suricata
app-layer.c
Go to the documentation of this file.
1 /* Copyright (C) 2007-2024 Open Information Security Foundation
2  *
3  * You can copy, redistribute or modify this Program under the terms of
4  * the GNU General Public License version 2 as published by the Free
5  * Software Foundation.
6  *
7  * This program is distributed in the hope that it will be useful,
8  * but WITHOUT ANY WARRANTY; without even the implied warranty of
9  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
10  * GNU General Public License for more details.
11  *
12  * You should have received a copy of the GNU General Public License
13  * version 2 along with this program; if not, write to the Free Software
14  * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA
15  * 02110-1301, USA.
16  */
17 
18 /**
19  * \file
20  *
21  * \author Victor Julien <victor@inliniac.net>
22  * \author Anoop Saldanha <anoopsaldanha@gmail.com>
23  *
24  * Generic App-layer functions
25  */
26 
27 #include "suricata-common.h"
28 #include "suricata.h"
29 #include "app-layer.h"
30 #include "app-layer-parser.h"
31 #include "app-layer-protos.h"
32 #include "app-layer-expectation.h"
33 #include "app-layer-ftp.h"
34 #include "app-layer-htp-range.h"
35 #include "app-layer-detect-proto.h"
36 #include "app-layer-frames.h"
37 #include "app-layer-events.h"
38 #include "stream-tcp-reassemble.h"
39 #include "stream-tcp-private.h"
40 #include "stream-tcp-inline.h"
41 #include "stream-tcp.h"
42 #include "flow.h"
43 #include "flow-util.h"
44 #include "flow-private.h"
45 #include "ippair.h"
46 #include "util-debug.h"
47 #include "util-print.h"
48 #include "util-profiling.h"
49 #include "util-validate.h"
50 #include "decode-events.h"
51 #include "app-layer-htp-mem.h"
52 #include "util-exception-policy.h"
53 
55 /**
56  * \brief This is for the app layer in general and it contains per thread
57  * context relevant to both the alpd and alp.
58  */
60  /* App layer protocol detection thread context, from AppLayerProtoDetectGetCtxThread(). */
62  /* App layer parser thread context, from AppLayerParserThreadCtxAlloc(). */
64 
65 #ifdef PROFILING
66  uint64_t ticks_start;
67  uint64_t ticks_end;
68  uint64_t ticks_spent;
73 #endif
74 };
75 
76 #define FLOW_PROTO_CHANGE_MAX_DEPTH 4096
77 
78 #define MAX_COUNTER_SIZE 64
79 typedef struct AppLayerCounterNames_ {
88 
89 typedef struct AppLayerCounters_ {
90  uint16_t counter_id;
91  uint16_t counter_tx_id;
92  uint16_t gap_error_id;
93  uint16_t parser_error_id;
95  uint16_t alloc_error_id;
98 
99 /* counter names. Only used at init. */
101 /* counter id's. Used that runtime. */
103 /* Exception policy global counters ids */
105 
106 /* Settings order as in the enum */
107 // clang-format off
109  .valid_settings_ids = {
110  /* EXCEPTION_POLICY_NOT_SET */ false,
111  /* EXCEPTION_POLICY_AUTO */ false,
112  /* EXCEPTION_POLICY_PASS_PACKET */ true,
113  /* EXCEPTION_POLICY_PASS_FLOW */ true,
114  /* EXCEPTION_POLICY_BYPASS_FLOW */ true,
115  /* EXCEPTION_POLICY_DROP_PACKET */ false,
116  /* EXCEPTION_POLICY_DROP_FLOW */ false,
117  /* EXCEPTION_POLICY_REJECT */ true,
118  },
119  .valid_settings_ips = {
120  /* EXCEPTION_POLICY_NOT_SET */ false,
121  /* EXCEPTION_POLICY_AUTO */ false,
122  /* EXCEPTION_POLICY_PASS_PACKET */ true,
123  /* EXCEPTION_POLICY_PASS_FLOW */ true,
124  /* EXCEPTION_POLICY_BYPASS_FLOW */ true,
125  /* EXCEPTION_POLICY_DROP_PACKET */ true,
126  /* EXCEPTION_POLICY_DROP_FLOW */ true,
127  /* EXCEPTION_POLICY_REJECT */ true,
128  },
129 };
130 // clang-format on
131 
132 void AppLayerSetupCounters(void);
133 void AppLayerDeSetupCounters(void);
134 
135 /***** L7 layer dispatchers *****/
136 
137 static inline int ProtoDetectDone(const Flow *f, const TcpSession *ssn, uint8_t direction) {
138  const TcpStream *stream = (direction & STREAM_TOSERVER) ? &ssn->client : &ssn->server;
140  (FLOW_IS_PM_DONE(f, direction) && FLOW_IS_PP_DONE(f, direction)));
141 }
142 
143 /**
144  * \note id can be 0 if protocol parser is disabled but detection
145  * is enabled.
146  */
147 static void AppLayerIncFlowCounter(ThreadVars *tv, Flow *f)
148 {
149  const uint16_t id = applayer_counters[f->alproto][f->protomap].counter_id;
150  if (likely(tv && id > 0)) {
151  StatsIncr(tv, id);
152  }
153 }
154 
155 void AppLayerIncTxCounter(ThreadVars *tv, Flow *f, uint64_t step)
156 {
157  const uint16_t id = applayer_counters[f->alproto][f->protomap].counter_tx_id;
158  if (likely(tv && id > 0)) {
159  StatsAddUI64(tv, id, step);
160  }
161 }
162 
164 {
165  const uint16_t id = applayer_counters[f->alproto][f->protomap].gap_error_id;
166  if (likely(tv && id > 0)) {
167  StatsIncr(tv, id);
168  }
169 }
170 
172 {
173  const uint16_t id = applayer_counters[f->alproto][f->protomap].alloc_error_id;
174  if (likely(tv && id > 0)) {
175  StatsIncr(tv, id);
176  }
177 }
178 
180 {
181  const uint16_t id = applayer_counters[f->alproto][f->protomap].parser_error_id;
182  if (likely(tv && id > 0)) {
183  StatsIncr(tv, id);
184  }
185 }
186 
188 {
189  const uint16_t id = applayer_counters[f->alproto][f->protomap].internal_error_id;
190  if (likely(tv && id > 0)) {
191  StatsIncr(tv, id);
192  }
193 }
194 
195 static void AppLayerIncrErrorExcPolicyCounter(ThreadVars *tv, Flow *f, enum ExceptionPolicy policy)
196 {
197 #ifdef UNITTESTS
198  if (tv == NULL) {
199  return;
200  }
201 #endif
202  uint16_t id = applayer_counters[f->alproto][f->protomap].eps_error.eps_id[policy];
203  /* for the summary values */
204  uint16_t g_id = eps_error_summary.eps_id[policy];
205 
206  if (likely(id > 0)) {
207  StatsIncr(tv, id);
208  }
209  if (likely(g_id > 0)) {
210  StatsIncr(tv, g_id);
211  }
212 }
213 
214 /* in IDS mode protocol detection is done in reverse order:
215  * when TCP data is ack'd. We want to flag the correct packet,
216  * so in this case we set a flag in the flow so that the first
217  * packet in the correct direction can be tagged.
218  *
219  * For IPS we update packet and flow. */
220 static inline void FlagPacketFlow(Packet *p, Flow *f, uint8_t flags)
221 {
222  if (p->proto != IPPROTO_TCP || EngineModeIsIPS()) {
223  if (flags & STREAM_TOSERVER) {
224  if (p->flowflags & FLOW_PKT_TOSERVER) {
227  } else {
229  }
230  } else {
231  if (p->flowflags & FLOW_PKT_TOCLIENT) {
234  } else {
236  }
237  }
238  } else {
239  if (flags & STREAM_TOSERVER) {
241  } else {
243  }
244  }
245 }
246 
247 static void DisableAppLayer(ThreadVars *tv, Flow *f, Packet *p)
248 {
249  SCLogDebug("disable app layer for flow %p alproto %u ts %u tc %u",
250  f, f->alproto, f->alproto_ts, f->alproto_tc);
253  TcpSession *ssn = f->protoctx;
255  f->alproto = ALPROTO_FAILED;
256  AppLayerIncFlowCounter(tv, f);
257 
258  if (f->alproto_tc != ALPROTO_FAILED) {
259  if (f->alproto_tc == ALPROTO_UNKNOWN) {
261  }
262  FlagPacketFlow(p, f, STREAM_TOCLIENT);
263  }
264  if (f->alproto_ts != ALPROTO_FAILED) {
265  if (f->alproto_ts == ALPROTO_UNKNOWN) {
267  }
268  FlagPacketFlow(p, f, STREAM_TOSERVER);
269  }
270  SCLogDebug("disabled app layer for flow %p alproto %u ts %u tc %u",
271  f, f->alproto, f->alproto_ts, f->alproto_tc);
272 }
273 
274 /* See if we're going to have to give up:
275  *
276  * If we're getting a lot of data in one direction and the
277  * proto for this direction is unknown, proto detect will
278  * hold up segments in the segment list in the stream.
279  * They are held so that if we detect the protocol on the
280  * opposing stream, we can still parse this side of the stream
281  * as well. However, some sessions are very unbalanced. FTP
282  * data channels, large PUT/POST request and many others, can
283  * lead to cases where we would have to store many megabytes
284  * worth of segments before we see the opposing stream. This
285  * leads to risks of resource starvation.
286  *
287  * Here a cutoff point is enforced. If we've stored 100k in
288  * one direction and we've seen no data in the other direction,
289  * we give up.
290  *
291  * Giving up means we disable applayer an set an applayer event
292  */
293 static void TCPProtoDetectCheckBailConditions(ThreadVars *tv,
294  Flow *f, TcpSession *ssn, Packet *p)
295 {
296  if (ssn->state < TCP_ESTABLISHED) {
297  SCLogDebug("skip as long as TCP is not ESTABLISHED (TCP fast open)");
298  return;
299  }
300 
301  const uint32_t size_ts = StreamDataAvailableForProtoDetect(&ssn->client);
302  const uint32_t size_tc = StreamDataAvailableForProtoDetect(&ssn->server);
303  SCLogDebug("size_ts %" PRIu32 ", size_tc %" PRIu32, size_ts, size_tc);
304 
305  /* at least 100000 whatever the conditions
306  * and can be more if window is bigger and if configuration allows it */
307  const uint32_t size_tc_limit =
309  const uint32_t size_ts_limit =
311 
312  if (ProtoDetectDone(f, ssn, STREAM_TOSERVER) &&
313  ProtoDetectDone(f, ssn, STREAM_TOCLIENT))
314  {
315  goto failure;
316 
317  /* we bail out whatever the pp and pm states if
318  * we received too much data */
319  } else if (size_tc > 2 * size_tc_limit || size_ts > 2 * size_ts_limit) {
321  goto failure;
322 
323  } else if (FLOW_IS_PM_DONE(f, STREAM_TOSERVER) && FLOW_IS_PP_DONE(f, STREAM_TOSERVER) &&
324  size_ts > size_ts_limit && size_tc == 0) {
326  goto failure;
327 
328  } else if (FLOW_IS_PM_DONE(f, STREAM_TOCLIENT) && FLOW_IS_PP_DONE(f, STREAM_TOCLIENT) &&
329  size_tc > size_tc_limit && size_ts == 0) {
331  goto failure;
332 
333  /* little data in ts direction, pp done, pm not done (max
334  * depth not reached), ts direction done, lots of data in
335  * tc direction. */
336  } else if (size_tc > size_tc_limit && FLOW_IS_PP_DONE(f, STREAM_TOSERVER) &&
337  !(FLOW_IS_PM_DONE(f, STREAM_TOSERVER)) && FLOW_IS_PM_DONE(f, STREAM_TOCLIENT) &&
338  FLOW_IS_PP_DONE(f, STREAM_TOCLIENT)) {
340  goto failure;
341 
342  /* little data in tc direction, pp done, pm not done (max
343  * depth not reached), tc direction done, lots of data in
344  * ts direction. */
345  } else if (size_ts > size_ts_limit && FLOW_IS_PP_DONE(f, STREAM_TOCLIENT) &&
346  !(FLOW_IS_PM_DONE(f, STREAM_TOCLIENT)) && FLOW_IS_PM_DONE(f, STREAM_TOSERVER) &&
347  FLOW_IS_PP_DONE(f, STREAM_TOSERVER)) {
349  goto failure;
350  }
351  return;
352 
353 failure:
354  DisableAppLayer(tv, f, p);
355 }
356 
357 static int TCPProtoDetectTriggerOpposingSide(ThreadVars *tv, TcpReassemblyThreadCtx *ra_ctx,
358  Packet *p, TcpSession *ssn, const TcpStream *stream)
359 {
360  TcpStream *opposing_stream = NULL;
361  if (stream == &ssn->client) {
362  opposing_stream = &ssn->server;
363  } else {
364  opposing_stream = &ssn->client;
365  }
366 
367  /* if the opposing side is not going to work, then
368  * we just have to give up. */
369  if (opposing_stream->flags & STREAMTCP_STREAM_FLAG_NOREASSEMBLY) {
370  SCLogDebug("opposing dir has STREAMTCP_STREAM_FLAG_NOREASSEMBLY set");
371  return -1;
372  }
373 
374  enum StreamUpdateDir dir = StreamTcpInlineMode() ?
377  int ret = StreamTcpReassembleAppLayer(tv, ra_ctx, ssn,
378  opposing_stream, p, dir);
379  return ret;
380 }
381 
383 
384 /** \todo data const
385  * \retval int -1 error
386  * \retval int 0 ok
387  */
388 static int TCPProtoDetect(ThreadVars *tv, TcpReassemblyThreadCtx *ra_ctx,
389  AppLayerThreadCtx *app_tctx, Packet *p, Flow *f, TcpSession *ssn, TcpStream **stream,
390  uint8_t *data, uint32_t data_len, uint8_t flags, enum StreamUpdateDir app_update_dir)
391 {
392  AppProto *alproto;
393  AppProto *alproto_otherdir;
394  uint8_t direction = (flags & STREAM_TOSERVER) ? 0 : 1;
395 
396  if (flags & STREAM_TOSERVER) {
397  alproto = &f->alproto_ts;
398  alproto_otherdir = &f->alproto_tc;
399  } else {
400  alproto = &f->alproto_tc;
401  alproto_otherdir = &f->alproto_ts;
402  }
403 
404  SCLogDebug("Stream initializer (len %" PRIu32 ")", data_len);
405 #ifdef PRINT
406  if (data_len > 0) {
407  printf("=> Init Stream Data (app layer) -- start %s%s\n",
408  flags & STREAM_TOCLIENT ? "toclient" : "",
409  flags & STREAM_TOSERVER ? "toserver" : "");
410  PrintRawDataFp(stdout, data, data_len);
411  printf("=> Init Stream Data -- end\n");
412  }
413 #endif
414 
415  bool reverse_flow = false;
416  DEBUG_VALIDATE_BUG_ON(data == NULL && data_len > 0);
418  *alproto = AppLayerProtoDetectGetProto(app_tctx->alpd_tctx,
419  f, data, data_len,
420  IPPROTO_TCP, flags, &reverse_flow);
421  PACKET_PROFILING_APP_PD_END(app_tctx);
422  SCLogDebug("alproto %u rev %s", *alproto, reverse_flow ? "true" : "false");
423 
424  if (*alproto != ALPROTO_UNKNOWN) {
425  if (*alproto_otherdir != ALPROTO_UNKNOWN && *alproto_otherdir != *alproto) {
428 
430  /* if we already invoked the parser, we go with that proto */
431  f->alproto = *alproto_otherdir;
432  } else {
433  /* no data sent to parser yet, we can still choose
434  * we're trusting the server more. */
435  if (flags & STREAM_TOCLIENT)
436  f->alproto = *alproto;
437  else
438  f->alproto = *alproto_otherdir;
439  }
440  } else {
441  f->alproto = *alproto;
442  }
443 
447  FlagPacketFlow(p, f, flags);
448 
449  /* if protocol detection indicated that we need to reverse
450  * the direction of the flow, do it now. We flip the flow,
451  * packet and the direction flags */
452  if (reverse_flow &&
455  /* but only if we didn't already detect it on the other side. */
456  if (*alproto_otherdir == ALPROTO_UNKNOWN) {
457  SCLogDebug("reversing flow after proto detect told us so");
458  PacketSwap(p);
459  FlowSwap(f);
460  // Will reset signature groups in DetectRunSetup
461  f->de_ctx_version = UINT32_MAX;
462  SWAP_FLAGS(flags, STREAM_TOSERVER, STREAM_TOCLIENT);
463  if (*stream == &ssn->client) {
464  *stream = &ssn->server;
465  } else {
466  *stream = &ssn->client;
467  }
468  direction = 1 - direction;
469  } else {
470  // TODO event, error?
471  }
472  }
473 
474  /* account flow if we have both sides */
475  if (*alproto_otherdir != ALPROTO_UNKNOWN) {
476  AppLayerIncFlowCounter(tv, f);
477  }
478 
479  /* if we have seen data from the other direction first, send
480  * data for that direction first to the parser. This shouldn't
481  * be an issue, since each stream processing happens
482  * independently of the other stream direction. At this point of
483  * call, you need to know that this function's already being
484  * called by the very same StreamReassembly() function that we
485  * will now call shortly for the opposing direction. */
486  if ((ssn->data_first_seen_dir & (STREAM_TOSERVER | STREAM_TOCLIENT)) &&
487  !(flags & ssn->data_first_seen_dir))
488  {
489  SCLogDebug("protocol %s needs first data in other direction",
490  AppProtoToString(*alproto));
491 
492  if (TCPProtoDetectTriggerOpposingSide(tv, ra_ctx,
493  p, ssn, *stream) != 0)
494  {
495  goto detect_error;
496  }
497  if (FlowChangeProto(f)) {
498  /* We have the first data which requested a protocol change from P1 to P2
499  * even if it was not recognized at first as being P1
500  * As the second data was recognized as P1, the protocol did not change !
501  */
505  }
506  }
507 
508  /* if the parser operates such that it needs to see data from
509  * a particular direction first, we check if we have seen
510  * data from that direction first for the flow. IF it is not
511  * the same, we set an event and exit.
512  *
513  * \todo We need to figure out a more robust solution for this,
514  * as this can lead to easy evasion tactics, where the
515  * attacker can first send some dummy data in the wrong
516  * direction first to mislead our proto detection process.
517  * While doing this we need to update the parsers as well,
518  * since the parsers must be robust to see such wrong
519  * direction data.
520  * Either ways the moment we see the
521  * APPLAYER_WRONG_DIRECTION_FIRST_DATA event set for the
522  * flow, it shows something's fishy.
523  */
525  uint8_t first_data_dir;
526  first_data_dir = AppLayerParserGetFirstDataDir(f->proto, f->alproto);
527 
528  if (first_data_dir && !(first_data_dir & ssn->data_first_seen_dir)) {
531  goto detect_error;
532  }
533  /* This can happen if the current direction is not the
534  * right direction, and the data from the other(also
535  * the right direction) direction is available to be sent
536  * to the app layer, but it is not ack'ed yet and hence
537  * the forced call to STreamTcpAppLayerReassemble still
538  * hasn't managed to send data from the other direction
539  * to the app layer. */
540  if (first_data_dir && !(first_data_dir & flags)) {
546  SCReturnInt(-1);
547  }
548  }
549 
550  /* Set a value that is neither STREAM_TOSERVER, nor STREAM_TOCLIENT */
552 
553  /* finally, invoke the parser */
554  PACKET_PROFILING_APP_START(app_tctx, f->alproto);
555  int r = AppLayerParserParse(tv, app_tctx->alp_tctx, f, f->alproto,
556  flags, data, data_len);
557  PACKET_PROFILING_APP_END(app_tctx);
558  p->app_update_direction = (uint8_t)app_update_dir;
559  if (r != 1) {
560  StreamTcpUpdateAppLayerProgress(ssn, direction, data_len);
561  }
562  if (r == 0) {
563  if (*alproto_otherdir == ALPROTO_UNKNOWN) {
564  TcpStream *opposing_stream;
565  if (*stream == &ssn->client) {
566  opposing_stream = &ssn->server;
567  } else {
568  opposing_stream = &ssn->client;
569  }
571  // can happen in detection-only
572  AppLayerIncFlowCounter(tv, f);
573  }
574  }
575  }
576  if (r < 0) {
577  goto parser_error;
578  }
579  } else {
580  /* if the ssn is midstream, we may end up with a case where the
581  * start of an HTTP request is missing. We won't detect HTTP based
582  * on the request. However, the reply is fine, so we detect
583  * HTTP anyway. This leads to passing the incomplete request to
584  * the htp parser.
585  *
586  * This has been observed, where the http parser then saw many
587  * bogus requests in the incomplete data.
588  *
589  * To counter this case, a midstream session MUST find it's
590  * protocol in the toserver direction. If not, we assume the
591  * start of the request/toserver is incomplete and no reliable
592  * detection and parsing is possible. So we give up.
593  */
594  if ((ssn->flags & STREAMTCP_FLAG_MIDSTREAM) &&
596  {
597  if (FLOW_IS_PM_DONE(f, STREAM_TOSERVER) && FLOW_IS_PP_DONE(f, STREAM_TOSERVER)) {
598  SCLogDebug("midstream end pd %p", ssn);
599  /* midstream and toserver detection failed: give up */
600  DisableAppLayer(tv, f, p);
601  SCReturnInt(0);
602  }
603  }
604 
605  if (*alproto_otherdir != ALPROTO_UNKNOWN) {
606  uint8_t first_data_dir;
607  first_data_dir = AppLayerParserGetFirstDataDir(f->proto, *alproto_otherdir);
608 
609  /* this would handle this test case -
610  * http parser which says it wants to see toserver data first only.
611  * tcp handshake
612  * toclient data first received. - RUBBISH DATA which
613  * we don't detect as http
614  * toserver data next sent - we detect this as http.
615  * at this stage we see that toclient is the first data seen
616  * for this session and we try and redetect the app protocol,
617  * but we are unable to detect the app protocol like before.
618  * But since we have managed to detect the protocol for the
619  * other direction as http, we try to use that. At this
620  * stage we check if the direction of this stream matches
621  * to that acceptable by the app parser. If it is not the
622  * acceptable direction we error out.
623  */
625  (first_data_dir) && !(first_data_dir & flags))
626  {
627  goto detect_error;
628  }
629 
630  /* if protocol detection is marked done for our direction we
631  * pass our data on. We're only succeeded in finding one
632  * direction: the opposing stream
633  *
634  * If PD was not yet complete, we don't do anything.
