diff --git a/rust/src/core.rs b/rust/src/core.rs index c52aa375c6..8c6ecc7ab0 100644 --- a/rust/src/core.rs +++ b/rust/src/core.rs @@ -99,7 +99,7 @@ pub type SCLogMessageFunc = pub type DetectEngineStateFreeFunc = extern "C" fn(state: *mut DetectEngineState); -pub type AppLayerParserTriggerRawStreamReassemblyFunc = +pub type AppLayerParserTriggerRawStreamInspectionFunc = extern "C" fn (flow: *const Flow, direction: i32); pub type AppLayerDecoderEventsSetEventRawFunc = extern "C" fn (events: *mut *mut AppLayerDecoderEvents, @@ -166,7 +166,7 @@ pub struct SuricataContext { DetectEngineStateFree: DetectEngineStateFreeFunc, AppLayerDecoderEventsSetEventRaw: AppLayerDecoderEventsSetEventRawFunc, AppLayerDecoderEventsFreeEvents: AppLayerDecoderEventsFreeEventsFunc, - pub AppLayerParserTriggerRawStreamReassembly: AppLayerParserTriggerRawStreamReassemblyFunc, + pub AppLayerParserTriggerRawStreamInspection: AppLayerParserTriggerRawStreamInspectionFunc, pub HttpRangeFreeBlock: SCHttpRangeFreeBlock, pub HTPFileCloseHandleRange: SCHTPFileCloseHandleRange, @@ -226,11 +226,11 @@ pub fn sc_generic_var_free(gvar: *mut GenericVar) } } -/// AppLayerParserTriggerRawStreamReassembly wrapper -pub fn sc_app_layer_parser_trigger_raw_stream_reassembly(flow: *const Flow, direction: i32) { +/// AppLayerParserTriggerRawStreamInspection wrapper +pub fn sc_app_layer_parser_trigger_raw_stream_inspection(flow: *const Flow, direction: i32) { unsafe { if let Some(c) = SC { - (c.AppLayerParserTriggerRawStreamReassembly)(flow, direction); + (c.AppLayerParserTriggerRawStreamInspection)(flow, direction); } } } diff --git a/rust/src/dcerpc/dcerpc.rs b/rust/src/dcerpc/dcerpc.rs index bca18f82cb..334cc776b7 100644 --- a/rust/src/dcerpc/dcerpc.rs +++ b/rust/src/dcerpc/dcerpc.rs @@ -523,7 +523,7 @@ impl DCERPCState { } tx.req_done = true; if let Some(flow) = self.flow { - sc_app_layer_parser_trigger_raw_stream_reassembly(flow, dir as i32); + sc_app_layer_parser_trigger_raw_stream_inspection(flow, dir as i32); } } } else if self.tc_ssn_gap && dir == Direction::ToClient { @@ -541,7 +541,7 @@ impl DCERPCState { tx.req_done = true; tx.resp_done = true; if let Some(flow) = self.flow { - sc_app_layer_parser_trigger_raw_stream_reassembly(flow, dir as i32); + sc_app_layer_parser_trigger_raw_stream_inspection(flow, dir as i32); } } } @@ -656,7 +656,7 @@ impl DCERPCState { tx.req_cmd = self.get_hdr_type().unwrap_or(0); tx.req_done = true; if let Some(flow) = self.flow { - sc_app_layer_parser_trigger_raw_stream_reassembly(flow, Direction::ToServer as i32); + sc_app_layer_parser_trigger_raw_stream_inspection(flow, Direction::ToServer as i32); } tx.frag_cnt_ts = 1; self.transactions.push_back(tx); @@ -739,7 +739,7 @@ impl DCERPCState { tx.req_done = true; tx.frag_cnt_ts = 1; if let Some(flow) = self.flow { - sc_app_layer_parser_trigger_raw_stream_reassembly(flow, Direction::ToServer as i32); + sc_app_layer_parser_trigger_raw_stream_inspection(flow, Direction::ToServer as i32); } } DCERPC_TYPE_RESPONSE => { @@ -754,7 +754,7 @@ impl DCERPCState { tx.resp_done = true; tx.frag_cnt_tc = 1; if let Some(flow) = self.flow { - sc_app_layer_parser_trigger_raw_stream_reassembly(flow, Direction::ToClient as