pub type DetectEngineStateFreeFunc =
extern "C" fn(state: *mut DetectEngineState);
-pub type AppLayerParserTriggerRawStreamReassemblyFunc =
+pub type AppLayerParserTriggerRawStreamInspectionFunc =
extern "C" fn (flow: *const Flow, direction: i32);
pub type AppLayerDecoderEventsSetEventRawFunc =
extern "C" fn (events: *mut *mut AppLayerDecoderEvents,
DetectEngineStateFree: DetectEngineStateFreeFunc,
AppLayerDecoderEventsSetEventRaw: AppLayerDecoderEventsSetEventRawFunc,
AppLayerDecoderEventsFreeEvents: AppLayerDecoderEventsFreeEventsFunc,
- pub AppLayerParserTriggerRawStreamReassembly: AppLayerParserTriggerRawStreamReassemblyFunc,
+ pub AppLayerParserTriggerRawStreamInspection: AppLayerParserTriggerRawStreamInspectionFunc,
pub HttpRangeFreeBlock: SCHttpRangeFreeBlock,
pub HTPFileCloseHandleRange: SCHTPFileCloseHandleRange,
}
}
-/// AppLayerParserTriggerRawStreamReassembly wrapper
-pub fn sc_app_layer_parser_trigger_raw_stream_reassembly(flow: *const Flow, direction: i32) {
+/// AppLayerParserTriggerRawStreamInspection wrapper
+pub fn sc_app_layer_parser_trigger_raw_stream_inspection(flow: *const Flow, direction: i32) {
unsafe {
if let Some(c) = SC {
- (c.AppLayerParserTriggerRawStreamReassembly)(flow, direction);
+ (c.AppLayerParserTriggerRawStreamInspection)(flow, direction);
}
}
}
}
tx.req_done = true;
if let Some(flow) = self.flow {
- sc_app_layer_parser_trigger_raw_stream_reassembly(flow, dir as i32);
+ sc_app_layer_parser_trigger_raw_stream_inspection(flow, dir as i32);
}
}
} else if self.tc_ssn_gap && dir == Direction::ToClient {
tx.req_done = true;
tx.resp_done = true;
if let Some(flow) = self.flow {
- sc_app_layer_parser_trigger_raw_stream_reassembly(flow, dir as i32);
+ sc_app_layer_parser_trigger_raw_stream_inspection(flow, dir as i32);
}
}
}
tx.req_cmd = self.get_hdr_type().unwrap_or(0);
tx.req_done = true;
if let Some(flow) = self.flow {
- sc_app_layer_parser_trigger_raw_stream_reassembly(flow, Direction::ToServer as i32);
+ sc_app_layer_parser_trigger_raw_stream_inspection(flow, Direction::ToServer as i32);
}
tx.frag_cnt_ts = 1;
self.transactions.push_back(tx);
tx.req_done = true;
tx.frag_cnt_ts = 1;
if let Some(flow) = self.flow {
- sc_app_layer_parser_trigger_raw_stream_reassembly(flow, Direction::ToServer as i32);
+ sc_app_layer_parser_trigger_raw_stream_inspection(flow, Direction::ToServer as i32);
}
}
DCERPC_TYPE_RESPONSE => {
tx.resp_done = true;
tx.frag_cnt_tc = 1;
if let Some(flow) = self.flow {
- sc_app_layer_parser_trigger_raw_stream_reassembly(flow, Direction::ToClient as i32);
+ sc_app_layer_parser_trigger_raw_stream_inspection(flow, Direction::ToClient as i32);
}
}
_ => {
tx.resp_done = true;
tx.frag_cnt_tc = 1;
if let Some(flow) = self.flow {
- sc_app_layer_parser_trigger_raw_stream_reassembly(flow, Direction::ToClient as i32);
+ sc_app_layer_parser_trigger_raw_stream_inspection(flow, Direction::ToClient as i32);
}
}
DCERPC_TYPE_REQUEST => {
);
if size > 0 && cur_i.len() >= size + 2 {
let msg = &cur_i[2..(size + 2)];
- sc_app_layer_parser_trigger_raw_stream_reassembly(flow, Direction::ToServer as i32);
+ sc_app_layer_parser_trigger_raw_stream_inspection(flow, Direction::ToServer as i32);
let frame = Frame::new(
flow,
&stream_slice,
);
if size > 0 && cur_i.len() >= size + 2 {
let msg = &cur_i[2..(size + 2)];
- sc_app_layer_parser_trigger_raw_stream_reassembly(flow, Direction::ToClient as i32);
+ sc_app_layer_parser_trigger_raw_stream_inspection(flow, Direction::ToClient as i32);