635  */
636  if (FLOW_IS_PM_DONE(f, flags) && FLOW_IS_PP_DONE(f, flags)) {
637  if (data_len > 0)
639 
640  if (*alproto_otherdir != ALPROTO_FAILED) {
641  PACKET_PROFILING_APP_START(app_tctx, f->alproto);
642  int r = AppLayerParserParse(tv, app_tctx->alp_tctx, f,
643  f->alproto, flags,
644  data, data_len);
645  PACKET_PROFILING_APP_END(app_tctx);
646  p->app_update_direction = (uint8_t)app_update_dir;
647  if (r != 1) {
648  StreamTcpUpdateAppLayerProgress(ssn, direction, data_len);
649  }
650 
655  AppLayerIncFlowCounter(tv, f);
656 
657  *alproto = *alproto_otherdir;
658  SCLogDebug("packet %"PRIu64": pd done(us %u them %u), parser called (r==%d), APPLAYER_DETECT_PROTOCOL_ONLY_ONE_DIRECTION set",
659  p->pcap_cnt, *alproto, *alproto_otherdir, r);
660  if (r < 0) {
661  goto parser_error;
662  }
663  }
664  *alproto = ALPROTO_FAILED;
666  FlagPacketFlow(p, f, flags);
667 
668  } else if (flags & STREAM_EOF) {
669  *alproto = f->alproto;
671  AppLayerIncFlowCounter(tv, f);
672  }
673  } else {
674  /* both sides unknown, let's see if we need to give up */
675  if (FlowChangeProto(f)) {
676  /* TCPProtoDetectCheckBailConditions does not work well because
677  * size_tc from STREAM_RIGHT_EDGE is not reset to zero
678  * so, we set a lower limit to the data we inspect
679  * We could instead have set ssn->server.sb.stream_offset = 0;
680  */
681  if (data_len >= FLOW_PROTO_CHANGE_MAX_DEPTH || (flags & STREAM_EOF)) {
682  DisableAppLayer(tv, f, p);
683  }
684  } else {
685  TCPProtoDetectCheckBailConditions(tv, f, ssn, p);
686  }
687  }
688  }
689  SCReturnInt(0);
690 parser_error:
692  AppLayerIncrErrorExcPolicyCounter(tv, f, g_applayerparser_error_policy);
693  SCReturnInt(-1);
694 detect_error:
695  DisableAppLayer(tv, f, p);
696  SCReturnInt(-2);
697 }
698 
699 /** \brief handle TCP data for the app-layer.
700  *
701  * First run protocol detection and then when the protocol is known invoke
702  * the app layer parser.
703  *
704  * \param stream ptr-to-ptr to stream object. Might change if flow dir is
705  * reversed.
706  */
708  TcpSession *ssn, TcpStream **stream, uint8_t *data, uint32_t data_len, uint8_t flags,
709  enum StreamUpdateDir app_update_dir)
710 {
711  SCEnter();
712 
714  DEBUG_VALIDATE_BUG_ON(data_len > (uint32_t)INT_MAX);
715 
716  AppLayerThreadCtx *app_tctx = ra_ctx->app_tctx;
717  AppProto alproto;
718  int r = 0;
719 
720  SCLogDebug("data_len %u flags %02X", data_len, flags);
722  SCLogDebug("STREAMTCP_FLAG_APP_LAYER_DISABLED is set");
723  goto end;
724  }
725 
726  const uint8_t direction = (flags & STREAM_TOSERVER) ? 0 : 1;
727 
728  if (flags & STREAM_TOSERVER) {
729  alproto = f->alproto_ts;
730  } else {
731  alproto = f->alproto_tc;
732  }
733 
734  /* If a gap notification, relay the notification on to the
735  * app-layer if known. */
736  if (flags & STREAM_GAP) {
737  SCLogDebug("GAP of size %u", data_len);
738  if (alproto == ALPROTO_UNKNOWN) {
740  SCLogDebug("ALPROTO_UNKNOWN flow %p, due to GAP in stream start", f);
741  /* if the other side didn't already find the proto, we're done */
742  if (f->alproto == ALPROTO_UNKNOWN) {
743  goto failure;
744  }
745  AppLayerIncFlowCounter(tv, f);
746  }
747  if (FlowChangeProto(f)) {
749  SCLogDebug("Cannot handle gap while changing protocol");
750  goto failure;
751  }
752  PACKET_PROFILING_APP_START(app_tctx, f->alproto);
753  r = AppLayerParserParse(tv, app_tctx->alp_tctx, f, f->alproto,
754  flags, data, data_len);
755  PACKET_PROFILING_APP_END(app_tctx);
756  p->app_update_direction = (uint8_t)app_update_dir;
757  /* ignore parser result for gap */
758  StreamTcpUpdateAppLayerProgress(ssn, direction, data_len);
759  if (r < 0) {
761  AppLayerIncrErrorExcPolicyCounter(tv, f, g_applayerparser_error_policy);
762  SCReturnInt(-1);
763  }
764  goto end;
765  }
766 
767  /* if we don't know the proto yet and we have received a stream
768  * initializer message, we run proto detection.
769  * We receive 2 stream init msgs (one for each direction), we
770  * only run the proto detection for both and emit an event
771  * in the case protocols mismatch. */
772  if (alproto == ALPROTO_UNKNOWN && (flags & STREAM_START)) {
774  /* run protocol detection */
775  if (TCPProtoDetect(tv, ra_ctx, app_tctx, p, f, ssn, stream, data, data_len, flags,
776  app_update_dir) != 0) {
777  goto failure;
778  }
779  } else if (alproto != ALPROTO_UNKNOWN && FlowChangeProto(f)) {
780  SCLogDebug("protocol change, old %s", AppProtoToString(f->alproto_orig));
781  void *alstate_orig = f->alstate;
782  AppLayerParserState *alparser = f->alparser;
783  // we delay AppLayerParserStateCleanup because we may need previous parser state
787  /* rerun protocol detection */
788  int rd = TCPProtoDetect(
789  tv, ra_ctx, app_tctx, p, f, ssn, stream, data, data_len, flags, app_update_dir);
790  if (f->alproto == ALPROTO_UNKNOWN) {
791  DEBUG_VALIDATE_BUG_ON(alstate_orig != f->alstate);
792  // not enough data, revert AppLayerProtoDetectReset to rerun detection
793  f->alparser = alparser;
794  f->alproto = f->alproto_orig;
795  f->alproto_tc = f->alproto_orig;
796  f->alproto_ts = f->alproto_orig;
797  } else {
799  AppLayerParserStateProtoCleanup(f->protomap, f->alproto_orig, alstate_orig, alparser);
800  if (alstate_orig == f->alstate) {
801  // we just freed it
802  f->alstate = NULL;
803  }
804  }
805  if (rd != 0) {
806  SCLogDebug("proto detect failure");
807  goto failure;
808  }
809  SCLogDebug("protocol change, old %s, new %s",
811 
813  f->alproto != f->alproto_expect) {
815 
816  if (f->alproto_expect == ALPROTO_TLS && f->alproto != ALPROTO_TLS) {
819  }
820  }
821  } else {
822  SCLogDebug("stream data (len %" PRIu32 " alproto "
823  "%"PRIu16" (flow %p)", data_len, f->alproto, f);
824 #ifdef PRINT
825  if (data_len > 0) {
826  printf("=> Stream Data (app layer) -- start %s%s\n",
827  flags & STREAM_TOCLIENT ? "toclient" : "",
828  flags & STREAM_TOSERVER ? "toserver" : "");
829  PrintRawDataFp(stdout, data, data_len);
830  printf("=> Stream Data -- end\n");
831  }
832 #endif
833  /* if we don't have a data object here we are not getting it
834  * a start msg should have gotten us one */
835  if (f->alproto != ALPROTO_UNKNOWN) {
836  PACKET_PROFILING_APP_START(app_tctx, f->alproto);
837  r = AppLayerParserParse(tv, app_tctx->alp_tctx, f, f->alproto,
838  flags, data, data_len);
839  PACKET_PROFILING_APP_END(app_tctx);
840  p->app_update_direction = (uint8_t)app_update_dir;
841  if (r != 1) {
842  StreamTcpUpdateAppLayerProgress(ssn, direction, data_len);
843  if (r < 0) {
846  AppLayerIncrErrorExcPolicyCounter(tv, f, g_applayerparser_error_policy);
847  SCReturnInt(-1);
848  }
849  }
850  }
851  }
852 
853  goto end;
854  failure:
855  r = -1;
856  end:
857  SCReturnInt(r);
858 }
859 
860 /**
861  * \brief Handle a app layer UDP message
862  *
863  * If the protocol is yet unknown, the proto detection code is run first.
864  *
865  * \param dp_ctx Thread app layer detect context
866  * \param f *locked* flow
867  * \param p UDP packet
868  *
869  * \retval 0 ok
870  * \retval -1 error
871  */
873 {
874  SCEnter();
875  AppProto *alproto;
876  AppProto *alproto_otherdir;
877 
878  if (f->alproto_ts == ALPROTO_FAILED && f->alproto_tc == ALPROTO_FAILED) {
879  SCReturnInt(0);
880  }
881 
882  int r = 0;
883  uint8_t flags = 0;
884  if (p->flowflags & FLOW_PKT_TOSERVER) {
885  flags |= STREAM_TOSERVER;
886  alproto = &f->alproto_ts;
887  alproto_otherdir = &f->alproto_tc;
888  } else {
889  flags |= STREAM_TOCLIENT;
890  alproto = &f->alproto_tc;
891  alproto_otherdir = &f->alproto_ts;
892  }
893 
895 
896  /* if the protocol is still unknown, run detection */
897  if (*alproto == ALPROTO_UNKNOWN) {
898  SCLogDebug("Detecting AL proto on udp mesg (len %" PRIu32 ")",
899  p->payload_len);
900 
901  bool reverse_flow = false;
903  *alproto = AppLayerProtoDetectGetProto(
904  tctx->alpd_tctx, f, p->payload, p->payload_len, IPPROTO_UDP, flags, &reverse_flow);
906 
907  switch (*alproto) {
908  case ALPROTO_UNKNOWN:
909  if (*alproto_otherdir != ALPROTO_UNKNOWN) {
910  // Use recognized side
911  f->alproto = *alproto_otherdir;
912  // do not keep ALPROTO_UNKNOWN for this side so as not to loop
913  *alproto = *alproto_otherdir;
914  if (*alproto_otherdir == ALPROTO_FAILED) {
915  SCLogDebug("ALPROTO_UNKNOWN flow %p", f);
916  }
917  } else {
918  // First side of protocol is unknown
919  *alproto = ALPROTO_FAILED;
920  }
921  break;
922  case ALPROTO_FAILED:
923  if (*alproto_otherdir != ALPROTO_UNKNOWN) {
924  // Use recognized side
925  f->alproto = *alproto_otherdir;
926  if (*alproto_otherdir == ALPROTO_FAILED) {
927  SCLogDebug("ALPROTO_UNKNOWN flow %p", f);
928  }
929  }
930  // else wait for second side of protocol
931  break;
932  default:
933  if (*alproto_otherdir != ALPROTO_UNKNOWN && *alproto_otherdir != ALPROTO_FAILED) {
934  if (*alproto_otherdir != *alproto) {
937  // data already sent to parser, we cannot change the protocol to use the one
938  // of the server
939  }
940  } else {
941  f->alproto = *alproto;
942  }
943  }
944  if (*alproto_otherdir == ALPROTO_UNKNOWN) {
945  if (f->alproto == ALPROTO_UNKNOWN) {
946  // so as to increase stat about .app_layer.flow.failed_udp
947  f->alproto = ALPROTO_FAILED;
948  }
949  // If the other side is unknown, this is the first packet of the flow
950  AppLayerIncFlowCounter(tv, f);
951  }
952 
953  // parse the data if we recognized one protocol
954  if (f->alproto != ALPROTO_UNKNOWN && f->alproto != ALPROTO_FAILED) {
955  if (reverse_flow) {
956  SCLogDebug("reversing flow after proto detect told us so");
957  PacketSwap(p);
958  FlowSwap(f);
959  SWAP_FLAGS(flags, STREAM_TOSERVER, STREAM_TOCLIENT);
960  }
961 
963  r = AppLayerParserParse(tv, tctx->alp_tctx, f, f->alproto,
964  flags, p->payload, p->payload_len);
967  }
969  /* we do only inspection in one direction, so flag both
970  * sides as done here */
971  FlagPacketFlow(p, f, STREAM_TOSERVER);
972  FlagPacketFlow(p, f, STREAM_TOCLIENT);
973  } else {
974  SCLogDebug("data (len %" PRIu32 " ), alproto "
975  "%"PRIu16" (flow %p)", p->payload_len, f->alproto, f);
976 
977  /* run the parser */
979  r = AppLayerParserParse(tv, tctx->alp_tctx, f, f->alproto,
980  flags, p->payload, p->payload_len);
984  }
985  if (r < 0) {
987  AppLayerIncrErrorExcPolicyCounter(tv, f, g_applayerparser_error_policy);
988  SCReturnInt(-1);
989  }
990 
991  SCReturnInt(r);
992 }
993 
994 /***** Utility *****/
995 
996 AppProto AppLayerGetProtoByName(const char *alproto_name)
997 {
998  SCEnter();
1000  SCReturnCT(r, "AppProto");
1001 }
1002 
1003 const char *AppLayerGetProtoName(AppProto alproto)
1004 {
1005  SCEnter();
1006  const char * r = AppLayerProtoDetectGetProtoName(alproto);
1007  SCReturnCT(r, "char *");
1008 }
1009 
1011 {
1012  SCEnter();
1013 
1014  AppProto alproto;
1015  AppProto alprotos[g_alproto_max];
1016 
1018 
1019  printf("=========Supported App Layer Protocols=========\n");
1020  for (alproto = 0; alproto < g_alproto_max; alproto++) {
1021  if (alprotos[alproto] == 1)
1022  printf("%s\n", AppLayerGetProtoName(alproto));
1023  }
1024 
1025  SCReturn;
1026 }
1027 
1028 /***** Setup/General Registration *****/
1029 static void AppLayerNamesSetup(void)
1030 {
1070 }
1071 
1072 int AppLayerSetup(void)
1073 {
1074  SCEnter();
1075 
1076  AppLayerNamesSetup();
1079 
1082 
1084  FrameConfigInit();
1085 
1086  SCReturnInt(0);
1087 }
1088 
1090 {
1091  SCEnter();
1092 
1095 
1098 
1099  SCReturnInt(0);
1100 }
1101 
1103 {
1104  SCEnter();
1105 
1106  AppLayerThreadCtx *app_tctx = SCCalloc(1, sizeof(*app_tctx));
1107  if (app_tctx == NULL)
1108  goto error;
1109 
1110  if ((app_tctx->alpd_tctx = AppLayerProtoDetectGetCtxThread()) == NULL)
1111  goto error;
1112  if ((app_tctx->alp_tctx = AppLayerParserThreadCtxAlloc()) == NULL)
1113  goto error;
1114 
1115  goto done;
1116  error:
1117  AppLayerDestroyCtxThread(app_tctx);
1118  app_tctx = NULL;
1119  done:
1120  SCReturnPtr(app_tctx, "void *");
1121 }
1122 
1124 {
1125  SCEnter();
1126 
1127  if (app_tctx == NULL)
1128  SCReturn;
1129 
1130  if (app_tctx->alpd_tctx != NULL)
1132  if (app_tctx->alp_tctx != NULL)
1134  SCFree(app_tctx);
1135 
1136  SCReturn;
1137 }
1138 
1139 #ifdef PROFILING
1141 {
1142  PACKET_PROFILING_APP_RESET(app_tctx);
1143 }
1144 
1146 {
1147  PACKET_PROFILING_APP_STORE(app_tctx, p);
1148 }
1149 #endif
1150 
1151 /** \brief HACK to work around our broken unix manager (re)init loop
1152  */
1154 {
1159  StatsRegisterGlobalCounter("app_layer.expectations", ExpectationGetCounter);
1162  StatsRegisterGlobalCounter("ippair.memuse", IPPairGetMemuse);
1163  StatsRegisterGlobalCounter("ippair.memcap", IPPairGetMemcap);
1164  StatsRegisterGlobalCounter("host.memuse", HostGetMemuse);
1165  StatsRegisterGlobalCounter("host.memcap", HostGetMemcap);
1166 }
1167 
1168 static bool IsAppLayerErrorExceptionPolicyStatsValid(enum ExceptionPolicy policy)
1169 {
1170  if (EngineModeIsIPS()) {
1172  }
1174 }
1175 
1176 static void AppLayerSetupExceptionPolicyPerProtoCounters(
1177  uint8_t ipproto_map, AppProto alproto, const char *alproto_str, const char *ipproto_suffix)
1178 {
1181  for (enum ExceptionPolicy i = EXCEPTION_POLICY_NOT_SET + 1; i < EXCEPTION_POLICY_MAX; i++) {
1182  if (IsAppLayerErrorExceptionPolicyStatsValid(i)) {
1183  snprintf(applayer_counter_names[alproto][ipproto_map].eps_name[i],
1184  sizeof(applayer_counter_names[alproto][ipproto_map].eps_name[i]),
1185  "app_layer.error.%s%s.exception_policy.%s", alproto_str, ipproto_suffix,
1186  ExceptionPolicyEnumToString(i, true));
1187  }
1188  }
1189  }
1190 }
1191 
1193 {
1194  const uint8_t ipprotos[] = { IPPROTO_TCP, IPPROTO_UDP };
1195  AppProto alprotos[g_alproto_max];
1196  const char *str = "app_layer.flow.";
1197  const char *estr = "app_layer.error.";
1198 
1201  if (unlikely(applayer_counter_names == NULL)) {
1202  FatalError("Unable to alloc applayer_counter_names.");
1203  }
1205  if (unlikely(applayer_counters == NULL)) {
1206  FatalError("Unable to alloc applayer_counters.");
1207  }
1208  /* We don't log stats counters if exception policy is `ignore`/`not set` */
1210  /* Register global counters for app layer error exception policy summary */
1211  const char *eps_default_str = "exception_policy.app_layer.error.";
