aiden
/
suricata
mirror of https://github.com/OISF/suricata
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

stream: rename TriggerRawStreamReassembly

Browse Source 
The functions around TriggerRawStreamReassembly are misnomers in the
current layout of the code. The functions were named appropriately when
they were created as per the structural and logical layout of the code
at the time.

These functions in today's code are being used to track, update and
trigger progress of inspection in the raw stream only. Hence, rename them
to TriggerRawStreamInspection.
pull/13292/head
Shivani Bhardwaj 1 year ago committed by Victor Julien
parent ca9b29c2d0
commit 35cef72b44
19 changed files with 51 additions and 51 deletions
Show Stats Download Patch File Download Diff File

10
rust/src/core.rs
Unescape Escape View File

@ -99,7 +99,7 @@ pub type SCLogMessageFunc =
pub type DetectEngineStateFreeFunc =
extern "C" fn(state: *mut DetectEngineState);
pub type AppLayerParserTriggerRawStreamReassemblyFunc =
pub type AppLayerParserTriggerRawStreamInspectionFunc =
extern "C" fn (flow: *const Flow, direction: i32);
pub type AppLayerDecoderEventsSetEventRawFunc =
extern "C" fn (events: *mut *mut AppLayerDecoderEvents,
@ -166,7 +166,7 @@ pub struct SuricataContext {
DetectEngineStateFree: DetectEngineStateFreeFunc,
AppLayerDecoderEventsSetEventRaw: AppLayerDecoderEventsSetEventRawFunc,
AppLayerDecoderEventsFreeEvents: AppLayerDecoderEventsFreeEventsFunc,
pub AppLayerParserTriggerRawStreamReassembly: AppLayerParserTriggerRawStreamReassemblyFunc,
pub AppLayerParserTriggerRawStreamInspection: AppLayerParserTriggerRawStreamInspectionFunc,
pub HttpRangeFreeBlock: SCHttpRangeFreeBlock,
pub HTPFileCloseHandleRange: SCHTPFileCloseHandleRange,
@ -226,11 +226,11 @@ pub fn sc_generic_var_free(gvar: *mut GenericVar)
}
}
/// AppLayerParserTriggerRawStreamReassembly wrapper
pub fn sc_app_layer_parser_trigger_raw_stream_reassembly(flow: *const Flow, direction: i32) {
/// AppLayerParserTriggerRawStreamInspection wrapper
pub fn sc_app_layer_parser_trigger_raw_stream_inspection(flow: *const Flow, direction: i32) {
unsafe {
if let Some(c) = SC {
(c.AppLayerParserTriggerRawStreamReassembly)(flow, direction);
(c.AppLayerParserTriggerRawStreamInspection)(flow, direction);
}
}
}