i32); + sc_app_layer_parser_trigger_raw_stream_inspection(flow, Direction::ToClient as i32); } } _ => { @@ -951,7 +951,7 @@ impl DCERPCState { tx.resp_done = true; tx.frag_cnt_tc = 1; if let Some(flow) = self.flow { - sc_app_layer_parser_trigger_raw_stream_reassembly(flow, Direction::ToClient as i32); + sc_app_layer_parser_trigger_raw_stream_inspection(flow, Direction::ToClient as i32); } } DCERPC_TYPE_REQUEST => { diff --git a/rust/src/dns/dns.rs b/rust/src/dns/dns.rs index d40b89c486..3c2d2539e9 100644 --- a/rust/src/dns/dns.rs +++ b/rust/src/dns/dns.rs @@ -685,7 +685,7 @@ impl DNSState { ); if size > 0 && cur_i.len() >= size + 2 { let msg = &cur_i[2..(size + 2)]; - sc_app_layer_parser_trigger_raw_stream_reassembly(flow, Direction::ToServer as i32); + sc_app_layer_parser_trigger_raw_stream_inspection(flow, Direction::ToServer as i32); let frame = Frame::new( flow, &stream_slice, @@ -749,7 +749,7 @@ impl DNSState { ); if size > 0 && cur_i.len() >= size + 2 { let msg = &cur_i[2..(size + 2)]; - sc_app_layer_parser_trigger_raw_stream_reassembly(flow, Direction::ToClient as i32); + sc_app_layer_parser_trigger_raw_stream_inspection(flow, Direction::ToClient as i32); let frame = Frame::new( flow, &stream_slice, diff --git a/rust/src/enip/enip.rs b/rust/src/enip/enip.rs index 11e7a93d3f..685a071039 100644 --- a/rust/src/enip/enip.rs +++ b/rust/src/enip/enip.rs @@ -296,7 +296,7 @@ impl EnipState { tx.tx_data.set_event(EnipEvent::InvalidPdu as u8); } tx.response = Some(pdu); - sc_app_layer_parser_trigger_raw_stream_reassembly( + sc_app_layer_parser_trigger_raw_stream_inspection( flow, Direction::ToClient as i32, ); @@ -315,10 +315,10 @@ impl EnipState { } if request { tx.request = Some(pdu); - sc_app_layer_parser_trigger_raw_stream_reassembly(flow, Direction::ToServer as i32); + sc_app_layer_parser_trigger_raw_stream_inspection(flow, Direction::ToServer as i32); } else { tx.response = Some(pdu); - sc_app_layer_parser_trigger_raw_stream_reassembly(flow, Direction::ToClient as i32); + sc_app_layer_parser_trigger_raw_stream_inspection(flow, Direction::ToClient as i32); } self.transactions.push_back(tx); } diff --git a/rust/src/http2/http2.rs b/rust/src/http2/http2.rs index c11d195013..e11525613a 100644 --- a/rust/src/http2/http2.rs +++ b/rust/src/http2/http2.rs @@ -1282,7 +1282,7 @@ impl HTTP2State { None => panic!("no SURICATA_HTTP2_FILE_CONFIG"), } } - sc_app_layer_parser_trigger_raw_stream_reassembly(flow, dir as i32); + sc_app_layer_parser_trigger_raw_stream_inspection(flow, dir as i32); input = &rem[hlsafe..]; } Err(Err::Incomplete(_)) => { diff --git a/rust/src/krb/krb5.rs b/rust/src/krb/krb5.rs index 38da78cc23..46f13d643f 100644 --- a/rust/src/krb/krb5.rs +++ b/rust/src/krb/krb5.rs @@ -143,7 +143,7 @@ impl KRB5State { tx.sname = kdc_req.req_body.sname; tx.etype = None; self.transactions.push(tx); - sc_app_layer_parser_trigger_raw_stream_reassembly( + sc_app_layer_parser_trigger_raw_stream_inspection( flow, direction as i32, ); @@ -166,7 +166,7 @@ impl KRB5State { tx.ticket_etype = Some(kdc_rep.ticket.enc_part.etype); tx.etype = Some(kdc_rep.enc_part.etype); self.transactions.push(tx); - sc_app_layer_parser_trigger_raw_stream_reassembly( + sc_app_layer_parser_trigger_raw_stream_inspection( flow, direction