW_RESET_PM_DONE
#define FLOW_RESET_PM_DONE(f, dir)
Definition: flow.h:286
stream.h
FlowGetProtoMapping
uint8_t FlowGetProtoMapping(uint8_t proto)
Function to map the protocol to the defined FLOW_PROTO_* enumeration.
Definition: flow-util.c:99
StreamTcpIsSetStreamFlagAppProtoDetectionCompleted
#define StreamTcpIsSetStreamFlagAppProtoDetectionCompleted(stream)
Definition: stream-tcp-private.h:303
Packet_
Definition: decode.h:484
ALPROTO_IMAP
@ ALPROTO_IMAP
Definition: app-layer-protos.h:41
stream-tcp-private.h
ALPROTO_RDP
@ ALPROTO_RDP
Definition: app-layer-protos.h:68
FLOW_PROTO_APPLAYER_MAX
#define FLOW_PROTO_APPLAYER_MAX
Definition: flow-private.h:77
applayer_counters
AppLayerCounters(* applayer_counters)[FLOW_PROTO_APPLAYER_MAX]
Definition: app-layer.c:101
AppLayerHandleUdp
int AppLayerHandleUdp(ThreadVars *tv, AppLayerThreadCtx *tctx, Packet *p, Flow *f)
Handle a app layer UDP message.
Definition: app-layer.c:877
DEBUG_ASSERT_FLOW_LOCKED
#define DEBUG_ASSERT_FLOW_LOCKED(f)
Definition: util-validate.h:99
StreamTcpSetStreamFlagAppProtoDetectionCompleted
#define StreamTcpSetStreamFlagAppProtoDetectionCompleted(stream)
Definition: stream-tcp-private.h:301
PACKET_PROFILING_APP_END
#define PACKET_PROFILING_APP_END(dp)
Definition: util-profiling.h:173
TcpStream_::window
uint32_t window
Definition: stream-tcp-private.h:117
ALPROTO_TELNET
@ ALPROTO_TELNET
Definition: app-layer-protos.h:63
ALPROTO_DOH2
@ ALPROTO_DOH2
Definition: app-layer-protos.h:66
name
const char * name
Definition: tm-threads.c:2135
SCReturnPtr
#define SCReturnPtr(x, type)
Definition: util-debug.h:287
AppLayerThreadCtx_::alpd_tctx
AppLayerProtoDetectThreadCtx * alpd_tctx
Definition: app-layer.c:60
StreamDataAvailableForProtoDetect
uint32_t StreamDataAvailableForProtoDetect(TcpStream *stream)
Definition: stream-tcp-reassemble.c:722
AppLayerGetCtxThread
AppLayerThreadCtx * AppLayerGetCtxThread(void)
Creates a new app layer thread context.
Definition: app-layer.c:1106
ALPROTO_TFTP
@ ALPROTO_TFTP
Definition: app-layer-protos.h:54
AppLayerThreadCtx_::ticks_start
uint64_t ticks_start
Definition: app-layer.c:65
AppLayerIncParserErrorCounter
void AppLayerIncParserErrorCounter(ThreadVars *tv, Flow *f)
Definition: app-layer.c:178
ALPROTO_HTTP2
@ ALPROTO_HTTP2
Definition: app-layer-protos.h:69
FTPMemcapGlobalCounter
uint64_t FTPMemcapGlobalCounter(void)
Definition: app-layer-ftp.c:83
FLOW_PKT_TOCLIENT
#define FLOW_PKT_TOCLIENT
Definition: flow.h:234
Flow_::alproto_expect
AppProto alproto_expect
Definition: flow.h:459
decode-events.h
UPDATE_DIR_OPPOSING
@ UPDATE_DIR_OPPOSING
Definition: stream-tcp-reassemble.h:57
AppLayerParserThreadCtxAlloc
AppLayerParserThreadCtx * AppLayerParserThreadCtxAlloc(void)
Gets a new app layer protocol's parser thread context.
Definition: app-layer-parser.c:295
TH_PUSH
#define TH_PUSH
Definition: decode-tcp.h:37
app-layer-frames.h
FAIL_IF
#define FAIL_IF(expr)
Fail a test if expression evaluates to true.
