aiden
/
suricata
mirror of https://github.com/OISF/suricata
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

app-layer: split EOF flag per direction

Browse Source
pull/5234/head
Victor Julien 6 years ago
parent 57b75f89da
commit 4f73943df9
13 changed files with 50 additions and 22 deletions
Show Stats Download Patch File Download Diff File

2
src/app-layer-enip.c
Unescape Escape View File

@ -327,7 +327,7 @@ static AppLayerResult ENIPParse(Flow *f, void *state, AppLayerParserState *pstat
ENIPTransaction *tx;
if (input == NULL && AppLayerParserStateIssetFlag(pstate,
APP_LAYER_PARSER_EOF))
APP_LAYER_PARSER_EOF_TS|APP_LAYER_PARSER_EOF_TC))
{
SCReturnStruct(APP_LAYER_OK);
} else if (input == NULL && input_len != 0) {

7
src/app-layer-ftp.c
Unescape Escape View File

@ -559,7 +559,7 @@ static AppLayerResult FTPParseRequest(Flow *f, void *ftp_state,
FtpState *state = (FtpState *)ftp_state;
void *ptmp;
if (input == NULL && AppLayerParserStateIssetFlag(pstate, APP_LAYER_PARSER_EOF)) {
if (input == NULL && AppLayerParserStateIssetFlag(pstate, APP_LAYER_PARSER_EOF_TS)) {
SCReturnStruct(APP_LAYER_OK);
} else if (input == NULL || input_len == 0) {
SCReturnStruct(APP_LAYER_ERROR);
@ -1113,7 +1113,10 @@ static AppLayerResult FTPDataParse(Flow *f, FtpDataState *ftpdata_state,
}
}
if (input_len && AppLayerParserStateIssetFlag(pstate, APP_LAYER_PARSER_EOF)) {
const bool eof_flag = flags & STREAM_TOSERVER ?
AppLayerParserStateIssetFlag(pstate, APP_LAYER_PARSER_EOF_TS) != 0 :
AppLayerParserStateIssetFlag(pstate, APP_LAYER_PARSER_EOF_TC) != 0;
if (input_len && eof_flag) {
ret = FileCloseFile(ftpdata_state->files, (uint8_t *) NULL, 0, flags);
ftpdata_state->state = FTPDATA_STATE_FINISHED;
}

4
src/app-layer-htp.c
Unescape Escape View File

@ -897,7 +897,7 @@ static AppLayerResult HTPHandleRequestData(Flow *f, void *htp_state,
}
/* if the TCP connection is closed, then close the HTTP connection */
if (AppLayerParserStateIssetFlag(pstate, APP_LAYER_PARSER_EOF) &&
if (AppLayerParserStateIssetFlag(pstate, APP_LAYER_PARSER_EOF_TS) &&
!(hstate->flags & HTP_FLAG_STATE_CLOSED_TS))
{
htp_connp_req_close(hstate->connp, &ts);
@ -960,7 +960,7 @@ static AppLayerResult HTPHandleResponseData(Flow *f, void *htp_state,
}
/* if we the TCP connection is closed, then close the HTTP connection */
if (AppLayerParserStateIssetFlag(pstate, APP_LAYER_PARSER_EOF) &&
if (AppLayerParserStateIssetFlag(pstate, APP_LAYER_PARSER_EOF_TC) &&
!(hstate->flags & HTP_FLAG_STATE_CLOSED_TC))
{
htp_connp_close(hstate->connp, &ts);

4
src/app-layer-modbus.c
Unescape Escape View File

@ -1274,7 +1274,7 @@ static AppLayerResult ModbusParseRequest(Flow *f,
ModbusTransaction *tx;
ModbusHeader header;
if (input == NULL && AppLayerParserStateIssetFlag(pstate, APP_LAYER_PARSER_EOF)) {
if (input == NULL && AppLayerParserStateIssetFlag(pstate, APP_LAYER_PARSER_EOF_TS)) {
SCReturnStruct(APP_LAYER_OK);
} else if (input == NULL || input_len == 0) {
SCReturnStruct(APP_LAYER_ERROR);
@ -1339,7 +1339,7 @@ static AppLayerResult ModbusParseResponse(Flow *f,
ModbusState *modbus = (ModbusState *) state;
ModbusTransaction *tx;
if (input == NULL && AppLayerParserStateIssetFlag(pstate, APP_LAYER_PARSER_EOF)) {
if (input == NULL && AppLayerParserStateIssetFlag(pstate, APP_LAYER_PARSER_EOF_TC)) {
SCReturnStruct(APP_LAYER_OK);
} else if (input == NULL || input_len == 0) {
SCReturnStruct(APP_LAYER_ERROR);

