aiden
/
suricata
mirror of https://github.com/OISF/suricata
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

Removed FLOW_AL_STREAM_START, EOF and GAP flags. We don't need these. Just use STREAM_* flags

Browse Source
remotes/origin/master-1.1.x
Anoop Saldanha 15 years ago committed by Victor Julien
parent 000ce98cd1
commit 38fe2b9070
4 changed files with 11 additions and 28 deletions
Show Stats Download Patch File Download Diff File

10
src/app-layer-parser.c
Unescape Escape View File

@ -803,7 +803,7 @@ int AppLayerParse(Flow *f, uint8_t proto, uint8_t flags, uint8_t *input,
ssn = f->protoctx; ssn = f->protoctx;
/** Do this check before calling AppLayerParse */ /** Do this check before calling AppLayerParse */
if (flags & FLOW_AL_STREAM_GAP) { if (flags & STREAM_GAP) {
SCLogDebug("stream gap detected (missing packets), this is not yet supported."); SCLogDebug("stream gap detected (missing packets), this is not yet supported.");
goto error; goto error;
} }
@ -831,7 +831,7 @@ int AppLayerParse(Flow *f, uint8_t proto, uint8_t flags, uint8_t *input,
} }
AppLayerParserState *parser_state = NULL; AppLayerParserState *parser_state = NULL;
if (flags & FLOW_AL_STREAM_TOSERVER) { if (flags & STREAM_TOSERVER) {
SCLogDebug("to_server msg (flow %p)", f); SCLogDebug("to_server msg (flow %p)", f);
parser_state = &parser_state_store->to_server; parser_state = &parser_state_store->to_server;
@ -864,7 +864,7 @@ int AppLayerParse(Flow *f, uint8_t proto, uint8_t flags, uint8_t *input,
SCReturnInt(0); SCReturnInt(0);
} }
if (flags & FLOW_AL_STREAM_EOF) if (flags & STREAM_EOF)
parser_state->flags |= APP_LAYER_PARSER_EOF; parser_state->flags |= APP_LAYER_PARSER_EOF;
/* See if we already have a 'app layer' state */ /* See if we already have a 'app layer' state */
@ -904,9 +904,9 @@ int AppLayerParse(Flow *f, uint8_t proto, uint8_t flags, uint8_t *input,
if (parser_state->flags & APP_LAYER_PARSER_NO_REASSEMBLY) { if (parser_state->flags & APP_LAYER_PARSER_NO_REASSEMBLY) {
if (ssn != NULL) { if (ssn != NULL) {
StreamTcpSetSessionNoReassemblyFlag(ssn, StreamTcpSetSessionNoReassemblyFlag(ssn,
flags & FLOW_AL_STREAM_TOCLIENT ? 1 : 0); flags & STREAM_TOCLIENT ? 1 : 0);
StreamTcpSetSessionNoReassemblyFlag(ssn, StreamTcpSetSessionNoReassemblyFlag(ssn,
flags & FLOW_AL_STREAM_TOSERVER ? 1 : 0); flags & STREAM_TOSERVER ? 1 : 0);
} }
} }
} }

