aiden
/
suricata
mirror of https://github.com/OISF/suricata
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

app-layer API optimizations and cleanups

Browse Source
pull/2712/head
Victor Julien 9 years ago
parent cd97fa80f1
commit 3148ff34b6
9 changed files with 31 additions and 34 deletions
Show Stats Download Patch File Download Diff File

2
src/app-layer-detect-proto.c
Unescape Escape View File

@ -1657,7 +1657,7 @@ void AppLayerProtoDetectReset(Flow *f)
f->probing_parser_toserver_alproto_masks = 0; f->probing_parser_toserver_alproto_masks = 0;
f->probing_parser_toclient_alproto_masks = 0; f->probing_parser_toclient_alproto_masks = 0;
AppLayerParserStateCleanup(f->proto, f->alproto, f->alstate, f->alparser); AppLayerParserStateCleanup(f, f->alstate, f->alparser);
f->alstate = NULL; f->alstate = NULL;
f->alparser = NULL; f->alparser = NULL;
f->alproto = ALPROTO_UNKNOWN; f->alproto = ALPROTO_UNKNOWN;

32
src/app-layer-parser.c
Unescape Escape View File

@ -883,8 +883,8 @@ uint8_t AppLayerParserGetFirstDataDir(uint8_t ipproto, AppProto alproto)
SCReturnCT(r, "uint8_t"); SCReturnCT(r, "uint8_t");
} }
uint64_t AppLayerParserGetTransactionActive(uint8_t ipproto, AppProto alproto, uint64_t AppLayerParserGetTransactionActive(const Flow *f,
AppLayerParserState *pstate, uint8_t direction) AppLayerParserState *pstate, uint8_t direction)
{ {
SCEnter(); SCEnter();
@ -892,7 +892,7 @@ uint64_t AppLayerParserGetTransactionActive(uint8_t ipproto, AppProto alproto,
uint64_t log_id = pstate->log_id; uint64_t log_id = pstate->log_id;
uint64_t inspect_id = pstate->inspect_id[direction & STREAM_TOSERVER ? 0 : 1]; uint64_t inspect_id = pstate->inspect_id[direction & STREAM_TOSERVER ? 0 : 1];
if (alp_ctx.ctxs[FlowGetProtoMapping(ipproto)][alproto].logger == TRUE) { if (alp_ctx.ctxs[f->protomap][f->alproto].logger == TRUE) {
active_id = (log_id < inspect_id) ? log_id : inspect_id; active_id = (log_id < inspect_id) ? log_id : inspect_id;
} else { } else {
active_id = inspect_id; active_id = inspect_id;
@ -933,14 +933,14 @@ DetectEngineState *AppLayerParserGetTxDetectState(uint8_t ipproto, AppProto alpr
SCReturnPtr(s, "DetectEngineState"); SCReturnPtr(s, "DetectEngineState");
} }
int AppLayerParserSetTxDetectState(uint8_t ipproto, AppProto alproto, int AppLayerParserSetTxDetectState(const Flow *f,
void *alstate, void *tx, DetectEngineState *s) void *alstate, void *tx, DetectEngineState *s)
{ {
int r; int r;
SCEnter(); SCEnter();
if ((alp_ctx.ctxs[FlowGetProtoMapping(ipproto)][alproto].GetTxDetectState(tx) != NULL)) if ((alp_ctx.ctxs[f->protomap][f->alproto].GetTxDetectState(tx) != NULL))
SCReturnInt(-EBUSY); SCReturnInt(-EBUSY);
r = alp_ctx.ctxs[FlowGetProtoMapping(ipproto)][alproto].SetTxDetectState(alstate, tx, s); r = alp_ctx.ctxs[f->protomap][f->alproto].SetTxDetectState(alstate, tx, s);
