app-layer: remove APP_LAYER_PARSER_OPT_UNIDIR_TXS

This flag is no longer needed as a parser can now create a transaction
as unidirectional.

Setting this flag also doesn't make sense on parsers that may have
request/reply and some unidirectional messaging.

diff --git a/rust/src/applayer.rs b/rust/src/applayer.rs
index 155d5701d00b96b9e582d7767c1c86958d245c03..9dfde28491f686a294b5d2663c734d7342ebede3 100644 (file)
--- a/rust/src/applayer.rs
+++ b/rust/src/applayer.rs
@@ -498,7 +498,6 @@ pub const APP_LAYER_PARSER_TRUNC_TS : u16 = BIT_U16!(7);
 pub const APP_LAYER_PARSER_TRUNC_TC : u16 = BIT_U16!(8);
 
 pub const APP_LAYER_PARSER_OPT_ACCEPT_GAPS: u32 = BIT_U32!(0);
-pub const APP_LAYER_PARSER_OPT_UNIDIR_TXS: u32 = BIT_U32!(1);
 
 pub const APP_LAYER_TX_SKIP_INSPECT_FLAG: u64 = BIT_U64!(62);
 

diff --git a/rust/src/bittorrent_dht/bittorrent_dht.rs b/rust/src/bittorrent_dht/bittorrent_dht.rs
index 9b36e2eaba6b36ae47b4c12a5468a131b692ebd7..8c6857dc5d922dc813cd3ac82da04ef824da2d96 100644 (file)
--- a/rust/src/bittorrent_dht/bittorrent_dht.rs
+++ b/rust/src/bittorrent_dht/bittorrent_dht.rs
@@ -281,7 +281,7 @@ pub unsafe extern "C" fn rs_bittorrent_dht_udp_register_parser() {
         get_tx_data: rs_bittorrent_dht_get_tx_data,
         get_state_data: rs_bittorrent_dht_get_state_data,
         apply_tx_config: None,
-        flags: APP_LAYER_PARSER_OPT_UNIDIR_TXS,
+        flags: 0,
         truncate: None,
         get_frame_id_by_name: None,
         get_frame_name_by_id: None,

diff --git a/rust/src/dcerpc/dcerpc_udp.rs b/rust/src/dcerpc/dcerpc_udp.rs
index b9ac7fe71fddc49da280614250158e413a0d00e1..e007149f9973919972c0b4a20d18eaf4a59de085 100644 (file)
--- a/rust/src/dcerpc/dcerpc_udp.rs
+++ b/rust/src/dcerpc/dcerpc_udp.rs
@@ -360,7 +360,7 @@ pub unsafe extern "C" fn rs_dcerpc_udp_register_parser() {
         get_tx_data: rs_dcerpc_udp_get_tx_data,
         get_state_data: rs_dcerpc_udp_get_state_data,
         apply_tx_config: None,
-        flags: APP_LAYER_PARSER_OPT_UNIDIR_TXS,
+        flags: 0,
         truncate: None,
         get_frame_id_by_name: None,
         get_frame_name_by_id: None,

diff --git a/rust/src/dhcp/dhcp.rs b/rust/src/dhcp/dhcp.rs
index 66fe09ea409a8f83ea8b4f5ed9260d3a8792ab98..00291757c8037c016de2d6c4d53391263fc0088f 100644 (file)
--- a/rust/src/dhcp/dhcp.rs
+++ b/rust/src/dhcp/dhcp.rs
@@ -296,7 +296,7 @@ pub unsafe extern "C" fn rs_dhcp_register_parser() {
         get_tx_data        : rs_dhcp_get_tx_data,
         get_state_data     : rs_dhcp_get_state_data,
         apply_tx_config    : None,
-        flags              : APP_LAYER_PARSER_OPT_UNIDIR_TXS,
+        flags              : 0,
         truncate           : None,
         get_frame_id_by_name: None,
         get_frame_name_by_id: None,