1212  for (enum ExceptionPolicy i = EXCEPTION_POLICY_NOT_SET + 1; i < EXCEPTION_POLICY_MAX; i++) {
1213  if (IsAppLayerErrorExceptionPolicyStatsValid(i)) {
1214  snprintf(app_layer_error_eps_stats.eps_name[i],
1215  sizeof(app_layer_error_eps_stats.eps_name[i]), "%s%s", eps_default_str,
1216  ExceptionPolicyEnumToString(i, true));
1217  }
1218  }
1219  }
1220 
1222 
1223  for (uint8_t p = 0; p < FLOW_PROTO_APPLAYER_MAX; p++) {
1224  const uint8_t ipproto = ipprotos[p];
1225  const uint8_t ipproto_map = FlowGetProtoMapping(ipproto);
1226  const char *ipproto_suffix = (ipproto == IPPROTO_TCP) ? "_tcp" : "_udp";
1227  uint8_t ipprotos_all[256 / 8];
1228 
1229  for (AppProto alproto = 0; alproto < g_alproto_max; alproto++) {
1230  if (alprotos[alproto] == 1) {
1231  const char *tx_str = "app_layer.tx.";
1232  const char *alproto_str = AppLayerGetProtoName(alproto);
1233 
1234  memset(ipprotos_all, 0, sizeof(ipprotos_all));
1235  AppLayerProtoDetectSupportedIpprotos(alproto, ipprotos_all);
1236  if ((ipprotos_all[IPPROTO_TCP / 8] & (1 << (IPPROTO_TCP % 8))) &&
1237  (ipprotos_all[IPPROTO_UDP / 8] & (1 << (IPPROTO_UDP % 8)))) {
1238  snprintf(applayer_counter_names[alproto][ipproto_map].name,
1239  sizeof(applayer_counter_names[alproto][ipproto_map].name), "%s%s%s",
1240  str, alproto_str, ipproto_suffix);
1241  snprintf(applayer_counter_names[alproto][ipproto_map].tx_name,
1242  sizeof(applayer_counter_names[alproto][ipproto_map].tx_name), "%s%s%s",
1243  tx_str, alproto_str, ipproto_suffix);
1244 
1245  if (ipproto == IPPROTO_TCP) {
1246  snprintf(applayer_counter_names[alproto][ipproto_map].gap_error,
1247  sizeof(applayer_counter_names[alproto][ipproto_map].gap_error),
1248  "%s%s%s.gap", estr, alproto_str, ipproto_suffix);
1249  }
1250  snprintf(applayer_counter_names[alproto][ipproto_map].alloc_error,
1251  sizeof(applayer_counter_names[alproto][ipproto_map].alloc_error),
1252  "%s%s%s.alloc", estr, alproto_str, ipproto_suffix);
1253  snprintf(applayer_counter_names[alproto][ipproto_map].parser_error,
1254  sizeof(applayer_counter_names[alproto][ipproto_map].parser_error),
1255  "%s%s%s.parser", estr, alproto_str, ipproto_suffix);
1256  snprintf(applayer_counter_names[alproto][ipproto_map].internal_error,
1257  sizeof(applayer_counter_names[alproto][ipproto_map].internal_error),
1258  "%s%s%s.internal", estr, alproto_str, ipproto_suffix);
1259 
1260  AppLayerSetupExceptionPolicyPerProtoCounters(
1261  ipproto_map, alproto, alproto_str, ipproto_suffix);
1262  } else {
1263  snprintf(applayer_counter_names[alproto][ipproto_map].name,
1264  sizeof(applayer_counter_names[alproto][ipproto_map].name), "%s%s", str,
1265  alproto_str);
1266  snprintf(applayer_counter_names[alproto][ipproto_map].tx_name,
1267  sizeof(applayer_counter_names[alproto][ipproto_map].tx_name), "%s%s",
1268  tx_str, alproto_str);
1269 
1270  if (ipproto == IPPROTO_TCP) {
1271  snprintf(applayer_counter_names[alproto][ipproto_map].gap_error,
1272  sizeof(applayer_counter_names[alproto][ipproto_map].gap_error),
1273  "%s%s.gap", estr, alproto_str);
1274  }
1275  snprintf(applayer_counter_names[alproto][ipproto_map].alloc_error,
1276  sizeof(applayer_counter_names[alproto][ipproto_map].alloc_error),
1277  "%s%s.alloc", estr, alproto_str);
1278  snprintf(applayer_counter_names[alproto][ipproto_map].parser_error,
1279  sizeof(applayer_counter_names[alproto][ipproto_map].parser_error),
1280  "%s%s.parser", estr, alproto_str);
1281  snprintf(applayer_counter_names[alproto][ipproto_map].internal_error,
1282  sizeof(applayer_counter_names[alproto][ipproto_map].internal_error),
1283  "%s%s.internal", estr, alproto_str);
1284  AppLayerSetupExceptionPolicyPerProtoCounters(
1285  ipproto_map, alproto, alproto_str, "");
1286  }
1287  } else if (alproto == ALPROTO_FAILED) {
1288  snprintf(applayer_counter_names[alproto][ipproto_map].name,
1289  sizeof(applayer_counter_names[alproto][ipproto_map].name), "%s%s%s", str,
1290  "failed", ipproto_suffix);
1291  if (ipproto == IPPROTO_TCP) {
1292  snprintf(applayer_counter_names[alproto][ipproto_map].gap_error,
1293  sizeof(applayer_counter_names[alproto][ipproto_map].gap_error),
1294  "%sfailed%s.gap", estr, ipproto_suffix);
1295  }
1296  }
1297  }
1298  }
1299 }
1300 
1302 {
1303  const uint8_t ipprotos[] = { IPPROTO_TCP, IPPROTO_UDP };
1304  AppProto alprotos[g_alproto_max];
1306 
1307  /* We don't log stats counters if exception policy is `ignore`/`not set` */
1309  /* Register global counters for app layer error exception policy summary */
1310  for (enum ExceptionPolicy i = EXCEPTION_POLICY_NOT_SET + 1; i < EXCEPTION_POLICY_MAX; i++) {
1311  if (IsAppLayerErrorExceptionPolicyStatsValid(i)) {
1314  }
1315  }
1316  }
1317 
1318  for (uint8_t p = 0; p < FLOW_PROTO_APPLAYER_MAX; p++) {
1319  const uint8_t ipproto = ipprotos[p];
1320  const uint8_t ipproto_map = FlowGetProtoMapping(ipproto);
1321 
1322  for (AppProto alproto = 0; alproto < g_alproto_max; alproto++) {
1323  if (alprotos[alproto] == 1) {
1324  applayer_counters[alproto][ipproto_map].counter_id =
1325  StatsRegisterCounter(applayer_counter_names[alproto][ipproto_map].name, tv);
1326 
1327  applayer_counters[alproto][ipproto_map].counter_tx_id = StatsRegisterCounter(
1328  applayer_counter_names[alproto][ipproto_map].tx_name, tv);
1329 
1330  if (ipproto == IPPROTO_TCP) {
1331  applayer_counters[alproto][ipproto_map].gap_error_id = StatsRegisterCounter(
1332  applayer_counter_names[alproto][ipproto_map].gap_error, tv);
1333  }
1334  applayer_counters[alproto][ipproto_map].alloc_error_id = StatsRegisterCounter(
1335  applayer_counter_names[alproto][ipproto_map].alloc_error, tv);
1336  applayer_counters[alproto][ipproto_map].parser_error_id = StatsRegisterCounter(
1337  applayer_counter_names[alproto][ipproto_map].parser_error, tv);
1339  applayer_counter_names[alproto][ipproto_map].internal_error, tv);
1340  /* We don't log stats counters if exception policy is `ignore`/`not set` */
1343  for (enum ExceptionPolicy i = EXCEPTION_POLICY_NOT_SET + 1;
1344  i < EXCEPTION_POLICY_MAX; i++) {
1345  if (IsAppLayerErrorExceptionPolicyStatsValid(i)) {
1346  applayer_counters[alproto][ipproto_map]
1348  applayer_counter_names[alproto][ipproto_map].eps_name[i], tv);
1349  }
1350  }
1351  }
1352  } else if (alproto == ALPROTO_FAILED) {
1353  applayer_counters[alproto][ipproto_map].counter_id =
1354  StatsRegisterCounter(applayer_counter_names[alproto][ipproto_map].name, tv);
1355 
1356  if (ipproto == IPPROTO_TCP) {
1357  applayer_counters[alproto][ipproto_map].gap_error_id = StatsRegisterCounter(
1358  applayer_counter_names[alproto][ipproto_map].gap_error, tv);
1359  }
1360  }
1361  }
1362  }
1363 }
1364 
1366 {
1369 }
1370 
1371 /***** Unittests *****/
1372 
1373 #ifdef UNITTESTS
1374 #include "pkt-var.h"
1375 #include "stream-tcp-util.h"
1376 #include "stream.h"
1377 #include "util-unittest.h"
1378 
1379 #define TEST_START \
1380  Packet *p = PacketGetFromAlloc(); \
1381  FAIL_IF_NULL(p); \
1382  Flow f; \
1383  ThreadVars tv; \
1384  StreamTcpThread *stt = NULL; \
1385  TCPHdr tcph; \
1386  PacketQueueNoLock pq; \
1387  memset(&pq, 0, sizeof(PacketQueueNoLock)); \
1388  memset(&f, 0, sizeof(Flow)); \
1389  memset(&tv, 0, sizeof(ThreadVars)); \
1390  memset(&tcph, 0, sizeof(TCPHdr)); \
1391  \
1392  FLOW_INITIALIZE(&f); \
1393  f.flags = FLOW_IPV4; \
1394  f.proto = IPPROTO_TCP; \
1395  p->flow = &f; \
1396  PacketSetTCP(p, (uint8_t *)&tcph); \
1397  \
1398  StreamTcpInitConfig(true); \
1399  IPPairInitConfig(true); \
1400  StreamTcpThreadInit(&tv, NULL, (void **)&stt); \
1401  \
1402  /* handshake */ \
1403  tcph.th_win = htons(5480); \
1404  tcph.th_flags = TH_SYN; \
1405  p->flowflags = FLOW_PKT_TOSERVER; \
1406  p->payload_len = 0; \
1407  p->payload = NULL; \
1408  FAIL_IF(StreamTcpPacket(&tv, p, stt, &pq) == -1); \
1409  TcpSession *ssn = (TcpSession *)f.protoctx; \
1410  \
1411  FAIL_IF(StreamTcpIsSetStreamFlagAppProtoDetectionCompleted(&ssn->server)); \
1412  FAIL_IF(StreamTcpIsSetStreamFlagAppProtoDetectionCompleted(&ssn->client)); \
1413  FAIL_IF(f.alproto != ALPROTO_UNKNOWN); \
1414  FAIL_IF(f.alproto_ts != ALPROTO_UNKNOWN); \
1415  FAIL_IF(f.alproto_tc != ALPROTO_UNKNOWN); \
1416  FAIL_IF(ssn->flags &STREAMTCP_FLAG_APP_LAYER_DISABLED); \
1417  FAIL_IF(FLOW_IS_PM_DONE(&f, STREAM_TOSERVER)); \
1418  FAIL_IF(FLOW_IS_PP_DONE(&f, STREAM_TOSERVER)); \
1419  FAIL_IF(FLOW_IS_PM_DONE(&f, STREAM_TOCLIENT)); \
1420  FAIL_IF(FLOW_IS_PP_DONE(&f, STREAM_TOCLIENT)); \
1421  FAIL_IF(ssn->data_first_seen_dir != 0); \
1422  \
1423  /* handshake */ \
1424  tcph.th_ack = htonl(1); \
1425  tcph.th_flags = TH_SYN | TH_ACK; \
1426  p->flowflags = FLOW_PKT_TOCLIENT; \
1427  p->payload_len = 0; \
1428  p->payload = NULL; \
1429  FAIL_IF(StreamTcpPacket(&tv, p, stt, &pq) == -1); \
1430  FAIL_IF(StreamTcpIsSetStreamFlagAppProtoDetectionCompleted(&ssn->server)); \
1431  FAIL_IF(StreamTcpIsSetStreamFlagAppProtoDetectionCompleted(&ssn->client)); \
1432  FAIL_IF(f.alproto != ALPROTO_UNKNOWN); \
1433  FAIL_IF(f.alproto_ts != ALPROTO_UNKNOWN); \
1434  FAIL_IF(f.alproto_tc != ALPROTO_UNKNOWN); \
1435  FAIL_IF(ssn->flags &STREAMTCP_FLAG_APP_LAYER_DISABLED); \
1436  FAIL_IF(FLOW_IS_PM_DONE(&f, STREAM_TOSERVER)); \
1437  FAIL_IF(FLOW_IS_PP_DONE(&f, STREAM_TOSERVER)); \
1438  FAIL_IF(FLOW_IS_PM_DONE(&f, STREAM_TOCLIENT)); \
1439  FAIL_IF(FLOW_IS_PP_DONE(&f, STREAM_TOCLIENT)); \
1440  FAIL_IF(ssn->data_first_seen_dir != 0); \
1441  \
1442  /* handshake */ \
1443  tcph.th_ack = htonl(1); \
1444  tcph.th_seq = htonl(1); \
1445  tcph.th_flags = TH_ACK; \
1446  p->flowflags = FLOW_PKT_TOSERVER; \
1447  p->payload_len = 0; \
1448  p->payload = NULL; \
1449  FAIL_IF(StreamTcpPacket(&tv, p, stt, &pq) == -1); \
1450  FAIL_IF(StreamTcpIsSetStreamFlagAppProtoDetectionCompleted(&ssn->server)); \
1451  FAIL_IF(StreamTcpIsSetStreamFlagAppProtoDetectionCompleted(&ssn->client)); \
1452  FAIL_IF(f.alproto != ALPROTO_UNKNOWN); \
1453  FAIL_IF(f.alproto_ts != ALPROTO_UNKNOWN); \
1454  FAIL_IF(f.alproto_tc != ALPROTO_UNKNOWN); \
1455  FAIL_IF(ssn->flags &STREAMTCP_FLAG_APP_LAYER_DISABLED); \
1456  FAIL_IF(FLOW_IS_PM_DONE(&f, STREAM_TOSERVER)); \
1457  FAIL_IF(FLOW_IS_PP_DONE(&f, STREAM_TOSERVER)); \
1458  FAIL_IF(FLOW_IS_PM_DONE(&f, STREAM_TOCLIENT)); \
1459  FAIL_IF(FLOW_IS_PP_DONE(&f, STREAM_TOCLIENT)); \
1460  FAIL_IF(ssn->data_first_seen_dir != 0);
1461 #define TEST_END \
1462  StreamTcpSessionClear(p->flow->protoctx); \
1463  StreamTcpThreadDeinit(&tv, (void *)stt); \
1464  StreamTcpFreeConfig(true); \
1465  PacketFree(p); \
1466  FLOW_DESTROY(&f); \
1467  StatsThreadCleanup(&tv);
1468 
1469 /**
1470  * \test GET -> HTTP/1.1
1471  */
1472 static int AppLayerTest01(void)
1473 {
1474  TEST_START;
1475 
1476  /* full request */
1477  uint8_t request[] = {
1478  0x47, 0x45, 0x54, 0x20, 0x2f, 0x69, 0x6e, 0x64,
1479  0x65, 0x78, 0x2e, 0x68, 0x74, 0x6d, 0x6c, 0x20,
1480  0x48, 0x54, 0x54, 0x50, 0x2f, 0x31, 0x2e, 0x30,
1481  0x0d, 0x0a, 0x48, 0x6f, 0x73, 0x74, 0x3a, 0x20,
1482  0x6c, 0x6f, 0x63, 0x61, 0x6c, 0x68, 0x6f, 0x73,
1483  0x74, 0x0d, 0x0a, 0x55, 0x73, 0x65, 0x72, 0x2d,
1484  0x41, 0x67, 0x65, 0x6e, 0x74, 0x3a, 0x20, 0x41,
1485  0x70, 0x61, 0x63, 0x68, 0x65, 0x42, 0x65, 0x6e,
1486  0x63, 0x68, 0x2f, 0x32, 0x2e, 0x33, 0x0d, 0x0a,
1487  0x41, 0x63, 0x63, 0x65, 0x70, 0x74, 0x3a, 0x20,
1488  0x2a, 0x2f, 0x2a, 0x0d, 0x0a, 0x0d, 0x0a };
1489  tcph.th_ack = htonl(1);
1490  tcph.th_seq = htonl(1);
1491  tcph.th_flags = TH_PUSH | TH_ACK;
1493  p->payload_len = sizeof(request);
1494  p->payload = request;
1495  FAIL_IF(StreamTcpPacket(&tv, p, stt, &pq) == -1);
1502  FAIL_IF(FLOW_IS_PM_DONE(&f, STREAM_TOSERVER));
1503  FAIL_IF(FLOW_IS_PP_DONE(&f, STREAM_TOSERVER));
1504  FAIL_IF(FLOW_IS_PM_DONE(&f, STREAM_TOCLIENT));
1505  FAIL_IF(FLOW_IS_PP_DONE(&f, STREAM_TOCLIENT));
1506  FAIL_IF(ssn->data_first_seen_dir != STREAM_TOSERVER);
1507 
1508  /* full response - request ack */
1509  uint8_t response[] = {
1510  0x48, 0x54, 0x54, 0x50, 0x2f, 0x31, 0x2e, 0x31,
1511  0x20, 0x32, 0x30, 0x30, 0x20, 0x4f, 0x4b, 0x0d,
1512  0x0a, 0x44, 0x61, 0x74, 0x65, 0x3a, 0x20, 0x46,
1513  0x72, 0x69, 0x2c, 0x20, 0x32, 0x33, 0x20, 0x53,
1514  0x65, 0x70, 0x20, 0x32, 0x30, 0x31, 0x31, 0x20,
1515  0x30, 0x36, 0x3a, 0x32, 0x39, 0x3a, 0x33, 0x39,
1516  0x20, 0x47, 0x4d, 0x54, 0x0d, 0x0a, 0x53, 0x65,
1517  0x72, 0x76, 0x65, 0x72, 0x3a, 0x20, 0x41, 0x70,
1518  0x61, 0x63, 0x68, 0x65, 0x2f, 0x32, 0x2e, 0x32,
1519  0x2e, 0x31, 0x35, 0x20, 0x28, 0x55, 0x6e, 0x69,
1520  0x78, 0x29, 0x20, 0x44, 0x41, 0x56, 0x2f, 0x32,
1521  0x0d, 0x0a, 0x4c, 0x61, 0x73, 0x74, 0x2d, 0x4d,
1522  0x6f, 0x64, 0x69, 0x66, 0x69, 0x65, 0x64, 0x3a,
1523  0x20, 0x54, 0x68, 0x75, 0x2c, 0x20, 0x30, 0x34,
1524  0x20, 0x4e, 0x6f, 0x76, 0x20, 0x32, 0x30, 0x31,
1525  0x30, 0x20, 0x31, 0x35, 0x3a, 0x30, 0x34, 0x3a,
1526  0x34, 0x36, 0x20, 0x47, 0x4d, 0x54, 0x0d, 0x0a,
1527  0x45, 0x54, 0x61, 0x67, 0x3a, 0x20, 0x22, 0x61,
1528  0x62, 0x38, 0x39, 0x36, 0x35, 0x2d, 0x32, 0x63,
1529  0x2d, 0x34, 0x39, 0x34, 0x33, 0x62, 0x37, 0x61,
1530  0x37, 0x66, 0x37, 0x66, 0x38, 0x30, 0x22, 0x0d,
1531  0x0a, 0x41, 0x63, 0x63, 0x65, 0x70, 0x74, 0x2d,
1532  0x52, 0x61, 0x6e, 0x67, 0x65, 0x73, 0x3a, 0x20,
1533  0x62, 0x79, 0x74, 0x65, 0x73, 0x0d, 0x0a, 0x43,
1534  0x6f, 0x6e, 0x74, 0x65, 0x6e, 0x74, 0x2d, 0x4c,
1535  0x65, 0x6e, 0x67, 0x74, 0x68, 0x3a, 0x20, 0x34,
1536  0x34, 0x0d, 0x0a, 0x43, 0x6f, 0x6e, 0x6e, 0x65,
1537  0x63, 0x74, 0x69, 0x6f, 0x6e, 0x3a, 0x20, 0x63,
1538  0x6c, 0x6f, 0x73, 0x65, 0x0d, 0x0a, 0x43, 0x6f,
1539  0x6e, 0x74, 0x65, 0x6e, 0x74, 0x2d, 0x54, 0x79,
1540  0x70, 0x65, 0x3a, 0x20, 0x74, 0x65, 0x78, 0x74,
1541  0x2f, 0x68, 0x74, 0x6d, 0x6c, 0x0d, 0x0a, 0x58,
1542  0x2d, 0x50, 0x61, 0x64, 0x3a, 0x20, 0x61, 0x76,
1543  0x6f, 0x69, 0x64, 0x20, 0x62, 0x72, 0x6f, 0x77,
1544  0x73, 0x65, 0x72, 0x20, 0x62, 0x75, 0x67, 0x0d,
1545  0x0a, 0x0d, 0x0a, 0x3c, 0x68, 0x74, 0x6d, 0x6c,
1546  0x3e, 0x3c, 0x62, 0x6f, 0x64, 0x79, 0x3e, 0x3c,
1547  0x68, 0x31, 0x3e, 0x49, 0x74, 0x20, 0x77, 0x6f,
1548  0x72, 0x6b, 0x73, 0x21, 0x3c, 0x2f, 0x68, 0x31,
1549  0x3e, 0x3c, 0x2f, 0x62, 0x6f, 0x64, 0x79, 0x3e,
1550  0x3c, 0x2f, 0x68, 0x74, 0x6d, 0x6c, 0x3e };
1551  tcph.th_ack = htonl(88);
1552  tcph.th_seq = htonl(1);
1553  tcph.th_flags = TH_PUSH | TH_ACK;
1555  p->payload_len = sizeof(response);