SCReturnInt(r); SCReturnInt(r);
} }
@ -1104,7 +1104,7 @@ void AppLayerParserSetEOF(AppLayerParserState *pstate)
SCReturn; SCReturn;
} }
int AppLayerParserHasDecoderEvents(uint8_t ipproto, AppProto alproto, int AppLayerParserHasDecoderEvents(const Flow *f,
void *alstate, AppLayerParserState *pstate, void *alstate, AppLayerParserState *pstate,
uint8_t flags) uint8_t flags)
{ {
@ -1117,10 +1117,10 @@ int AppLayerParserHasDecoderEvents(uint8_t ipproto, AppProto alproto,
uint64_t tx_id; uint64_t tx_id;
uint64_t max_id; uint64_t max_id;
if (AppLayerParserProtocolIsTxEventAware(ipproto, alproto)) { if (AppLayerParserProtocolIsTxEventAware(f->proto, f->alproto)) {
/* fast path if supported by alproto */ /* fast path if supported by alproto */
if (alp_ctx.ctxs[FlowGetProtoMapping(ipproto)][alproto].StateHasEvents != NULL) { if (alp_ctx.ctxs[f->protomap][f->alproto].StateHasEvents != NULL) {
if (alp_ctx.ctxs[FlowGetProtoMapping(ipproto)][alproto]. if (alp_ctx.ctxs[f->protomap][f->alproto].
StateHasEvents(alstate) == 1) StateHasEvents(alstate) == 1)
{ {
goto present; goto present;
@ -1128,9 +1128,9 @@ int AppLayerParserHasDecoderEvents(uint8_t ipproto, AppProto alproto,
} else { } else {
/* check each tx */ /* check each tx */
tx_id = AppLayerParserGetTransactionInspectId(pstate, flags); tx_id = AppLayerParserGetTransactionInspectId(pstate, flags);
max_id = AppLayerParserGetTxCnt(ipproto, alproto, alstate); max_id = AppLayerParserGetTxCnt(f->proto, f->alproto, alstate);
for ( ; tx_id < max_id; tx_id++) { for ( ; tx_id < max_id; tx_id++) {
decoder_events = AppLayerParserGetEventsByTx(ipproto, alproto, alstate, tx_id); decoder_events = AppLayerParserGetEventsByTx(f->proto, f->alproto, alstate, tx_id);
if (decoder_events && decoder_events->cnt) if (decoder_events && decoder_events->cnt)
goto present; goto present;
} }
@ -1209,19 +1209,19 @@ void AppLayerParserSetStreamDepth(uint8_t ipproto, AppProto alproto, uint32_t st
SCReturn; SCReturn;
} }
uint32_t AppLayerParserGetStreamDepth(uint8_t ipproto, AppProto alproto) uint32_t AppLayerParserGetStreamDepth(const Flow *f)
{ {
SCReturnInt(alp_ctx.ctxs[FlowGetProtoMapping(ipproto)][alproto].stream_depth); SCReturnInt(alp_ctx.ctxs[f->protomap][f->alproto].stream_depth);
} }
/***** Cleanup *****/ /***** Cleanup *****/
void AppLayerParserStateCleanup(uint8_t ipproto, AppProto alproto, void *alstate, void AppLayerParserStateCleanup(const Flow *f, void *alstate,
AppLayerParserState *pstate) AppLayerParserState *pstate)
{ {
SCEnter(); SCEnter();
AppLayerParserProtoCtx *ctx = &alp_ctx.ctxs[FlowGetProtoMapping(ipproto)][alproto]; AppLayerParserProtoCtx *ctx = &alp_ctx.ctxs[f->protomap][f->alproto];
if (ctx->StateFree != NULL && alstate != NULL) if (ctx->StateFree != NULL && alstate != NULL)
ctx->StateFree(alstate); ctx->StateFree(alstate);