let frame = Frame::new(
flow,
&stream_slice,
tx.tx_data.set_event(EnipEvent::InvalidPdu as u8);
}
tx.response = Some(pdu);
- sc_app_layer_parser_trigger_raw_stream_reassembly(
+ sc_app_layer_parser_trigger_raw_stream_inspection(
flow,
Direction::ToClient as i32,
);
}
if request {
tx.request = Some(pdu);
- sc_app_layer_parser_trigger_raw_stream_reassembly(flow, Direction::ToServer as i32);
+ sc_app_layer_parser_trigger_raw_stream_inspection(flow, Direction::ToServer as i32);
} else {
tx.response = Some(pdu);
- sc_app_layer_parser_trigger_raw_stream_reassembly(flow, Direction::ToClient as i32);
+ sc_app_layer_parser_trigger_raw_stream_inspection(flow, Direction::ToClient as i32);
}
self.transactions.push_back(tx);
}
None => panic!("no SURICATA_HTTP2_FILE_CONFIG"),
}
}
- sc_app_layer_parser_trigger_raw_stream_reassembly(flow, dir as i32);
+ sc_app_layer_parser_trigger_raw_stream_inspection(flow, dir as i32);
input = &rem[hlsafe..];
}
Err(Err::Incomplete(_)) => {
tx.sname = kdc_req.req_body.sname;
tx.etype = None;
self.transactions.push(tx);
- sc_app_layer_parser_trigger_raw_stream_reassembly(
+ sc_app_layer_parser_trigger_raw_stream_inspection(
flow,
direction as i32,
);
tx.ticket_etype = Some(kdc_rep.ticket.enc_part.etype);
tx.etype = Some(kdc_rep.enc_part.etype);
self.transactions.push(tx);
- sc_app_layer_parser_trigger_raw_stream_reassembly(
+ sc_app_layer_parser_trigger_raw_stream_inspection(
flow,
direction as i32,
);
tx.sname = kdc_req.req_body.sname;
tx.etype = None;
self.transactions.push(tx);
- sc_app_layer_parser_trigger_raw_stream_reassembly(
+ sc_app_layer_parser_trigger_raw_stream_inspection(
flow,
direction as i32,
);
tx.sname = Some(kdc_rep.ticket.sname);
tx.etype = Some(kdc_rep.enc_part.etype);
self.transactions.push(tx);
- sc_app_layer_parser_trigger_raw_stream_reassembly(
+ sc_app_layer_parser_trigger_raw_stream_inspection(
flow,
direction as i32,
);
tx.sname = Some(error.sname);
tx.error_code = Some(error.error_code);
self.transactions.push(tx);
- sc_app_layer_parser_trigger_raw_stream_reassembly(
+ sc_app_layer_parser_trigger_raw_stream_inspection(
flow,
direction as i32,
);
tx.complete |= tx_is_complete(&request.protocol_op, Direction::ToServer);
tx.request = Some(request);
self.transactions.push_back(tx);
- sc_app_layer_parser_trigger_raw_stream_reassembly(
+ sc_app_layer_parser_trigger_raw_stream_inspection(
flow,
Direction::ToServer as i32,
);
let tx_id = tx.id();
tx.tx_data.updated_tc = true;
tx.responses.push_back(response);
- sc_app_layer_parser_trigger_raw_stream_reassembly(
+ sc_app_layer_parser_trigger_raw_stream_inspection(
flow,
Direction::ToClient as i32,
);
tx.complete = true;
tx.responses.push_back(response);
self.transactions.push_back(tx);
- sc_app_layer_parser_trigger_raw_stream_reassembly(
+ sc_app_layer_parser_trigger_raw_stream_inspection(
flow,
Direction::ToClient as i32,
);
let tx_id = tx.id();
tx.responses.push_back(response);
self.transactions.push_back(tx);
- sc_app_layer_parser_trigger_raw_stream_reassembly(
+ sc_app_layer_parser_trigger_raw_stream_inspection(
flow,
Direction::ToClient as i32,
);
tx.tx_data.updated_ts = true;
tx.request = Some(msg);
if !flow.is_null() {
- sc_app_layer_parser_trigger_raw_stream_reassembly(
+ sc_app_layer_parser_trigger_raw_stream_inspection(
flow,
Direction::ToServer as i32,
);
tx.request = Some(msg);
self.transactions.push(tx);
if !flow.is_null() {
- sc_app_layer_parser_trigger_raw_stream_reassembly(
+ sc_app_layer_parser_trigger_raw_stream_inspection(
