snmp: can be set to detection-only

Realloc alp_ctx.ctxs when a dynamic alproto is registered and
g_alproto_max increases. So dynamic alproto can be treated as
real/normal ones. And app-layer switch can be set to any value
of no/deteciton-only/yes.

Ticket: 8000

diff --git a/rust/sys/src/sys.rs b/rust/sys/src/sys.rs
index f36264ce4354e77d956f14f2f989118ec2c4fb6e..a6707121bcb2f4525fe6ec170c0eec7303216acc 100644 (file)
--- a/rust/sys/src/sys.rs
+++ b/rust/sys/src/sys.rs
@@ -765,6 +765,9 @@ extern "C" {
         ipproto: *const ::std::os::raw::c_char, alproto_name: *const ::std::os::raw::c_char,
     ) -> ::std::os::raw::c_int;
 }
+extern "C" {
+    pub fn SCAppLayerParserReallocCtx(alproto: AppProto) -> ::std::os::raw::c_int;
+}
 extern "C" {
     pub fn SCAppLayerParserRegisterParserAcceptableDataDirection(
         ipproto: u8, alproto: AppProto, direction: u8,

diff --git a/src/app-layer-parser.c b/src/app-layer-parser.c
index d68922388003a6a2a9b594176d1b1fb5f8a51a8d..90960c3b081383a3318236cac730c84273509f2f 100644 (file)
--- a/src/app-layer-parser.c
+++ b/src/app-layer-parser.c
@@ -437,20 +437,6 @@ void AppLayerParserRegisterStateFuncs(uint8_t ipproto, AppProto alproto,
 {
     SCEnter();
 
-    if (alp_ctx.ctxs_len <= alproto && alproto < g_alproto_max) {
-        // Realloc now as AppLayerParserRegisterStateFuncs is called first
-        void *tmp = SCRealloc(
-                alp_ctx.ctxs, sizeof(AppLayerParserProtoCtx[FLOW_PROTO_MAX]) * g_alproto_max);
-        if (unlikely(tmp == NULL)) {
-            FatalError("Unable to realloc alp_ctx.ctxs.");
-        }
-        alp_ctx.ctxs = tmp;
-        memset(&alp_ctx.ctxs[alp_ctx.ctxs_len], 0,
-                sizeof(AppLayerParserProtoCtx[FLOW_PROTO_MAX]) *
-                        (g_alproto_max - alp_ctx.ctxs_len));
-        alp_ctx.ctxs_len = g_alproto_max;
-    }
-
     alp_ctx.ctxs[alproto][FlowGetProtoMapping(ipproto)].StateAlloc = StateAlloc;
     alp_ctx.ctxs[alproto][FlowGetProtoMapping(ipproto)].StateFree = StateFree;
 
@@ -1750,6 +1736,24 @@ static void (**PreRegisteredCallbacks)(void) = NULL;
 static size_t preregistered_callbacks_nb = 0;
 static size_t preregistered_callbacks_cap = 0;
 
+int SCAppLayerParserReallocCtx(AppProto alproto)
+{
+    if (alp_ctx.ctxs_len <= alproto && alproto < g_alproto_max) {
+        /* Realloc alp_ctx.ctxs, so that dynamic alproto can be treated as real/normal ones.
+         * In case we need to turn off dynamic alproto. */
+        void *tmp = SCRealloc(alp_ctx.ctxs, sizeof(AppLayerParserProtoCtx[FLOW_PROTO_MAX]) *
+                                                    (alp_ctx.ctxs_len + ARRAY_CAP_STEP));
+        if (unlikely(tmp == NULL)) {
+            FatalError("Unable to realloc alp_ctx.ctxs.");
+        }
+        alp_ctx.ctxs = tmp;
+        memset(&alp_ctx.ctxs[alp_ctx.ctxs_len], 0,
+                sizeof(AppLayerParserProtoCtx[FLOW_PROTO_MAX]) * ARRAY_CAP_STEP);
+        alp_ctx.ctxs_len += ARRAY_CAP_STEP;
+    }
+    return 0;
+}
+
 int AppLayerParserPreRegister(void (*Register)(void))
 {
     if (preregistered_callbacks_nb == preregistered_callbacks_cap) {

diff --git a/src/app-layer-parser.h b/src/app-layer-parser.h
index 32c7d264452d976d1e1430ffffd93fd57ac91101..23cf556aea675ef3061aa53ca508579c977ac18e 100644 (file)
--- a/src/app-layer-parser.h
+++ b/src/app-layer-parser.h
@@ -160,6 +160,7 @@ typedef const char *(*AppLayerParserGetStateNameByIdFn)(const int id, const uint
 typedef int (*AppLayerParserGetFrameIdByNameFn)(const char *frame_name);
 typedef const char *(*AppLayerParserGetFrameNameByIdFn)(const uint8_t id);
 
+int SCAppLayerParserReallocCtx(AppProto alproto);
 int AppLayerParserPreRegister(void (*Register)(void));
 /**
  * \brief Register app layer parser for the protocol.

diff --git a/src/app-layer-protos.c b/src/app-layer-protos.c
index 7c48847be55cb660f71610f43f41c53f9e02ffa0..13fe402949eae335a2a3f1d9da40cfbdfbade1db 100644 (file)
--- a/src/app-layer-protos.c
+++ b/src/app-layer-protos.c
@@ -24,6 +24,7 @@
 
 #include "suricata-common.h"
 #include "app-layer-protos.h"
+#include "app-layer-parser.h"
 #include "rust.h"
 
 AppProto g_alproto_max = ALPROTO_MAX_STATIC;
@@ -97,6 +98,7 @@ void AppProtoRegisterProtoString(AppProto alproto, const char *proto_name)
             g_alproto_strings = tmp;
         }
         g_alproto_max++;
+        SCAppLayerParserReallocCtx(alproto);
     }
     g_alproto_strings[alproto].str = proto_name;
     g_alproto_strings[alproto].alproto = alproto;