diff --git a/rust/src/dns/dns.rs b/rust/src/dns/dns.rs
index bfd57dc7077552bb0a9d90417c4bee3dfb85cba7..67eb3085547f87897355a0d2626dc0f35305df1f 100644 (file)
--- a/rust/src/dns/dns.rs
+++ b/rust/src/dns/dns.rs
@@ -1005,7 +1005,7 @@ pub unsafe extern "C" fn rs_dns_udp_register_parser() {
         get_tx_data: rs_dns_state_get_tx_data,
         get_state_data: rs_dns_get_state_data,
         apply_tx_config: Some(rs_dns_apply_tx_config),
-        flags: APP_LAYER_PARSER_OPT_UNIDIR_TXS,
+        flags: 0,
         truncate: None,
         get_frame_id_by_name: Some(DnsFrameType::ffi_id_from_name),
         get_frame_name_by_id: Some(DnsFrameType::ffi_name_from_id),
@@ -1051,7 +1051,7 @@ pub unsafe extern "C" fn rs_dns_tcp_register_parser() {
         get_tx_data: rs_dns_state_get_tx_data,
         get_state_data: rs_dns_get_state_data,
         apply_tx_config: Some(rs_dns_apply_tx_config),
-        flags: APP_LAYER_PARSER_OPT_ACCEPT_GAPS | APP_LAYER_PARSER_OPT_UNIDIR_TXS,
+        flags: APP_LAYER_PARSER_OPT_ACCEPT_GAPS,
         truncate: None,
         get_frame_id_by_name: Some(DnsFrameType::ffi_id_from_name),
         get_frame_name_by_id: Some(DnsFrameType::ffi_name_from_id),

diff --git a/rust/src/ike/ike.rs b/rust/src/ike/ike.rs
index eff74a893494274504241fbfb2497d9ec51e0f4f..2a5448ab27cfeb0a5f06371d4611f8cb259ed5ec 100644 (file)
--- a/rust/src/ike/ike.rs
+++ b/rust/src/ike/ike.rs
@@ -423,7 +423,7 @@ pub unsafe extern "C" fn rs_ike_register_parser() {
         get_tx_data: rs_ike_get_tx_data,
         get_state_data: rs_ike_get_state_data,
         apply_tx_config: None,
-        flags: APP_LAYER_PARSER_OPT_UNIDIR_TXS,
+        flags: 0,
         truncate: None,
         get_frame_id_by_name: None,
         get_frame_name_by_id: None,

diff --git a/rust/src/krb/krb5.rs b/rust/src/krb/krb5.rs
index 6cbdd0146a93691e679649857fdbea8062761d61..bceae25519ff0248c10ce573c0c821ab5912758a 100644 (file)
--- a/rust/src/krb/krb5.rs
+++ b/rust/src/krb/krb5.rs
@@ -570,7 +570,7 @@ pub unsafe extern "C" fn rs_register_krb5_parser() {
         get_tx_data        : rs_krb5_get_tx_data,
         get_state_data     : rs_krb5_get_state_data,
         apply_tx_config    : None,
-        flags              : APP_LAYER_PARSER_OPT_UNIDIR_TXS,
+        flags              : 0,
         truncate           : None,
         get_frame_id_by_name: None,
         get_frame_name_by_id: None,

diff --git a/rust/src/mqtt/mqtt.rs b/rust/src/mqtt/mqtt.rs
index 8ec2ad3558c511777919bb0d66231049f627c054..43bd7081512ad93842380d2e002e415cbea419ce 100644 (file)
--- a/rust/src/mqtt/mqtt.rs
+++ b/rust/src/mqtt/mqtt.rs
@@ -759,7 +759,7 @@ pub unsafe extern "C" fn rs_mqtt_register_parser(cfg_max_msg_len: u32) {
         get_tx_data: rs_mqtt_get_tx_data,
         get_state_data: rs_mqtt_get_state_data,
         apply_tx_config: None,
-        flags: APP_LAYER_PARSER_OPT_UNIDIR_TXS,
+        flags: 0,
         truncate: None,
         get_frame_id_by_name: None,
         get_frame_name_by_id: None,