1556  p->payload = response;
1557  FAIL_IF(StreamTcpPacket(&tv, p, stt, &pq) == -1);
1564  FAIL_IF(!FLOW_IS_PM_DONE(&f, STREAM_TOSERVER));
1565  FAIL_IF(FLOW_IS_PP_DONE(&f, STREAM_TOSERVER));
1566  FAIL_IF(FLOW_IS_PM_DONE(&f, STREAM_TOCLIENT));
1567  FAIL_IF(FLOW_IS_PP_DONE(&f, STREAM_TOCLIENT));
1569 
1570  /* response ack */
1571  tcph.th_ack = htonl(328);
1572  tcph.th_seq = htonl(88);
1573  tcph.th_flags = TH_ACK;
1575  p->payload_len = 0;
1576  p->payload = NULL;
1577  FAIL_IF(StreamTcpPacket(&tv, p, stt, &pq) == -1);
1584  FAIL_IF(!FLOW_IS_PM_DONE(&f, STREAM_TOSERVER));
1585  FAIL_IF(FLOW_IS_PP_DONE(&f, STREAM_TOSERVER));
1586  FAIL_IF(!FLOW_IS_PM_DONE(&f, STREAM_TOCLIENT));
1587  FAIL_IF(FLOW_IS_PP_DONE(&f, STREAM_TOCLIENT));
1589 
1590  TEST_END;
1591  PASS;
1592 }
1593 
1594 /**
1595  * \test GE -> T -> HTTP/1.1
1596  */
1597 static int AppLayerTest02(void)
1598 {
1599  TEST_START;
1600 
1601  /* partial request */
1602  uint8_t request1[] = { 0x47, 0x45, };
1603  tcph.th_ack = htonl(1);
1604  tcph.th_seq = htonl(1);
1605  tcph.th_flags = TH_PUSH | TH_ACK;
1607  p->payload_len = sizeof(request1);
1608  p->payload = request1;
1609  FAIL_IF(StreamTcpPacket(&tv, p, stt, &pq) == -1);
1616  FAIL_IF(FLOW_IS_PM_DONE(&f, STREAM_TOSERVER));
1617  FAIL_IF(FLOW_IS_PP_DONE(&f, STREAM_TOSERVER));
1618  FAIL_IF(FLOW_IS_PM_DONE(&f, STREAM_TOCLIENT));
1619  FAIL_IF(FLOW_IS_PP_DONE(&f, STREAM_TOCLIENT));
1620  FAIL_IF(ssn->data_first_seen_dir != STREAM_TOSERVER);
1621 
1622  /* response ack against partial request */
1623  tcph.th_ack = htonl(3);
1624  tcph.th_seq = htonl(1);
1625  tcph.th_flags = TH_ACK;
1627  p->payload_len = 0;
1628  p->payload = NULL;
1629  FAIL_IF(StreamTcpPacket(&tv, p, stt, &pq) == -1);
1636  FAIL_IF(FLOW_IS_PM_DONE(&f, STREAM_TOSERVER));
1637  FAIL_IF(!FLOW_IS_PP_DONE(&f, STREAM_TOSERVER));
1638  FAIL_IF(FLOW_IS_PM_DONE(&f, STREAM_TOCLIENT));
1639  FAIL_IF(FLOW_IS_PP_DONE(&f, STREAM_TOCLIENT));
1640  FAIL_IF(ssn->data_first_seen_dir != STREAM_TOSERVER);
1641 
1642  /* complete partial request */
1643  uint8_t request2[] = {
1644  0x54, 0x20, 0x2f, 0x69, 0x6e, 0x64,
1645  0x65, 0x78, 0x2e, 0x68, 0x74, 0x6d, 0x6c, 0x20,
1646  0x48, 0x54, 0x54, 0x50, 0x2f, 0x31, 0x2e, 0x30,
1647  0x0d, 0x0a, 0x48, 0x6f, 0x73, 0x74, 0x3a, 0x20,
1648  0x6c, 0x6f, 0x63, 0x61, 0x6c, 0x68, 0x6f, 0x73,
1649  0x74, 0x0d, 0x0a, 0x55, 0x73, 0x65, 0x72, 0x2d,
1650  0x41, 0x67, 0x65, 0x6e, 0x74, 0x3a, 0x20, 0x41,
1651  0x70, 0x61, 0x63, 0x68, 0x65, 0x42, 0x65, 0x6e,
1652  0x63, 0x68, 0x2f, 0x32, 0x2e, 0x33, 0x0d, 0x0a,
1653  0x41, 0x63, 0x63, 0x65, 0x70, 0x74, 0x3a, 0x20,
1654  0x2a, 0x2f, 0x2a, 0x0d, 0x0a, 0x0d, 0x0a };
1655  tcph.th_ack = htonl(1);
1656  tcph.th_seq = htonl(3);
1657  tcph.th_flags = TH_PUSH | TH_ACK;
1659  p->payload_len = sizeof(request2);
1660  p->payload = request2;
1661  FAIL_IF(StreamTcpPacket(&tv, p, stt, &pq) == -1);
1668  FAIL_IF(FLOW_IS_PM_DONE(&f, STREAM_TOSERVER));
1669  FAIL_IF(!FLOW_IS_PP_DONE(&f, STREAM_TOSERVER));
1670  FAIL_IF(FLOW_IS_PM_DONE(&f, STREAM_TOCLIENT));
1671  FAIL_IF(FLOW_IS_PP_DONE(&f, STREAM_TOCLIENT));
1672  FAIL_IF(ssn->data_first_seen_dir != STREAM_TOSERVER);
1673 
1674  /* response - request ack */
1675  uint8_t response[] = {
1676  0x48, 0x54, 0x54, 0x50, 0x2f, 0x31, 0x2e, 0x31,
1677  0x20, 0x32, 0x30, 0x30, 0x20, 0x4f, 0x4b, 0x0d,
1678  0x0a, 0x44, 0x61, 0x74, 0x65, 0x3a, 0x20, 0x46,
1679  0x72, 0x69, 0x2c, 0x20, 0x32, 0x33, 0x20, 0x53,
1680  0x65, 0x70, 0x20, 0x32, 0x30, 0x31, 0x31, 0x20,
1681  0x30, 0x36, 0x3a, 0x32, 0x39, 0x3a, 0x33, 0x39,
1682  0x20, 0x47, 0x4d, 0x54, 0x0d, 0x0a, 0x53, 0x65,
1683  0x72, 0x76, 0x65, 0x72, 0x3a, 0x20, 0x41, 0x70,
1684  0x61, 0x63, 0x68, 0x65, 0x2f, 0x32, 0x2e, 0x32,
1685  0x2e, 0x31, 0x35, 0x20, 0x28, 0x55, 0x6e, 0x69,
1686  0x78, 0x29, 0x20, 0x44, 0x41, 0x56, 0x2f, 0x32,
1687  0x0d, 0x0a, 0x4c, 0x61, 0x73, 0x74, 0x2d, 0x4d,
1688  0x6f, 0x64, 0x69, 0x66, 0x69, 0x65, 0x64, 0x3a,
1689  0x20, 0x54, 0x68, 0x75, 0x2c, 0x20, 0x30, 0x34,
1690  0x20, 0x4e, 0x6f, 0x76, 0x20, 0x32, 0x30, 0x31,
1691  0x30, 0x20, 0x31, 0x35, 0x3a, 0x30, 0x34, 0x3a,
1692  0x34, 0x36, 0x20, 0x47, 0x4d, 0x54, 0x0d, 0x0a,
1693  0x45, 0x54, 0x61, 0x67, 0x3a, 0x20, 0x22, 0x61,
1694  0x62, 0x38, 0x39, 0x36, 0x35, 0x2d, 0x32, 0x63,
1695  0x2d, 0x34, 0x39, 0x34, 0x33, 0x62, 0x37, 0x61,
1696  0x37, 0x66, 0x37, 0x66, 0x38, 0x30, 0x22, 0x0d,
1697  0x0a, 0x41, 0x63, 0x63, 0x65, 0x70, 0x74, 0x2d,
1698  0x52, 0x61, 0x6e, 0x67, 0x65, 0x73, 0x3a, 0x20,
1699  0x62, 0x79, 0x74, 0x65, 0x73, 0x0d, 0x0a, 0x43,
1700  0x6f, 0x6e, 0x74, 0x65, 0x6e, 0x74, 0x2d, 0x4c,
1701  0x65, 0x6e, 0x67, 0x74, 0x68, 0x3a, 0x20, 0x34,
1702  0x34, 0x0d, 0x0a, 0x43, 0x6f, 0x6e, 0x6e, 0x65,
1703  0x63, 0x74, 0x69, 0x6f, 0x6e, 0x3a, 0x20, 0x63,
1704  0x6c, 0x6f, 0x73, 0x65, 0x0d, 0x0a, 0x43, 0x6f,
1705  0x6e, 0x74, 0x65, 0x6e, 0x74, 0x2d, 0x54, 0x79,
1706  0x70, 0x65, 0x3a, 0x20, 0x74, 0x65, 0x78, 0x74,
1707  0x2f, 0x68, 0x74, 0x6d, 0x6c, 0x0d, 0x0a, 0x58,
1708  0x2d, 0x50, 0x61, 0x64, 0x3a, 0x20, 0x61, 0x76,
1709  0x6f, 0x69, 0x64, 0x20, 0x62, 0x72, 0x6f, 0x77,
1710  0x73, 0x65, 0x72, 0x20, 0x62, 0x75, 0x67, 0x0d,
1711  0x0a, 0x0d, 0x0a, 0x3c, 0x68, 0x74, 0x6d, 0x6c,
1712  0x3e, 0x3c, 0x62, 0x6f, 0x64, 0x79, 0x3e, 0x3c,
1713  0x68, 0x31, 0x3e, 0x49, 0x74, 0x20, 0x77, 0x6f,
1714  0x72, 0x6b, 0x73, 0x21, 0x3c, 0x2f, 0x68, 0x31,
1715  0x3e, 0x3c, 0x2f, 0x62, 0x6f, 0x64, 0x79, 0x3e,
1716  0x3c, 0x2f, 0x68, 0x74, 0x6d, 0x6c, 0x3e };
1717  tcph.th_ack = htonl(88);
1718  tcph.th_seq = htonl(1);
1719  tcph.th_flags = TH_PUSH | TH_ACK;
1721  p->payload_len = sizeof(response);
1722  p->payload = response;
1723  FAIL_IF(StreamTcpPacket(&tv, p, stt, &pq) == -1);
1730  FAIL_IF(!FLOW_IS_PM_DONE(&f, STREAM_TOSERVER));
1731  FAIL_IF(!FLOW_IS_PP_DONE(&f, STREAM_TOSERVER));
1732  FAIL_IF(FLOW_IS_PM_DONE(&f, STREAM_TOCLIENT));
1733  FAIL_IF(FLOW_IS_PP_DONE(&f, STREAM_TOCLIENT));
1735 
1736  /* response ack */
1737  tcph.th_ack = htonl(328);
1738  tcph.th_seq = htonl(88);
1739  tcph.th_flags = TH_ACK;
1741  p->payload_len = 0;
1742  p->payload = NULL;
1743  FAIL_IF(StreamTcpPacket(&tv, p, stt, &pq) == -1);
1750  FAIL_IF(!FLOW_IS_PM_DONE(&f, STREAM_TOSERVER));
1751  FAIL_IF(!FLOW_IS_PP_DONE(&f, STREAM_TOSERVER));
1752  FAIL_IF(!FLOW_IS_PM_DONE(&f, STREAM_TOCLIENT));
1753  FAIL_IF(FLOW_IS_PP_DONE(&f, STREAM_TOCLIENT));
1755 
1756  TEST_END;
1757  PASS;
1758 }
1759 
1760 /**
1761  * \test GET -> RUBBISH(PM AND PP DONE IN ONE GO)
1762  */
1763 static int AppLayerTest03(void)
1764 {
1765  TEST_START;
1766 
1767  /* request */
1768  uint8_t request[] = {
1769  0x47, 0x45, 0x54, 0x20, 0x2f, 0x69, 0x6e, 0x64,
1770  0x65, 0x78, 0x2e, 0x68, 0x74, 0x6d, 0x6c, 0x20,
1771  0x48, 0x54, 0x54, 0x50, 0x2f, 0x31, 0x2e, 0x30,
1772  0x0d, 0x0a, 0x48, 0x6f, 0x73, 0x74, 0x3a, 0x20,
1773  0x6c, 0x6f, 0x63, 0x61, 0x6c, 0x68, 0x6f, 0x73,
1774  0x74, 0x0d, 0x0a, 0x55, 0x73, 0x65, 0x72, 0x2d,
1775  0x41, 0x67, 0x65, 0x6e, 0x74, 0x3a, 0x20, 0x41,
1776  0x70, 0x61, 0x63, 0x68, 0x65, 0x42, 0x65, 0x6e,
1777  0x63, 0x68, 0x2f, 0x32, 0x2e, 0x33, 0x0d, 0x0a,
1778  0x41, 0x63, 0x63, 0x65, 0x70, 0x74, 0x3a, 0x20,
1779  0x2a, 0x2f, 0x2a, 0x0d, 0x0a, 0x0d, 0x0a };
1780  tcph.th_ack = htonl(1);
1781  tcph.th_seq = htonl(1);
1782  tcph.th_flags = TH_PUSH | TH_ACK;
1784  p->payload_len = sizeof(request);
1785  p->payload = request;
1786  FAIL_IF(StreamTcpPacket(&tv, p, stt, &pq) == -1);
1793  FAIL_IF(FLOW_IS_PM_DONE(&f, STREAM_TOSERVER));
1794  FAIL_IF(FLOW_IS_PP_DONE(&f, STREAM_TOSERVER));
1795  FAIL_IF(FLOW_IS_PM_DONE(&f, STREAM_TOCLIENT));
1796  FAIL_IF(FLOW_IS_PP_DONE(&f, STREAM_TOCLIENT));
1797  FAIL_IF(ssn->data_first_seen_dir != STREAM_TOSERVER);
1798 
1799  /* rubbish response */
1800  uint8_t response[] = {
1801  0x58, 0x54, 0x54, 0x50, 0x2f, 0x31, 0x2e, 0x31,
1802  0x20, 0x32, 0x30, 0x30, 0x20, 0x4f, 0x4b, 0x0d,
1803  0x0a, 0x44, 0x61, 0x74, 0x65, 0x3a, 0x20, 0x46,
1804  0x72, 0x69, 0x2c, 0x20, 0x32, 0x33, 0x20, 0x53,
1805  0x65, 0x70, 0x20, 0x32, 0x30, 0x31, 0x31, 0x20,
1806  0x30, 0x36, 0x3a, 0x32, 0x39, 0x3a, 0x33, 0x39,
1807  0x20, 0x47, 0x4d, 0x54, 0x0d, 0x0a, 0x53, 0x65,
1808  0x72, 0x76, 0x65, 0x72, 0x3a, 0x20, 0x41, 0x70,
1809  0x61, 0x63, 0x68, 0x65, 0x2f, 0x32, 0x2e, 0x32,
1810  0x2e, 0x31, 0x35, 0x20, 0x28, 0x55, 0x6e, 0x69,
1811  0x78, 0x29, 0x20, 0x44, 0x41, 0x56, 0x2f, 0x32,
1812  0x0d, 0x0a, 0x4c, 0x61, 0x73, 0x74, 0x2d, 0x4d,
1813  0x6f, 0x64, 0x69, 0x66, 0x69, 0x65, 0x64, 0x3a,
1814  0x20, 0x54, 0x68, 0x75, 0x2c, 0x20, 0x30, 0x34,
1815  0x20, 0x4e, 0x6f, 0x76, 0x20, 0x32, 0x30, 0x31,
1816  0x30, 0x20, 0x31, 0x35, 0x3a, 0x30, 0x34, 0x3a,
1817  0x34, 0x36, 0x20, 0x47, 0x4d, 0x54, 0x0d, 0x0a,
1818  0x45, 0x54, 0x61, 0x67, 0x3a, 0x20, 0x22, 0x61,
1819  0x62, 0x38, 0x39, 0x36, 0x35, 0x2d, 0x32, 0x63,
1820  0x2d, 0x34, 0x39, 0x34, 0x33, 0x62, 0x37, 0x61,
1821  0x37, 0x66, 0x37, 0x66, 0x38, 0x30, 0x22, 0x0d,
1822  0x0a, 0x41, 0x63, 0x63, 0x65, 0x70, 0x74, 0x2d,
1823  0x52, 0x61, 0x6e, 0x67, 0x65, 0x73, 0x3a, 0x20,
1824  0x62, 0x79, 0x74, 0x65, 0x73, 0x0d, 0x0a, 0x43,
1825  0x6f, 0x6e, 0x74, 0x65, 0x6e, 0x74, 0x2d, 0x4c,
1826  0x65, 0x6e, 0x67, 0x74, 0x68, 0x3a, 0x20, 0x34,
1827  0x34, 0x0d, 0x0a, 0x43, 0x6f, 0x6e, 0x6e, 0x65,
1828  0x63, 0x74, 0x69, 0x6f, 0x6e, 0x3a, 0x20, 0x63,
1829  0x6c, 0x6f, 0x73, 0x65, 0x0d, 0x0a, 0x43, 0x6f,
1830  0x6e, 0x74, 0x65, 0x6e, 0x74, 0x2d, 0x54, 0x79,
1831  0x70, 0x65, 0x3a, 0x20, 0x74, 0x65, 0x78, 0x74,
1832  0x2f, 0x68, 0x74, 0x6d, 0x6c, 0x0d, 0x0a, 0x58,
1833  0x2d, 0x50, 0x61, 0x64, 0x3a, 0x20, 0x61, 0x76,
1834  0x6f, 0x69, 0x64, 0x20, 0x62, 0x72, 0x6f, 0x77,
1835  0x73, 0x65, 0x72, 0x20, 0x62, 0x75, 0x67, 0x0d,
1836  0x0a, 0x0d, 0x0a, 0x3c, 0x68, 0x74, 0x6d, 0x6c,
1837  0x3e, 0x3c, 0x62, 0x6f, 0x64, 0x79, 0x3e, 0x3c,
1838  0x68, 0x31, 0x3e, 0x49, 0x74, 0x20, 0x77, 0x6f,
1839  0x72, 0x6b, 0x73, 0x21, 0x3c, 0x2f, 0x68, 0x31,
1840  0x3e, 0x3c, 0x2f, 0x62, 0x6f, 0x64, 0x79, 0x3e,
1841  0x3c, 0x2f, 0x68, 0x74, 0x6d, 0x6c, 0x3e };
1842  tcph.th_ack = htonl(88);
1843  tcph.th_seq = htonl(1);
1844  tcph.th_flags = TH_PUSH | TH_ACK;
1846  p->payload_len = sizeof(response);
1847  p->payload = response;
1848  FAIL_IF(StreamTcpPacket(&tv, p, stt, &pq) == -1);
1855  FAIL_IF(!FLOW_IS_PM_DONE(&f, STREAM_TOSERVER));
1856  FAIL_IF(FLOW_IS_PP_DONE(&f, STREAM_TOSERVER));
1857  FAIL_IF(FLOW_IS_PM_DONE(&f, STREAM_TOCLIENT));
1858  FAIL_IF(FLOW_IS_PP_DONE(&f, STREAM_TOCLIENT));
1860 
1861  /* response ack */
1862  tcph.th_ack = htonl(328);
1863  tcph.th_seq = htonl(88);
1864  tcph.th_flags = TH_ACK;
1866  p->payload_len = 0;
1867  p->payload = NULL;
1868  FAIL_IF(StreamTcpPacket(&tv, p, stt, &pq) == -1);
1875  FAIL_IF(!FLOW_IS_PM_DONE(&f, STREAM_TOSERVER));
1876  FAIL_IF(FLOW_IS_PP_DONE(&f, STREAM_TOSERVER));
1877  FAIL_IF(!FLOW_IS_PM_DONE(&f, STREAM_TOCLIENT));
1878  FAIL_IF(!FLOW_IS_PP_DONE(&f, STREAM_TOCLIENT));
1880 
1881  TEST_END;
1882  PASS;
1883 }
1884 
1885 /**
1886  * \test GE -> RUBBISH(TC - PM AND PP NOT DONE) -> RUBBISH(TC - PM AND PP DONE).
1887  */
1888 static int AppLayerTest04(void)
1889 {
1890  TEST_START;
1891 
1892  /* request */
1893  uint8_t request[] = {
1894  0x47, 0x45, 0x54, 0x20, 0x2f, 0x69, 0x6e, 0x64,
1895  0x65, 0x78, 0x2e, 0x68, 0x74, 0x6d, 0x6c, 0x20,
1896  0x48, 0x54, 0x54, 0x50, 0x2f, 0x31, 0x2e, 0x30,
1897  0x0d, 0x0a, 0x48, 0x6f, 0x73, 0x74, 0x3a, 0x20,
1898  0x6c, 0x6f, 0x63, 0x61, 0x6c, 0x68, 0x6f, 0x73,
1899  0x74, 0x0d, 0x0a, 0x55, 0x73, 0x65, 0x72, 0x2d,
1900  0x41, 0x67, 0x65, 0x6e, 0x74, 0x3a, 0x20, 0x41,
1901  0x70, 0x61, 0x63, 0x68, 0x65, 0x42, 0x65, 0x6e,
1902  0x63, 0x68, 0x2f, 0x32, 0x2e, 0x33, 0x0d, 0x0a,
1903  0x41, 0x63, 0x63, 0x65, 0x70, 0x74, 0x3a, 0x20,
1904  0x2a, 0x2f, 0x2a, 0x0d, 0x0a, 0x0d, 0x0a };
1905  PrintRawDataFp(stdout, request, sizeof(request));
1906  tcph.th_ack = htonl(1);
1907  tcph.th_seq = htonl(1);
1908  tcph.th_flags = TH_PUSH | TH_ACK;
1910  p->payload_len = sizeof(request);
1911  p->payload = request;
1912  FAIL_IF(StreamTcpPacket(&tv, p, stt, &pq) == -1);
1919  FAIL_IF(FLOW_IS_PM_DONE(&f, STREAM_TOSERVER));
1920  FAIL_IF(FLOW_IS_PP_DONE(&f, STREAM_TOSERVER));
1921  FAIL_IF(FLOW_IS_PM_DONE(&f, STREAM_TOCLIENT));
1922  FAIL_IF(FLOW_IS_PP_DONE(&f, STREAM_TOCLIENT));
1923  FAIL_IF(ssn->data_first_seen_dir != STREAM_TOSERVER); // TOSERVER data now seen
1924 
1925  /* partial response */
1926  uint8_t response1[] = { 0x58, 0x54, 0x54, 0x50, };
1927  PrintRawDataFp(stdout, response1, sizeof(response1));
1928  tcph.th_ack = htonl(88);
1929  tcph.th_seq = htonl(1);
1930  tcph.th_flags = TH_PUSH | TH_ACK;
1932  p->payload_len = sizeof(response1);
1933  p->payload = response1;
1934  FAIL_IF(StreamTcpPacket(&tv, p, stt, &pq) == -1);
1937  FAIL_IF(f.alproto != ALPROTO_HTTP1); // http based on ts
1938  FAIL_IF(f.alproto_ts != ALPROTO_HTTP1); // ts complete
1941  FAIL_IF(!FLOW_IS_PM_DONE(&f, STREAM_TOSERVER));
1942  FAIL_IF(FLOW_IS_PP_DONE(&f, STREAM_TOSERVER));
1943  FAIL_IF(FLOW_IS_PM_DONE(&f, STREAM_TOCLIENT));
1944  FAIL_IF(FLOW_IS_PP_DONE(&f, STREAM_TOCLIENT));
1945  FAIL_IF(ssn->data_first_seen_dir != APP_LAYER_DATA_ALREADY_SENT_TO_APP_LAYER); // first data sent to applayer
1946 
1947  /* partial response ack */
1948  tcph.th_ack = htonl(5);
1949  tcph.th_seq = htonl(88);
1950  tcph.th_flags = TH_ACK;
1952  p->payload_len = 0;
1953  p->payload = NULL;
1954  FAIL_IF(StreamTcpPacket(&tv, p, stt, &pq) == -1);
1957  FAIL_IF(f.alproto != ALPROTO_HTTP1); // http based on ts
1958  FAIL_IF(f.alproto_ts != ALPROTO_HTTP1); // ts complete
1961  FAIL_IF(!FLOW_IS_PM_DONE(&f, STREAM_TOSERVER));
1962  FAIL_IF(FLOW_IS_PP_DONE(&f, STREAM_TOSERVER));
1963  FAIL_IF(FLOW_IS_PM_DONE(&f, STREAM_TOCLIENT));
1964  FAIL_IF(!FLOW_IS_PP_DONE(&f, STREAM_TOCLIENT)); // to client pp got nothing
1965  FAIL_IF(ssn->data_first_seen_dir != APP_LAYER_DATA_ALREADY_SENT_TO_APP_LAYER); // first data sent to applayer
1966 
1967  /* remaining response */
1968  uint8_t response2[] = {
1969  0x2f, 0x31, 0x2e, 0x31,
1970  0x20, 0x32, 0x30, 0x30, 0x20, 0x4f, 0x4b, 0x0d,
1971  0x0a, 0x44, 0x61, 0x74, 0x65, 0x3a, 0x20, 0x46,
1972  0x72, 0x69, 0x2c, 0x20, 0x32, 0x33, 0x20, 0x53,
1973  0x65, 0x70, 0x20, 0x32, 0x30, 0x31, 0x31, 0x20,
1974  0x30, 0x36, 0x3a, 0x32, 0x39, 0x3a, 0x33, 0x39,
1975  0x20, 0x47, 0x4d, 0x54, 0x0d, 0x0a, 0x53, 0x65,
1976  0x72, 0x76, 0x65, 0x72, 0x3a, 0x20, 0x41, 0x70,
