diff --git a/rust/sys/src/sys.rs b/rust/sys/src/sys.rs index 67097e5edb..20309cf5ed 100644 --- a/rust/sys/src/sys.rs +++ b/rust/sys/src/sys.rs @@ -1332,6 +1332,12 @@ extern "C" { pp_max_depth: u16, ) -> ::std::os::raw::c_int; } +extern "C" { + #[doc = " \\brief Get the size of the stream data available for protocol detection\n in the given direction, for use by probing parsers.\n\n \\retval bool false if the flow has no TCP session"] + pub fn SCAppLayerProtoDetectGetStreamDataSize( + f: *const Flow, direction: u8, size: *mut u32, + ) -> bool; +} extern "C" { pub fn SCAppLayerRequestProtocolTLSUpgrade(f: *mut Flow) -> bool; } @@ -1874,6 +1880,9 @@ extern "C" { extern "C" { pub fn SCFlowGetAppProtocol(f: *const Flow) -> AppProto; } +extern "C" { + pub fn SCFlowGetAppProtocolToClient(f: *const Flow) -> AppProto; +} #[doc = " \\brief Function type for flow initialization callbacks.\n\n Once registered with SCFlowRegisterInitCallback, this function will\n be called every time a flow is initialized, or in other words,\n every time Suricata picks up a flow.\n\n \\param tv The ThreadVars data structure for the thread creating the\n flow.\n \\param f The newly initialized flow.\n \\param p The packet related to creating the new flow.\n \\param user The user data provided during callback registration."] pub type SCFlowInitCallbackFn = ::std::option::Option< unsafe extern "C" fn( diff --git a/src/app-layer-detect-proto.c b/src/app-layer-detect-proto.c index 054cfc3b24..b3e954f141 100644 --- a/src/app-layer-detect-proto.c +++ b/src/app-layer-detect-proto.c @@ -1668,6 +1668,17 @@ int SCAppLayerProtoDetectPMRegisterPatternCI(uint8_t ipproto, AppProto alproto, SCReturnInt(r); } +bool SCAppLayerProtoDetectGetStreamDataSize(const Flow *f, uint8_t direction, uint32_t *size) +{ + TcpSession *ssn = (TcpSession *)f->protoctx; + if (f->proto != IPPROTO_TCP || ssn == NULL) { + return false; + } + TcpStream *stream = (direction & STREAM_TOSERVER) ? &ssn->client : &ssn->server; + *size = StreamDataAvailableForProtoDetect(stream); + return true; +} + /***** Setup/General Registration *****/ int AppLayerProtoDetectSetup(void) diff --git a/src/app-layer-detect-proto.h b/src/app-layer-detect-proto.h index 4e9147ca40..f333cf0640 100644 --- a/src/app-layer-detect-proto.h +++ b/src/app-layer-detect-proto.h @@ -93,6 +93,14 @@ int SCAppLayerProtoDetectPMRegisterPatternCIwPP(uint8_t ipproto, AppProto alprot const char *pattern, uint16_t depth, uint16_t offset, uint8_t direction, ProbingParserFPtr PPFunc, uint16_t pp_min_depth, uint16_t pp_max_depth); +/** + * \brief Get the size of the stream data available for protocol detection + * in the given direction, for use by probing parsers. + * + * \retval bool false if the flow has no TCP session + */ +bool SCAppLayerProtoDetectGetStreamDataSize(const Flow *f, uint8_t direction, uint32_t *size); + /***** Setup/General Registration *****/ /** diff --git a/src/flow-bindgen.h b/src/flow-bindgen.h index 11e793db5d..71617b47cb 100644 --- a/src/flow-bindgen.h +++ b/src/flow-bindgen.h @@ -47,5 +47,6 @@ const uint8_t *SCFlowGetDestinationAddressAsRawPtr(const Flow *flow); uint32_t SCFlowGetToServerPacketCount(const Flow *flow); uint32_t SCFlowGetToClientPacketCount(const Flow *flow); AppProto SCFlowGetAppProtocol(const Flow *f); +AppProto SCFlowGetAppProtocolToClient(const Flow *f); #endif /* SURICATA_FLOW_BINDGEN_H */ diff --git a/src/flow.c b/src/flow.c index d58b3d9b6d..e662e8838f 100644 --- a/src/flow.c +++ b/src/flow.c @@ -1290,6 +1290,11 @@ AppProto SCFlowGetAppProtocol(const Flow *f) return f->alproto; } +AppProto SCFlowGetAppProtocolToClient(const Flow *f) +{ + return f->alproto_tc; +} + /** * \brief Get flow destination port. *