12
rust/src/dcerpc/dcerpc.rs
Unescape Escape View File

@ -523,7 +523,7 @@ impl DCERPCState {
}
tx.req_done = true;
if let Some(flow) = self.flow {
sc_app_layer_parser_trigger_raw_stream_reassembly(flow, dir as i32);
sc_app_layer_parser_trigger_raw_stream_inspection(flow, dir as i32);
}
}
} else if self.tc_ssn_gap && dir == Direction::ToClient {
@ -541,7 +541,7 @@ impl DCERPCState {
tx.req_done = true;
tx.resp_done = true;
if let Some(flow) = self.flow {
sc_app_layer_parser_trigger_raw_stream_reassembly(flow, dir as i32);
sc_app_layer_parser_trigger_raw_stream_inspection(flow, dir as i32);
}
}
}
@ -656,7 +656,7 @@ impl DCERPCState {
tx.req_cmd = self.get_hdr_type().unwrap_or(0);
tx.req_done = true;
if let Some(flow) = self.flow {
sc_app_layer_parser_trigger_raw_stream_reassembly(flow, Direction::ToServer as i32);
sc_app_layer_parser_trigger_raw_stream_inspection(flow, Direction::ToServer as i32);
}
tx.frag_cnt_ts = 1;
self.transactions.push_back(tx);
@ -739,7 +739,7 @@ impl DCERPCState {
tx.req_done = true;
tx.frag_cnt_ts = 1;
if let Some(flow) = self.flow {
sc_app_layer_parser_trigger_raw_stream_reassembly(flow, Direction::ToServer as i32);
sc_app_layer_parser_trigger_raw_stream_inspection(flow, Direction::ToServer as i32);
}
}
DCERPC_TYPE_RESPONSE => {
@ -754,7 +754,7 @@ impl DCERPCState {
tx.resp_done = true;
tx.frag_cnt_tc = 1;
if let Some(flow) = self.flow {
sc_app_layer_parser_trigger_raw_stream_reassembly(flow, Direction::ToClient as i32);
sc_app_layer_parser_trigger_raw_stream_inspection(flow, Direction::ToClient as i32);
}
}
_ => {
@ -951,7 +951,7 @@ impl DCERPCState {
tx.resp_done = true;
tx.frag_cnt_tc = 1;
if let Some(flow) = self.flow {
sc_app_layer_parser_trigger_raw_stream_reassembly(flow, Direction::ToClient as i32);
sc_app_layer_parser_trigger_raw_stream_inspection(flow, Direction::ToClient as i32);
}
}
DCERPC_TYPE_REQUEST => {

4
rust/src/dns/dns.rs
Unescape Escape View File

@ -685,7 +685,7 @@ impl DNSState {
);
if size > 0 && cur_i.len() >= size + 2 {
let msg = &cur_i[2..(size + 2)];
sc_app_layer_parser_trigger_raw_stream_reassembly(flow, Direction::ToServer as i32);
sc_app_layer_parser_trigger_raw_stream_inspection(flow, Direction::ToServer as i32);
let frame = Frame::new(
flow,
&stream_slice,
@ -749,7 +749,7 @@ impl DNSState {
);
if size > 0 && cur_i.len() >= size + 2 {
let msg = &cur_i[2..(size + 2)];
sc_app_layer_parser_trigger_raw_stream_reassembly(flow, Direction::ToClient as i32);
sc_app_layer_parser_trigger_raw_stream_inspection(flow, Direction::ToClient as i32);
let frame = Frame::new(
flow,
&stream_slice,

6
rust/src/enip/enip.rs
Unescape Escape View File

@ -296,7 +296,7 @@ impl EnipState {
tx.tx_data.set_event(EnipEvent::InvalidPdu as u8);
}
tx.response = Some(pdu);
sc_app_layer_parser_trigger_raw_stream_reassembly(
sc_app_layer_parser_trigger_raw_stream_inspection(
flow,
Direction::ToClient as i32,
);
@ -315,10 +315,10 @@ impl EnipState {
}
if request {
tx.request = Some(pdu);
sc_app_layer_parser_trigger_raw_stream_reassembly(flow, Direction::ToServer as i32);
sc_app_layer_parser_trigger_raw_stream_inspection(flow, Direction::ToServer as i32);
} else {
tx.response = Some(pdu);
sc_app_layer_parser_trigger_raw_stream_reassembly(flow, Direction::ToClient as i32);
sc_app_layer_parser_trigger_raw_stream_inspection(flow, Direction::ToClient as i32);
}
self.transactions.push_back(tx);
}

2
rust/src/http2/http2.rs
Unescape Escape View File

@ -1282,7 +1282,7 @@ impl HTTP2State {
None => panic!("no SURICATA_HTTP2_FILE_CONFIG"),
}
}
sc_app_layer_parser_trigger_raw_stream_reassembly(flow, dir as i32);
sc_app_layer_parser_trigger_raw_stream_inspection(flow, dir as i32);
input = &rem[hlsafe..];
}
Err(Err::Incomplete(_)) => {