16
src/app-layer.c
Unescape Escape View File

@ -141,16 +141,6 @@ int AppLayerHandleTCPData(AlpProtoDetectThreadCtx *dp_ctx, Flow *f,
SCLogDebug("STREAM_TOCLIENT"); SCLogDebug("STREAM_TOCLIENT");
} }
if (flags & STREAM_GAP) {
f->alflags |= FLOW_AL_STREAM_GAP;
SCLogDebug("STREAM_GAP");
}
if (flags & STREAM_EOF) {
f->alflags |= FLOW_AL_STREAM_EOF;
SCLogDebug("STREAM_EOF");
}
SCLogDebug("data_len %u flags %02X", data_len, flags); SCLogDebug("data_len %u flags %02X", data_len, flags);
if (!(f->alflags & FLOW_AL_NO_APPLAYER_INSPECTION)) { if (!(f->alflags & FLOW_AL_NO_APPLAYER_INSPECTION)) {
/* if we don't know the proto yet and we have received a stream /* if we don't know the proto yet and we have received a stream
@ -182,7 +172,7 @@ int AppLayerHandleTCPData(AlpProtoDetectThreadCtx *dp_ctx, Flow *f,
ssn->flags |= STREAMTCP_FLAG_APPPROTO_DETECTION_COMPLETED; ssn->flags |= STREAMTCP_FLAG_APPPROTO_DETECTION_COMPLETED;
f->alflags |= FLOW_AL_PROTO_DETECT_DONE; f->alflags |= FLOW_AL_PROTO_DETECT_DONE;
r = AppLayerParse(f, alproto, f->alflags, data, data_len); r = AppLayerParse(f, alproto, flags, data, data_len);
} else { } else {
if (flags & STREAM_TOSERVER) { if (flags & STREAM_TOSERVER) {
SCLogDebug("alp_proto_ctx.toserver.max_len %u", alp_proto_ctx.toserver.max_len); SCLogDebug("alp_proto_ctx.toserver.max_len %u", alp_proto_ctx.toserver.max_len);
@ -342,10 +332,6 @@ int AppLayerHandleMsg(AlpProtoDetectThreadCtx *dp_ctx, StreamMsg *smsg)
smsg->flow->alflags |= FLOW_AL_STREAM_TOSERVER; smsg->flow->alflags |= FLOW_AL_STREAM_TOSERVER;
if (smsg->flags & STREAM_TOCLIENT) if (smsg->flags & STREAM_TOCLIENT)
smsg->flow->alflags |= FLOW_AL_STREAM_TOCLIENT; smsg->flow->alflags |= FLOW_AL_STREAM_TOCLIENT;
if (smsg->flags & STREAM_GAP)
smsg->flow->alflags |= FLOW_AL_STREAM_GAP;
if (smsg->flags & STREAM_EOF)
smsg->flow->alflags |= FLOW_AL_STREAM_EOF;
if (!(smsg->flow->alflags & FLOW_AL_NO_APPLAYER_INSPECTION)) { if (!(smsg->flow->alflags & FLOW_AL_NO_APPLAYER_INSPECTION)) {
/* if we don't know the proto yet and we have received a stream /* if we don't know the proto yet and we have received a stream

3
src/flow.h
Unescape Escape View File

@ -216,11 +216,8 @@ typedef struct Flow_
#define FLOW_AL_PROTO_UNKNOWN 0x01 #define FLOW_AL_PROTO_UNKNOWN 0x01
#define FLOW_AL_PROTO_DETECT_DONE 0x02 #define FLOW_AL_PROTO_DETECT_DONE 0x02
#define FLOW_AL_NO_APPLAYER_INSPECTION 0x04 /** \todo move to flow flags later */ #define FLOW_AL_NO_APPLAYER_INSPECTION 0x04 /** \todo move to flow flags later */
#define FLOW_AL_STREAM_START 0x08
#define FLOW_AL_STREAM_EOF 0x10
#define FLOW_AL_STREAM_TOSERVER 0x20 #define FLOW_AL_STREAM_TOSERVER 0x20
#define FLOW_AL_STREAM_TOCLIENT 0x40 #define FLOW_AL_STREAM_TOCLIENT 0x40
#define FLOW_AL_STREAM_GAP 0x80
enum { enum {
FLOW_STATE_NEW = 0, FLOW_STATE_NEW = 0,

10
src/stream.h
Unescape Escape View File

@ -26,11 +26,11 @@
#include "flow.h" #include "flow.h"
#define STREAM_START FLOW_AL_STREAM_START #define STREAM_START 0x01
#define STREAM_EOF FLOW_AL_STREAM_EOF #define STREAM_EOF 0x02
#define STREAM_TOSERVER FLOW_AL_STREAM_TOSERVER #define STREAM_TOSERVER 0x04
#define STREAM_TOCLIENT FLOW_AL_STREAM_TOCLIENT #define STREAM_TOCLIENT 0x08
#define STREAM_GAP FLOW_AL_STREAM_GAP #define STREAM_GAP 0x10
/** size of the data chunks sent to the app layer parser. */ /** size of the data chunks sent to the app layer parser. */
#define MSG_DATA_SIZE 4024 /* 4096 - 72 (size of rest of the struct) */ #define MSG_DATA_SIZE 4024 /* 4096 - 72 (size of rest of the struct) */

Write Preview
Loading…
Cancel
Save