1977  0x61, 0x63, 0x68, 0x65, 0x2f, 0x32, 0x2e, 0x32,
1978  0x2e, 0x31, 0x35, 0x20, 0x28, 0x55, 0x6e, 0x69,
1979  0x78, 0x29, 0x20, 0x44, 0x41, 0x56, 0x2f, 0x32,
1980  0x0d, 0x0a, 0x4c, 0x61, 0x73, 0x74, 0x2d, 0x4d,
1981  0x6f, 0x64, 0x69, 0x66, 0x69, 0x65, 0x64, 0x3a,
1982  0x20, 0x54, 0x68, 0x75, 0x2c, 0x20, 0x30, 0x34,
1983  0x20, 0x4e, 0x6f, 0x76, 0x20, 0x32, 0x30, 0x31,
1984  0x30, 0x20, 0x31, 0x35, 0x3a, 0x30, 0x34, 0x3a,
1985  0x34, 0x36, 0x20, 0x47, 0x4d, 0x54, 0x0d, 0x0a,
1986  0x45, 0x54, 0x61, 0x67, 0x3a, 0x20, 0x22, 0x61,
1987  0x62, 0x38, 0x39, 0x36, 0x35, 0x2d, 0x32, 0x63,
1988  0x2d, 0x34, 0x39, 0x34, 0x33, 0x62, 0x37, 0x61,
1989  0x37, 0x66, 0x37, 0x66, 0x38, 0x30, 0x22, 0x0d,
1990  0x0a, 0x41, 0x63, 0x63, 0x65, 0x70, 0x74, 0x2d,
1991  0x52, 0x61, 0x6e, 0x67, 0x65, 0x73, 0x3a, 0x20,
1992  0x62, 0x79, 0x74, 0x65, 0x73, 0x0d, 0x0a, 0x43,
1993  0x6f, 0x6e, 0x74, 0x65, 0x6e, 0x74, 0x2d, 0x4c,
1994  0x65, 0x6e, 0x67, 0x74, 0x68, 0x3a, 0x20, 0x34,
1995  0x34, 0x0d, 0x0a, 0x43, 0x6f, 0x6e, 0x6e, 0x65,
1996  0x63, 0x74, 0x69, 0x6f, 0x6e, 0x3a, 0x20, 0x63,
1997  0x6c, 0x6f, 0x73, 0x65, 0x0d, 0x0a, 0x43, 0x6f,
1998  0x6e, 0x74, 0x65, 0x6e, 0x74, 0x2d, 0x54, 0x79,
1999  0x70, 0x65, 0x3a, 0x20, 0x74, 0x65, 0x78, 0x74,
2000  0x2f, 0x68, 0x74, 0x6d, 0x6c, 0x0d, 0x0a, 0x58,
2001  0x2d, 0x50, 0x61, 0x64, 0x3a, 0x20, 0x61, 0x76,
2002  0x6f, 0x69, 0x64, 0x20, 0x62, 0x72, 0x6f, 0x77,
2003  0x73, 0x65, 0x72, 0x20, 0x62, 0x75, 0x67, 0x0d,
2004  0x0a, 0x0d, 0x0a, 0x3c, 0x68, 0x74, 0x6d, 0x6c,
2005  0x3e, 0x3c, 0x62, 0x6f, 0x64, 0x79, 0x3e, 0x3c,
2006  0x68, 0x31, 0x3e, 0x49, 0x74, 0x20, 0x77, 0x6f,
2007  0x72, 0x6b, 0x73, 0x21, 0x3c, 0x2f, 0x68, 0x31,
2008  0x3e, 0x3c, 0x2f, 0x62, 0x6f, 0x64, 0x79, 0x3e,
2009  0x3c, 0x2f, 0x68, 0x74, 0x6d, 0x6c, 0x3e };
2010  PrintRawDataFp(stdout, response2, sizeof(response2));
2011  tcph.th_ack = htonl(88);
2012  tcph.th_seq = htonl(5);
2013  tcph.th_flags = TH_PUSH | TH_ACK;
2015  p->payload_len = sizeof(response2);
2016  p->payload = response2;
2017  FAIL_IF(StreamTcpPacket(&tv, p, stt, &pq) == -1);
2020  FAIL_IF(f.alproto != ALPROTO_HTTP1); // http based on ts
2021  FAIL_IF(f.alproto_ts != ALPROTO_HTTP1); // ts complete
2024  FAIL_IF(!FLOW_IS_PM_DONE(&f, STREAM_TOSERVER));
2025  FAIL_IF(FLOW_IS_PP_DONE(&f, STREAM_TOSERVER));
2026  FAIL_IF(FLOW_IS_PM_DONE(&f, STREAM_TOCLIENT));
2027  FAIL_IF(!FLOW_IS_PP_DONE(&f, STREAM_TOCLIENT)); // to client pp got nothing
2028  FAIL_IF(ssn->data_first_seen_dir != APP_LAYER_DATA_ALREADY_SENT_TO_APP_LAYER); // first data sent to applayer
2029 
2030  /* response ack */
2031  tcph.th_ack = htonl(328);
2032  tcph.th_seq = htonl(88);
2033  tcph.th_flags = TH_ACK;
2035  p->payload_len = 0;
2036  p->payload = NULL;
2037  FAIL_IF(StreamTcpPacket(&tv, p, stt, &pq) == -1);
2038  FAIL_IF(!StreamTcpIsSetStreamFlagAppProtoDetectionCompleted(&ssn->server)); // toclient complete (failed)
2040  FAIL_IF(f.alproto != ALPROTO_HTTP1); // http based on ts
2041  FAIL_IF(f.alproto_ts != ALPROTO_HTTP1); // ts complete
2042  FAIL_IF(f.alproto_tc != ALPROTO_FAILED); // tc failed
2044  FAIL_IF(!FLOW_IS_PM_DONE(&f, STREAM_TOSERVER));
2045  FAIL_IF(FLOW_IS_PP_DONE(&f, STREAM_TOSERVER));
2046  FAIL_IF(!FLOW_IS_PM_DONE(&f, STREAM_TOCLIENT));
2047  FAIL_IF(!FLOW_IS_PP_DONE(&f, STREAM_TOCLIENT)); // to client pp got nothing
2048  FAIL_IF(ssn->data_first_seen_dir != APP_LAYER_DATA_ALREADY_SENT_TO_APP_LAYER); // first data sent to applayer
2049 
2050  TEST_END;
2051  PASS;
2052 }
2053 
2054 /**
2055  * \test RUBBISH -> HTTP/1.1
2056  */
2057 static int AppLayerTest05(void)
2058 {
2059  TEST_START;
2060 
2061  /* full request */
2062  uint8_t request[] = {
2063  0x48, 0x45, 0x54, 0x20, 0x2f, 0x69, 0x6e, 0x64,
2064  0x65, 0x78, 0x2e, 0x68, 0x74, 0x6d, 0x6c, 0x20,
2065  0x48, 0x54, 0x54, 0x50, 0x2f, 0x31, 0x2e, 0x30,
2066  0x0d, 0x0a, 0x48, 0x6f, 0x73, 0x74, 0x3a, 0x20,
2067  0x6c, 0x6f, 0x63, 0x61, 0x6c, 0x68, 0x6f, 0x73,
2068  0x74, 0x0d, 0x0a, 0x55, 0x73, 0x65, 0x72, 0x2d,
2069  0x41, 0x67, 0x65, 0x6e, 0x74, 0x3a, 0x20, 0x41,
2070  0x70, 0x61, 0x63, 0x68, 0x65, 0x42, 0x65, 0x6e,
2071  0x63, 0x68, 0x2f, 0x32, 0x2e, 0x33, 0x0d, 0x0a,
2072  0x41, 0x63, 0x63, 0x65, 0x70, 0x74, 0x3a, 0x20,
2073  0x2a, 0x2f, 0x2a, 0x0d, 0x0a, 0x0d, 0x0a };
2074  PrintRawDataFp(stdout, request, sizeof(request));
2075  tcph.th_ack = htonl(1);
2076  tcph.th_seq = htonl(1);
2077  tcph.th_flags = TH_PUSH | TH_ACK;
2079  p->payload_len = sizeof(request);
2080  p->payload = request;
2081  FAIL_IF(StreamTcpPacket(&tv, p, stt, &pq) == -1);
2088  FAIL_IF(FLOW_IS_PM_DONE(&f, STREAM_TOSERVER));
2089  FAIL_IF(FLOW_IS_PP_DONE(&f, STREAM_TOSERVER));
2090  FAIL_IF(FLOW_IS_PM_DONE(&f, STREAM_TOCLIENT));
2091  FAIL_IF(FLOW_IS_PP_DONE(&f, STREAM_TOCLIENT));
2092  FAIL_IF(ssn->data_first_seen_dir != STREAM_TOSERVER);
2093 
2094  /* full response - request ack */
2095  uint8_t response[] = {
2096  0x48, 0x54, 0x54, 0x50, 0x2f, 0x31, 0x2e, 0x31,
2097  0x20, 0x32, 0x30, 0x30, 0x20, 0x4f, 0x4b, 0x0d,
2098  0x0a, 0x44, 0x61, 0x74, 0x65, 0x3a, 0x20, 0x46,
2099  0x72, 0x69, 0x2c, 0x20, 0x32, 0x33, 0x20, 0x53,
2100  0x65, 0x70, 0x20, 0x32, 0x30, 0x31, 0x31, 0x20,
2101  0x30, 0x36, 0x3a, 0x32, 0x39, 0x3a, 0x33, 0x39,
2102  0x20, 0x47, 0x4d, 0x54, 0x0d, 0x0a, 0x53, 0x65,
2103  0x72, 0x76, 0x65, 0x72, 0x3a, 0x20, 0x41, 0x70,
2104  0x61, 0x63, 0x68, 0x65, 0x2f, 0x32, 0x2e, 0x32,
2105  0x2e, 0x31, 0x35, 0x20, 0x28, 0x55, 0x6e, 0x69,
2106  0x78, 0x29, 0x20, 0x44, 0x41, 0x56, 0x2f, 0x32,
2107  0x0d, 0x0a, 0x4c, 0x61, 0x73, 0x74, 0x2d, 0x4d,
2108  0x6f, 0x64, 0x69, 0x66, 0x69, 0x65, 0x64, 0x3a,
2109  0x20, 0x54, 0x68, 0x75, 0x2c, 0x20, 0x30, 0x34,
2110  0x20, 0x4e, 0x6f, 0x76, 0x20, 0x32, 0x30, 0x31,
2111  0x30, 0x20, 0x31, 0x35, 0x3a, 0x30, 0x34, 0x3a,
2112  0x34, 0x36, 0x20, 0x47, 0x4d, 0x54, 0x0d, 0x0a,
2113  0x45, 0x54, 0x61, 0x67, 0x3a, 0x20, 0x22, 0x61,
2114  0x62, 0x38, 0x39, 0x36, 0x35, 0x2d, 0x32, 0x63,
2115  0x2d, 0x34, 0x39, 0x34, 0x33, 0x62, 0x37, 0x61,
2116  0x37, 0x66, 0x37, 0x66, 0x38, 0x30, 0x22, 0x0d,
2117  0x0a, 0x41, 0x63, 0x63, 0x65, 0x70, 0x74, 0x2d,
2118  0x52, 0x61, 0x6e, 0x67, 0x65, 0x73, 0x3a, 0x20,
2119  0x62, 0x79, 0x74, 0x65, 0x73, 0x0d, 0x0a, 0x43,
2120  0x6f, 0x6e, 0x74, 0x65, 0x6e, 0x74, 0x2d, 0x4c,
2121  0x65, 0x6e, 0x67, 0x74, 0x68, 0x3a, 0x20, 0x34,
2122  0x34, 0x0d, 0x0a, 0x43, 0x6f, 0x6e, 0x6e, 0x65,
2123  0x63, 0x74, 0x69, 0x6f, 0x6e, 0x3a, 0x20, 0x63,
2124  0x6c, 0x6f, 0x73, 0x65, 0x0d, 0x0a, 0x43, 0x6f,
2125  0x6e, 0x74, 0x65, 0x6e, 0x74, 0x2d, 0x54, 0x79,
2126  0x70, 0x65, 0x3a, 0x20, 0x74, 0x65, 0x78, 0x74,
2127  0x2f, 0x68, 0x74, 0x6d, 0x6c, 0x0d, 0x0a, 0x58,
2128  0x2d, 0x50, 0x61, 0x64, 0x3a, 0x20, 0x61, 0x76,
2129  0x6f, 0x69, 0x64, 0x20, 0x62, 0x72, 0x6f, 0x77,
2130  0x73, 0x65, 0x72, 0x20, 0x62, 0x75, 0x67, 0x0d,
2131  0x0a, 0x0d, 0x0a, 0x3c, 0x68, 0x74, 0x6d, 0x6c,
2132  0x3e, 0x3c, 0x62, 0x6f, 0x64, 0x79, 0x3e, 0x3c,
2133  0x68, 0x31, 0x3e, 0x49, 0x74, 0x20, 0x77, 0x6f,
2134  0x72, 0x6b, 0x73, 0x21, 0x3c, 0x2f, 0x68, 0x31,
2135  0x3e, 0x3c, 0x2f, 0x62, 0x6f, 0x64, 0x79, 0x3e,
2136  0x3c, 0x2f, 0x68, 0x74, 0x6d, 0x6c, 0x3e };
2137  PrintRawDataFp(stdout, response, sizeof(response));
2138  tcph.th_ack = htonl(88);
2139  tcph.th_seq = htonl(1);
2140  tcph.th_flags = TH_PUSH | TH_ACK;
2142  p->payload_len = sizeof(response);
2143  p->payload = response;
2144  FAIL_IF(StreamTcpPacket(&tv, p, stt, &pq) == -1);
2151  FAIL_IF(!FLOW_IS_PM_DONE(&f, STREAM_TOSERVER));
2152  FAIL_IF(!FLOW_IS_PP_DONE(&f, STREAM_TOSERVER));
2153  FAIL_IF(FLOW_IS_PM_DONE(&f, STREAM_TOCLIENT));
2154  FAIL_IF(FLOW_IS_PP_DONE(&f, STREAM_TOCLIENT));
2155  FAIL_IF(ssn->data_first_seen_dir != STREAM_TOSERVER);
2156 
2157  /* response ack */
2158  tcph.th_ack = htonl(328);
2159  tcph.th_seq = htonl(88);
2160  tcph.th_flags = TH_ACK;
2162  p->payload_len = 0;
2163  p->payload = NULL;
2164  FAIL_IF(StreamTcpPacket(&tv, p, stt, &pq) == -1);
2171  FAIL_IF(!FLOW_IS_PM_DONE(&f, STREAM_TOSERVER));
2172  FAIL_IF(!FLOW_IS_PP_DONE(&f, STREAM_TOSERVER));
2173  FAIL_IF(!FLOW_IS_PM_DONE(&f, STREAM_TOCLIENT));
2174  FAIL_IF(FLOW_IS_PP_DONE(&f, STREAM_TOCLIENT));
2176 
2177  TEST_END;
2178  PASS;
2179 }
2180 
2181 /**
2182  * \test HTTP/1.1 -> GET
2183  */
2184 static int AppLayerTest06(void)
2185 {
2186  TEST_START;
2187 
2188  /* full response - request ack */
2189  uint8_t response[] = {
2190  0x48, 0x54, 0x54, 0x50, 0x2f, 0x31, 0x2e, 0x31,
2191  0x20, 0x32, 0x30, 0x30, 0x20, 0x4f, 0x4b, 0x0d,
2192  0x0a, 0x44, 0x61, 0x74, 0x65, 0x3a, 0x20, 0x46,
2193  0x72, 0x69, 0x2c, 0x20, 0x32, 0x33, 0x20, 0x53,
2194  0x65, 0x70, 0x20, 0x32, 0x30, 0x31, 0x31, 0x20,
2195  0x30, 0x36, 0x3a, 0x32, 0x39, 0x3a, 0x33, 0x39,
2196  0x20, 0x47, 0x4d, 0x54, 0x0d, 0x0a, 0x53, 0x65,
2197  0x72, 0x76, 0x65, 0x72, 0x3a, 0x20, 0x41, 0x70,
2198  0x61, 0x63, 0x68, 0x65, 0x2f, 0x32, 0x2e, 0x32,
2199  0x2e, 0x31, 0x35, 0x20, 0x28, 0x55, 0x6e, 0x69,
2200  0x78, 0x29, 0x20, 0x44, 0x41, 0x56, 0x2f, 0x32,
2201  0x0d, 0x0a, 0x4c, 0x61, 0x73, 0x74, 0x2d, 0x4d,
2202  0x6f, 0x64, 0x69, 0x66, 0x69, 0x65, 0x64, 0x3a,
2203  0x20, 0x54, 0x68, 0x75, 0x2c, 0x20, 0x30, 0x34,
2204  0x20, 0x4e, 0x6f, 0x76, 0x20, 0x32, 0x30, 0x31,
2205  0x30, 0x20, 0x31, 0x35, 0x3a, 0x30, 0x34, 0x3a,
2206  0x34, 0x36, 0x20, 0x47, 0x4d, 0x54, 0x0d, 0x0a,
2207  0x45, 0x54, 0x61, 0x67, 0x3a, 0x20, 0x22, 0x61,
2208  0x62, 0x38, 0x39, 0x36, 0x35, 0x2d, 0x32, 0x63,
2209  0x2d, 0x34, 0x39, 0x34, 0x33, 0x62, 0x37, 0x61,
2210  0x37, 0x66, 0x37, 0x66, 0x38, 0x30, 0x22, 0x0d,
2211  0x0a, 0x41, 0x63, 0x63, 0x65, 0x70, 0x74, 0x2d,
2212  0x52, 0x61, 0x6e, 0x67, 0x65, 0x73, 0x3a, 0x20,
2213  0x62, 0x79, 0x74, 0x65, 0x73, 0x0d, 0x0a, 0x43,
2214  0x6f, 0x6e, 0x74, 0x65, 0x6e, 0x74, 0x2d, 0x4c,
2215  0x65, 0x6e, 0x67, 0x74, 0x68, 0x3a, 0x20, 0x34,
2216  0x34, 0x0d, 0x0a, 0x43, 0x6f, 0x6e, 0x6e, 0x65,
2217  0x63, 0x74, 0x69, 0x6f, 0x6e, 0x3a, 0x20, 0x63,
2218  0x6c, 0x6f, 0x73, 0x65, 0x0d, 0x0a, 0x43, 0x6f,
2219  0x6e, 0x74, 0x65, 0x6e, 0x74, 0x2d, 0x54, 0x79,
2220  0x70, 0x65, 0x3a, 0x20, 0x74, 0x65, 0x78, 0x74,
2221  0x2f, 0x68, 0x74, 0x6d, 0x6c, 0x0d, 0x0a, 0x58,
2222  0x2d, 0x50, 0x61, 0x64, 0x3a, 0x20, 0x61, 0x76,
2223  0x6f, 0x69, 0x64, 0x20, 0x62, 0x72, 0x6f, 0x77,
2224  0x73, 0x65, 0x72, 0x20, 0x62, 0x75, 0x67, 0x0d,
2225  0x0a, 0x0d, 0x0a, 0x3c, 0x68, 0x74, 0x6d, 0x6c,
2226  0x3e, 0x3c, 0x62, 0x6f, 0x64, 0x79, 0x3e, 0x3c,
2227  0x68, 0x31, 0x3e, 0x49, 0x74, 0x20, 0x77, 0x6f,
2228  0x72, 0x6b, 0x73, 0x21, 0x3c, 0x2f, 0x68, 0x31,
2229  0x3e, 0x3c, 0x2f, 0x62, 0x6f, 0x64, 0x79, 0x3e,
2230  0x3c, 0x2f, 0x68, 0x74, 0x6d, 0x6c, 0x3e };
2231  tcph.th_ack = htonl(1);
2232  tcph.th_seq = htonl(1);
2233  tcph.th_flags = TH_PUSH | TH_ACK;
2235  p->payload_len = sizeof(response);
2236  p->payload = response;
2237  FAIL_IF(StreamTcpPacket(&tv, p, stt, &pq) == -1);
2244  FAIL_IF(FLOW_IS_PM_DONE(&f, STREAM_TOSERVER));
2245  FAIL_IF(FLOW_IS_PP_DONE(&f, STREAM_TOSERVER));
2246  FAIL_IF(FLOW_IS_PM_DONE(&f, STREAM_TOCLIENT));
2247  FAIL_IF(FLOW_IS_PP_DONE(&f, STREAM_TOCLIENT));
2248  FAIL_IF(ssn->data_first_seen_dir != STREAM_TOCLIENT);
2249 
2250  /* full request - response ack*/
2251  uint8_t request[] = {
2252  0x47, 0x45, 0x54, 0x20, 0x2f, 0x69, 0x6e, 0x64,
2253  0x65, 0x78, 0x2e, 0x68, 0x74, 0x6d, 0x6c, 0x20,
2254  0x48, 0x54, 0x54, 0x50, 0x2f, 0x31, 0x2e, 0x30,
2255  0x0d, 0x0a, 0x48, 0x6f, 0x73, 0x74, 0x3a, 0x20,
2256  0x6c, 0x6f, 0x63, 0x61, 0x6c, 0x68, 0x6f, 0x73,
2257  0x74, 0x0d, 0x0a, 0x55, 0x73, 0x65, 0x72, 0x2d,
2258  0x41, 0x67, 0x65, 0x6e, 0x74, 0x3a, 0x20, 0x41,
2259  0x70, 0x61, 0x63, 0x68, 0x65, 0x42, 0x65, 0x6e,
2260  0x63, 0x68, 0x2f, 0x32, 0x2e, 0x33, 0x0d, 0x0a,
2261  0x41, 0x63, 0x63, 0x65, 0x70, 0x74, 0x3a, 0x20,
2262  0x2a, 0x2f, 0x2a, 0x0d, 0x0a, 0x0d, 0x0a };
2263  tcph.th_ack = htonl(328);
2264  tcph.th_seq = htonl(1);
2265  tcph.th_flags = TH_PUSH | TH_ACK;
2267  p->payload_len = sizeof(request);
2268  p->payload = request;
2269  FAIL_IF(StreamTcpPacket(&tv, p, stt, &pq) == -1);
2276  FAIL_IF(FLOW_IS_PM_DONE(&f, STREAM_TOSERVER));
2277  FAIL_IF(FLOW_IS_PP_DONE(&f, STREAM_TOSERVER));
2278  FAIL_IF(!FLOW_IS_PM_DONE(&f, STREAM_TOCLIENT));
2279  FAIL_IF(FLOW_IS_PP_DONE(&f, STREAM_TOCLIENT));
2281 
2282  tcph.th_ack = htonl(1 + sizeof(request));
2283  tcph.th_seq = htonl(328);
2284  tcph.th_flags = TH_PUSH | TH_ACK;
2286  p->payload_len = 0;
2287  p->payload = NULL;
2288  FAIL_IF(StreamTcpPacket(&tv, p, stt, &pq) == -1);
2295  FAIL_IF(!FLOW_IS_PM_DONE(&f, STREAM_TOSERVER));
2296  FAIL_IF(FLOW_IS_PP_DONE(&f, STREAM_TOSERVER));
2297  FAIL_IF(!FLOW_IS_PM_DONE(&f, STREAM_TOCLIENT));
2298  FAIL_IF(FLOW_IS_PP_DONE(&f, STREAM_TOCLIENT));
2300 
2301  TEST_END;
2302  PASS;
2303 }
2304 
2305 /**
2306  * \test GET -> DCERPC
2307  */
2308 static int AppLayerTest07(void)
2309 {
2310  TEST_START;
2311 
2312  /* full request */
2313  uint8_t request[] = {
2314  0x47, 0x45, 0x54, 0x20, 0x2f, 0x69, 0x6e, 0x64,
2315  0x65, 0x78, 0x2e, 0x68, 0x74, 0x6d, 0x6c, 0x20,
2316  0x48, 0x54, 0x54, 0x50, 0x2f, 0x31, 0x2e, 0x30,
2317  0x0d, 0x0a, 0x48, 0x6f, 0x73, 0x74, 0x3a, 0x20,
2318  0x6c, 0x6f, 0x63, 0x61, 0x6c, 0x68, 0x6f, 0x73,
2319  0x74, 0x0d, 0x0a, 0x55, 0x73, 0x65, 0x72, 0x2d,
2320  0x41, 0x67, 0x65, 0x6e, 0x74, 0x3a, 0x20, 0x41,
2321  0x70, 0x61, 0x63, 0x68, 0x65, 0x42, 0x65, 0x6e,
2322  0x63, 0x68, 0x2f, 0x32, 0x2e, 0x33, 0x0d, 0x0a,
2323  0x41, 0x63, 0x63, 0x65, 0x70, 0x74, 0x3a, 0x20,
2324  0x2a, 0x2f, 0x2a, 0x0d, 0x0a, 0x0d, 0x0a };
2325  tcph.th_ack = htonl(1);
2326  tcph.th_seq = htonl(1);
2327  tcph.th_flags = TH_PUSH | TH_ACK;
2329  p->payload_len = sizeof(request);
2330  p->payload = request;
2331  FAIL_IF(StreamTcpPacket(&tv, p, stt, &pq) == -1);
2338  FAIL_IF(FLOW_IS_PM_DONE(&f, STREAM_TOSERVER));
2339  FAIL_IF(FLOW_IS_PP_DONE(&f, STREAM_TOSERVER));
2340  FAIL_IF(FLOW_IS_PM_DONE(&f, STREAM_TOCLIENT));
2341  FAIL_IF(FLOW_IS_PP_DONE(&f, STREAM_TOCLIENT));
2342  FAIL_IF(ssn->data_first_seen_dir != STREAM_TOSERVER);
2343 
2344  /* full response - request ack */
2345  uint8_t response[] = { 0x05, 0x00, 0x4d, 0x42, 0x00, 0x01, 0x2e, 0x31, 0x20, 0x32, 0x30, 0x30,
2346  0x20, 0x4f, 0x4b, 0x0d, 0x0a, 0x44, 0x61, 0x74, 0x65, 0x3a, 0x20, 0x46, 0x72, 0x69, 0x2c,
2347  0x20, 0x32, 0x33, 0x20, 0x53, 0x65, 0x70, 0x20, 0x32, 0x30, 0x31, 0x31, 0x20, 0x30, 0x36,
