aiden
/
suricata
mirror of https://github.com/OISF/suricata
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

app-layer: mandatory tx registration checks

Browse Source 
All protocols now implement the TX API, so the runtime checks for
whether or not a protocol supports the TX API can be removed.
pull/3898/head
Victor Julien 8 years ago
parent 8bc1e120ea
commit 952cbb563c
6 changed files with 20 additions and 54 deletions
Show Stats Download Patch File Download Diff File

39
src/app-layer-parser.c
Unescape Escape View File

@ -1177,9 +1177,7 @@ int AppLayerParserParse(ThreadVars *tv, AppLayerParserThreadCtx *alp_tctx, Flow
alstate, AppLayerGetProtoName(f->alproto)); alstate, AppLayerGetProtoName(f->alproto));
} }
if (AppLayerParserProtocolIsTxAware(f->proto, alproto)) { p_tx_cnt = AppLayerParserGetTxCnt(f, f->alstate);
p_tx_cnt = AppLayerParserGetTxCnt(f, f->alstate);
}
/* invoke the recursive parser, but only on data. We may get empty msgs on EOF */ /* invoke the recursive parser, but only on data. We may get empty msgs on EOF */
if (input_len > 0 || (flags & STREAM_EOF)) { if (input_len > 0 || (flags & STREAM_EOF)) {
@ -1237,13 +1235,10 @@ int AppLayerParserParse(ThreadVars *tv, AppLayerParserThreadCtx *alp_tctx, Flow
} }
} }
if (AppLayerParserProtocolIsTxAware(f->proto, alproto)) { /* get the diff in tx cnt for stats keeping */
if (likely(tv)) { uint64_t cur_tx_cnt = AppLayerParserGetTxCnt(f, f->alstate);
uint64_t cur_tx_cnt = AppLayerParserGetTxCnt(f, f->alstate); if (cur_tx_cnt > p_tx_cnt && tv) {
if (cur_tx_cnt > p_tx_cnt) { AppLayerIncTxCounter(tv, f, cur_tx_cnt - p_tx_cnt);
AppLayerIncTxCounter(tv, f, cur_tx_cnt - p_tx_cnt);
}
}
} }
/* stream truncated, inform app layer */ /* stream truncated, inform app layer */
@ -1301,14 +1296,6 @@ int AppLayerParserIsTxAware(AppProto alproto)
.StateGetProgressCompletionStatus != NULL); .StateGetProgressCompletionStatus != NULL);
} }
int AppLayerParserProtocolIsTxAware(uint8_t ipproto, AppProto alproto)
{
SCEnter();
int ipproto_map = FlowGetProtoMapping(ipproto);
int r = (alp_ctx.ctxs[ipproto_map][alproto].StateGetTx == NULL) ? 0 : 1;
SCReturnInt(r);
}
int AppLayerParserProtocolIsTxEventAware(uint8_t ipproto, AppProto alproto) int AppLayerParserProtocolIsTxEventAware(uint8_t ipproto, AppProto alproto)
{ {
SCEnter(); SCEnter();
@ -1317,14 +1304,6 @@ int AppLayerParserProtocolIsTxEventAware(uint8_t ipproto, AppProto alproto)
SCReturnInt(r); SCReturnInt(r);
} }
int AppLayerParserProtocolSupportsTxs(uint8_t ipproto, AppProto alproto)
{
SCEnter();
int ipproto_map = FlowGetProtoMapping(ipproto);
int r = (alp_ctx.ctxs[ipproto_map][alproto].StateTransactionFree == NULL) ? 0 : 1;
SCReturnInt(r);
}
int AppLayerParserProtocolHasLogger(uint8_t ipproto, AppProto alproto) int AppLayerParserProtocolHasLogger(uint8_t ipproto, AppProto alproto)
{ {
SCEnter(); SCEnter();
@ -1412,6 +1391,7 @@ static void ValidateParserProtoDump(AppProto alproto, uint8_t ipproto)
#define BOTH_SET(a, b) ((a) != NULL && (b) != NULL) #define BOTH_SET(a, b) ((a) != NULL && (b) != NULL)
#define BOTH_SET_OR_BOTH_UNSET(a, b) (((a) == NULL && (b) == NULL) || ((a) != NULL && (b) != NULL)) #define BOTH_SET_OR_BOTH_UNSET(a, b) (((a) == NULL && (b) == NULL) || ((a) != NULL && (b) != NULL))
#define THREE_SET_OR_THREE_UNSET(a, b, c) (((a) == NULL && (b) == NULL && (c) == NULL) || ((a) != NULL && (b) != NULL && (c) != NULL)) #define THREE_SET_OR_THREE_UNSET(a, b, c) (((a) == NULL && (b) == NULL && (c) == NULL) || ((a) != NULL && (b) != NULL && (c) != NULL))
#define THREE_SET(a, b, c) ((a) != NULL && (b) != NULL && (c) != NULL)
static void ValidateParserProto(AppProto alproto, uint8_t ipproto) static void ValidateParserProto(AppProto alproto, uint8_t ipproto)
{ {
@ -1428,7 +1408,7 @@ static void ValidateParserProto(AppProto alproto, uint8_t ipproto)
if (!(BOTH_SET(ctx->StateFree, ctx->StateAlloc))) { if (!(BOTH_SET(ctx->StateFree, ctx->StateAlloc))) {
goto bad; goto bad;
} }
if (!(THREE_SET_OR_THREE_UNSET(ctx->StateGetTx, ctx->StateGetTxCnt, ctx->StateTransactionFree))) { if (!(THREE_SET(ctx->StateGetTx, ctx->StateGetTxCnt, ctx->StateTransactionFree))) {
goto bad; goto bad;
} }
/* special case: StateGetProgressCompletionStatus is used from 'default'. */ /* special case: StateGetProgressCompletionStatus is used from 'default'. */
@ -1445,11 +1425,9 @@ static void ValidateParserProto(AppProto alproto, uint8_t ipproto)
if (!(BOTH_SET(ctx->GetTxDetectState, ctx->SetTxDetectState))) { if (!(BOTH_SET(ctx->GetTxDetectState, ctx->SetTxDetectState))) {
goto bad; goto bad;
} }
/* TODO: not yet mandatory to use StateHasTxDetectState if (!(BOTH_SET_OR_BOTH_UNSET(ctx->GetTxDetectState, ctx->SetTxDetectState))) {
if (!(THREE_SET_OR_THREE_UNSET(ctx->GetTxDetectState, ctx->SetTxDetectState, ctx->StateHasTxDetectState))) {
goto bad; goto bad;
} }
*/
return; return;
bad: bad:
@ -1459,6 +1437,7 @@ bad:
#undef BOTH_SET #undef BOTH_SET
#undef BOTH_SET_OR_BOTH_UNSET #undef BOTH_SET_OR_BOTH_UNSET
#undef THREE_SET_OR_THREE_UNSET #undef THREE_SET_OR_THREE_UNSET
#undef THREE_SET
static void ValidateParser(AppProto alproto) static void ValidateParser(AppProto alproto)
{ {