flow,
Direction::ToServer as i32,
);
tx.tx_data.updated_ts = true;
tx.response = Some(msg);
if !flow.is_null() {
- sc_app_layer_parser_trigger_raw_stream_reassembly(
+ sc_app_layer_parser_trigger_raw_stream_inspection(
flow,
Direction::ToClient as i32,
);
tx.set_event(ModbusEvent::UnsolicitedResponse);
self.transactions.push(tx);
if !flow.is_null() {
- sc_app_layer_parser_trigger_raw_stream_reassembly(
+ sc_app_layer_parser_trigger_raw_stream_inspection(
flow,
Direction::ToClient as i32,
);
} else {
Direction::ToServer
};
- sc_app_layer_parser_trigger_raw_stream_reassembly(flow, dir as i32);
+ sc_app_layer_parser_trigger_raw_stream_inspection(flow, dir as i32);
}
}
/* The server won't send any responses to such requests, so transaction should be over */
tx.tx_res_state = PgsqlTxProgress::TxDone;
}
- sc_app_layer_parser_trigger_raw_stream_reassembly(
+ sc_app_layer_parser_trigger_raw_stream_inspection(
flow,
Direction::ToServer as i32,
);
if Self::response_is_complete(state) {
tx.tx_req_state = PgsqlTxProgress::TxDone;
tx.tx_res_state = PgsqlTxProgress::TxDone;
- sc_app_layer_parser_trigger_raw_stream_reassembly(
+ sc_app_layer_parser_trigger_raw_stream_inspection(
flow,
Direction::ToClient as i32,
);
/* body still in progress, but due to min inspect size we need to inspect now */
StreamTcpReassemblySetMinInspectDepth(hstate->f->protoctx, STREAM_TOSERVER, depth);
- AppLayerParserTriggerRawStreamReassembly(hstate->f, STREAM_TOSERVER);
+ AppLayerParserTriggerRawStreamInspection(hstate->f, STREAM_TOSERVER);
}
/* after the start of the body, disable the depth logic */
} else if (tx_ud->request_body.body_inspected > 0) {
/* body still in progress, but due to min inspect size we need to inspect now */
StreamTcpReassemblySetMinInspectDepth(hstate->f->protoctx, STREAM_TOCLIENT, depth);
- AppLayerParserTriggerRawStreamReassembly(hstate->f, STREAM_TOCLIENT);
+ AppLayerParserTriggerRawStreamInspection(hstate->f, STREAM_TOCLIENT);
}
/* after the start of the body, disable the depth logic */
} else if (tx_ud->response_body.body_inspected > 0) {
hstate->last_request_data_stamp = abs_right_edge;
/* request done, do raw reassembly now to inspect state and stream
* at the same time. */
- AppLayerParserTriggerRawStreamReassembly(hstate->f, STREAM_TOSERVER);
+ AppLayerParserTriggerRawStreamInspection(hstate->f, STREAM_TOSERVER);
SCReturnInt(HTP_STATUS_OK);
}
/* response done, do raw reassembly now to inspect state and stream
* at the same time. */
- AppLayerParserTriggerRawStreamReassembly(hstate->f, STREAM_TOCLIENT);
+ AppLayerParserTriggerRawStreamInspection(hstate->f, STREAM_TOCLIENT);
/* handle HTTP CONNECT */
if (htp_tx_request_method_number(tx) == HTP_METHOD_CONNECT) {
if (!(p->option_flags & APP_LAYER_PARSER_OPT_ACCEPT_GAPS)) {
SCLogDebug("app-layer parser does not accept gaps");
if (f->alstate != NULL && !FlowChangeProto(f)) {
- AppLayerParserTriggerRawStreamReassembly(f, direction);
+ AppLayerParserTriggerRawStreamInspection(f, direction);
}
AppLayerIncGapErrorCounter(tv, f);
goto error;
SCReturnUInt(r);
}
-void AppLayerParserTriggerRawStreamReassembly(Flow *f, int direction)
+void AppLayerParserTriggerRawStreamInspection(Flow *f, int direction)
{
SCEnter();
SCLogDebug("f %p tcp %p direction %d", f, f ? f->protoctx : NULL, direction);
if (f != NULL && f->protoctx != NULL)
- StreamTcpReassembleTriggerRawReassembly(f->protoctx, direction);
+ StreamTcpReassembleTriggerRawInspection(f->protoctx, direction);