diff --git a/rust/src/ntp/ntp.rs b/rust/src/ntp/ntp.rs
index 2b01a0d6c4340afe3757ba6f1a35866217d2b48e..c7b3b3d01826e9a4f8595b3411911dab1dcbd77a 100644 (file)
--- a/rust/src/ntp/ntp.rs
+++ b/rust/src/ntp/ntp.rs
@@ -296,7 +296,7 @@ pub unsafe extern "C" fn rs_register_ntp_parser() {
         get_tx_data        : rs_ntp_get_tx_data,
         get_state_data     : rs_ntp_get_state_data,
         apply_tx_config    : None,
-        flags              : APP_LAYER_PARSER_OPT_UNIDIR_TXS,
+        flags              : 0,
         truncate           : None,
         get_frame_id_by_name: None,
         get_frame_name_by_id: None,

diff --git a/rust/src/quic/quic.rs b/rust/src/quic/quic.rs
index dd8909b15e986c47ceca02e1a7459200f64abf5c..8e3ea6f35a21b1742da793cecb3aa547de99ef38 100644 (file)
--- a/rust/src/quic/quic.rs
+++ b/rust/src/quic/quic.rs
@@ -481,7 +481,7 @@ pub unsafe extern "C" fn rs_quic_register_parser() {
         get_tx_data: rs_quic_get_tx_data,
         get_state_data: rs_quic_get_state_data,
         apply_tx_config: None,
-        flags: APP_LAYER_PARSER_OPT_UNIDIR_TXS,
+        flags: 0,
         truncate: None,
         get_frame_id_by_name: None,
         get_frame_name_by_id: None,

diff --git a/rust/src/rdp/rdp.rs b/rust/src/rdp/rdp.rs
index 636850d9e532963c4ab434bda82f748e5980b75a..833d4011739f12e9ce6736129edca12506cbacce 100644 (file)
--- a/rust/src/rdp/rdp.rs
+++ b/rust/src/rdp/rdp.rs
@@ -492,7 +492,7 @@ pub unsafe extern "C" fn rs_rdp_register_parser() {
         get_tx_data: rs_rdp_get_tx_data,
         get_state_data: rs_rdp_get_state_data,
         apply_tx_config: None,
-        flags: APP_LAYER_PARSER_OPT_UNIDIR_TXS,
+        flags: 0,
         truncate: None,
         get_frame_id_by_name: None,
         get_frame_name_by_id: None,

diff --git a/rust/src/sip/sip.rs b/rust/src/sip/sip.rs
index 7f4716f1e8bef77bf624fdd16621631ef6f9154f..4e86f5ea476d534538729828408dea9cbda1933f 100755 (executable)
--- a/rust/src/sip/sip.rs
+++ b/rust/src/sip/sip.rs
@@ -372,7 +372,7 @@ pub unsafe extern "C" fn rs_sip_register_parser() {
         get_tx_data: rs_sip_get_tx_data,
         get_state_data: rs_sip_get_state_data,
         apply_tx_config: None,
-        flags: APP_LAYER_PARSER_OPT_UNIDIR_TXS,
+        flags: 0,
         truncate: None,
         get_frame_id_by_name: Some(SIPFrameType::ffi_id_from_name),
         get_frame_name_by_id: Some(SIPFrameType::ffi_name_from_id),

diff --git a/rust/src/snmp/snmp.rs b/rust/src/snmp/snmp.rs
index 1ed9c89b8f95b9aed386603da1de32b72d233a1b..f00adf6eccd69eb751813fda2e5ba0234355dc2c 100644 (file)
--- a/rust/src/snmp/snmp.rs
+++ b/rust/src/snmp/snmp.rs
@@ -402,7 +402,7 @@ pub unsafe extern "C" fn rs_register_snmp_parser() {
         get_tx_data        : rs_snmp_get_tx_data,
         get_state_data     : rs_snmp_get_state_data,
         apply_tx_config    : None,
-        flags              : APP_LAYER_PARSER_OPT_UNIDIR_TXS,
+        flags              : 0,
         truncate           : None,
         get_frame_id_by_name: None,
         get_frame_name_by_id: None,