16
src/app-layer-parser.c
Unescape Escape View File

@ -1160,6 +1160,17 @@ void AppLayerParserApplyTxConfig(uint8_t ipproto, AppProto alproto,
/***** General *****/
static inline void SetEOFFlags(AppLayerParserState *pstate, const uint8_t flags)
{
if ((flags & (STREAM_EOF|STREAM_TOSERVER)) == (STREAM_EOF|STREAM_TOSERVER)) {
SCLogDebug("setting APP_LAYER_PARSER_EOF_TS");
AppLayerParserStateSetFlag(pstate, APP_LAYER_PARSER_EOF_TS);
} else if ((flags & (STREAM_EOF|STREAM_TOCLIENT)) == (STREAM_EOF|STREAM_TOCLIENT)) {
SCLogDebug("setting APP_LAYER_PARSER_EOF_TC");
AppLayerParserStateSetFlag(pstate, APP_LAYER_PARSER_EOF_TC);
}
}
/** \retval int -1 in case of unrecoverable error. App-layer tracking stops for this flow.
* \retval int 0 ok: we did not update app_progress
* \retval int 1 ok: we updated app_progress */
@ -1199,8 +1210,7 @@ int AppLayerParserParse(ThreadVars *tv, AppLayerParserThreadCtx *alp_tctx, Flow
goto error;
}
if (flags & STREAM_EOF)
AppLayerParserStateSetFlag(pstate, APP_LAYER_PARSER_EOF);
SetEOFFlags(pstate, flags);
alstate = f->alstate;
if (alstate == NULL) {
@ -1333,7 +1343,7 @@ void AppLayerParserSetEOF(AppLayerParserState *pstate)
if (pstate == NULL)
goto end;
AppLayerParserStateSetFlag(pstate, APP_LAYER_PARSER_EOF);
AppLayerParserStateSetFlag(pstate, APP_LAYER_PARSER_EOF_TS|APP_LAYER_PARSER_EOF_TC);
end:
SCReturn;

4
src/app-layer-parser.h
Unescape Escape View File

@ -33,11 +33,13 @@
#include "util-config.h"
/* Flags for AppLayerParserState. */
#define APP_LAYER_PARSER_EOF BIT_U8(0)
// flag available BIT_U8(0)
#define APP_LAYER_PARSER_NO_INSPECTION BIT_U8(1)
#define APP_LAYER_PARSER_NO_REASSEMBLY BIT_U8(2)
#define APP_LAYER_PARSER_NO_INSPECTION_PAYLOAD BIT_U8(3)
#define APP_LAYER_PARSER_BYPASS_READY BIT_U8(4)
#define APP_LAYER_PARSER_EOF_TS BIT_U8(5)
#define APP_LAYER_PARSER_EOF_TC BIT_U8(6)
/* Flags for AppLayerParserProtoCtx. */
#define APP_LAYER_PARSER_OPT_ACCEPT_GAPS BIT_U32(0)

4
src/app-layer-smtp.c
Unescape Escape View File

@ -1376,7 +1376,9 @@ static AppLayerResult SMTPParse(int direction, Flow *f, SMTPState *state,
{
SCEnter();
if (input == NULL && AppLayerParserStateIssetFlag(pstate, APP_LAYER_PARSER_EOF)) {
if (input == NULL &&
((direction == 0 && AppLayerParserStateIssetFlag(pstate, APP_LAYER_PARSER_EOF_TS)) ||
(direction == 1 && AppLayerParserStateIssetFlag(pstate, APP_LAYER_PARSER_EOF_TC)))) {
SCReturnStruct(APP_LAYER_OK);
} else if (input == NULL || input_len == 0) {
SCReturnStruct(APP_LAYER_ERROR);

6
src/app-layer-ssl.c
Unescape Escape View File

@ -2501,7 +2501,8 @@ static AppLayerResult SSLDecode(Flow *f, uint8_t direction, void *alstate, AppLa
ssl_state->f = f;
if (input == NULL &&
AppLayerParserStateIssetFlag(pstate, APP_LAYER_PARSER_EOF)) {
((direction == 0 && AppLayerParserStateIssetFlag(pstate, APP_LAYER_PARSER_EOF_TS)) ||
(direction == 1 && AppLayerParserStateIssetFlag(pstate, APP_LAYER_PARSER_EOF_TC)))) {
/* flag session as finished if APP_LAYER_PARSER_EOF is set */
ssl_state->flags |= SSL_AL_FLAG_STATE_FINISHED;
SCReturnStruct(APP_LAYER_OK);
@ -2606,7 +2607,8 @@ static AppLayerResult SSLDecode(Flow *f, uint8_t direction, void *alstate, AppLa
}
/* flag session as finished if APP_LAYER_PARSER_EOF is set */
if (AppLayerParserStateIssetFlag(pstate, APP_LAYER_PARSER_EOF)) {
if (AppLayerParserStateIssetFlag(pstate, APP_LAYER_PARSER_EOF_TS) &&
AppLayerParserStateIssetFlag(pstate, APP_LAYER_PARSER_EOF_TC)) {
SCLogDebug("SSL_AL_FLAG_STATE_FINISHED");
ssl_state->flags |= SSL_AL_FLAG_STATE_FINISHED;
}

