firewall/analyzer: include all hooks

For protocols using default 0-1 states, add support.

For others, print 'unknown' if no name is yet supported.

Ticket: #8514.
pull/15398/head
Victor Julien 6 months ago
parent f7c44c4c23
commit b29226c7ea

@ -2239,17 +2239,21 @@ int FirewallAnalyzer(const DetectEngineCtx *de_ctx)
if (!AppProtoIsValid(a))
continue;
// HACK not all protocols have named states yet
const char *hack = AppLayerParserGetStateNameById(IPPROTO_TCP, a, 0, STREAM_TOSERVER);
if (!hack)
continue;
SCJbOpenObject(ctx.js, AppProtoToString(a));
const uint8_t complete_state_ts =
(const uint8_t)AppLayerParserGetStateProgressCompletionStatus(a, STREAM_TOSERVER);
for (uint8_t state = 0; state < complete_state_ts; state++) {
SCJbOpenObject(ctx.js, AppProtoToString(a));
for (uint8_t state = 0; state <= complete_state_ts; state++) {
const char *name =
AppLayerParserGetStateNameById(IPPROTO_TCP, a, state, STREAM_TOSERVER);
if (name == NULL) {
if (state == 0)
name = "request-started";
else if (state == complete_state_ts)
name = "request-complete";
else
name = "unknown";
}
char table_name[128];
snprintf(table_name, sizeof(table_name), "app:%s:%s", AppProtoToString(a), name);
SCJbOpenObject(ctx.js, table_name);
@ -2264,9 +2268,17 @@ int FirewallAnalyzer(const DetectEngineCtx *de_ctx)
}
const uint8_t complete_state_tc =
(const uint8_t)AppLayerParserGetStateProgressCompletionStatus(a, STREAM_TOCLIENT);
for (uint8_t state = 0; state < complete_state_tc; state++) {
for (uint8_t state = 0; state <= complete_state_tc; state++) {
const char *name =
AppLayerParserGetStateNameById(IPPROTO_TCP, a, state, STREAM_TOCLIENT);
if (name == NULL) {
if (state == 0)
name = "response-started";
else if (state == complete_state_tc)
name = "response-complete";
else
name = "unknown";
}
char table_name[128];
snprintf(table_name, sizeof(table_name), "app:%s:%s", AppProtoToString(a), name);
SCJbOpenObject(ctx.js, table_name);

Loading…
Cancel
Save