2348  0x3a, 0x32, 0x39, 0x3a, 0x33, 0x39, 0x20, 0x47, 0x4d, 0x54, 0x0d, 0x0a, 0x53, 0x65, 0x72,
2349  0x76, 0x65, 0x72, 0x3a, 0x20, 0x41, 0x70, 0x61, 0x63, 0x68, 0x65, 0x2f, 0x32, 0x2e, 0x32,
2350  0x2e, 0x31, 0x35, 0x20, 0x28, 0x55, 0x6e, 0x69, 0x78, 0x29, 0x20, 0x44, 0x41, 0x56, 0x2f,
2351  0x32, 0x0d, 0x0a, 0x4c, 0x61, 0x73, 0x74, 0x2d, 0x4d, 0x6f, 0x64, 0x69, 0x66, 0x69, 0x65,
2352  0x64, 0x3a, 0x20, 0x54, 0x68, 0x75, 0x2c, 0x20, 0x30, 0x34, 0x20, 0x4e, 0x6f, 0x76, 0x20,
2353  0x32, 0x30, 0x31, 0x30, 0x20, 0x31, 0x35, 0x3a, 0x30, 0x34, 0x3a, 0x34, 0x36, 0x20, 0x47,
2354  0x4d, 0x54, 0x0d, 0x0a, 0x45, 0x54, 0x61, 0x67, 0x3a, 0x20, 0x22, 0x61, 0x62, 0x38, 0x39,
2355  0x36, 0x35, 0x2d, 0x32, 0x63, 0x2d, 0x34, 0x39, 0x34, 0x33, 0x62, 0x37, 0x61, 0x37, 0x66,
2356  0x37, 0x66, 0x38, 0x30, 0x22, 0x0d, 0x0a, 0x41, 0x63, 0x63, 0x65, 0x70, 0x74, 0x2d, 0x52,
2357  0x61, 0x6e, 0x67, 0x65, 0x73, 0x3a, 0x20, 0x62, 0x79, 0x74, 0x65, 0x73, 0x0d, 0x0a, 0x43,
2358  0x6f, 0x6e, 0x74, 0x65, 0x6e, 0x74, 0x2d, 0x4c, 0x65, 0x6e, 0x67, 0x74, 0x68, 0x3a, 0x20,
2359  0x34, 0x34, 0x0d, 0x0a, 0x43, 0x6f, 0x6e, 0x6e, 0x65, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x3a,
2360  0x20, 0x63, 0x6c, 0x6f, 0x73, 0x65, 0x0d, 0x0a, 0x43, 0x6f, 0x6e, 0x74, 0x65, 0x6e, 0x74,
2361  0x2d, 0x54, 0x79, 0x70, 0x65, 0x3a, 0x20, 0x74, 0x65, 0x78, 0x74, 0x2f, 0x68, 0x74, 0x6d,
2362  0x6c, 0x0d, 0x0a, 0x58, 0x2d, 0x50, 0x61, 0x64, 0x3a, 0x20, 0x61, 0x76, 0x6f, 0x69, 0x64,
2363  0x20, 0x62, 0x72, 0x6f, 0x77, 0x73, 0x65, 0x72, 0x20, 0x62, 0x75, 0x67, 0x0d, 0x0a, 0x0d,
2364  0x0a, 0x3c, 0x68, 0x74, 0x6d, 0x6c, 0x3e, 0x3c, 0x62, 0x6f, 0x64, 0x79, 0x3e, 0x3c, 0x68,
2365  0x31, 0x3e, 0x49, 0x74, 0x20, 0x77, 0x6f, 0x72, 0x6b, 0x73, 0x21, 0x3c, 0x2f, 0x68, 0x31,
2366  0x3e, 0x3c, 0x2f, 0x62, 0x6f, 0x64, 0x79, 0x3e, 0x3c, 0x2f, 0x68, 0x74, 0x6d, 0x6c, 0x3e };
2367  tcph.th_ack = htonl(88);
2368  tcph.th_seq = htonl(1);
2369  tcph.th_flags = TH_PUSH | TH_ACK;
2371  p->payload_len = sizeof(response);
2372  p->payload = response;
2373  FAIL_IF(StreamTcpPacket(&tv, p, stt, &pq) == -1);
2380  FAIL_IF(!FLOW_IS_PM_DONE(&f, STREAM_TOSERVER));
2381  FAIL_IF(FLOW_IS_PP_DONE(&f, STREAM_TOSERVER));
2382  FAIL_IF(FLOW_IS_PM_DONE(&f, STREAM_TOCLIENT));
2383  FAIL_IF(FLOW_IS_PP_DONE(&f, STREAM_TOCLIENT));
2385 
2386  /* response ack */
2387  tcph.th_ack = htonl(328);
2388  tcph.th_seq = htonl(88);
2389  tcph.th_flags = TH_ACK;
2391  p->payload_len = 0;
2392  p->payload = NULL;
2393  FAIL_IF(StreamTcpPacket(&tv, p, stt, &pq) == -1);
2400  FAIL_IF(!FLOW_IS_PM_DONE(&f, STREAM_TOSERVER));
2401  FAIL_IF(FLOW_IS_PP_DONE(&f, STREAM_TOSERVER));
2402  FAIL_IF(!FLOW_IS_PM_DONE(&f, STREAM_TOCLIENT));
2403  FAIL_IF(FLOW_IS_PP_DONE(&f, STREAM_TOCLIENT));
2405 
2406  TEST_END;
2407  PASS;
2408 }
2409 
2410 /**
2411  * \test RUBBISH(TC - PM and PP NOT DONE) ->
2412  * RUBBISH(TC - PM and PP DONE) ->
2413  * RUBBISH(TS - PM and PP DONE)
2414  */
2415 static int AppLayerTest09(void)
2416 {
2417  TEST_START;
2418 
2419  /* full request */
2420  uint8_t request1[] = {
2421  0x47, 0x47, 0x49, 0x20, 0x2f, 0x69, 0x6e, 0x64 };
2422  tcph.th_ack = htonl(1);
2423  tcph.th_seq = htonl(1);
2424  tcph.th_flags = TH_PUSH | TH_ACK;
2426  p->payload_len = sizeof(request1);
2427  p->payload = request1;
2428  FAIL_IF(StreamTcpPacket(&tv, p, stt, &pq) == -1);
2435  FAIL_IF(FLOW_IS_PM_DONE(&f, STREAM_TOSERVER));
2436  FAIL_IF(FLOW_IS_PP_DONE(&f, STREAM_TOSERVER));
2437  FAIL_IF(FLOW_IS_PM_DONE(&f, STREAM_TOCLIENT));
2438  FAIL_IF(FLOW_IS_PP_DONE(&f, STREAM_TOCLIENT));
2439  FAIL_IF(ssn->data_first_seen_dir != STREAM_TOSERVER);
2440 
2441  /* response - request ack */
2442  tcph.th_ack = htonl(9);
2443  tcph.th_seq = htonl(1);
2444  tcph.th_flags = TH_PUSH | TH_ACK;
2446  p->payload_len = 0;
2447  p->payload = NULL;
2448  FAIL_IF(StreamTcpPacket(&tv, p, stt, &pq) == -1);
2455  FAIL_IF(FLOW_IS_PM_DONE(&f, STREAM_TOSERVER));
2456  FAIL_IF(!FLOW_IS_PP_DONE(&f, STREAM_TOSERVER));
2457  FAIL_IF(FLOW_IS_PM_DONE(&f, STREAM_TOCLIENT));
2458  FAIL_IF(FLOW_IS_PP_DONE(&f, STREAM_TOCLIENT));
2459  FAIL_IF(ssn->data_first_seen_dir != STREAM_TOSERVER);
2460 
2461  /* full request */
2462  uint8_t request2[] = {
2463  0x44, 0x44, 0x45, 0x20, 0x2f, 0x69, 0x6e, 0x64, 0xff };
2464  tcph.th_ack = htonl(1);
2465  tcph.th_seq = htonl(9);
2466  tcph.th_flags = TH_PUSH | TH_ACK;
2468  p->payload_len = sizeof(request2);
2469  p->payload = request2;
2470  FAIL_IF(StreamTcpPacket(&tv, p, stt, &pq) == -1);
2477  FAIL_IF(FLOW_IS_PM_DONE(&f, STREAM_TOSERVER));
2478  FAIL_IF(!FLOW_IS_PP_DONE(&f, STREAM_TOSERVER));
2479  FAIL_IF(FLOW_IS_PM_DONE(&f, STREAM_TOCLIENT));
2480  FAIL_IF(FLOW_IS_PP_DONE(&f, STREAM_TOCLIENT));
2481  FAIL_IF(ssn->data_first_seen_dir != STREAM_TOSERVER);
2482 
2483  /* full response - request ack */
2484  uint8_t response[] = {
2485  0x55, 0x74, 0x54, 0x50, 0x2f, 0x31, 0x2e, 0x31,
2486  0x20, 0x32, 0x30, 0x30, 0x20, 0x4f, 0x4b, 0x0d,
2487  0x0a, 0x44, 0x61, 0x74, 0x65, 0x3a, 0x20, 0x46,
2488  0x72, 0x69, 0x2c, 0x20, 0x32, 0x33, 0x20, 0x53,
2489  0x65, 0x70, 0x20, 0x32, 0x30, 0x31, 0x31, 0x20,
2490  0x30, 0x36, 0x3a, 0x32, 0x39, 0x3a, 0x33, 0x39,
2491  0x20, 0x47, 0x4d, 0x54, 0x0d, 0x0a, 0x53, 0x65,
2492  0x72, 0x76, 0x65, 0x72, 0x3a, 0x20, 0x41, 0x70,
2493  0x61, 0x63, 0x68, 0x65, 0x2f, 0x32, 0x2e, 0x32,
2494  0x2e, 0x31, 0x35, 0x20, 0x28, 0x55, 0x6e, 0x69,
2495  0x78, 0x29, 0x20, 0x44, 0x41, 0x56, 0x2f, 0x32,
2496  0x0d, 0x0a, 0x4c, 0x61, 0x73, 0x74, 0x2d, 0x4d,
2497  0x6f, 0x64, 0x69, 0x66, 0x69, 0x65, 0x64, 0x3a,
2498  0x20, 0x54, 0x68, 0x75, 0x2c, 0x20, 0x30, 0x34,
2499  0x20, 0x4e, 0x6f, 0x76, 0x20, 0x32, 0x30, 0x31,
2500  0x30, 0x20, 0x31, 0x35, 0x3a, 0x30, 0x34, 0x3a,
2501  0x34, 0x36, 0x20, 0x47, 0x4d, 0x54, 0x0d, 0x0a,
2502  0x45, 0x54, 0x61, 0x67, 0x3a, 0x20, 0x22, 0x61,
2503  0x62, 0x38, 0x39, 0x36, 0x35, 0x2d, 0x32, 0x63,
2504  0x2d, 0x34, 0x39, 0x34, 0x33, 0x62, 0x37, 0x61,
2505  0x37, 0x66, 0x37, 0x66, 0x38, 0x30, 0x22, 0x0d,
2506  0x0a, 0x41, 0x63, 0x63, 0x65, 0x70, 0x74, 0x2d,
2507  0x52, 0x61, 0x6e, 0x67, 0x65, 0x73, 0x3a, 0x20,
2508  0x62, 0x79, 0x74, 0x65, 0x73, 0x0d, 0x0a, 0x43,
2509  0x6f, 0x6e, 0x74, 0x65, 0x6e, 0x74, 0x2d, 0x4c,
2510  0x65, 0x6e, 0x67, 0x74, 0x68, 0x3a, 0x20, 0x34,
2511  0x34, 0x0d, 0x0a, 0x43, 0x6f, 0x6e, 0x6e, 0x65,
2512  0x63, 0x74, 0x69, 0x6f, 0x6e, 0x3a, 0x20, 0x63,
2513  0x6c, 0x6f, 0x73, 0x65, 0x0d, 0x0a, 0x43, 0x6f,
2514  0x6e, 0x74, 0x65, 0x6e, 0x74, 0x2d, 0x54, 0x79,
2515  0x70, 0x65, 0x3a, 0x20, 0x74, 0x65, 0x78, 0x74,
2516  0x2f, 0x68, 0x74, 0x6d, 0x6c, 0x0d, 0x0a, 0x58,
2517  0x2d, 0x50, 0x61, 0x64, 0x3a, 0x20, 0x61, 0x76,
2518  0x6f, 0x69, 0x64, 0x20, 0x62, 0x72, 0x6f, 0x77,
2519  0x73, 0x65, 0x72, 0x20, 0x62, 0x75, 0x67, 0x0d,
2520  0x0a, 0x0d, 0x0a, 0x3c, 0x68, 0x74, 0x6d, 0x6c,
2521  0x3e, 0x3c, 0x62, 0x6f, 0x64, 0x79, 0x3e, 0x3c,
2522  0x68, 0x31, 0x3e, 0x49, 0x74, 0x20, 0x77, 0x6f,
2523  0x72, 0x6b, 0x73, 0x21, 0x3c, 0x2f, 0x68, 0x31,
2524  0x3e, 0x3c, 0x2f, 0x62, 0x6f, 0x64, 0x79, 0x3e,
2525  0x3c, 0x2f, 0x68, 0x74, 0x6d, 0x6c, 0x3e };
2526  tcph.th_ack = htonl(18);
2527  tcph.th_seq = htonl(1);
2528  tcph.th_flags = TH_PUSH | TH_ACK;
2530  p->payload_len = sizeof(response);
2531  p->payload = response;
2532  FAIL_IF(StreamTcpPacket(&tv, p, stt, &pq) == -1);
2539  FAIL_IF(!FLOW_IS_PM_DONE(&f, STREAM_TOSERVER));
2540  FAIL_IF(!FLOW_IS_PP_DONE(&f, STREAM_TOSERVER));
2541  FAIL_IF(FLOW_IS_PM_DONE(&f, STREAM_TOCLIENT));
2542  FAIL_IF(FLOW_IS_PP_DONE(&f, STREAM_TOCLIENT));
2543  FAIL_IF(ssn->data_first_seen_dir != STREAM_TOSERVER);
2544 
2545  /* response ack */
2546  tcph.th_ack = htonl(328);
2547  tcph.th_seq = htonl(18);
2548  tcph.th_flags = TH_ACK;
2550  p->payload_len = 0;
2551  p->payload = NULL;
2552  FAIL_IF(StreamTcpPacket(&tv, p, stt, &pq) == -1);
2559  FAIL_IF(!FLOW_IS_PM_DONE(&f, STREAM_TOSERVER));
2560  FAIL_IF(!FLOW_IS_PP_DONE(&f, STREAM_TOSERVER));
2561  FAIL_IF(!FLOW_IS_PM_DONE(&f, STREAM_TOCLIENT));
2562  FAIL_IF(!FLOW_IS_PP_DONE(&f, STREAM_TOCLIENT));
2564 
2565  TEST_END;
2566  PASS;
2567 }
2568 
2569 /**
2570  * \test RUBBISH(TC - PM and PP DONE) ->
2571  * RUBBISH(TS - PM and PP DONE)
2572  */
2573 static int AppLayerTest10(void)
2574 {
2575  TEST_START;
2576 
2577  /* full request */
2578  uint8_t request1[] = {
2579  0x47, 0x47, 0x49, 0x20, 0x2f, 0x69, 0x6e, 0x64,
2580  0x47, 0x47, 0x49, 0x20, 0x2f, 0x69, 0x6e, 0x64, 0xff };
2581  tcph.th_ack = htonl(1);
2582  tcph.th_seq = htonl(1);
2583  tcph.th_flags = TH_PUSH | TH_ACK;
2585  p->payload_len = sizeof(request1);
2586  p->payload = request1;
2587  FAIL_IF(StreamTcpPacket(&tv, p, stt, &pq) == -1);
2594  FAIL_IF(FLOW_IS_PM_DONE(&f, STREAM_TOSERVER));
2595  FAIL_IF(FLOW_IS_PP_DONE(&f, STREAM_TOSERVER));
2596  FAIL_IF(FLOW_IS_PM_DONE(&f, STREAM_TOCLIENT));
2597  FAIL_IF(FLOW_IS_PP_DONE(&f, STREAM_TOCLIENT));
2598  FAIL_IF(ssn->data_first_seen_dir != STREAM_TOSERVER);
2599 
2600  /* response - request ack */
2601  tcph.th_ack = htonl(18);
2602  tcph.th_seq = htonl(1);
2603  tcph.th_flags = TH_PUSH | TH_ACK;
2605  p->payload_len = 0;
2606  p->payload = NULL;
2607  FAIL_IF(StreamTcpPacket(&tv, p, stt, &pq) == -1);
2614  FAIL_IF(!FLOW_IS_PM_DONE(&f, STREAM_TOSERVER));
2615  FAIL_IF(!FLOW_IS_PP_DONE(&f, STREAM_TOSERVER));
2616  FAIL_IF(FLOW_IS_PM_DONE(&f, STREAM_TOCLIENT));
2617  FAIL_IF(FLOW_IS_PP_DONE(&f, STREAM_TOCLIENT));
2618  FAIL_IF(ssn->data_first_seen_dir != STREAM_TOSERVER);
2619 
2620  /* full response - request ack */
2621  uint8_t response[] = {
2622  0x55, 0x74, 0x54, 0x50, 0x2f, 0x31, 0x2e, 0x31,
2623  0x20, 0x32, 0x30, 0x30, 0x20, 0x4f, 0x4b, 0x0d,
2624  0x0a, 0x44, 0x61, 0x74, 0x65, 0x3a, 0x20, 0x46,
2625  0x72, 0x69, 0x2c, 0x20, 0x32, 0x33, 0x20, 0x53,
2626  0x65, 0x70, 0x20, 0x32, 0x30, 0x31, 0x31, 0x20,
2627  0x30, 0x36, 0x3a, 0x32, 0x39, 0x3a, 0x33, 0x39,
2628  0x20, 0x47, 0x4d, 0x54, 0x0d, 0x0a, 0x53, 0x65,
2629  0x72, 0x76, 0x65, 0x72, 0x3a, 0x20, 0x41, 0x70,
2630  0x61, 0x63, 0x68, 0x65, 0x2f, 0x32, 0x2e, 0x32,
2631  0x2e, 0x31, 0x35, 0x20, 0x28, 0x55, 0x6e, 0x69,
2632  0x78, 0x29, 0x20, 0x44, 0x41, 0x56, 0x2f, 0x32,
2633  0x0d, 0x0a, 0x4c, 0x61, 0x73, 0x74, 0x2d, 0x4d,
2634  0x6f, 0x64, 0x69, 0x66, 0x69, 0x65, 0x64, 0x3a,
2635  0x20, 0x54, 0x68, 0x75, 0x2c, 0x20, 0x30, 0x34,
2636  0x20, 0x4e, 0x6f, 0x76, 0x20, 0x32, 0x30, 0x31,
2637  0x30, 0x20, 0x31, 0x35, 0x3a, 0x30, 0x34, 0x3a,
2638  0x34, 0x36, 0x20, 0x47, 0x4d, 0x54, 0x0d, 0x0a,
2639  0x45, 0x54, 0x61, 0x67, 0x3a, 0x20, 0x22, 0x61,
2640  0x62, 0x38, 0x39, 0x36, 0x35, 0x2d, 0x32, 0x63,
2641  0x2d, 0x34, 0x39, 0x34, 0x33, 0x62, 0x37, 0x61,
2642  0x37, 0x66, 0x37, 0x66, 0x38, 0x30, 0x22, 0x0d,
2643  0x0a, 0x41, 0x63, 0x63, 0x65, 0x70, 0x74, 0x2d,
2644  0x52, 0x61, 0x6e, 0x67, 0x65, 0x73, 0x3a, 0x20,
2645  0x62, 0x79, 0x74, 0x65, 0x73, 0x0d, 0x0a, 0x43,
2646  0x6f, 0x6e, 0x74, 0x65, 0x6e, 0x74, 0x2d, 0x4c,
2647  0x65, 0x6e, 0x67, 0x74, 0x68, 0x3a, 0x20, 0x34,
2648  0x34, 0x0d, 0x0a, 0x43, 0x6f, 0x6e, 0x6e, 0x65,
2649  0x63, 0x74, 0x69, 0x6f, 0x6e, 0x3a, 0x20, 0x63,
2650  0x6c, 0x6f, 0x73, 0x65, 0x0d, 0x0a, 0x43, 0x6f,
2651  0x6e, 0x74, 0x65, 0x6e, 0x74, 0x2d, 0x54, 0x79,
2652  0x70, 0x65, 0x3a, 0x20, 0x74, 0x65, 0x78, 0x74,
2653  0x2f, 0x68, 0x74, 0x6d, 0x6c, 0x0d, 0x0a, 0x58,
2654  0x2d, 0x50, 0x61, 0x64, 0x3a, 0x20, 0x61, 0x76,
2655  0x6f, 0x69, 0x64, 0x20, 0x62, 0x72, 0x6f, 0x77,
2656  0x73, 0x65, 0x72, 0x20, 0x62, 0x75, 0x67, 0x0d,
2657  0x0a, 0x0d, 0x0a, 0x3c, 0x68, 0x74, 0x6d, 0x6c,
2658  0x3e, 0x3c, 0x62, 0x6f, 0x64, 0x79, 0x3e, 0x3c,
2659  0x68, 0x31, 0x3e, 0x49, 0x74, 0x20, 0x77, 0x6f,
2660  0x72, 0x6b, 0x73, 0x21, 0x3c, 0x2f, 0x68, 0x31,
2661  0x3e, 0x3c, 0x2f, 0x62, 0x6f, 0x64, 0x79, 0x3e,
2662  0x3c, 0x2f, 0x68, 0x74, 0x6d, 0x6c, 0x3e };
2663  tcph.th_ack = htonl(18);
2664  tcph.th_seq = htonl(1);
2665  tcph.th_flags = TH_PUSH | TH_ACK;
2667  p->payload_len = sizeof(response);
2668  p->payload = response;
2669  FAIL_IF(StreamTcpPacket(&tv, p, stt, &pq) == -1);
2676  FAIL_IF(!FLOW_IS_PM_DONE(&f, STREAM_TOSERVER));
2677  FAIL_IF(!FLOW_IS_PP_DONE(&f, STREAM_TOSERVER));
2678  FAIL_IF(FLOW_IS_PM_DONE(&f, STREAM_TOCLIENT));
2679  FAIL_IF(FLOW_IS_PP_DONE(&f, STREAM_TOCLIENT));
2680  FAIL_IF(ssn->data_first_seen_dir != STREAM_TOSERVER);
2681 
2682  /* response ack */
2683  tcph.th_ack = htonl(328);
2684  tcph.th_seq = htonl(18);
2685  tcph.th_flags = TH_ACK;
2687  p->payload_len = 0;
2688  p->payload = NULL;
2689  FAIL_IF(StreamTcpPacket(&tv, p, stt, &pq) == -1);
2696  FAIL_IF(!FLOW_IS_PM_DONE(&f, STREAM_TOSERVER));
2697  FAIL_IF(!FLOW_IS_PP_DONE(&f, STREAM_TOSERVER));
2698  FAIL_IF(!FLOW_IS_PM_DONE(&f, STREAM_TOCLIENT));
2699  FAIL_IF(!FLOW_IS_PP_DONE(&f, STREAM_TOCLIENT));
2701 
2702  TEST_END;
2703  PASS;
2704 }
2705 
2706 /**
2707  * \test RUBBISH(TC - PM and PP DONE) ->
2708  * RUBBISH(TS - PM and PP NOT DONE) ->
2709  * RUBBISH(TS - PM and PP DONE)
2710  */
2711 static int AppLayerTest11(void)
2712 {
2713  TEST_START;
2714 
2715  /* full request */
2716  uint8_t request1[] = {
2717  0x47, 0x47, 0x49, 0x20, 0x2f, 0x69, 0x6e, 0x64,
2718  0x47, 0x47, 0x49, 0x20, 0x2f, 0x69, 0x6e, 0x64, 0xff };
2719  tcph.th_ack = htonl(1);
2720  tcph.th_seq = htonl(1);
2721  tcph.th_flags = TH_PUSH | TH_ACK;
2723  p->payload_len = sizeof(request1);
2724  p->payload = request1;
2725  FAIL_IF(StreamTcpPacket(&tv, p, stt, &pq) == -1);
2732  FAIL_IF(FLOW_IS_PM_DONE(&f, STREAM_TOSERVER));
2733  FAIL_IF(FLOW_IS_PP_DONE(&f, STREAM_TOSERVER));
2734  FAIL_IF(FLOW_IS_PM_DONE(&f, STREAM_TOCLIENT));
2735  FAIL_IF(FLOW_IS_PP_DONE(&f, STREAM_TOCLIENT));
2736  FAIL_IF(ssn->data_first_seen_dir != STREAM_TOSERVER);
2737 
2738  /* response - request ack */
2739  tcph.th_ack = htonl(18);
2740  tcph.th_seq = htonl(1);
2741  tcph.th_flags = TH_PUSH | TH_ACK;
2743  p->payload_len = 0;
2744  p->payload = NULL;
2745  FAIL_IF(StreamTcpPacket(&tv, p, stt, &pq) == -1);
2752  FAIL_IF(!FLOW_IS_PM_DONE(&f, STREAM_TOSERVER));
2753  FAIL_IF(!FLOW_IS_PP_DONE(&f, STREAM_TOSERVER));
2754  FAIL_IF(FLOW_IS_PM_DONE(&f, STREAM_TOCLIENT));
2755  FAIL_IF(FLOW_IS_PP_DONE(&f, STREAM_TOCLIENT));
2756  FAIL_IF(ssn->data_first_seen_dir != STREAM_TOSERVER);
2757 
2758  /* full response - request ack */
2759  uint8_t response1[] = {
2760  0x55, 0x74, 0x54, 0x50, };
2761  tcph.th_ack = htonl(18);
2762  tcph.th_seq = htonl(1);
2763  tcph.th_flags = TH_PUSH | TH_ACK;
2765  p->payload_len = sizeof(response1);