SCReturn;
}
bool AppLayerParserHasDecoderEvents(AppLayerParserState *pstate);
int AppLayerParserProtocolHasLogger(uint8_t ipproto, AppProto alproto);
LoggerId AppLayerParserProtocolGetLoggerBits(uint8_t ipproto, AppProto alproto);
-void AppLayerParserTriggerRawStreamReassembly(Flow *f, int direction);
+void AppLayerParserTriggerRawStreamInspection(Flow *f, int direction);
void AppLayerParserSetStreamDepth(uint8_t ipproto, AppProto alproto, uint32_t stream_depth);
uint32_t AppLayerParserGetStreamDepth(const Flow *f);
void AppLayerParserSetStreamDepthFlag(uint8_t ipproto, AppProto alproto, void *state, uint64_t tx_id, uint8_t flags);
depth = (uint32_t)(smtp_config.content_inspect_min_size +
(state->toserver_data_count -
state->toserver_last_data_stamp));
- AppLayerParserTriggerRawStreamReassembly(f, STREAM_TOSERVER);
+ AppLayerParserTriggerRawStreamInspection(f, STREAM_TOSERVER);
SCLogDebug(
"StreamTcpReassemblySetMinInspectDepth STREAM_TOSERVER %u", depth);
StreamTcpReassemblySetMinInspectDepth(f->protoctx, STREAM_TOSERVER, depth);
}
depth = (uint32_t)(state->toserver_data_count -
state->toserver_last_data_stamp);
- AppLayerParserTriggerRawStreamReassembly(f, STREAM_TOSERVER);
+ AppLayerParserTriggerRawStreamInspection(f, STREAM_TOSERVER);
SCLogDebug("StreamTcpReassemblySetMinInspectDepth STREAM_TOSERVER %u", depth);
StreamTcpReassemblySetMinInspectDepth(f->protoctx, STREAM_TOSERVER, depth);
}
if (ssl_state->curr_connp->bytes_processed >=
ssl_state->curr_connp->record_length + SSLV3_RECORD_HDR_LEN) {
SCLogDebug("record complete, trigger RAW");
- AppLayerParserTriggerRawStreamReassembly(
+ AppLayerParserTriggerRawStreamInspection(
ssl_state->f, direction == 0 ? STREAM_TOSERVER : STREAM_TOCLIENT);
SSLParserReset(ssl_state);
ValidateRecordState(ssl_state->curr_connp);
DetectEngineStateFree,
AppLayerDecoderEventsSetEventRaw,
AppLayerDecoderEventsFreeEvents,
- AppLayerParserTriggerRawStreamReassembly,
+ AppLayerParserTriggerRawStreamInspection,
HttpRangeFreeBlock,
HTPFileCloseHandleRange,
void (*AppLayerDecoderEventsSetEventRaw)(AppLayerDecoderEvents **,
uint8_t);
void (*AppLayerDecoderEventsFreeEvents)(AppLayerDecoderEvents **);
- void (*AppLayerParserTriggerRawStreamReassembly)(Flow *, int direction);
+ void (*AppLayerParserTriggerRawStreamInspection)(Flow *, int direction);
void (*HttpRangeFreeBlock)(HttpRangeContainerBlock *);
bool (*HTPFileCloseHandleRange)(const StreamingBufferConfig *sbcfg, FileContainer *,
}
/**
- * \brief Trigger RAW stream reassembly
+ * \brief Trigger RAW stream inspection
*
- * Used by AppLayerTriggerRawStreamReassembly to trigger RAW stream
- * reassembly from the applayer, for example upon completion of a
+ * Used by AppLayerTriggerRawStreamInspection to trigger RAW stream
+ * inspection from the applayer, for example upon completion of a
* HTTP request.
*
* It sets a flag in the stream so that the next Raw call will return
*
* \param ssn TcpSession
*/
-void StreamTcpReassembleTriggerRawReassembly(TcpSession *ssn, int direction)
+void StreamTcpReassembleTriggerRawInspection(TcpSession *ssn, int direction)
{
#ifdef DEBUG
BUG_ON(ssn == NULL);
void StreamTcpReturnStreamSegments(TcpStream *);
void StreamTcpSegmentReturntoPool(TcpSegment *);
-void StreamTcpReassembleTriggerRawReassembly(TcpSession *, int direction);
+void StreamTcpReassembleTriggerRawInspection(TcpSession *, int direction);
void StreamTcpPruneSession(Flow *, uint8_t);
bool StreamTcpReassembleDepthReached(Packet *p);