Definition: util-unittest.h:71
flags
uint8_t flags
Definition: decode-gre.h:0
AppLayerParserParse
int AppLayerParserParse(ThreadVars *tv, AppLayerParserThreadCtx *alp_tctx, Flow *f, AppProto alproto, uint8_t flags, const uint8_t *input, uint32_t input_len)
Definition: app-layer-parser.c:1300
StreamTcpDisableAppLayer
void StreamTcpDisableAppLayer(Flow *f)
Definition: stream-tcp-reassemble.c:447
suricata-common.h
FLOW_RESET_PE_DONE
#define FLOW_RESET_PE_DONE(f, dir)
Definition: flow.h:288
AppLayerProtoDetectDeSetup
int AppLayerProtoDetectDeSetup(void)
Cleans up the app layer protocol detection phase.
Definition: app-layer-detect-proto.c:1724
ALPROTO_HTTP1
@ ALPROTO_HTTP1
Definition: app-layer-protos.h:36
AppLayerDecoderEventsSetEventRaw
void AppLayerDecoderEventsSetEventRaw(AppLayerDecoderEvents **sevents, uint8_t event)
Set an app layer decoder event.
Definition: app-layer-events.c:94
ALPROTO_PGSQL
@ ALPROTO_PGSQL
Definition: app-layer-protos.h:62
IPPairGetMemuse
uint64_t IPPairGetMemuse(void)
Return memuse value.
Definition: ippair.c:92
Packet_::app_update_direction
uint8_t app_update_direction
Definition: decode.h:518
FLOW_PROTO_DETECT_TS_DONE
#define FLOW_PROTO_DETECT_TS_DONE
Definition: flow.h:104
ALPROTO_FTPDATA
@ ALPROTO_FTPDATA
Definition: app-layer-protos.h:53
AppLayerIncInternalErrorCounter
void AppLayerIncInternalErrorCounter(ThreadVars *tv, Flow *f)
Definition: app-layer.c:186
eps_error_summary
ExceptionPolicyCounters eps_error_summary
Definition: app-layer.c:103
FatalError
#define FatalError(...)
Definition: util-debug.h:502
APPLAYER_DETECT_PROTOCOL_ONLY_ONE_DIRECTION
@ APPLAYER_DETECT_PROTOCOL_ONLY_ONE_DIRECTION
Definition: app-layer-events.h:51
STREAMTCP_FLAG_MIDSTREAM_SYNACK
#define STREAMTCP_FLAG_MIDSTREAM_SYNACK
Definition: stream-tcp-private.h:174
applayer_counter_names
AppLayerCounterNames(* applayer_counter_names)[FLOW_PROTO_APPLAYER_MAX]
Definition: app-layer.c:99
ALPROTO_WEBSOCKET
@ ALPROTO_WEBSOCKET
Definition: app-layer-protos.h:64
TcpSession_::client
TcpStream client
Definition: stream-tcp-private.h:297
PKT_PROTO_DETECT_TC_DONE
#define PKT_PROTO_DETECT_TC_DONE
Definition: decode.h:1276
FrameConfigInit
void FrameConfigInit(void)
Definition: app-layer-frames.c:39
AppLayerParserGetStreamDepth
uint32_t AppLayerParserGetStreamDepth(const Flow *f)
Definition: app-layer-parser.c:1588
tv
ThreadVars * tv
Definition: fuzz_decodepcapfile.c:32
util-validate.h
FlowSwap
void FlowSwap(Flow *f)
swap the flow's direction
Definition: flow.c:245
StatsAddUI64
void StatsAddUI64(ThreadVars *tv, uint16_t id, uint64_t x)
Adds a value of type uint64_t to the local counter.
Definition: counters.c:146
AppLayerProtoDetectSupportedAppProtocols
void AppLayerProtoDetectSupportedAppProtocols(AppProto *alprotos)
Definition: app-layer-detect-proto.c:2110
AppLayerProtoDetectGetProto
AppProto AppLayerProtoDetectGetProto(AppLayerProtoDetectThreadCtx *tctx, Flow *f, const uint8_t *buf, uint32_t buflen, uint8_t ipproto, uint8_t flags, bool *reverse_flow)
Returns the app layer protocol given a buffer.
Definition: app-layer-detect-proto.c:1395
AppLayerProtoDetectGetCtxThread
AppLayerProtoDetectThreadCtx * AppLayerProtoDetectGetCtxThread(void)
Inits and returns an app layer protocol detection thread context.