2766  p->payload = response1;
2767  FAIL_IF(StreamTcpPacket(&tv, p, stt, &pq) == -1);
2774  FAIL_IF(!FLOW_IS_PM_DONE(&f, STREAM_TOSERVER));
2775  FAIL_IF(!FLOW_IS_PP_DONE(&f, STREAM_TOSERVER));
2776  FAIL_IF(FLOW_IS_PM_DONE(&f, STREAM_TOCLIENT));
2777  FAIL_IF(FLOW_IS_PP_DONE(&f, STREAM_TOCLIENT));
2778  FAIL_IF(ssn->data_first_seen_dir != STREAM_TOSERVER);
2779 
2780  /* response ack from request */
2781  tcph.th_ack = htonl(5);
2782  tcph.th_seq = htonl(18);
2783  tcph.th_flags = TH_ACK;
2785  p->payload_len = 0;
2786  p->payload = NULL;
2787  FAIL_IF(StreamTcpPacket(&tv, p, stt, &pq) == -1);
2794  FAIL_IF(!FLOW_IS_PM_DONE(&f, STREAM_TOSERVER));
2795  FAIL_IF(!FLOW_IS_PP_DONE(&f, STREAM_TOSERVER));
2796  FAIL_IF(FLOW_IS_PM_DONE(&f, STREAM_TOCLIENT));
2797  FAIL_IF(!FLOW_IS_PP_DONE(&f, STREAM_TOCLIENT));
2798  FAIL_IF(ssn->data_first_seen_dir != STREAM_TOSERVER);
2799 
2800  uint8_t response2[] = {
2801  0x2f, 0x31, 0x2e, 0x31,
2802  0x20, 0x32, 0x30, 0x30, 0x20, 0x4f, 0x4b, 0x0d,
2803  0x0a, 0x44, 0x61, 0x74, 0x65, 0x3a, 0x20, 0x46,
2804  0x72, 0x69, 0x2c, 0x20, 0x32, 0x33, 0x20, 0x53,
2805  0x65, 0x70, 0x20, 0x32, 0x30, 0x31, 0x31, 0x20,
2806  0x30, 0x36, 0x3a, 0x32, 0x39, 0x3a, 0x33, 0x39,
2807  0x20, 0x47, 0x4d, 0x54, 0x0d, 0x0a, 0x53, 0x65,
2808  0x72, 0x76, 0x65, 0x72, 0x3a, 0x20, 0x41, 0x70,
2809  0x61, 0x63, 0x68, 0x65, 0x2f, 0x32, 0x2e, 0x32,
2810  0x2e, 0x31, 0x35, 0x20, 0x28, 0x55, 0x6e, 0x69,
2811  0x78, 0x29, 0x20, 0x44, 0x41, 0x56, 0x2f, 0x32,
2812  0x0d, 0x0a, 0x4c, 0x61, 0x73, 0x74, 0x2d, 0x4d,
2813  0x6f, 0x64, 0x69, 0x66, 0x69, 0x65, 0x64, 0x3a,
2814  0x20, 0x54, 0x68, 0x75, 0x2c, 0x20, 0x30, 0x34,
2815  0x20, 0x4e, 0x6f, 0x76, 0x20, 0x32, 0x30, 0x31,
2816  0x30, 0x20, 0x31, 0x35, 0x3a, 0x30, 0x34, 0x3a,
2817  0x34, 0x36, 0x20, 0x47, 0x4d, 0x54, 0x0d, 0x0a,
2818  0x45, 0x54, 0x61, 0x67, 0x3a, 0x20, 0x22, 0x61,
2819  0x62, 0x38, 0x39, 0x36, 0x35, 0x2d, 0x32, 0x63,
2820  0x2d, 0x34, 0x39, 0x34, 0x33, 0x62, 0x37, 0x61,
2821  0x37, 0x66, 0x37, 0x66, 0x38, 0x30, 0x22, 0x0d,
2822  0x0a, 0x41, 0x63, 0x63, 0x65, 0x70, 0x74, 0x2d,
2823  0x52, 0x61, 0x6e, 0x67, 0x65, 0x73, 0x3a, 0x20,
2824  0x62, 0x79, 0x74, 0x65, 0x73, 0x0d, 0x0a, 0x43,
2825  0x6f, 0x6e, 0x74, 0x65, 0x6e, 0x74, 0x2d, 0x4c,
2826  0x65, 0x6e, 0x67, 0x74, 0x68, 0x3a, 0x20, 0x34,
2827  0x34, 0x0d, 0x0a, 0x43, 0x6f, 0x6e, 0x6e, 0x65,
2828  0x63, 0x74, 0x69, 0x6f, 0x6e, 0x3a, 0x20, 0x63,
2829  0x6c, 0x6f, 0x73, 0x65, 0x0d, 0x0a, 0x43, 0x6f,
2830  0x6e, 0x74, 0x65, 0x6e, 0x74, 0x2d, 0x54, 0x79,
2831  0x70, 0x65, 0x3a, 0x20, 0x74, 0x65, 0x78, 0x74,
2832  0x2f, 0x68, 0x74, 0x6d, 0x6c, 0x0d, 0x0a, 0x58,
2833  0x2d, 0x50, 0x61, 0x64, 0x3a, 0x20, 0x61, 0x76,
2834  0x6f, 0x69, 0x64, 0x20, 0x62, 0x72, 0x6f, 0x77,
2835  0x73, 0x65, 0x72, 0x20, 0x62, 0x75, 0x67, 0x0d,
2836  0x0a, 0x0d, 0x0a, 0x3c, 0x68, 0x74, 0x6d, 0x6c,
2837  0x3e, 0x3c, 0x62, 0x6f, 0x64, 0x79, 0x3e, 0x3c,
2838  0x68, 0x31, 0x3e, 0x49, 0x74, 0x20, 0x77, 0x6f,
2839  0x72, 0x6b, 0x73, 0x21, 0x3c, 0x2f, 0x68, 0x31,
2840  0x3e, 0x3c, 0x2f, 0x62, 0x6f, 0x64, 0x79, 0x3e,
2841  0x3c, 0x2f, 0x68, 0x74, 0x6d, 0x6c, 0x3e };
2842  tcph.th_ack = htonl(18);
2843  tcph.th_seq = htonl(5);
2844  tcph.th_flags = TH_PUSH | TH_ACK;
2846  p->payload_len = sizeof(response2);
2847  p->payload = response2;
2848  FAIL_IF(StreamTcpPacket(&tv, p, stt, &pq) == -1);
2855  FAIL_IF(!FLOW_IS_PM_DONE(&f, STREAM_TOSERVER));
2856  FAIL_IF(!FLOW_IS_PP_DONE(&f, STREAM_TOSERVER));
2857  FAIL_IF(FLOW_IS_PM_DONE(&f, STREAM_TOCLIENT));
2858  FAIL_IF(!FLOW_IS_PP_DONE(&f, STREAM_TOCLIENT));
2859  FAIL_IF(ssn->data_first_seen_dir != STREAM_TOSERVER);
2860 
2861  /* response ack from request */
2862  tcph.th_ack = htonl(328);
2863  tcph.th_seq = htonl(18);
2864  tcph.th_flags = TH_ACK;
2866  p->payload_len = 0;
2867  p->payload = NULL;
2868  FAIL_IF(StreamTcpPacket(&tv, p, stt, &pq) == -1);
2875  FAIL_IF(!FLOW_IS_PM_DONE(&f, STREAM_TOSERVER));
2876  FAIL_IF(!FLOW_IS_PP_DONE(&f, STREAM_TOSERVER));
2877  FAIL_IF(!FLOW_IS_PM_DONE(&f, STREAM_TOCLIENT));
2878  FAIL_IF(!FLOW_IS_PP_DONE(&f, STREAM_TOCLIENT));
2880 
2881  TEST_END;
2882  PASS;
2883 }
2884 
2886 {
2887  SCEnter();
2888 
2889  UtRegisterTest("AppLayerTest01", AppLayerTest01);
2890  UtRegisterTest("AppLayerTest02", AppLayerTest02);
2891  UtRegisterTest("AppLayerTest03", AppLayerTest03);
2892  UtRegisterTest("AppLayerTest04", AppLayerTest04);
2893  UtRegisterTest("AppLayerTest05", AppLayerTest05);
2894  UtRegisterTest("AppLayerTest06", AppLayerTest06);
2895  UtRegisterTest("AppLayerTest07", AppLayerTest07);
2896  UtRegisterTest("AppLayerTest09", AppLayerTest09);
2897  UtRegisterTest("AppLayerTest10", AppLayerTest10);
2898  UtRegisterTest("AppLayerTest11", AppLayerTest11);
2899 
2900  SCReturn;
2901 }
2902 
2903 #endif /* UNITTESTS */
AppLayerCounters_::alloc_error_id
uint16_t alloc_error_id
Definition: app-layer.c:95
APP_LAYER_DATA_ALREADY_SENT_TO_APP_LAYER
#define APP_LAYER_DATA_ALREADY_SENT_TO_APP_LAYER
Definition: app-layer.h:40
AppLayerCounters_::counter_id
uint16_t counter_id
Definition: app-layer.c:90
FLOW_RESET_PP_DONE
#define FLOW_RESET_PP_DONE(f, dir)
Definition: flow.h:279
UPDATE_DIR_PACKET
@ UPDATE_DIR_PACKET
Definition: stream-tcp-reassemble.h:56
FlowUnsetChangeProtoFlag
void FlowUnsetChangeProtoFlag(Flow *f)
Unset flag to indicate to change proto for the flow.
Definition: flow.c:187
Packet_::proto
uint8_t proto
Definition: decode.h:523
AppLayerParserDeSetup
int AppLayerParserDeSetup(void)
Definition: app-layer-parser.c:285
TcpStream_
Definition: stream-tcp-private.h:106
APPLAYER_UNEXPECTED_PROTOCOL
@ APPLAYER_UNEXPECTED_PROTOCOL
Definition: app-layer-events.h:51
ExceptionPolicyApply
void ExceptionPolicyApply(Packet *p, enum ExceptionPolicy policy, enum PacketDropReason drop_reason)
Definition: util-exception-policy.c:136
AppLayerCounters_::gap_error_id
uint16_t gap_error_id
Definition: app-layer.c:92
AppLayerCounters_
Definition: app-layer.c:89
ippair.h
app-layer-htp-range.h
FlowCleanupAppLayer
void FlowCleanupAppLayer(Flow *f)
Definition: flow.c:140
AppLayerProtoDetectSetup
int AppLayerProtoDetectSetup(void)
The first function to be called. This initializes a global protocol detection context.
Definition: app-layer-detect-proto.c:1661
ALPROTO_IKE
@ ALPROTO_IKE
Definition: app-layer-protos.h:55
ExpectationGetCounter
uint64_t ExpectationGetCounter(void)
Definition: app-layer-expectation.c:140
AppLayerCounterNames_::eps_name
char eps_name[EXCEPTION_POLICY_MAX][MAX_COUNTER_SIZE]
Definition: app-layer.c:86
StatsIncr
void StatsIncr(ThreadVars *tv, uint16_t id)
Increments the local counter.
Definition: counters.c:166
AppLayerCounters_::counter_tx_id
uint16_t counter_tx_id
Definition: app-layer.c:91
AppLayerCounters
struct AppLayerCounters_ AppLayerCounters
stream-tcp-inline.h
ALPROTO_DCERPC
@ ALPROTO_DCERPC
Definition: app-layer-protos.h:44
flow-util.h
ALPROTO_DNS
@ ALPROTO_DNS
Definition: app-layer-protos.h:47
stream-tcp.h
ALPROTO_ENIP
@ ALPROTO_ENIP
Definition: app-layer-protos.h:49
StreamTcpInlineMode
bool StreamTcpInlineMode(void)
See if stream engine is operating in inline mode.
Definition: stream-tcp.c:7213
unlikely
#define unlikely(expr)
Definition: util-optimize.h:35
UtRegisterTest
void UtRegisterTest(const char *name, int(*TestFn)(void))
Register unit test.
Definition: util-unittest.c:103
AppLayerGetProtoByName
AppProto AppLayerGetProtoByName(const char *alproto_name)
Given a protocol string, returns the corresponding internal protocol id.
Definition: app-layer.c:996
ALPROTO_TLS
@ ALPROTO_TLS
Definition: app-layer-protos.h:39
SCLogDebug
#define SCLogDebug(...)
Definition: util-debug.h:279
Packet_::pcap_cnt
uint64_t pcap_cnt
Definition: decode.h:626
AppLayerCounterNames_::parser_error
char parser_error[MAX_COUNTER_SIZE]
Definition: app-layer.c:83
StatsRegisterGlobalCounter
uint16_t StatsRegisterGlobalCounter(const char *name, uint64_t(*Func)(void))
Registers a counter, which represents a global value.
Definition: counters.c:1010
ALPROTO_MODBUS
@ ALPROTO_MODBUS
Definition: app-layer-protos.h:48
AppLayerProfilingStoreInternal
void AppLayerProfilingStoreInternal(AppLayerThreadCtx *app_tctx, Packet *p)
Definition: app-layer.c:1145
Flow_::proto
uint8_t proto
Definition: flow.h:370
AppProto
uint16_t AppProto
Definition: app-layer-protos.h:86
ALPROTO_QUIC
@ ALPROTO_QUIC
Definition: app-layer-protos.h:57
Packet_::payload
uint8_t * payload
Definition: decode.h:605
ALPROTO_POP3
@ ALPROTO_POP3
Definition: app-layer-protos.h:71
TcpReassemblyThreadCtx_::app_tctx
void * app_tctx
Definition: stream-tcp-reassemble.h:62
Packet_::flags
uint32_t flags
Definition: decode.h:544
AppLayerThreadCtx_::proto_detect_ticks_spent
uint64_t proto_detect_ticks_spent
Definition: app-layer.c:72
PACKET_PROFILING_APP_PD_END
#define PACKET_PROFILING_APP_PD_END(dp)
Definition: util-profiling.h:186
ALPROTO_JABBER
@ ALPROTO_JABBER
Definition: app-layer-protos.h:42
TcpStreamCnf_::reassembly_depth
uint32_t reassembly_depth
Definition: stream-tcp.h:75
AppLayerThreadCtx_::alp_tctx
AppLayerParserThreadCtx * alp_tctx
Definition: app-layer.c:63
flow-private.h
Flow_
Flow data structure.
Definition: flow.h:348
AppLayerIncGapErrorCounter
void AppLayerIncGapErrorCounter(ThreadVars *tv, Flow *f)
Definition: app-layer.c:163
AppLayerCounters_::internal_error_id
uint16_t internal_error_id
Definition: app-layer.c:94
Flow_::protomap
uint8_t protomap
Definition: flow.h:437
AppProtoToString
const char * AppProtoToString(AppProto alproto)
Maps the ALPROTO_*, to its string equivalent.
Definition: app-layer-protos.c:40
AppLayerThreadCtx_::ticks_spent
uint64_t ticks_spent
Definition: app-layer.c:68
ALPROTO_IRC
@ ALPROTO_IRC
Definition: app-layer-protos.h:45
ExceptionPolicyStatsSetts_
Definition: util-exception-policy-types.h:56
AppLayerParserGetFirstDataDir
uint8_t AppLayerParserGetFirstDataDir(uint8_t ipproto, AppProto alproto)
Definition: app-layer-parser.c:1149
g_stats_eps_per_app_proto_errors
bool g_stats_eps_per_app_proto_errors
Definition: suricata.c:220
StreamTcpReassembleAppLayer
int StreamTcpReassembleAppLayer(ThreadVars *tv, TcpReassemblyThreadCtx *ra_ctx, TcpSession *ssn, TcpStream *stream, Packet *p, enum StreamUpdateDir app_update_dir)
Update the stream reassembly upon receiving a packet.
Definition: stream-tcp-reassemble.c:1396
StreamTcpResetStreamFlagAppProtoDetectionCompleted
#define StreamTcpResetStreamFlagAppProtoDetectionCompleted(stream)
Definition: stream-tcp-private.h:305
AppLayerRegisterThreadCounters
void AppLayerRegisterThreadCounters(ThreadVars *tv)
Registers per flow counters for all protocols.
Definition: app-layer.c:1301
Flow_::alproto_orig
AppProto alproto_orig
Definition: flow.h:448
AppLayerProtoDetectSupportedIpprotos
void AppLayerProtoDetectSupportedIpprotos(AppProto alproto, uint8_t *ipprotos)
Definition: app-layer-detect-proto.c:2025
FTPMemuseGlobalCounter
uint64_t FTPMemuseGlobalCounter(void)
Definition: app-layer-ftp.c:78
ALPROTO_SIP
@ ALPROTO_SIP
Definition: app-layer-protos.h:59
AppLayerProfilingResetInternal
void AppLayerProfilingResetInternal(AppLayerThreadCtx *app_tctx)
Definition: app-layer.c:1140
AppLayerCounterNames_
Definition: app-layer.c:79
AppLayerParserStateProtoCleanup
void AppLayerParserStateProtoCleanup(uint8_t protomap, AppProto alproto, void *alstate, AppLayerParserState *pstate)
Definition: app-layer-parser.c:1647
AppLayerParserThreadCtxFree
void AppLayerParserThreadCtxFree(AppLayerParserThreadCtx *tctx)
Destroys the app layer parser thread context obtained using AppLayerParserThreadCtxAlloc().
Definition: app-layer-parser.c:324
AppLayerHandleTCPData
int AppLayerHandleTCPData(ThreadVars *tv, TcpReassemblyThreadCtx *ra_ctx, Packet *p, Flow *f, TcpSession *ssn, TcpStream **stream, uint8_t *data, uint32_t data_len, uint8_t flags, enum StreamUpdateDir app_update_dir)
handle TCP data for the app-layer.
Definition: app-layer.c:707
FLOW_PKT_TOSERVER
#define FLOW_PKT_TOSERVER
Definition: flow.h:225
ALPROTO_LDAP
@ ALPROTO_LDAP
Definition: app-layer-protos.h:65
TCP_ESTABLISHED
@ TCP_ESTABLISHED
Definition: stream-tcp-private.h:155
MIN
#define MIN(x, y)
Definition: suricata-common.h:408
StreamTcpUpdateAppLayerProgress
void StreamTcpUpdateAppLayerProgress(TcpSession *ssn, char direction, const uint32_t progress)
update reassembly progress
Definition: stream-tcp.c:6788
ALPROTO_FTP
@ ALPROTO_FTP
Definition: app-layer-protos.h:37
app_layer_error_eps_stats
ExceptionPolicyStatsSetts app_layer_error_eps_stats
Definition: app-layer.c:108
stream-tcp-reassemble.h
AppLayerThreadCtx_::proto_detect_ticks_end
uint64_t proto_detect_ticks_end
Definition: app-layer.c:71
TcpStream_::flags
uint16_t flags
Definition: stream-tcp-private.h:107
AppLayerUnittestsRegister
void AppLayerUnittestsRegister(void)
Definition: app-layer.c:2885
APPLAYER_PROTO_DETECTION_SKIPPED
@ APPLAYER_PROTO_DETECTION_SKIPPED
Definition: app-layer-events.h:49
HTPMemuseGlobalCounter
uint64_t HTPMemuseGlobalCounter(void)
Definition: app-layer-htp-mem.c:80
AppLayerListSupportedProtocols
void AppLayerListSupportedProtocols(void)
Definition: app-layer.c:1010
AppLayerSetupCounters
void AppLayerSetupCounters(void)
Definition: app-layer.c:1192
ALPROTO_SSH
@ ALPROTO_SSH
Definition: app-layer-protos.h:40
app-layer-ftp.h
ALPROTO_DHCP
@ ALPROTO_DHCP
Definition: app-layer-protos.h:58
Packet_::flowflags
uint8_t flowflags
Definition: decode.h:532
AppLayerThreadCtx_::alproto
AppProto alproto
Definition: app-layer.c:69
stream_config
TcpStreamCnf stream_config
Definition: stream-tcp.c:219
MAX
#define MAX(x, y)
Definition: suricata-common.h:412
Flow_::protoctx
void * protoctx
Definition: flow.h:433
AppLayerCounterNames_::tx_name
char tx_name[MAX_COUNTER_SIZE]
Definition: app-layer.c:81
AppLayerIncAllocErrorCounter
void AppLayerIncAllocErrorCounter(ThreadVars *tv, Flow *f)
Definition: app-layer.c:171
EXCEPTION_POLICY_NOT_SET
@ EXCEPTION_POLICY_NOT_SET
Definition: util-exception-policy-types.h:26
Packet_::payload_len
uint16_t payload_len
Definition: decode.h:606
Packet_::app_layer_events
AppLayerDecoderEvents * app_layer_events
Definition: decode.h:632
util-unittest.h
PACKET_PROFILING_APP_PD_START
#define PACKET_PROFILING_APP_PD_START(dp)
Definition: util-profiling.h:181
AppLayerCounters_::parser_error_id
uint16_t parser_error_id
Definition: app-layer.c:93
AppLayerDeSetup
int AppLayerDeSetup(void)
De initializes the app layer.