as i32, ); @@ -186,7 +186,7 @@ impl KRB5State { tx.sname = kdc_req.req_body.sname; tx.etype = None; self.transactions.push(tx); - sc_app_layer_parser_trigger_raw_stream_reassembly( + sc_app_layer_parser_trigger_raw_stream_inspection( flow, direction as i32, ); @@ -209,7 +209,7 @@ impl KRB5State { tx.sname = Some(kdc_rep.ticket.sname); tx.etype = Some(kdc_rep.enc_part.etype); self.transactions.push(tx); - sc_app_layer_parser_trigger_raw_stream_reassembly( + sc_app_layer_parser_trigger_raw_stream_inspection( flow, direction as i32, ); @@ -240,7 +240,7 @@ impl KRB5State { tx.sname = Some(error.sname); tx.error_code = Some(error.error_code); self.transactions.push(tx); - sc_app_layer_parser_trigger_raw_stream_reassembly( + sc_app_layer_parser_trigger_raw_stream_inspection( flow, direction as i32, ); diff --git a/rust/src/ldap/ldap.rs b/rust/src/ldap/ldap.rs index a820225674..4e9688e30d 100644 --- a/rust/src/ldap/ldap.rs +++ b/rust/src/ldap/ldap.rs @@ -237,7 +237,7 @@ impl LdapState { tx.complete |= tx_is_complete(&request.protocol_op, Direction::ToServer); tx.request = Some(request); self.transactions.push_back(tx); - sc_app_layer_parser_trigger_raw_stream_reassembly( + sc_app_layer_parser_trigger_raw_stream_inspection( flow, Direction::ToServer as i32, ); @@ -308,7 +308,7 @@ impl LdapState { let tx_id = tx.id(); tx.tx_data.updated_tc = true; tx.responses.push_back(response); - sc_app_layer_parser_trigger_raw_stream_reassembly( + sc_app_layer_parser_trigger_raw_stream_inspection( flow, Direction::ToClient as i32, ); @@ -326,7 +326,7 @@ impl LdapState { tx.complete = true; tx.responses.push_back(response); self.transactions.push_back(tx); - sc_app_layer_parser_trigger_raw_stream_reassembly( + sc_app_layer_parser_trigger_raw_stream_inspection( flow, Direction::ToClient as i32, ); @@ -342,7 +342,7 @@ impl LdapState { let tx_id = tx.id(); tx.responses.push_back(response); self.transactions.push_back(tx); - sc_app_layer_parser_trigger_raw_stream_reassembly( + sc_app_layer_parser_trigger_raw_stream_inspection( flow, Direction::ToClient as i32, ); diff --git a/rust/src/modbus/modbus.rs b/rust/src/modbus/modbus.rs index 981602a72a..d2bc37038e 100644 --- a/rust/src/modbus/modbus.rs +++ b/rust/src/modbus/modbus.rs @@ -196,7 +196,7 @@ impl ModbusState { tx.tx_data.updated_ts = true; tx.request = Some(msg); if !flow.is_null() { - sc_app_layer_parser_trigger_raw_stream_reassembly( + sc_app_layer_parser_trigger_raw_stream_inspection( flow, Direction::ToServer as i32, ); @@ -211,7 +211,7 @@ impl ModbusState { tx.request = Some(msg); self.transactions.push(tx); if !flow.is_null() { - sc_app_layer_parser_trigger_raw_stream_reassembly( + sc_app_layer_parser_trigger_raw_stream_inspection( flow, Direction::ToServer as i32, ); @@ -236,7 +236,7 @@ impl ModbusState { tx.tx_data.updated_ts = true; tx.response = Some(msg); if !flow.is_null() { - sc_app_layer_parser_trigger_raw_stream_reassembly( + sc_app_layer_parser_trigger_raw_stream_inspection( flow, Direction::ToClient as i32, ); @@ -262,7 +262,7 @@ impl ModbusState { tx.set_event(ModbusEvent::UnsolicitedResponse); self.transactions.push(tx); if !flow.is_null() { - sc_app_layer_parser_trigger_raw_stream_reassembly( + sc_app_layer_parser_trigger_raw_stream_inspection( flow, Direction::ToClient as i32, ); diff --git a/rust/src/mqtt/mqtt.rs b/rust/src/mqtt/mqtt.rs index 617b4077c1..7760d6016b 100644 --- a/rust/src/mqtt/mqtt.rs +++ b/rust/src/mqtt/mqtt.rs @@ -406,7 +406,7 @@ impl MQTTState { } else { Direction::ToServer }; - sc_app_layer_parser_trigger_raw_stream_reassembly(flow, dir as i32); + sc_app_layer_parser_trigger_raw_stream_inspection(flow, dir as i32); } } diff --git a/rust/src/pgsql/pgsql.rs b/rust/src/pgsql/pgsql.rs index 6c3f3fd225..14d5f09f4f 100644 --- a/rust/src/pgsql/pgsql.rs +++ b/rust/src/pgsql/pgsql.rs @@ -391,7 +391,7 @@ impl PgsqlState { /* The server won't send any responses to such requests, so transaction should be over */ tx.tx_res_state = PgsqlTxProgress::TxDone; } - sc_app_layer_parser_trigger_raw_stream_reassembly( + sc_app_layer_parser_trigger_raw_stream_inspection( flow, Direction::ToServer as i32, ); @@ -618,7 +618,7 @@ impl PgsqlState { if Self::response_is_complete(state) { tx.tx_req_state = PgsqlTxProgress::TxDone; tx.tx_res_state = PgsqlTxProgress::TxDone; - sc_app_layer_parser_trigger_raw_stream_reassembly( + sc_app_layer_parser_trigger_raw_stream_inspection( flow, Direction::ToClient as i32, ); diff --git a/src/app-layer-htp.c b/src/app-layer-htp.c index 288cd99a80..fbccea34b0 100644 --- a/src/app-layer-htp.c +++ b/src/app-layer-htp.c @@ -1471,7 +1471,7 @@ end: /* body still in progress, but due to min inspect size we need to inspect now */ StreamTcpReassemblySetMinInspectDepth(hstate->f->protoctx, STREAM_TOSERVER, depth); - AppLayerParserTriggerRawStreamReassembly(hstate->f, STREAM_TOSERVER); + AppLayerParserTriggerRawStreamInspection(hstate->f, STREAM_TOSERVER); } /* after the start of the body, disable the depth logic */ } else if (tx_ud->request_body.body_inspected > 0) { @@ -1563,7 +1563,7 @@ static int HTPCallbackResponseBodyData(const htp_connp_t *connp, htp_tx_data_t * /* body still in progress, but due to min inspect size we need to inspect now */ StreamTcpReassemblySetMinInspectDepth(hstate->f->protoctx, STREAM_TOCLIENT, depth); - AppLayerParserTriggerRawStreamReassembly(hstate->f, STREAM_TOCLIENT); + AppLayerParserTriggerRawStreamInspection(hstate->f, STREAM_TOCLIENT); } /* after the start of the body, disable the depth logic */ } else if (tx_ud->response_body.body_inspected > 0) { @@ -1769,7 +1769,7 @@ static int HTPCallbackRequestComplete(const htp_connp_t *connp, htp_tx_t *tx) hstate->last_request_data_stamp = abs_right_edge; /* request done, do raw reassembly now to inspect state and stream * at the same time. */ - AppLayerParserTriggerRawStreamReassembly(hstate->f, STREAM_TOSERVER); + AppLayerParserTriggerRawStreamInspection(hstate->f, STREAM_TOSERVER); SCReturnInt(HTP_STATUS_OK); } @@ -1818,7 +1818,7 @@ static int HTPCallbackResponseComplete(const htp_connp_t *connp, htp_tx_t *tx) /* response done, do raw reassembly now to inspect state and stream * at the same time. */ - AppLayerParserTriggerRawStreamReassembly(hstate->f, STREAM_TOCLIENT); + AppLayerParserTriggerRawStreamInspection(hstate->f, STREAM_TOCLIENT); /* handle HTTP CONNECT */ if (htp_tx_request_method_number(tx) == HTP_METHOD_CONNECT) { diff --git a/src/app-layer-parser.c b/src/app-layer-parser.c index 75845c4a51..42b0548b83 100644 --- a/src/app-layer-parser.c +++ b/src/app-layer-parser.c @@ -1314,7 +1314,7 @@ int AppLayerParserParse(ThreadVars *tv, AppLayerParserThreadCtx *alp_tctx, Flow if (!