Definition: app-layer-detect-proto.c:1969
TcpSession_::server
TcpStream server
Definition: stream-tcp-private.h:296
AppLayerProtoDetectGetProtoByName
AppProto AppLayerProtoDetectGetProtoByName(const char *alproto_name)
Definition: app-layer-detect-proto.c:2068
str
#define str(s)
Definition: suricata-common.h:300
SWAP_FLAGS
#define SWAP_FLAGS(flags, a, b)
Definition: suricata-common.h:426
ExceptionPolicyEnumToString
const char * ExceptionPolicyEnumToString(enum ExceptionPolicy policy, bool is_json)
Definition: util-exception-policy.c:39
SCFree
#define SCFree(p)
Definition: util-mem.h:61
AppLayerCounterNames_::gap_error
char gap_error[MAX_COUNTER_SIZE]
Definition: app-layer.c:81
Flow_::alproto_ts
AppProto alproto_ts
Definition: flow.h:451
ExceptionPolicyStatsSetts_::valid_settings_ips
bool valid_settings_ips[EXCEPTION_POLICY_MAX]
Definition: util-exception-policy-types.h:59
TcpSessionSetReassemblyDepth
void TcpSessionSetReassemblyDepth(TcpSession *ssn, uint32_t size)
Definition: stream-tcp.c:7105
Flow_::alstate
void * alstate
Definition: flow.h:479
AppLayerDestroyCtxThread
void AppLayerDestroyCtxThread(AppLayerThreadCtx *app_tctx)
Destroys the context created by AppLayerGetCtxThread().
Definition: app-layer.c:1127
PACKET_PROFILING_APP_START
#define PACKET_PROFILING_APP_START(dp, id)
Definition: util-profiling.h:167
HTPByteRangeMemcapGlobalCounter
uint64_t HTPByteRangeMemcapGlobalCounter(void)
Definition: app-layer-htp-range.c:55
Flow_::flags
uint32_t flags
Definition: flow.h:421
HTPMemcapGlobalCounter
uint64_t HTPMemcapGlobalCounter(void)
Definition: app-layer-htp-mem.c:86
ALPROTO_MQTT
@ ALPROTO_MQTT
Definition: app-layer-protos.h:61
AppLayerGetProtoName
const char * AppLayerGetProtoName(AppProto alproto)
Given the internal protocol id, returns a string representation of the protocol.
Definition: app-layer.c:1008
g_applayerparser_error_policy
enum ExceptionPolicy g_applayerparser_error_policy
Definition: app-layer-parser.c:153
ALPROTO_HTTP
@ ALPROTO_HTTP
Definition: app-layer-protos.h:75
AppLayerCounters_::eps_error
ExceptionPolicyCounters eps_error
Definition: app-layer.c:95
AppLayerIncTxCounter
void AppLayerIncTxCounter(ThreadVars *tv, Flow *f, uint64_t step)
Definition: app-layer.c:154
stream-tcp-util.h
ALPROTO_UNKNOWN
@ ALPROTO_UNKNOWN
Definition: app-layer-protos.h:29
ALPROTO_FAILED
@ ALPROTO_FAILED
Definition: app-layer-protos.h:33
ALPROTO_TEMPLATE
@ ALPROTO_TEMPLATE
Definition: app-layer-protos.h:67
AppLayerCounterNames_::internal_error
char internal_error[MAX_COUNTER_SIZE]
Definition: app-layer.c:83
TcpReassemblyThreadCtx_
Definition: stream-tcp-reassemble.h:61
SCReturnCT
#define SCReturnCT(x, type)
Definition: util-debug.h:285
app-layer-protos.h
AppLayerProfilingReset
#define AppLayerProfilingReset(app_tctx)
Definition: app-layer.h:127
app-layer-htp-mem.h
EngineModeIsIPS
int EngineModeIsIPS(void)
Definition: suricata.c:234
STREAMTCP_FLAG_APP_LAYER_DISABLED
#define STREAMTCP_FLAG_APP_LAYER_DISABLED
Definition: stream-tcp-private.h:201
STREAMTCP_STREAM_FLAG_NOREASSEMBLY
#define STREAMTCP_STREAM_FLAG_NOREASSEMBLY
Definition: stream-tcp-private.h:219
suricata.h
ALPROTO_RFB
@ ALPROTO_RFB
Definition: app-layer-protos.h:60
TEST_END
#define TEST_END
Definition: app-layer.c:1465
StreamUpdateDir
StreamUpdateDir
Definition: stream-tcp-reassemble.h:54
AppLayerProtoDetectDestroyCtxThread
void AppLayerProtoDetectDestroyCtxThread(AppLayerProtoDetectThreadCtx *alpd_tctx)
Destroys the app layer protocol detection thread context.