diff --git a/src/app-layer-dnp3.c b/src/app-layer-dnp3.c
index 2049b968e1520da0fb2a0ccafb135a3ea5bb8a8d..3ef50bb8aa9e6222edf5271f3746672880c25b75 100644 (file)
--- a/src/app-layer-dnp3.c
+++ b/src/app-layer-dnp3.c
@@ -1596,9 +1596,6 @@ void RegisterDNP3Parsers(void)
         AppLayerParserRegisterTxDataFunc(IPPROTO_TCP, ALPROTO_DNP3,
             DNP3GetTxData);
         AppLayerParserRegisterStateDataFunc(IPPROTO_TCP, ALPROTO_DNP3, DNP3GetStateData);
-
-        AppLayerParserRegisterOptionFlags(
-                IPPROTO_TCP, ALPROTO_DNP3, APP_LAYER_PARSER_OPT_UNIDIR_TXS);
     }
     else {
         SCLogConfig("Parser disabled for protocol %s. "

diff --git a/src/app-layer-enip.c b/src/app-layer-enip.c
index 0fb626ce351848d2c8f46e3624397899d76deb45..94c707c144b83191395ac4d4f459186324bb3936 100644 (file)
--- a/src/app-layer-enip.c
+++ b/src/app-layer-enip.c
@@ -561,10 +561,8 @@ void RegisterENIPUDPParsers(void)
         AppLayerParserRegisterGetEventInfo(IPPROTO_UDP, ALPROTO_ENIP, ENIPStateGetEventInfo);
         AppLayerParserRegisterGetEventInfoById(IPPROTO_UDP, ALPROTO_ENIP, ENIPStateGetEventInfoById);
 
-        AppLayerParserRegisterParserAcceptableDataDirection(IPPROTO_UDP,
-                ALPROTO_ENIP, STREAM_TOSERVER | STREAM_TOCLIENT);
-        AppLayerParserRegisterOptionFlags(
-                IPPROTO_UDP, ALPROTO_ENIP, APP_LAYER_PARSER_OPT_UNIDIR_TXS);
+        AppLayerParserRegisterParserAcceptableDataDirection(
+                IPPROTO_UDP, ALPROTO_ENIP, STREAM_TOSERVER | STREAM_TOCLIENT);
     } else
     {
         SCLogInfo(
@@ -640,8 +638,7 @@ void RegisterENIPTCPParsers(void)
         AppLayerParserRegisterOptionFlags(IPPROTO_TCP, ALPROTO_ENIP,
                 APP_LAYER_PARSER_OPT_ACCEPT_GAPS);
 
-        AppLayerParserRegisterOptionFlags(
-                IPPROTO_TCP, ALPROTO_ENIP, APP_LAYER_PARSER_OPT_UNIDIR_TXS);
+        AppLayerParserRegisterOptionFlags(IPPROTO_TCP, ALPROTO_ENIP, 0);
     } else
     {
         SCLogConfig("Parser disabled for %s protocol. Protocol detection still on.",

diff --git a/src/app-layer-parser.c b/src/app-layer-parser.c
index 6b93a0faf0ba3b033f3502bb04e8d2e2f5c3ef25..fc60b98b9a1101549893ac1dfd5cebfd06c83225 100644 (file)
--- a/src/app-layer-parser.c
+++ b/src/app-layer-parser.c
@@ -736,7 +736,7 @@ uint64_t AppLayerParserGetTransactionInspectId(AppLayerParserState *pstate, uint
     SCReturnCT(pstate->inspect_id[(direction & STREAM_TOSERVER) ? 0 : 1], "uint64_t");
 }
 
-static inline uint64_t GetTxDetectFlags(AppLayerTxData *txd, const uint8_t dir)
+inline uint64_t AppLayerParserGetTxDetectFlags(AppLayerTxData *txd, const uint8_t dir)
 {
     uint64_t detect_flags =
         (dir & STREAM_TOSERVER) ? txd->detect_flags_ts : txd->detect_flags_tc;
@@ -793,7 +793,7 @@ void AppLayerParserSetTransactionInspectId(const Flow *f, AppLayerParserState *p
 
