]> git.ipfire.org Git - people/ms/suricata.git/commit
App layer API rewritten. The main files in question are:
authorAnoop Saldanha <anoopsaldanha@gmail.com>
Tue, 24 Dec 2013 10:00:57 +0000 (15:30 +0530)
committerAnoop Saldanha <anoopsaldanha@gmail.com>
Mon, 30 Dec 2013 14:52:38 +0000 (20:22 +0530)
commit429c6388f6c901174cce64b5eed383d52b525dcb
tree91d1493bdff72ae340762c7b7678b2f5fac6d142
parent127ef8f903f2f0cf9101c7992d3aa7e3dcbb6bee
App layer API rewritten.  The main files in question are:
app-layer.[ch], app-layer-detect-proto.[ch] and app-layer-parser.[ch].

Things addressed in this commit:
- Brings out a proper separation between protocol detection phase and the
  parser phase.
- The dns app layer now is registered such that we don't use "dnstcp" and
  "dnsudp" in the rules.  A user who previously wrote a rule like this -

  "alert dnstcp....." or
  "alert dnsudp....."

  would now have to use,

  alert dns (ipproto:tcp;) or
  alert udp (app-layer-protocol:dns;) or
  alert ip (ipproto:udp; app-layer-protocol:dns;)

  The same rules extend to other another such protocol, dcerpc.
- The app layer parser api now takes in the ipproto while registering
  callbacks.
- The app inspection/detection engine also takes an ipproto.
- All app layer parser functions now take direction as STREAM_TOSERVER or
  STREAM_TOCLIENT, as opposed to 0 or 1, which was taken by some of the
  functions.
- FlowInitialize() and FlowRecycle() now resets proto to 0.  This is
  needed by unittests, which would try to clean the flow, and that would
  call the api, AppLayerParserCleanupParserState(), which would try to
  clean the app state, but the app layer now needs an ipproto to figure
  out which api to internally call to clean the state, and if the ipproto
  is 0, it would return without trying to clean the state.
- A lot of unittests are now updated where if they are using a flow and
  they need to use the app layer, we would set a flow ipproto.
- The "app-layer" section in the yaml conf has also been updated as well.
101 files changed:
src/alert-unified2-alert.c
src/app-layer-dcerpc-udp.c
src/app-layer-dcerpc.c
src/app-layer-detect-proto.c
src/app-layer-detect-proto.h
src/app-layer-dns-common.c
src/app-layer-dns-common.h
src/app-layer-dns-tcp.c
src/app-layer-dns-udp.c
src/app-layer-ftp.c
src/app-layer-htp-file.c
src/app-layer-htp.c
src/app-layer-parser.c
src/app-layer-parser.h
src/app-layer-protos.c
src/app-layer-protos.h
src/app-layer-smb.c
src/app-layer-smb2.c
src/app-layer-smtp.c
src/app-layer-ssl.c
src/app-layer.c
src/app-layer.h
src/decode-events.h
src/decode-udp.c
src/decode.c
src/decode.h
src/detect-app-layer-event.c
src/detect-app-layer-event.h
src/detect-app-layer-protocol.c
src/detect-dce-iface.c
src/detect-dce-opnum.c
src/detect-dce-stub-data.c
src/detect-dns-query.c
src/detect-engine-apt-event.c
src/detect-engine-dcepayload.c
src/detect-engine-hcbd.c
src/detect-engine-hcd.c
src/detect-engine-hhd.c
src/detect-engine-hhhd.c
src/detect-engine-hmd.c
src/detect-engine-hrhd.c
src/detect-engine-hrhhd.c
src/detect-engine-hrud.c
src/detect-engine-hsbd.c
src/detect-engine-hscd.c
src/detect-engine-hsmd.c
src/detect-engine-hua.c
src/detect-engine-state.c
src/detect-engine-uri.c
src/detect-engine.c
src/detect-engine.h
src/detect-filestore.c
src/detect-fragbits.c
src/detect-ftpbounce.c
src/detect-http-client-body.c
src/detect-http-cookie.c
src/detect-http-header.c
src/detect-http-hh.c
src/detect-http-hrh.c
src/detect-http-method.c
src/detect-http-raw-header.c
src/detect-http-server-body.c
src/detect-http-stat-code.c
src/detect-http-stat-msg.c
src/detect-http-ua.c
src/detect-luajit.c
src/detect-parse.c
src/detect-pcre.c
src/detect-replace.c
src/detect-ssl-state.c
src/detect-ssl-version.c
src/detect-tls-version.c
src/detect-uricontent.c
src/detect-urilen.c
src/detect.c
src/flow-timeout.c
src/flow-util.c
src/flow-util.h
src/flow.c
src/flow.h
src/log-dnslog.c
src/log-file.c
src/log-filestore.c
src/log-httplog.c
src/log-tlslog.c
src/runmode-unittests.c
src/stream-tcp-reassemble.c
src/stream-tcp-reassemble.h
src/stream-tcp.c
src/suricata.c
src/util-error.c
src/util-error.h
src/util-file.c
src/util-memcmp.h
src/util-mpm-ac-bs.c
src/util-mpm-ac-gfbs.c
src/util-mpm-ac.c
src/util-mpm.c
src/util-mpm.h
src/util-running-modes.c
suricata.yaml.in