Definition: app-layer.c:1089
HostGetMemcap
uint64_t HostGetMemcap(void)
Return memcap value.
Definition: host.c:83
SCAppLayerDecoderEventsSetEventRaw
void SCAppLayerDecoderEventsSetEventRaw(AppLayerDecoderEvents **sevents, uint8_t event)
Set an app layer decoder event.
Definition: app-layer-events.c:96
PKT_PROTO_DETECT_TS_DONE
#define PKT_PROTO_DETECT_TS_DONE
Definition: decode.h:1301
MAX_COUNTER_SIZE
#define MAX_COUNTER_SIZE
Definition: app-layer.c:78
ALPROTO_KRB5
@ ALPROTO_KRB5
Definition: app-layer-protos.h:56
STREAMTCP_FLAG_MIDSTREAM
#define STREAMTCP_FLAG_MIDSTREAM
Definition: stream-tcp-private.h:170
TcpSession_::flags
uint32_t flags
Definition: stream-tcp-private.h:294
FLOW_IS_PM_DONE
#define FLOW_IS_PM_DONE(f, dir)
Definition: flow.h:270
APPLAYER_NO_TLS_AFTER_STARTTLS
@ APPLAYER_NO_TLS_AFTER_STARTTLS
Definition: app-layer-events.h:50
Flow_::alparser
AppLayerParserState * alparser
Definition: flow.h:470
EXCEPTION_POLICY_MAX
#define EXCEPTION_POLICY_MAX
Definition: util-exception-policy-types.h:36
AppLayerParserRegisterProtocolParsers
void AppLayerParserRegisterProtocolParsers(void)
Definition: app-layer-parser.c:1769
AppLayerThreadCtx_::proto_detect_ticks_start
uint64_t proto_detect_ticks_start
Definition: app-layer.c:70
AppLayerSetup
int AppLayerSetup(void)
Setup the app layer.
Definition: app-layer.c:1072
app-layer-expectation.h
app-layer-detect-proto.h
AppLayerProtoDetectThreadCtx_
The app layer protocol detection thread context.
Definition: app-layer-detect-proto.c:179
util-debug.h
AppLayerParserState_
Definition: app-layer-parser.c:135
PASS
#define PASS
Pass the test.
Definition: util-unittest.h:105
ExceptionPolicyCounters_
Definition: util-exception-policy-types.h:51
APPLAYER_MISMATCH_PROTOCOL_BOTH_DIRECTIONS
@ APPLAYER_MISMATCH_PROTOCOL_BOTH_DIRECTIONS
Definition: app-layer-events.h:46
g_alproto_max
AppProto g_alproto_max
Definition: app-layer-protos.c:29
FLOW_IS_PP_DONE
#define FLOW_IS_PP_DONE(f, dir)
Definition: flow.h:271
AppLayerRegisterGlobalCounters
void AppLayerRegisterGlobalCounters(void)
HACK to work around our broken unix manager (re)init loop.
Definition: app-layer.c:1153
ALPROTO_DNP3
@ ALPROTO_DNP3
Definition: app-layer-protos.h:50
PKT_DROP_REASON_APPLAYER_ERROR
@ PKT_DROP_REASON_APPLAYER_ERROR
Definition: decode.h:387
AppLayerThreadCtx_::ticks_end
uint64_t ticks_end
Definition: app-layer.c:67
PacketSwap
void PacketSwap(Packet *p)
switch direction of a packet
Definition: decode.c:577
util-exception-policy.h
ALPROTO_SMTP
@ ALPROTO_SMTP
Definition: app-layer-protos.h:38
AppProtoRegisterProtoString
void AppProtoRegisterProtoString(AppProto alproto, const char *proto_name)
Definition: app-layer-protos.c:80
HTPByteRangeMemuseGlobalCounter
uint64_t HTPByteRangeMemuseGlobalCounter(void)
Definition: app-layer-htp-range.c:61
AppLayerThreadCtx_
This is for the app layer in general and it contains per thread context relevant to both the alpd and...
Definition: app-layer.c:59
ExceptionPolicyCounters_::eps_id
uint16_t eps_id[EXCEPTION_POLICY_MAX]
Definition: util-exception-policy-types.h:53
util-print.h
IPPairGetMemcap
uint64_t IPPairGetMemcap(void)
Return memcap value.
Definition: ippair.c:81
SCEnter
#define SCEnter(...)
Definition: util-debug.h:281
ThreadVars_
Per thread variable structure.
Definition: threadvars.h:58
pkt-var.h
StreamTcpPacket
int StreamTcpPacket(ThreadVars *tv, Packet *p, StreamTcpThread *stt, PacketQueueNoLock *pq)
Definition: stream-tcp.c:5656
AppLayerProtoDetectReset
void AppLayerProtoDetectReset(Flow *f)
Reset proto detect for flow.
Definition: app-layer-detect-proto.c:1853
TcpSession_::state
uint8_t state
Definition: stream-tcp-private.h:285
TEST_START
#define TEST_START
Definition: app-layer.c:1379
ExceptionPolicyStatsSetts_::valid_settings_ids
bool valid_settings_ids[EXCEPTION_POLICY_MAX]
Definition: util-exception-policy-types.h:58
TH_ACK
#define TH_ACK
Definition: decode-tcp.h:38
HostGetMemuse
uint64_t HostGetMemuse(void)
Return memuse value.
Definition: host.c:94
PACKET_PROFILING_APP_STORE
#define PACKET_PROFILING_APP_STORE(dp, p)
Definition: util-profiling.h:206
PrintRawDataFp
void PrintRawDataFp(FILE *fp, const uint8_t *buf, uint32_t buflen)
Definition: util-print.c:112
app-layer-parser.h
FLOW_PROTO_DETECT_TC_DONE
#define FLOW_PROTO_DETECT_TC_DONE
Definition: flow.h:105
AppLayerCounterNames
struct AppLayerCounterNames_ AppLayerCounterNames
util-profiling.h
AppLayerParserSetup
int AppLayerParserSetup(void)
Definition: app-layer-parser.c:259
SCReturn
#define SCReturn
Definition: util-debug.h:283
FLOW_RESET_PM_DONE
#define FLOW_RESET_PM_DONE(f, dir)
Definition: flow.h:278
stream.h
FlowGetProtoMapping
uint8_t FlowGetProtoMapping(uint8_t proto)
Function to map the protocol to the defined FLOW_PROTO_* enumeration.
Definition: flow-util.c:99
StreamTcpIsSetStreamFlagAppProtoDetectionCompleted
#define StreamTcpIsSetStreamFlagAppProtoDetectionCompleted(stream)
Definition: stream-tcp-private.h:303
Packet_
Definition: decode.h:501
ALPROTO_IMAP
@ ALPROTO_IMAP
Definition: app-layer-protos.h:41
stream-tcp-private.h
ALPROTO_RDP
@ ALPROTO_RDP
Definition: app-layer-protos.h:68
FLOW_PROTO_APPLAYER_MAX
#define FLOW_PROTO_APPLAYER_MAX
Definition: flow-private.h:77
applayer_counters
AppLayerCounters(* applayer_counters)[FLOW_PROTO_APPLAYER_MAX]
Definition: app-layer.c:102
AppLayerHandleUdp
int AppLayerHandleUdp(ThreadVars *tv, AppLayerThreadCtx *tctx, Packet *p, Flow *f)
Handle a app layer UDP message.
Definition: app-layer.c:872
DEBUG_ASSERT_FLOW_LOCKED
#define DEBUG_ASSERT_FLOW_LOCKED(f)
Definition: util-validate.h:99
StreamTcpSetStreamFlagAppProtoDetectionCompleted
#define StreamTcpSetStreamFlagAppProtoDetectionCompleted(stream)
Definition: stream-tcp-private.h:301
PACKET_PROFILING_APP_END
#define PACKET_PROFILING_APP_END(dp)
Definition: util-profiling.h:173
TcpStream_::window
uint32_t window
Definition: stream-tcp-private.h:117
ALPROTO_TELNET
@ ALPROTO_TELNET
Definition: app-layer-protos.h:63
ALPROTO_DOH2
@ ALPROTO_DOH2
Definition: app-layer-protos.h:66
name
const char * name
Definition: tm-threads.c:2163
SCReturnPtr
#define SCReturnPtr(x, type)
Definition: util-debug.h:297
AppLayerThreadCtx_::alpd_tctx
AppLayerProtoDetectThreadCtx * alpd_tctx
Definition: app-layer.c:61
StreamDataAvailableForProtoDetect
uint32_t StreamDataAvailableForProtoDetect(TcpStream *stream)
Definition: stream-tcp-reassemble.c:722
AppLayerGetCtxThread
AppLayerThreadCtx * AppLayerGetCtxThread(void)
Creates a new app layer thread context.
Definition: app-layer.c:1102
ALPROTO_TFTP
@ ALPROTO_TFTP
Definition: app-layer-protos.h:54
AppLayerThreadCtx_::ticks_start
uint64_t ticks_start
Definition: app-layer.c:66
AppLayerIncParserErrorCounter
void AppLayerIncParserErrorCounter(ThreadVars *tv, Flow *f)
Definition: app-layer.c:179
ALPROTO_HTTP2
@ ALPROTO_HTTP2
Definition: app-layer-protos.h:69
FTPMemcapGlobalCounter
uint64_t FTPMemcapGlobalCounter(void)
Definition: app-layer-ftp.c:84
FLOW_PKT_TOCLIENT
#define FLOW_PKT_TOCLIENT
Definition: flow.h:226
Flow_::alproto_expect
AppProto alproto_expect
Definition: flow.h:451
decode-events.h
UPDATE_DIR_OPPOSING
@ UPDATE_DIR_OPPOSING
Definition: stream-tcp-reassemble.h:57
AppLayerParserThreadCtxAlloc
AppLayerParserThreadCtx * AppLayerParserThreadCtxAlloc(void)
Gets a new app layer protocol's parser thread context.
Definition: app-layer-parser.c:297
TH_PUSH
#define TH_PUSH
Definition: decode-tcp.h:37
app-layer-frames.h
FAIL_IF
#define FAIL_IF(expr)
Fail a test if expression evaluates to true.
Definition: util-unittest.h:71
flags
uint8_t flags
Definition: decode-gre.h:0
AppLayerParserParse
int AppLayerParserParse(ThreadVars *tv, AppLayerParserThreadCtx *alp_tctx, Flow *f, AppProto alproto, uint8_t flags, const uint8_t *input, uint32_t input_len)
Definition: app-layer-parser.c:1291
StreamTcpDisableAppLayer
void StreamTcpDisableAppLayer(Flow *f)
Definition: stream-tcp-reassemble.c:447
suricata-common.h
FLOW_RESET_PE_DONE
#define FLOW_RESET_PE_DONE(f, dir)
Definition: flow.h:280
AppLayerProtoDetectDeSetup
int AppLayerProtoDetectDeSetup(void)
Cleans up the app layer protocol detection phase.
Definition: app-layer-detect-proto.c:1702
ALPROTO_HTTP1
@ ALPROTO_HTTP1
Definition: app-layer-protos.h:36
ALPROTO_PGSQL
@ ALPROTO_PGSQL
Definition: app-layer-protos.h:62
IPPairGetMemuse
uint64_t IPPairGetMemuse(void)
Return memuse value.
Definition: ippair.c:92
Packet_::app_update_direction
uint8_t app_update_direction
Definition: decode.h:535
FLOW_PROTO_DETECT_TS_DONE
#define FLOW_PROTO_DETECT_TS_DONE
Definition: flow.h:104
ALPROTO_FTPDATA
@ ALPROTO_FTPDATA
Definition: app-layer-protos.h:53
AppLayerIncInternalErrorCounter
void AppLayerIncInternalErrorCounter(ThreadVars *tv, Flow *f)
Definition: app-layer.c:187
eps_error_summary
ExceptionPolicyCounters eps_error_summary
Definition: app-layer.c:104
FatalError
#define FatalError(...)
Definition: util-debug.h:514
APPLAYER_DETECT_PROTOCOL_ONLY_ONE_DIRECTION
@ APPLAYER_DETECT_PROTOCOL_ONLY_ONE_DIRECTION
Definition: app-layer-events.h:48
STREAMTCP_FLAG_MIDSTREAM_SYNACK
#define STREAMTCP_FLAG_MIDSTREAM_SYNACK
Definition: stream-tcp-private.h:174
applayer_counter_names
AppLayerCounterNames(* applayer_counter_names)[FLOW_PROTO_APPLAYER_MAX]
Definition: app-layer.c:100
ALPROTO_WEBSOCKET
@ ALPROTO_WEBSOCKET
Definition: app-layer-protos.h:64
TcpSession_::client
TcpStream client
Definition: stream-tcp-private.h:297
PKT_PROTO_DETECT_TC_DONE
#define PKT_PROTO_DETECT_TC_DONE
Definition: decode.h:1302
FrameConfigInit
void FrameConfigInit(void)
Definition: app-layer-frames.c:39
AppLayerParserGetStreamDepth
uint32_t AppLayerParserGetStreamDepth(const Flow *f)
Definition: app-layer-parser.c:1579
tv
ThreadVars * tv
Definition: fuzz_decodepcapfile.c:32
app-layer-events.h
util-validate.h
FlowSwap
void FlowSwap(Flow *f)
swap the flow's direction
Definition: flow.c:246
StatsAddUI64
void StatsAddUI64(ThreadVars *tv, uint16_t id, uint64_t x)
Adds a value of type uint64_t to the local counter.
Definition: counters.c:146
AppLayerProtoDetectSupportedAppProtocols
void AppLayerProtoDetectSupportedAppProtocols(AppProto *alprotos)
Definition: app-layer-detect-proto.c:2087
AppLayerProtoDetectGetProto
AppProto AppLayerProtoDetectGetProto(AppLayerProtoDetectThreadCtx *tctx, Flow *f, const uint8_t *buf, uint32_t buflen, uint8_t ipproto, uint8_t flags, bool *reverse_flow)
Returns the app layer protocol given a buffer.
Definition: app-layer-detect-proto.c:1394
AppLayerProtoDetectGetCtxThread
AppLayerProtoDetectThreadCtx * AppLayerProtoDetectGetCtxThread(void)
Inits and returns an app layer protocol detection thread context.
Definition: app-layer-detect-proto.c:1946
TcpSession_::server
TcpStream server
Definition: stream-tcp-private.h:296
AppLayerProtoDetectGetProtoByName
AppProto AppLayerProtoDetectGetProtoByName(const char *alproto_name)
Definition: app-layer-detect-proto.c:2045
str
#define str(s)
Definition: suricata-common.h:308
SWAP_FLAGS
#define SWAP_FLAGS(flags, a, b)
Definition: suricata-common.h:434
ExceptionPolicyEnumToString
const char * ExceptionPolicyEnumToString(enum ExceptionPolicy policy, bool is_json)
Definition: util-exception-policy.c:39
SCFree
#define SCFree(p)
Definition: util-mem.h:61
AppLayerCounterNames_::gap_error
char gap_error[MAX_COUNTER_SIZE]
Definition: app-layer.c:82
Flow_::alproto_ts
AppProto alproto_ts
Definition: flow.h:443
ExceptionPolicyStatsSetts_::valid_settings_ips
bool valid_settings_ips[EXCEPTION_POLICY_MAX]
Definition: util-exception-policy-types.h:59
TcpSessionSetReassemblyDepth
void TcpSessionSetReassemblyDepth(TcpSession *ssn, uint32_t size)
Definition: stream-tcp.c:7219
Flow_::alstate
void * alstate
Definition: flow.h:471
AppLayerDestroyCtxThread
void AppLayerDestroyCtxThread(AppLayerThreadCtx *app_tctx)
Destroys the context created by AppLayerGetCtxThread().
Definition: app-layer.c:1123
PACKET_PROFILING_APP_START
#define PACKET_PROFILING_APP_START(dp, id)
Definition: util-profiling.h:167
HTPByteRangeMemcapGlobalCounter
uint64_t HTPByteRangeMemcapGlobalCounter(void)
Definition: app-layer-htp-range.c:55
Flow_::flags
uint32_t flags
Definition: flow.h:413
ALPROTO_MDNS
@ ALPROTO_MDNS
Definition: app-layer-protos.h:72
HTPMemcapGlobalCounter
uint64_t HTPMemcapGlobalCounter(void)
Definition: app-layer-htp-mem.c:86
ALPROTO_MQTT
@ ALPROTO_MQTT
Definition: app-layer-protos.h:61
AppLayerGetProtoName
const char * AppLayerGetProtoName(AppProto alproto)
Given the internal protocol id, returns a string representation of the protocol.
Definition: app-layer.c:1003
g_applayerparser_error_policy
enum ExceptionPolicy g_applayerparser_error_policy
Definition: app-layer-parser.c:155
ALPROTO_HTTP
@ ALPROTO_HTTP
Definition: app-layer-protos.h:76
AppLayerCounters_::eps_error
ExceptionPolicyCounters eps_error
Definition: app-layer.c:96
AppLayerIncTxCounter
void AppLayerIncTxCounter(ThreadVars *tv, Flow *f, uint64_t step)
Definition: app-layer.c:155
stream-tcp-util.h
ALPROTO_UNKNOWN
@ ALPROTO_UNKNOWN
Definition: app-layer-protos.h:29
ALPROTO_FAILED
@ ALPROTO_FAILED
Definition: app-layer-protos.h:33
ALPROTO_TEMPLATE
@ ALPROTO_TEMPLATE
Definition: app-layer-protos.h:67
AppLayerCounterNames_::internal_error
char internal_error[MAX_COUNTER_SIZE]
Definition: app-layer.c:84
TcpReassemblyThreadCtx_
Definition: stream-tcp-reassemble.h:61
SCReturnCT
#define SCReturnCT(x, type)
Definition: util-debug.h:295
app-layer-protos.h
AppLayerProfilingReset
#define AppLayerProfilingReset(app_tctx)
Definition: app-layer.h:127
app-layer-htp-mem.h
EngineModeIsIPS
int EngineModeIsIPS(void)
Definition: suricata.c:242
STREAMTCP_FLAG_APP_LAYER_DISABLED
#define STREAMTCP_FLAG_APP_LAYER_DISABLED
Definition: stream-tcp-private.h:201
STREAMTCP_STREAM_FLAG_NOREASSEMBLY
#define STREAMTCP_STREAM_FLAG_NOREASSEMBLY
Definition: stream-tcp-private.h:219
suricata.h
ALPROTO_RFB
@ ALPROTO_RFB
Definition: app-layer-protos.h:60
TEST_END
#define TEST_END
Definition: app-layer.c:1461
StreamUpdateDir
StreamUpdateDir
Definition: stream-tcp-reassemble.h:54
AppLayerProtoDetectDestroyCtxThread
void AppLayerProtoDetectDestroyCtxThread(AppLayerProtoDetectThreadCtx *alpd_tctx)
Destroys the app layer protocol detection thread context.
Definition: app-layer-detect-proto.c:1999
ALPROTO_BITTORRENT_DHT
@ ALPROTO_BITTORRENT_DHT
Definition: app-layer-protos.h:70
ALPROTO_NTP
@ ALPROTO_NTP
Definition: app-layer-protos.h:52
ALPROTO_SMB
@ ALPROTO_SMB
Definition: app-layer-protos.h:43
likely
#define likely(expr)
Definition: util-optimize.h:32
AppLayerParserThreadCtx_
Definition: app-layer-parser.c:60
AppLayerCounterNames_::name
char name[MAX_COUNTER_SIZE]
Definition: app-layer.c:80
FlowChangeProto
int FlowChangeProto(Flow *f)
Check if change proto flag is set for flow.
Definition: flow.c:197
TcpSession_
Definition: stream-tcp-private.h:283
FrameConfigDeInit
void FrameConfigDeInit(void)
Definition: app-layer-frames.c:50
TcpSession_::data_first_seen_dir
int8_t data_first_seen_dir
Definition: stream-tcp-private.h:288
flow.h
Flow_::alproto_tc
AppProto alproto_tc
Definition: flow.h:444
FLOW_PROTO_CHANGE_MAX_DEPTH
#define FLOW_PROTO_CHANGE_MAX_DEPTH
Definition: app-layer.c:76
AppLayerProtoDetectPrepareState
int AppLayerProtoDetectPrepareState(void)
Prepares the internal state for protocol detection. This needs to be called once all the patterns and...
Definition: app-layer-detect-proto.c:1482
Flow_::alproto
AppProto alproto
application level protocol
Definition: flow.h:442
ExceptionPolicy
ExceptionPolicy
Definition: util-exception-policy-types.h:25
StatsRegisterCounter
uint16_t StatsRegisterCounter(const char *name, struct ThreadVars_ *tv)
Registers a normal, unqualified counter.
Definition: counters.c:952
SCCalloc
#define SCCalloc(nm, sz)
Definition: util-mem.h:53
AppLayerCounterNames_::alloc_error
char alloc_error[MAX_COUNTER_SIZE]
Definition: app-layer.c:85
SCReturnInt
#define SCReturnInt(x)
Definition: util-debug.h:285
PACKET_PROFILING_APP_RESET
#define PACKET_PROFILING_APP_RESET(dp)
Definition: util-profiling.h:195
APPLAYER_WRONG_DIRECTION_FIRST_DATA
@ APPLAYER_WRONG_DIRECTION_FIRST_DATA
Definition: app-layer-events.h:47
AppLayerDeSetupCounters
void AppLayerDeSetupCounters(void)
Definition: app-layer.c:1365
DEBUG_VALIDATE_BUG_ON
#define DEBUG_VALIDATE_BUG_ON(exp)
Definition: util-validate.h:102
ALPROTO_NFS
@ ALPROTO_NFS
Definition: app-layer-protos.h:51
ExceptionPolicyStatsSetts_::eps_name
char eps_name[EXCEPTION_POLICY_MAX][EXCEPTION_POLICY_COUNTER_MAX_LEN]
Definition: util-exception-policy-types.h:57
STREAMTCP_STREAM_FLAG_APPPROTO_DETECTION_COMPLETED
#define STREAMTCP_STREAM_FLAG_APPPROTO_DETECTION_COMPLETED
Definition: stream-tcp-private.h:232
AppLayerProtoDetectGetProtoName
const char * AppLayerProtoDetectGetProtoName(AppProto alproto)
Definition: app-layer-detect-proto.c:2070
app-layer.h
Flow_::de_ctx_version
uint32_t de_ctx_version
Definition: flow.h:456