|
|
|
|
@ -2239,17 +2239,21 @@ int FirewallAnalyzer(const DetectEngineCtx *de_ctx)
|
|
|
|
|
if (!AppProtoIsValid(a))
|
|
|
|
|
continue;
|
|
|
|
|
|
|
|
|
|
// HACK not all protocols have named states yet
|
|
|
|
|
const char *hack = AppLayerParserGetStateNameById(IPPROTO_TCP, a, 0, STREAM_TOSERVER);
|
|
|
|
|
if (!hack)
|
|
|
|
|
continue;
|
|
|
|
|
|
|
|
|
|
SCJbOpenObject(ctx.js, AppProtoToString(a));
|
|
|
|
|
const uint8_t complete_state_ts =
|
|
|
|
|
(const uint8_t)AppLayerParserGetStateProgressCompletionStatus(a, STREAM_TOSERVER);
|
|
|
|
|
for (uint8_t state = 0; state < complete_state_ts; state++) {
|
|
|
|
|
SCJbOpenObject(ctx.js, AppProtoToString(a));
|
|
|
|
|
for (uint8_t state = 0; state <= complete_state_ts; state++) {
|
|
|
|
|
const char *name =
|
|
|
|
|
AppLayerParserGetStateNameById(IPPROTO_TCP, a, state, STREAM_TOSERVER);
|
|
|
|
|
if (name == NULL) {
|
|
|
|
|
if (state == 0)
|
|
|
|
|
name = "request-started";
|
|
|
|
|
else if (state == complete_state_ts)
|
|
|
|
|
name = "request-complete";
|
|
|
|
|
else
|
|
|
|
|
name = "unknown";
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
char table_name[128];
|
|
|
|
|
snprintf(table_name, sizeof(table_name), "app:%s:%s", AppProtoToString(a), name);
|
|
|
|
|
SCJbOpenObject(ctx.js, table_name);
|
|
|
|
|
@ -2264,9 +2268,17 @@ int FirewallAnalyzer(const DetectEngineCtx *de_ctx)
|
|
|
|
|
}
|
|
|
|
|
const uint8_t complete_state_tc =
|
|
|
|
|
(const uint8_t)AppLayerParserGetStateProgressCompletionStatus(a, STREAM_TOCLIENT);
|
|
|
|
|
for (uint8_t state = 0; state < complete_state_tc; state++) {
|
|
|
|
|
for (uint8_t state = 0; state <= complete_state_tc; state++) {
|
|
|
|
|
const char *name =
|
|
|
|
|
AppLayerParserGetStateNameById(IPPROTO_TCP, a, state, STREAM_TOCLIENT);
|
|
|
|
|
if (name == NULL) {
|
|
|
|
|
if (state == 0)
|
|
|
|
|
name = "response-started";
|
|
|
|
|
else if (state == complete_state_tc)
|
|
|
|
|
name = "response-complete";
|
|
|
|
|
else
|
|
|
|
|
name = "unknown";
|
|
|
|
|
}
|
|
|
|
|
char table_name[128];
|
|
|
|
|
snprintf(table_name, sizeof(table_name), "app:%s:%s", AppProtoToString(a), name);
|
|
|
|
|
SCJbOpenObject(ctx.js, table_name);
|
|
|
|
|
|