Definition: app-layer-detect-proto.c:2022
ALPROTO_BITTORRENT_DHT
@ ALPROTO_BITTORRENT_DHT
Definition: app-layer-protos.h:70
ALPROTO_NTP
@ ALPROTO_NTP
Definition: app-layer-protos.h:52
ALPROTO_SMB
@ ALPROTO_SMB
Definition: app-layer-protos.h:43
likely
#define likely(expr)
Definition: util-optimize.h:32
AppLayerParserThreadCtx_
Definition: app-layer-parser.c:58
AppLayerCounterNames_::name
char name[MAX_COUNTER_SIZE]
Definition: app-layer.c:79
FlowChangeProto
int FlowChangeProto(Flow *f)
Check if change proto flag is set for flow.
Definition: flow.c:195
TcpSession_
Definition: stream-tcp-private.h:283
FrameConfigDeInit
void FrameConfigDeInit(void)
Definition: app-layer-frames.c:50
TcpSession_::data_first_seen_dir
int8_t data_first_seen_dir
Definition: stream-tcp-private.h:288
flow.h
Flow_::alproto_tc
AppProto alproto_tc
Definition: flow.h:452
FLOW_PROTO_CHANGE_MAX_DEPTH
#define FLOW_PROTO_CHANGE_MAX_DEPTH
Definition: app-layer.c:75
AppLayerProtoDetectPrepareState
int AppLayerProtoDetectPrepareState(void)
Prepares the internal state for protocol detection. This needs to be called once all the patterns and...
Definition: app-layer-detect-proto.c:1483
Flow_::alproto
AppProto alproto
application level protocol
Definition: flow.h:450
ExceptionPolicy
ExceptionPolicy
Definition: util-exception-policy-types.h:25
StatsRegisterCounter
uint16_t StatsRegisterCounter(const char *name, struct ThreadVars_ *tv)
Registers a normal, unqualified counter.
Definition: counters.c:952
SCCalloc
#define SCCalloc(nm, sz)
Definition: util-mem.h:53
AppLayerCounterNames_::alloc_error
char alloc_error[MAX_COUNTER_SIZE]
Definition: app-layer.c:84
SCReturnInt
#define SCReturnInt(x)
Definition: util-debug.h:275
PACKET_PROFILING_APP_RESET
#define PACKET_PROFILING_APP_RESET(dp)
Definition: util-profiling.h:195
APPLAYER_WRONG_DIRECTION_FIRST_DATA
@ APPLAYER_WRONG_DIRECTION_FIRST_DATA
Definition: app-layer-events.h:50
AppLayerDeSetupCounters
void AppLayerDeSetupCounters(void)
Definition: app-layer.c:1369
DEBUG_VALIDATE_BUG_ON
#define DEBUG_VALIDATE_BUG_ON(exp)
Definition: util-validate.h:102
ALPROTO_NFS
@ ALPROTO_NFS
Definition: app-layer-protos.h:51
ExceptionPolicyStatsSetts_::eps_name
char eps_name[EXCEPTION_POLICY_MAX][EXCEPTION_POLICY_COUNTER_MAX_LEN]
Definition: util-exception-policy-types.h:57
STREAMTCP_STREAM_FLAG_APPPROTO_DETECTION_COMPLETED
#define STREAMTCP_STREAM_FLAG_APPPROTO_DETECTION_COMPLETED
Definition: stream-tcp-private.h:232
AppLayerProtoDetectGetProtoName
const char * AppLayerProtoDetectGetProtoName(AppProto alproto)
Definition: app-layer-detect-proto.c:2093
app-layer.h
Flow_::de_ctx_version
uint32_t de_ctx_version
Definition: flow.h:464