4
src/app-layer-template.c
Unescape Escape View File

@ -246,7 +246,7 @@ static AppLayerResult TemplateParseRequest(Flow *f, void *statev,
SCLogNotice("Parsing template request: len=%"PRIu32, input_len);
if (input == NULL) {
if (AppLayerParserStateIssetFlag(pstate, APP_LAYER_PARSER_EOF)) {
if (AppLayerParserStateIssetFlag(pstate, APP_LAYER_PARSER_EOF_TS)) {
/* This is a signal that the stream is done. Do any
* cleanup if needed. Usually nothing is required here. */
SCReturnStruct(APP_LAYER_OK);
@ -322,7 +322,7 @@ static AppLayerResult TemplateParseResponse(Flow *f, void *statev, AppLayerParse
/* Likely connection closed, we can just return here. */
if ((input == NULL || input_len == 0) &&
AppLayerParserStateIssetFlag(pstate, APP_LAYER_PARSER_EOF)) {
AppLayerParserStateIssetFlag(pstate, APP_LAYER_PARSER_EOF_TC)) {
SCReturnStruct(APP_LAYER_OK);
}

2
src/app-layer-tftp.c
Unescape Escape View File

@ -104,7 +104,7 @@ static AppLayerResult TFTPParseRequest(Flow *f, void *state,
/* Likely connection closed, we can just return here. */
if ((input == NULL || input_len == 0) &&
AppLayerParserStateIssetFlag(pstate, APP_LAYER_PARSER_EOF)) {
AppLayerParserStateIssetFlag(pstate, APP_LAYER_PARSER_EOF_TS)) {
SCReturnStruct(APP_LAYER_OK);
}

2
src/flow-timeout.c
Unescape Escape View File

@ -248,8 +248,6 @@ static inline Packet *FlowForceReassemblyPseudoPacketSetup(Packet *p,
memset(&p->ts, 0, sizeof(struct timeval));
TimeGet(&p->ts);
AppLayerParserSetEOF(f->alparser);
return p;
error:

11
src/output-tx.c
Unescape Escape View File

@ -260,8 +260,15 @@ static TmEcode OutputTxLog(ThreadVars *tv, Packet *p, void *thread_data)
if ((tx_logged_old & (1<<logger->logger_id)) == 0) {
SCLogDebug("alproto match %d, logging tx_id %"PRIu64, logger->alproto, tx_id);
if (!(AppLayerParserStateIssetFlag(f->alparser,
APP_LAYER_PARSER_EOF))) {
const bool ts_eof = AppLayerParserStateIssetFlag(f->alparser,
APP_LAYER_PARSER_EOF_TS) != 0;
const bool tc_eof = AppLayerParserStateIssetFlag(f->alparser,
APP_LAYER_PARSER_EOF_TC) != 0;
SCLogDebug("pcap_cnt %"PRIu64", tx_id %"PRIu64" logger %d. EOFs TS %s TC %s",
p->pcap_cnt, tx_id, logger->logger_id,
ts_eof ? "true" : "false", tc_eof ? "true" : "false");
if (!(ts_eof && tc_eof)) {
if (logger->LogCondition) {
int r = logger->LogCondition(tv, p, alstate, tx, tx_id);
if (r == FALSE) {

6
src/tests/fuzz/fuzz_applayerparserparse.c
Unescape Escape View File

@ -125,7 +125,11 @@ int LLVMFuzzerTestOneInput(const uint8_t *data, size_t size)
(void) AppLayerParserParse(NULL, alp_tctx, f, f->alproto, flags, isolatedBuffer, alnext - albuffer);
free(isolatedBuffer);
flags &= ~(STREAM_START);
if (f->alparser && AppLayerParserStateIssetFlag(f->alparser, APP_LAYER_PARSER_EOF)) {
if (f->alparser &&
(((flags & STREAM_TOSERVER) != 0 &&
AppLayerParserStateIssetFlag(f->alparser, APP_LAYER_PARSER_EOF_TS)) ||
((flags & STREAM_TOCLIENT) != 0 &&
AppLayerParserStateIssetFlag(f->alparser, APP_LAYER_PARSER_EOF_TC)))) {
//no final chunk
alsize = 0;
break;

Write Preview
Loading…
Cancel
Save