         AppLayerTxData *txd = AppLayerParserGetTxData(ipproto, alproto, tx);
         if (txd && tag_txs_as_inspected) {
-            uint64_t detect_flags = GetTxDetectFlags(txd, flags);
+            uint64_t detect_flags = AppLayerParserGetTxDetectFlags(txd, flags);
             if ((detect_flags & APP_LAYER_TX_INSPECTED_FLAG) == 0) {
                 detect_flags |= APP_LAYER_TX_INSPECTED_FLAG;
                 SetTxDetectFlags(txd, flags, detect_flags);
@@ -833,7 +833,7 @@ void AppLayerParserSetTransactionInspectId(const Flow *f, AppLayerParserState *p
             /* txd can be NULL for HTTP sessions where the user data alloc failed */
             AppLayerTxData *txd = AppLayerParserGetTxData(ipproto, alproto, tx);
             if (likely(txd)) {
-                uint64_t detect_flags = GetTxDetectFlags(txd, flags);
+                uint64_t detect_flags = AppLayerParserGetTxDetectFlags(txd, flags);
                 if ((detect_flags & APP_LAYER_TX_INSPECTED_FLAG) == 0) {
                     detect_flags |= APP_LAYER_TX_INSPECTED_FLAG;
                     SetTxDetectFlags(txd, flags, detect_flags);
@@ -953,8 +953,6 @@ void AppLayerParserTransactionsCleanup(Flow *f, const uint8_t pkt_dir)
     uint64_t new_min = min;
     SCLogDebug("start min %"PRIu64, min);
     bool skipped = false;
-    const bool is_unidir =
-            AppLayerParserGetOptionFlags(f->protomap, f->alproto) & APP_LAYER_PARSER_OPT_UNIDIR_TXS;
     // const bool support_files = AppLayerParserSupportsFiles(f->proto, f->alproto);
 
     while (1) {
@@ -993,44 +991,29 @@ void AppLayerParserTransactionsCleanup(Flow *f, const uint8_t pkt_dir)
             goto next;
         }
 
-        bool inspected = false;
         if (txd && has_tx_detect_flags) {
             if (!IS_DISRUPTED(ts_disrupt_flags) && f->sgh_toserver != NULL) {
-                uint64_t detect_flags_ts = GetTxDetectFlags(txd, STREAM_TOSERVER);
-                if (!(detect_flags_ts & APP_LAYER_TX_INSPECTED_FLAG)) {
-                    SCLogDebug("%p/%"PRIu64" skipping: TS inspect not done: ts:%"PRIx64,
-                            tx, i, detect_flags_ts);
+                uint64_t detect_flags_ts = AppLayerParserGetTxDetectFlags(txd, STREAM_TOSERVER);
+                if (!(detect_flags_ts &
+                            (APP_LAYER_TX_INSPECTED_FLAG | APP_LAYER_TX_SKIP_INSPECT_FLAG))) {
+                    SCLogDebug("%p/%" PRIu64 " skipping: TS inspect not done: ts:%" PRIx64, tx, i,
+                            detect_flags_ts);
                     tx_skipped = true;
-                } else {
-                    inspected = true;
                 }
             }
             if (!IS_DISRUPTED(tc_disrupt_flags) && f->sgh_toclient != NULL) {
-                uint64_t detect_flags_tc = GetTxDetectFlags(txd, STREAM_TOCLIENT);
-                if (!(detect_flags_tc & APP_LAYER_TX_INSPECTED_FLAG)) {
-                    SCLogDebug("%p/%"PRIu64" skipping: TC inspect not done: tc:%"PRIx64,
-                            tx, i, detect_flags_tc);
+                uint64_t detect_flags_tc = AppLayerParserGetTxDetectFlags(txd, STREAM_TOCLIENT);
+                if (!(detect_flags_tc &
+                            (APP_LAYER_TX_INSPECTED_FLAG | APP_LAYER_TX_SKIP_INSPECT_FLAG))) {
+                    SCLogDebug("%p/%" PRIu64 " skipping: TC inspect not done: ts:%" PRIx64, tx, i,
+                            detect_flags_tc);
                     tx_skipped = true;
-                } else {
-                    inspected = true;
                 }
             }
         }
 