10
rust/src/krb/krb5.rs
Unescape Escape View File

@ -143,7 +143,7 @@ impl KRB5State {
tx.sname = kdc_req.req_body.sname;
tx.etype = None;
self.transactions.push(tx);
sc_app_layer_parser_trigger_raw_stream_reassembly(
sc_app_layer_parser_trigger_raw_stream_inspection(
flow,
direction as i32,
);
@ -166,7 +166,7 @@ impl KRB5State {
tx.ticket_etype = Some(kdc_rep.ticket.enc_part.etype);
tx.etype = Some(kdc_rep.enc_part.etype);
self.transactions.push(tx);
sc_app_layer_parser_trigger_raw_stream_reassembly(
sc_app_layer_parser_trigger_raw_stream_inspection(
flow,
direction as i32,
);
@ -186,7 +186,7 @@ impl KRB5State {
tx.sname = kdc_req.req_body.sname;
tx.etype = None;
self.transactions.push(tx);
sc_app_layer_parser_trigger_raw_stream_reassembly(
sc_app_layer_parser_trigger_raw_stream_inspection(
flow,
direction as i32,
);
@ -209,7 +209,7 @@ impl KRB5State {
tx.sname = Some(kdc_rep.ticket.sname);
tx.etype = Some(kdc_rep.enc_part.etype);
self.transactions.push(tx);
sc_app_layer_parser_trigger_raw_stream_reassembly(
sc_app_layer_parser_trigger_raw_stream_inspection(
flow,
direction as i32,
);
@ -240,7 +240,7 @@ impl KRB5State {
tx.sname = Some(error.sname);
tx.error_code = Some(error.error_code);
self.transactions.push(tx);
sc_app_layer_parser_trigger_raw_stream_reassembly(
sc_app_layer_parser_trigger_raw_stream_inspection(
flow,
direction as i32,
);

8
rust/src/ldap/ldap.rs
Unescape Escape View File

@ -237,7 +237,7 @@ impl LdapState {
tx.complete |= tx_is_complete(&request.protocol_op, Direction::ToServer);
tx.request = Some(request);
self.transactions.push_back(tx);
sc_app_layer_parser_trigger_raw_stream_reassembly(
sc_app_layer_parser_trigger_raw_stream_inspection(
flow,
Direction::ToServer as i32,
);
@ -308,7 +308,7 @@ impl LdapState {
let tx_id = tx.id();
tx.tx_data.updated_tc = true;
tx.responses.push_back(response);
sc_app_layer_parser_trigger_raw_stream_reassembly(
sc_app_layer_parser_trigger_raw_stream_inspection(
flow,
Direction::ToClient as i32,
);
@ -326,7 +326,7 @@ impl LdapState {
tx.complete = true;
tx.responses.push_back(response);
self.transactions.push_back(tx);
sc_app_layer_parser_trigger_raw_stream_reassembly(
sc_app_layer_parser_trigger_raw_stream_inspection(
flow,
Direction::ToClient as i32,
);
@ -342,7 +342,7 @@ impl LdapState {
let tx_id = tx.id();
tx.responses.push_back(response);
self.transactions.push_back(tx);
sc_app_layer_parser_trigger_raw_stream_reassembly(
sc_app_layer_parser_trigger_raw_stream_inspection(
flow,
Direction::ToClient as i32,
);