10
src/app-layer-parser.h
Unescape Escape View File

@ -188,7 +188,7 @@ int AppLayerParserGetStateProgressCompletionStatus(AppProto alproto, uint8_t dir
int AppLayerParserGetEventInfo(uint8_t ipproto, AppProto alproto, const char *event_name, int AppLayerParserGetEventInfo(uint8_t ipproto, AppProto alproto, const char *event_name,
int *event_id, AppLayerEventType *event_type); int *event_id, AppLayerEventType *event_type);
uint64_t AppLayerParserGetTransactionActive(uint8_t ipproto, AppProto alproto, AppLayerParserState *pstate, uint8_t direction); uint64_t AppLayerParserGetTransactionActive(const Flow *f, AppLayerParserState *pstate, uint8_t direction);
uint8_t AppLayerParserGetFirstDataDir(uint8_t ipproto, AppProto alproto); uint8_t AppLayerParserGetFirstDataDir(uint8_t ipproto, AppProto alproto);
@ -196,7 +196,7 @@ int AppLayerParserSupportsFiles(uint8_t ipproto, AppProto alproto);
int AppLayerParserSupportsTxDetectState(uint8_t ipproto, AppProto alproto); int AppLayerParserSupportsTxDetectState(uint8_t ipproto, AppProto alproto);
int AppLayerParserHasTxDetectState(uint8_t ipproto, AppProto alproto, void *alstate); int AppLayerParserHasTxDetectState(uint8_t ipproto, AppProto alproto, void *alstate);
DetectEngineState *AppLayerParserGetTxDetectState(uint8_t ipproto, AppProto alproto, void *tx); DetectEngineState *AppLayerParserGetTxDetectState(uint8_t ipproto, AppProto alproto, void *tx);
int AppLayerParserSetTxDetectState(uint8_t ipproto, AppProto alproto, void *alstate, void *tx, DetectEngineState *s); int AppLayerParserSetTxDetectState(const Flow *f, void *alstate, void *tx, DetectEngineState *s);
uint64_t AppLayerParserGetTxMpmIDs(uint8_t ipproto, AppProto alproto, void *tx); uint64_t AppLayerParserGetTxMpmIDs(uint8_t ipproto, AppProto alproto, void *tx);
int AppLayerParserSetTxMpmIDs(uint8_t ipproto, AppProto alproto, void *tx, uint64_t); int AppLayerParserSetTxMpmIDs(uint8_t ipproto, AppProto alproto, void *tx, uint64_t);
@ -206,7 +206,7 @@ int AppLayerParserSetTxMpmIDs(uint8_t ipproto, AppProto alproto, void *tx, uint6
int AppLayerParserParse(ThreadVars *tv, AppLayerParserThreadCtx *tctx, Flow *f, AppProto alproto, int AppLayerParserParse(ThreadVars *tv, AppLayerParserThreadCtx *tctx, Flow *f, AppProto alproto,
uint8_t flags, uint8_t *input, uint32_t input_len); uint8_t flags, uint8_t *input, uint32_t input_len);
void AppLayerParserSetEOF(AppLayerParserState *pstate); void AppLayerParserSetEOF(AppLayerParserState *pstate);
int AppLayerParserHasDecoderEvents(uint8_t ipproto, AppProto alproto, void *alstate, AppLayerParserState *pstate, int AppLayerParserHasDecoderEvents(const Flow *f, void *alstate, AppLayerParserState *pstate,
uint8_t flags); uint8_t flags);
int AppLayerParserIsTxAware(AppProto alproto); int AppLayerParserIsTxAware(AppProto alproto);
int AppLayerParserProtocolIsTxAware(uint8_t ipproto, AppProto alproto); int AppLayerParserProtocolIsTxAware(uint8_t ipproto, AppProto alproto);
@ -215,11 +215,11 @@ int AppLayerParserProtocolSupportsTxs(uint8_t ipproto, AppProto alproto);
int AppLayerParserProtocolHasLogger(uint8_t ipproto, AppProto alproto); int AppLayerParserProtocolHasLogger(uint8_t ipproto, AppProto alproto);
void AppLayerParserTriggerRawStreamReassembly(Flow *f, int direction); void AppLayerParserTriggerRawStreamReassembly(Flow *f, int direction);
void AppLayerParserSetStreamDepth(uint8_t ipproto, AppProto alproto, uint32_t stream_depth); void AppLayerParserSetStreamDepth(uint8_t ipproto, AppProto alproto, uint32_t stream_depth);
uint32_t AppLayerParserGetStreamDepth(uint8_t ipproto, AppProto alproto); uint32_t AppLayerParserGetStreamDepth(const Flow *f);
/***** Cleanup *****/ /***** Cleanup *****/
void AppLayerParserStateCleanup(uint8_t ipproto, AppProto alproto, void *alstate, AppLayerParserState *pstate); void AppLayerParserStateCleanup(const Flow *f, void *alstate, AppLayerParserState *pstate);
void AppLayerParserRegisterProtocolParsers(void); void AppLayerParserRegisterProtocolParsers(void);

4
src/app-layer.c
Unescape Escape View File

@ -342,7 +342,7 @@ static int TCPProtoDetect(ThreadVars *tv,
StreamTcpSetStreamFlagAppProtoDetectionCompleted(stream); StreamTcpSetStreamFlagAppProtoDetectionCompleted(stream);
TcpSessionSetReassemblyDepth(ssn, TcpSessionSetReassemblyDepth(ssn,
AppLayerParserGetStreamDepth(f->proto, f->alproto)); AppLayerParserGetStreamDepth(f));
FlagPacketFlow(p, f, flags); FlagPacketFlow(p, f, flags);
/* account flow if we have both sides */ /* account flow if we have both sides */
@ -496,7 +496,7 @@ static int TCPProtoDetect(ThreadVars *tv,
APPLAYER_DETECT_PROTOCOL_ONLY_ONE_DIRECTION); APPLAYER_DETECT_PROTOCOL_ONLY_ONE_DIRECTION);
StreamTcpSetStreamFlagAppProtoDetectionCompleted(stream); StreamTcpSetStreamFlagAppProtoDetectionCompleted(stream);
TcpSessionSetReassemblyDepth(ssn, TcpSessionSetReassemblyDepth(ssn,
AppLayerParserGetStreamDepth(f->proto, f->alproto)); AppLayerParserGetStreamDepth(f));
*alproto = ALPROTO_FAILED; *alproto = ALPROTO_FAILED;
FlagPacketFlow(p, f, flags); FlagPacketFlow(p, f, flags);