-        // If not a unidirectional transaction both sides are required to have
-        // been inspected.
-        if (!is_unidir && tx_skipped) {
-            SCLogDebug("%p/%" PRIu64 " !is_unidir && tx_skipped", tx, i);
-            skipped = true;
-            goto next;
-        }
-
-        // If this is a unidirectional transaction require only one side to be
-        // inspected, which the inspected flag tells us. This is also guarded
-        // with skip to limit this check to transactions that actually had the
-        // tx inspected flag checked.
-        if (is_unidir && tx_skipped && !inspected) {
-            SCLogDebug("%p/%" PRIu64 " is_unidir && tx_skipped && !inspected", tx, i);
+        if (tx_skipped) {
+            SCLogDebug("%p/%" PRIu64 " tx_skipped", tx, i);
             skipped = true;
             goto next;
         }

diff --git a/src/app-layer-parser.h b/src/app-layer-parser.h
index 4836ab06be25664c982487e0e3a8e90dbefdfd96..f1f38c472602e819b50f06f6827b88879c6c7c20 100644 (file)
--- a/src/app-layer-parser.h
+++ b/src/app-layer-parser.h
@@ -44,8 +44,7 @@
 #define APP_LAYER_PARSER_SFRAME_TC             BIT_U16(10)
 
 /* Flags for AppLayerParserProtoCtx. */
-#define APP_LAYER_PARSER_OPT_ACCEPT_GAPS        BIT_U32(0)
-#define APP_LAYER_PARSER_OPT_UNIDIR_TXS         BIT_U32(1)
+#define APP_LAYER_PARSER_OPT_ACCEPT_GAPS BIT_U32(0)
 
 #define APP_LAYER_PARSER_INT_STREAM_DEPTH_SET   BIT_U32(0)
 
@@ -263,6 +262,7 @@ uint8_t AppLayerParserGetFirstDataDir(uint8_t ipproto, AppProto alproto);
 int AppLayerParserSupportsFiles(uint8_t ipproto, AppProto alproto);
 
 AppLayerTxData *AppLayerParserGetTxData(uint8_t ipproto, AppProto alproto, void *tx);
+uint64_t AppLayerParserGetTxDetectFlags(AppLayerTxData *txd, const uint8_t dir);
 AppLayerStateData *AppLayerParserGetStateData(uint8_t ipproto, AppProto alproto, void *state);
 void AppLayerParserApplyTxConfig(uint8_t ipproto, AppProto alproto,
         void *state, void *tx, enum ConfigAction mode, AppLayerTxConfig);

diff --git a/src/detect-config.c b/src/detect-config.c
index 3cdecd84b54f102316a5b24f9748d98757bda398..e0f366e34984c3811329d49f327cb71b407b54ea 100644 (file)
--- a/src/detect-config.c
+++ b/src/detect-config.c
@@ -97,19 +97,21 @@ static void ConfigApplyTx(Flow *f,
         if (txd) {
             SCLogDebug("tx %p txd %p: log_flags %x", tx, txd, txd->config.log_flags);
             txd->config.log_flags |= BIT_U8(config->type);
+
+            uint64_t unidir = ((AppLayerParserGetTxDetectFlags(txd, STREAM_TOSERVER) |
+                                       AppLayerParserGetTxDetectFlags(txd, STREAM_TOCLIENT)) &
+                                      APP_LAYER_TX_SKIP_INSPECT_FLAG) != 0;
+            if (unidir) {
+                SCLogDebug("handle unidir tx");
+                AppLayerTxConfig req;
+                memset(&req, 0, sizeof(req));
+                req.log_flags = BIT_U8(config->type);
+                AppLayerParserApplyTxConfig(
+                        f->proto, f->alproto, f->alstate, tx, CONFIG_ACTION_SET, req);
+            }
         } else {
             SCLogDebug("no tx data");
         }
-
-        if (AppLayerParserGetOptionFlags(f->protomap, f->alproto) &
-                APP_LAYER_PARSER_OPT_UNIDIR_TXS) {
-            SCLogDebug("handle unidir tx");
-            AppLayerTxConfig req;
-            memset(&req, 0, sizeof(req));
-            req.log_flags = BIT_U8(config->type);
-            AppLayerParserApplyTxConfig(f->proto, f->alproto, f->alstate, tx,
-                    CONFIG_ACTION_SET, req);
-        }
     } else {
         SCLogDebug("no tx");
     }