8
rust/src/modbus/modbus.rs
Unescape Escape View File

@ -196,7 +196,7 @@ impl ModbusState {
tx.tx_data.updated_ts = true;
tx.request = Some(msg);
if !flow.is_null() {
sc_app_layer_parser_trigger_raw_stream_reassembly(
sc_app_layer_parser_trigger_raw_stream_inspection(
flow,
Direction::ToServer as i32,
);
@ -211,7 +211,7 @@ impl ModbusState {
tx.request = Some(msg);
self.transactions.push(tx);
if !flow.is_null() {
sc_app_layer_parser_trigger_raw_stream_reassembly(
sc_app_layer_parser_trigger_raw_stream_inspection(
flow,
Direction::ToServer as i32,
);
@ -236,7 +236,7 @@ impl ModbusState {
tx.tx_data.updated_ts = true;
tx.response = Some(msg);
if !flow.is_null() {
sc_app_layer_parser_trigger_raw_stream_reassembly(
sc_app_layer_parser_trigger_raw_stream_inspection(
flow,
Direction::ToClient as i32,
);
@ -262,7 +262,7 @@ impl ModbusState {
tx.set_event(ModbusEvent::UnsolicitedResponse);
self.transactions.push(tx);
if !flow.is_null() {
sc_app_layer_parser_trigger_raw_stream_reassembly(
sc_app_layer_parser_trigger_raw_stream_inspection(
flow,
Direction::ToClient as i32,
);

2
rust/src/mqtt/mqtt.rs
Unescape Escape View File

@ -406,7 +406,7 @@ impl MQTTState {
} else {
Direction::ToServer
};
sc_app_layer_parser_trigger_raw_stream_reassembly(flow, dir as i32);
sc_app_layer_parser_trigger_raw_stream_inspection(flow, dir as i32);
}
}

4
rust/src/pgsql/pgsql.rs
Unescape Escape View File

@ -391,7 +391,7 @@ impl PgsqlState {
/* The server won't send any responses to such requests, so transaction should be over */
tx.tx_res_state = PgsqlTxProgress::TxDone;
}
sc_app_layer_parser_trigger_raw_stream_reassembly(
sc_app_layer_parser_trigger_raw_stream_inspection(
flow,
Direction::ToServer as i32,
);
@ -618,7 +618,7 @@ impl PgsqlState {
if Self::response_is_complete(state) {
tx.tx_req_state = PgsqlTxProgress::TxDone;
tx.tx_res_state = PgsqlTxProgress::TxDone;
sc_app_layer_parser_trigger_raw_stream_reassembly(
sc_app_layer_parser_trigger_raw_stream_inspection(
flow,
Direction::ToClient as i32,
);

8
src/app-layer-htp.c
Unescape Escape View File

@ -1471,7 +1471,7 @@ end:
/* body still in progress, but due to min inspect size we need to inspect now */
StreamTcpReassemblySetMinInspectDepth(hstate->f->protoctx, STREAM_TOSERVER, depth);
AppLayerParserTriggerRawStreamReassembly(hstate->f, STREAM_TOSERVER);
AppLayerParserTriggerRawStreamInspection(hstate->f, STREAM_TOSERVER);
}
/* after the start of the body, disable the depth logic */
} else if (tx_ud->request_body.body_inspected > 0) {
@ -1563,7 +1563,7 @@ static int HTPCallbackResponseBodyData(const htp_connp_t *connp, htp_tx_data_t *
/* body still in progress, but due to min inspect size we need to inspect now */
StreamTcpReassemblySetMinInspectDepth(hstate->f->protoctx, STREAM_TOCLIENT, depth);
AppLayerParserTriggerRawStreamReassembly(hstate->f, STREAM_TOCLIENT);
AppLayerParserTriggerRawStreamInspection(hstate->f, STREAM_TOCLIENT);
}
/* after the start of the body, disable the depth logic */
} else if (tx_ud->response_body.body_inspected > 0) {
@ -1769,7 +1769,7 @@ static int HTPCallbackRequestComplete(const htp_connp_t *connp, htp_tx_t *tx)
hstate->last_request_data_stamp = abs_right_edge;
/* request done, do raw reassembly now to inspect state and stream
* at the same time. */
AppLayerParserTriggerRawStreamReassembly(hstate->f, STREAM_TOSERVER);
AppLayerParserTriggerRawStreamInspection(hstate->f, STREAM_TOSERVER);
SCReturnInt(HTP_STATUS_OK);
}
@ -1818,7 +1818,7 @@ static int HTPCallbackResponseComplete(const htp_connp_t *connp, htp_tx_t *tx)
/* response done, do raw reassembly now to inspect state and stream
* at the same time. */
AppLayerParserTriggerRawStreamReassembly(hstate->f, STREAM_TOCLIENT);
AppLayerParserTriggerRawStreamInspection(hstate->f, STREAM_TOCLIENT);
/* handle HTTP CONNECT */
if (htp_tx_request_method_number(tx) == HTP_METHOD_CONNECT) {