4
src/detect-engine-state.c
Unescape Escape View File

@ -317,7 +317,7 @@ static void StoreStateTxFileOnly(DetectEngineThreadCtx *det_ctx,
destate = DetectEngineStateAlloc(); destate = DetectEngineStateAlloc();
if (destate == NULL) if (destate == NULL)
return; return;
if (AppLayerParserSetTxDetectState(f->proto, f->alproto, f->alstate, tx, destate) < 0) { if (AppLayerParserSetTxDetectState(f, f->alstate, tx, destate) < 0) {
DetectEngineStateFree(destate); DetectEngineStateFree(destate);
return; return;
} }
@ -342,7 +342,7 @@ static void StoreStateTx(DetectEngineThreadCtx *det_ctx,
destate = DetectEngineStateAlloc(); destate = DetectEngineStateAlloc();
if (destate == NULL) if (destate == NULL)
return; return;
if (AppLayerParserSetTxDetectState(f->proto, f->alproto, f->alstate, tx, destate) < 0) { if (AppLayerParserSetTxDetectState(f, f->alstate, tx, destate) < 0) {
DetectEngineStateFree(destate); DetectEngineStateFree(destate);
return; return;
} }

3
src/detect.c
Unescape Escape View File

@ -1013,8 +1013,7 @@ void SigMatchSignatures(ThreadVars *th_v, DetectEngineCtx *de_ctx, DetectEngineT
SCLogDebug("packet doesn't have established flag set (proto %d)", p->proto); SCLogDebug("packet doesn't have established flag set (proto %d)", p->proto);
} }
app_decoder_events = AppLayerParserHasDecoderEvents(pflow->proto, app_decoder_events = AppLayerParserHasDecoderEvents(pflow,
pflow->alproto,
pflow->alstate, pflow->alstate,
pflow->alparser, pflow->alparser,
flow_flags); flow_flags);

6
src/flow-timeout.c
Unescape Escape View File

@ -322,13 +322,11 @@ int FlowForceReassemblyNeedReassembly(Flow *f, int *server, int *client)
{ {
uint64_t total_txs = AppLayerParserGetTxCnt(f->proto, f->alproto, f->alstate); uint64_t total_txs = AppLayerParserGetTxCnt(f->proto, f->alproto, f->alstate);
if (AppLayerParserGetTransactionActive(f->proto, f->alproto, if (AppLayerParserGetTransactionActive(f, f->alparser, STREAM_TOCLIENT) < total_txs)
f->alparser, STREAM_TOCLIENT) < total_txs)
{ {
*server = STREAM_HAS_UNPROCESSED_SEGMENTS_NEED_ONLY_DETECTION; *server = STREAM_HAS_UNPROCESSED_SEGMENTS_NEED_ONLY_DETECTION;
} }
if (AppLayerParserGetTransactionActive(f->proto, f->alproto, if (AppLayerParserGetTransactionActive(f, f->alparser, STREAM_TOSERVER) < total_txs)
f->alparser, STREAM_TOSERVER) < total_txs)
{ {
*client = STREAM_HAS_UNPROCESSED_SEGMENTS_NEED_ONLY_DETECTION; *client = STREAM_HAS_UNPROCESSED_SEGMENTS_NEED_ONLY_DETECTION;
} }

2
src/flow.c
Unescape Escape View File

@ -94,7 +94,7 @@ void FlowCleanupAppLayer(Flow *f)
if (f == NULL || f->proto == 0) if (f == NULL || f->proto == 0)
return; return;
AppLayerParserStateCleanup(f->proto, f->alproto, f->alstate, f->alparser); AppLayerParserStateCleanup(f, f->alstate, f->alparser);
f->alstate = NULL; f->alstate = NULL;
f->alparser = NULL; f->alparser = NULL;
return; return;

2
src/output-tx.c
Unescape Escape View File

@ -148,7 +148,7 @@ static TmEcode OutputTxLog(ThreadVars *tv, Packet *p, void *thread_data)
Flow * const f = p->flow; Flow * const f = p->flow;
AppProto alproto = f->alproto; const AppProto alproto = f->alproto;
if (AppLayerParserProtocolIsTxAware(p->proto, alproto) == 0) if (AppLayerParserProtocolIsTxAware(p->proto, alproto) == 0)
goto end; goto end;

Write Preview
Loading…
Cancel
Save