2
src/app-layer-parser.h
Unescape Escape View File

@ -229,9 +229,7 @@ int AppLayerParserParse(ThreadVars *tv, AppLayerParserThreadCtx *tctx, Flow *f,
void AppLayerParserSetEOF(AppLayerParserState *pstate); void AppLayerParserSetEOF(AppLayerParserState *pstate);
bool AppLayerParserHasDecoderEvents(AppLayerParserState *pstate); bool AppLayerParserHasDecoderEvents(AppLayerParserState *pstate);
int AppLayerParserIsTxAware(AppProto alproto); int AppLayerParserIsTxAware(AppProto alproto);
int AppLayerParserProtocolIsTxAware(uint8_t ipproto, AppProto alproto);
int AppLayerParserProtocolIsTxEventAware(uint8_t ipproto, AppProto alproto); int AppLayerParserProtocolIsTxEventAware(uint8_t ipproto, AppProto alproto);
int AppLayerParserProtocolSupportsTxs(uint8_t ipproto, AppProto alproto);
int AppLayerParserProtocolHasLogger(uint8_t ipproto, AppProto alproto); int AppLayerParserProtocolHasLogger(uint8_t ipproto, AppProto alproto);
LoggerId AppLayerParserProtocolGetLoggerBits(uint8_t ipproto, AppProto alproto); LoggerId AppLayerParserProtocolGetLoggerBits(uint8_t ipproto, AppProto alproto);
void AppLayerParserTriggerRawStreamReassembly(Flow *f, int direction); void AppLayerParserTriggerRawStreamReassembly(Flow *f, int direction);