6
src/app-layer-parser.c
Unescape Escape View File

@ -1314,7 +1314,7 @@ int AppLayerParserParse(ThreadVars *tv, AppLayerParserThreadCtx *alp_tctx, Flow
if (!(p->option_flags & APP_LAYER_PARSER_OPT_ACCEPT_GAPS)) {
SCLogDebug("app-layer parser does not accept gaps");
if (f->alstate != NULL && !FlowChangeProto(f)) {
AppLayerParserTriggerRawStreamReassembly(f, direction);
AppLayerParserTriggerRawStreamInspection(f, direction);
}
AppLayerIncGapErrorCounter(tv, f);
goto error;
@ -1553,13 +1553,13 @@ LoggerId AppLayerParserProtocolGetLoggerBits(uint8_t ipproto, AppProto alproto)
SCReturnUInt(r);
}
void AppLayerParserTriggerRawStreamReassembly(Flow *f, int direction)
void AppLayerParserTriggerRawStreamInspection(Flow *f, int direction)
{
SCEnter();
SCLogDebug("f %p tcp %p direction %d", f, f ? f->protoctx : NULL, direction);
if (f != NULL && f->protoctx != NULL)
StreamTcpReassembleTriggerRawReassembly(f->protoctx, direction);
StreamTcpReassembleTriggerRawInspection(f->protoctx, direction);
SCReturn;
}

2
src/app-layer-parser.h
Unescape Escape View File

@ -278,7 +278,7 @@ void AppLayerParserSetEOF(AppLayerParserState *pstate);
bool AppLayerParserHasDecoderEvents(AppLayerParserState *pstate);
int AppLayerParserProtocolHasLogger(uint8_t ipproto, AppProto alproto);
LoggerId AppLayerParserProtocolGetLoggerBits(uint8_t ipproto, AppProto alproto);
void AppLayerParserTriggerRawStreamReassembly(Flow *f, int direction);
void AppLayerParserTriggerRawStreamInspection(Flow *f, int direction);
void AppLayerParserSetStreamDepth(uint8_t ipproto, AppProto alproto, uint32_t stream_depth);
uint32_t AppLayerParserGetStreamDepth(const Flow *f);
void AppLayerParserSetStreamDepthFlag(uint8_t ipproto, AppProto alproto, void *state, uint64_t tx_id, uint8_t flags);

4
src/app-layer-smtp.c
Unescape Escape View File

@ -804,7 +804,7 @@ static int SMTPProcessCommandDATA(
depth = (uint32_t)(smtp_config.content_inspect_min_size +
(state->toserver_data_count -
state->toserver_last_data_stamp));
AppLayerParserTriggerRawStreamReassembly(f, STREAM_TOSERVER);
AppLayerParserTriggerRawStreamInspection(f, STREAM_TOSERVER);
SCLogDebug(
"StreamTcpReassemblySetMinInspectDepth STREAM_TOSERVER %u", depth);
StreamTcpReassemblySetMinInspectDepth(f->protoctx, STREAM_TOSERVER, depth);
@ -832,7 +832,7 @@ static int SMTPProcessCommandDATA(
}
depth = (uint32_t)(state->toserver_data_count -
state->toserver_last_data_stamp);
AppLayerParserTriggerRawStreamReassembly(f, STREAM_TOSERVER);
AppLayerParserTriggerRawStreamInspection(f, STREAM_TOSERVER);
SCLogDebug("StreamTcpReassemblySetMinInspectDepth STREAM_TOSERVER %u", depth);
StreamTcpReassemblySetMinInspectDepth(f->protoctx, STREAM_TOSERVER, depth);
}