(p->option_flags & APP_LAYER_PARSER_OPT_ACCEPT_GAPS)) { SCLogDebug("app-layer parser does not accept gaps"); if (f->alstate != NULL && !FlowChangeProto(f)) { - AppLayerParserTriggerRawStreamReassembly(f, direction); + AppLayerParserTriggerRawStreamInspection(f, direction); } AppLayerIncGapErrorCounter(tv, f); goto error; @@ -1553,13 +1553,13 @@ LoggerId AppLayerParserProtocolGetLoggerBits(uint8_t ipproto, AppProto alproto) SCReturnUInt(r); } -void AppLayerParserTriggerRawStreamReassembly(Flow *f, int direction) +void AppLayerParserTriggerRawStreamInspection(Flow *f, int direction) { SCEnter(); SCLogDebug("f %p tcp %p direction %d", f, f ? f->protoctx : NULL, direction); if (f != NULL && f->protoctx != NULL) - StreamTcpReassembleTriggerRawReassembly(f->protoctx, direction); + StreamTcpReassembleTriggerRawInspection(f->protoctx, direction); SCReturn; } diff --git a/src/app-layer-parser.h b/src/app-layer-parser.h index 3be6d6a99a..d269c177e1 100644 --- a/src/app-layer-parser.h +++ b/src/app-layer-parser.h @@ -278,7 +278,7 @@ void AppLayerParserSetEOF(AppLayerParserState *pstate); bool AppLayerParserHasDecoderEvents(AppLayerParserState *pstate); int AppLayerParserProtocolHasLogger(uint8_t ipproto, AppProto alproto); LoggerId AppLayerParserProtocolGetLoggerBits(uint8_t ipproto, AppProto alproto); -void AppLayerParserTriggerRawStreamReassembly(Flow *f, int direction); +void AppLayerParserTriggerRawStreamInspection(Flow *f, int direction); void AppLayerParserSetStreamDepth(uint8_t ipproto, AppProto alproto, uint32_t stream_depth); uint32_t AppLayerParserGetStreamDepth(const Flow *f); void AppLayerParserSetStreamDepthFlag(uint8_t ipproto, AppProto alproto, void *state, uint64_t tx_id, uint8_t flags); diff --git a/src/app-layer-smtp.c b/src/app-layer-smtp.c index 2d4b2a424f..98d1f00145 100644 --- a/src/app-layer-smtp.c +++ b/src/app-layer-smtp.c @@ -804,7 +804,7 @@ static int SMTPProcessCommandDATA( depth = (uint32_t)(smtp_config.content_inspect_min_size + (state->toserver_data_count - state->toserver_last_data_stamp)); - AppLayerParserTriggerRawStreamReassembly(f, STREAM_TOSERVER); + AppLayerParserTriggerRawStreamInspection(f, STREAM_TOSERVER); SCLogDebug( "StreamTcpReassemblySetMinInspectDepth STREAM_TOSERVER %u", depth); StreamTcpReassemblySetMinInspectDepth(f->protoctx, STREAM_TOSERVER, depth); @@ -832,7 +832,7 @@ static int SMTPProcessCommandDATA( } depth = (uint32_t)(state->toserver_data_count - state->toserver_last_data_stamp); - AppLayerParserTriggerRawStreamReassembly(f, STREAM_TOSERVER); + AppLayerParserTriggerRawStreamInspection(f, STREAM_TOSERVER); SCLogDebug("StreamTcpReassemblySetMinInspectDepth STREAM_TOSERVER %u", depth); StreamTcpReassemblySetMinInspectDepth(f->protoctx, STREAM_TOSERVER, depth); } diff --git a/src/app-layer-ssl.c b/src/app-layer-ssl.c index 9df0999c89..5838003354 100644 --- a/src/app-layer-ssl.c +++ b/src/app-layer-ssl.c @@ -2628,7 +2628,7 @@ static struct SSLDecoderResult SSLv3Decode(uint8_t direction, SSLState *ssl_stat if (ssl_state->curr_connp->bytes_processed >= ssl_state->curr_connp->record_length + SSLV3_RECORD_HDR_LEN) { SCLogDebug("record complete, trigger RAW"); - AppLayerParserTriggerRawStreamReassembly( + AppLayerParserTriggerRawStreamInspection( ssl_state->f, direction == 0 ? STREAM_TOSERVER : STREAM_TOCLIENT); SSLParserReset(ssl_state); ValidateRecordState(ssl_state->curr_connp); diff --git a/src/rust-context.c b/src/rust-context.c index ef28c03351..226ae5c044 100644 --- a/src/rust-context.c +++ b/src/rust-context.c @@ -28,7 +28,7 @@ const SuricataContext suricata_context = { DetectEngineStateFree, AppLayerDecoderEventsSetEventRaw, AppLayerDecoderEventsFreeEvents, - AppLayerParserTriggerRawStreamReassembly, + AppLayerParserTriggerRawStreamInspection, HttpRangeFreeBlock, HTPFileCloseHandleRange, diff --git a/src/rust-context.h b/src/rust-context.h index 9aaf532953..2f9bf7b4c0 100644 --- a/src/rust-context.h +++ b/src/rust-context.h @@ -41,7 +41,7 @@ typedef struct SuricataContext_ { void (*AppLayerDecoderEventsSetEventRaw)(AppLayerDecoderEvents **, uint8_t); void (*AppLayerDecoderEventsFreeEvents)(AppLayerDecoderEvents **); - void (*AppLayerParserTriggerRawStreamReassembly)(Flow *, int direction); + void (*AppLayerParserTriggerRawStreamInspection)(Flow *, int direction); void (*HttpRangeFreeBlock)(HttpRangeContainerBlock *); bool (*HTPFileCloseHandleRange)(const StreamingBufferConfig *sbcfg, FileContainer *, diff --git a/src/stream-tcp-reassemble.c b/src/stream-tcp-reassemble.c index a1cd39563d..2c0c3ca7cc 100644 --- a/src/stream-tcp-reassemble.c +++ b/src/stream-tcp-reassemble.c @@ -2143,10 +2143,10 @@ TcpSegment *StreamTcpGetSegment(ThreadVars *tv, TcpReassemblyThreadCtx *ra_ctx) } /** - * \brief Trigger RAW stream reassembly + * \brief Trigger RAW stream inspection * - * Used by AppLayerTriggerRawStreamReassembly to trigger RAW stream - * reassembly from the applayer, for example upon completion of a + * Used by AppLayerTriggerRawStreamInspection to trigger RAW stream + * inspection from the applayer, for example upon completion of a * HTTP request. * * It sets a flag in the stream so that the next Raw call will return @@ -2154,7 +2154,7 @@ TcpSegment *StreamTcpGetSegment(ThreadVars *tv, TcpReassemblyThreadCtx *ra_ctx) * * \param ssn TcpSession */ -void StreamTcpReassembleTriggerRawReassembly(TcpSession *ssn, int direction) +void StreamTcpReassembleTriggerRawInspection(TcpSession *ssn, int direction) { #ifdef DEBUG BUG_ON(ssn == NULL); diff --git a/src/stream-tcp-reassemble.h b/src/stream-tcp-reassemble.h index d450a024a4..74d2c78dd3 100644 --- a/src/stream-tcp-reassemble.h +++ b/src/stream-tcp-reassemble.h @@ -120,7 +120,7 @@ TcpSegment *StreamTcpGetSegment(ThreadVars *, TcpReassemblyThreadCtx *); void StreamTcpReturnStreamSegments(TcpStream *); void StreamTcpSegmentReturntoPool(TcpSegment *); -void StreamTcpReassembleTriggerRawReassembly(TcpSession *, int direction); +void StreamTcpReassembleTriggerRawInspection(TcpSession *, int direction); void StreamTcpPruneSession(Flow *, uint8_t); bool StreamTcpReassembleDepthReached(Packet *p);