22
src/app-layer.c
Unescape Escape View File

@ -886,20 +886,16 @@ void AppLayerSetupCounters()
snprintf(applayer_counter_names[ipproto_map][alproto].name, snprintf(applayer_counter_names[ipproto_map][alproto].name,
sizeof(applayer_counter_names[ipproto_map][alproto].name), sizeof(applayer_counter_names[ipproto_map][alproto].name),
"%s%s%s", str, alproto_str, ipproto_suffix); "%s%s%s", str, alproto_str, ipproto_suffix);
if (AppLayerParserProtocolIsTxAware(ipprotos[ipproto], alproto)) { snprintf(applayer_counter_names[ipproto_map][alproto].tx_name,
snprintf(applayer_counter_names[ipproto_map][alproto].tx_name, sizeof(applayer_counter_names[ipproto_map][alproto].tx_name),
sizeof(applayer_counter_names[ipproto_map][alproto].tx_name), "%s%s%s", tx_str, alproto_str, ipproto_suffix);
"%s%s%s", tx_str, alproto_str, ipproto_suffix);
}
} else { } else {
snprintf(applayer_counter_names[ipproto_map][alproto].name, snprintf(applayer_counter_names[ipproto_map][alproto].name,
sizeof(applayer_counter_names[ipproto_map][alproto].name), sizeof(applayer_counter_names[ipproto_map][alproto].name),
"%s%s", str, alproto_str); "%s%s", str, alproto_str);
if (AppLayerParserProtocolIsTxAware(ipprotos[ipproto], alproto)) { snprintf(applayer_counter_names[ipproto_map][alproto].tx_name,
snprintf(applayer_counter_names[ipproto_map][alproto].tx_name, sizeof(applayer_counter_names[ipproto_map][alproto].tx_name),
sizeof(applayer_counter_names[ipproto_map][alproto].tx_name), "%s%s", tx_str, alproto_str);
"%s%s", tx_str, alproto_str);
}
} }
} else if (alproto == ALPROTO_FAILED) { } else if (alproto == ALPROTO_FAILED) {
snprintf(applayer_counter_names[ipproto_map][alproto].name, snprintf(applayer_counter_names[ipproto_map][alproto].name,
@ -927,10 +923,8 @@ void AppLayerRegisterThreadCounters(ThreadVars *tv)
applayer_counters[ipproto_map][alproto].counter_id = applayer_counters[ipproto_map][alproto].counter_id =
StatsRegisterCounter(applayer_counter_names[ipproto_map][alproto].name, tv); StatsRegisterCounter(applayer_counter_names[ipproto_map][alproto].name, tv);
if (AppLayerParserProtocolIsTxAware(ipprotos[ipproto], alproto)) { applayer_counters[ipproto_map][alproto].counter_tx_id =
applayer_counters[ipproto_map][alproto].counter_tx_id = StatsRegisterCounter(applayer_counter_names[ipproto_map][alproto].tx_name, tv);
StatsRegisterCounter(applayer_counter_names[ipproto_map][alproto].tx_name, tv);
}
} else if (alproto == ALPROTO_FAILED) { } else if (alproto == ALPROTO_FAILED) {
applayer_counters[ipproto_map][alproto].counter_id = applayer_counters[ipproto_map][alproto].counter_id =
StatsRegisterCounter(applayer_counter_names[ipproto_map][alproto].name, tv); StatsRegisterCounter(applayer_counter_names[ipproto_map][alproto].name, tv);