2
src/app-layer-ssl.c
Unescape Escape View File

@ -2628,7 +2628,7 @@ static struct SSLDecoderResult SSLv3Decode(uint8_t direction, SSLState *ssl_stat
if (ssl_state->curr_connp->bytes_processed >=
ssl_state->curr_connp->record_length + SSLV3_RECORD_HDR_LEN) {
SCLogDebug("record complete, trigger RAW");
AppLayerParserTriggerRawStreamReassembly(
AppLayerParserTriggerRawStreamInspection(
ssl_state->f, direction == 0 ? STREAM_TOSERVER : STREAM_TOCLIENT);
SSLParserReset(ssl_state);
ValidateRecordState(ssl_state->curr_connp);

2
src/rust-context.c
Unescape Escape View File

@ -28,7 +28,7 @@ const SuricataContext suricata_context = {
DetectEngineStateFree,
AppLayerDecoderEventsSetEventRaw,
AppLayerDecoderEventsFreeEvents,
AppLayerParserTriggerRawStreamReassembly,
AppLayerParserTriggerRawStreamInspection,
HttpRangeFreeBlock,
HTPFileCloseHandleRange,

2
src/rust-context.h
Unescape Escape View File

@ -41,7 +41,7 @@ typedef struct SuricataContext_ {
void (*AppLayerDecoderEventsSetEventRaw)(AppLayerDecoderEvents **,
uint8_t);
void (*AppLayerDecoderEventsFreeEvents)(AppLayerDecoderEvents **);
void (*AppLayerParserTriggerRawStreamReassembly)(Flow *, int direction);
void (*AppLayerParserTriggerRawStreamInspection)(Flow *, int direction);
void (*HttpRangeFreeBlock)(HttpRangeContainerBlock *);
bool (*HTPFileCloseHandleRange)(const StreamingBufferConfig *sbcfg, FileContainer *,

8
src/stream-tcp-reassemble.c
Unescape Escape View File

@ -2143,10 +2143,10 @@ TcpSegment *StreamTcpGetSegment(ThreadVars *tv, TcpReassemblyThreadCtx *ra_ctx)
}
/**
* \brief Trigger RAW stream reassembly
* \brief Trigger RAW stream inspection
*
* Used by AppLayerTriggerRawStreamReassembly to trigger RAW stream
* reassembly from the applayer, for example upon completion of a
* Used by AppLayerTriggerRawStreamInspection to trigger RAW stream
* inspection from the applayer, for example upon completion of a
* HTTP request.
*
* It sets a flag in the stream so that the next Raw call will return
@ -2154,7 +2154,7 @@ TcpSegment *StreamTcpGetSegment(ThreadVars *tv, TcpReassemblyThreadCtx *ra_ctx)
*
* \param ssn TcpSession
*/
void StreamTcpReassembleTriggerRawReassembly(TcpSession *ssn, int direction)
void StreamTcpReassembleTriggerRawInspection(TcpSession *ssn, int direction)
{
#ifdef DEBUG
BUG_ON(ssn == NULL);

2
src/stream-tcp-reassemble.h
Unescape Escape View File

@ -120,7 +120,7 @@ TcpSegment *StreamTcpGetSegment(ThreadVars *, TcpReassemblyThreadCtx *);
void StreamTcpReturnStreamSegments(TcpStream *);
void StreamTcpSegmentReturntoPool(TcpSegment *);
void StreamTcpReassembleTriggerRawReassembly(TcpSession *, int direction);
void StreamTcpReassembleTriggerRawInspection(TcpSession *, int direction);
void StreamTcpPruneSession(Flow *, uint8_t);
bool StreamTcpReassembleDepthReached(Packet *p);

Write Preview
Loading…
Cancel
Save