5
src/detect.c
Unescape Escape View File

@ -998,7 +998,7 @@ static inline void DetectRunPostRules(
DetectRunScratchpad *scratch) DetectRunScratchpad *scratch)
{ {
/* see if we need to increment the inspect_id and reset the de_state */ /* see if we need to increment the inspect_id and reset the de_state */
if (pflow && pflow->alstate && AppLayerParserProtocolSupportsTxs(p->proto, scratch->alproto)) { if (pflow && pflow->alstate) {
PACKET_PROFILING_DETECT_START(p, PROF_DETECT_TX_UPDATE); PACKET_PROFILING_DETECT_START(p, PROF_DETECT_TX_UPDATE);
DeStateUpdateInspectTransactionId(pflow, scratch->flow_flags, (scratch->sgh == NULL)); DeStateUpdateInspectTransactionId(pflow, scratch->flow_flags, (scratch->sgh == NULL));
PACKET_PROFILING_DETECT_END(p, PROF_DETECT_TX_UPDATE); PACKET_PROFILING_DETECT_END(p, PROF_DETECT_TX_UPDATE);
@ -1627,8 +1627,7 @@ static void DetectFlow(ThreadVars *tv,
* update the inspect_id forward. So test for the condition here, * update the inspect_id forward. So test for the condition here,
* and call the update code if necessary. */ * and call the update code if necessary. */
const int pass = ((p->flow->flags & FLOW_NOPACKET_INSPECTION)); const int pass = ((p->flow->flags & FLOW_NOPACKET_INSPECTION));
const AppProto alproto = FlowGetAppProtocol(p->flow); if (pass) {
if (pass && AppLayerParserProtocolSupportsTxs(p->proto, alproto)) {
uint8_t flags; uint8_t flags;
if (p->flowflags & FLOW_PKT_TOSERVER) { if (p->flowflags & FLOW_PKT_TOSERVER) {
flags = STREAM_TOSERVER; flags = STREAM_TOSERVER;

4
src/flow-timeout.c
Unescape Escape View File

@ -302,9 +302,7 @@ int FlowForceReassemblyNeedReassembly(Flow *f, int *server, int *client)
} }
/* if app layer still needs some love, push through */ /* if app layer still needs some love, push through */
if (f->alproto != ALPROTO_UNKNOWN && f->alstate != NULL && if (f->alproto != ALPROTO_UNKNOWN && f->alstate != NULL) {
AppLayerParserProtocolSupportsTxs(f->proto, f->alproto))
{
const uint64_t total_txs = AppLayerParserGetTxCnt(f, f->alstate); const uint64_t total_txs = AppLayerParserGetTxCnt(f, f->alstate);
if (AppLayerParserGetTransactionActive(f, f->alparser, STREAM_TOCLIENT) < total_txs) if (AppLayerParserGetTransactionActive(f, f->alparser, STREAM_TOCLIENT) < total_txs)

2
src/output-tx.c
Unescape Escape View File

@ -143,8 +143,6 @@ static TmEcode OutputTxLog(ThreadVars *tv, Packet *p, void *thread_data)
const uint8_t ipproto = f->proto; const uint8_t ipproto = f->proto;
const AppProto alproto = f->alproto; const AppProto alproto = f->alproto;
if (AppLayerParserProtocolIsTxAware(p->proto, alproto) == 0)
goto end;
if (AppLayerParserProtocolHasLogger(p->proto, alproto) == 0) if (AppLayerParserProtocolHasLogger(p->proto, alproto) == 0)
goto end; goto end;
const LoggerId logger_expectation = AppLayerParserProtocolGetLoggerBits(p->proto, alproto); const LoggerId logger_expectation = AppLayerParserProtocolGetLoggerBits(p->proto, alproto);

Write Preview
Loading…
Cancel
Save