diff --git a/rust/src/applayer.rs b/rust/src/applayer.rs index 795db989a4..71d4e6e1b8 100644 --- a/rust/src/applayer.rs +++ b/rust/src/applayer.rs @@ -18,7 +18,7 @@ //! Parser registration functions and common interface use std; -use crate::core::{DetectEngineState,Flow,AppLayerEventType,AppLayerDecoderEvents,AppProto}; +use crate::core::{DetectEngineState,Flow,AppLayerEventType,AppLayerDecoderEvents,AppProto, STREAM_TOCLIENT}; use crate::filecontainer::FileContainer; use crate::applayer; use std::os::raw::{c_void,c_char,c_int}; @@ -85,6 +85,14 @@ impl AppLayerTxData { pub fn incr_files_opened(&mut self) { self.files_opened += 1; } + + pub fn set_inspect_direction(&mut self, direction: u8) { + if direction == STREAM_TOCLIENT { + self.detect_flags_ts |= APP_LAYER_TX_SKIP_INSPECT_FLAG; + } else { + self.detect_flags_tc |= APP_LAYER_TX_SKIP_INSPECT_FLAG; + } + } } #[macro_export] @@ -321,6 +329,7 @@ pub const APP_LAYER_PARSER_BYPASS_READY : u8 = BIT_U8!(4); pub const APP_LAYER_PARSER_OPT_ACCEPT_GAPS: u32 = BIT_U32!(0); pub const APP_LAYER_PARSER_OPT_UNIDIR_TXS: u32 = BIT_U32!(1); +pub const APP_LAYER_TX_SKIP_INSPECT_FLAG: u64 = BIT_U64!(62); pub type AppLayerGetTxIteratorFn = extern "C" fn (ipproto: u8, alproto: AppProto, diff --git a/src/app-layer-parser.h b/src/app-layer-parser.h index 86c3a3696f..4a4def9b31 100644 --- a/src/app-layer-parser.h +++ b/src/app-layer-parser.h @@ -49,6 +49,7 @@ /* applies to DetectFlags uint64_t field */ +#define APP_LAYER_TX_SKIP_INSPECT_FLAG BIT_U64(62) /** is tx fully inspected? */ #define APP_LAYER_TX_INSPECTED_FLAG BIT_U64(63) /** other 63 bits are for tracking which prefilter engine is already diff --git a/src/detect.c b/src/detect.c index bd4f97604c..1aea748587 100644 --- a/src/detect.c +++ b/src/detect.c @@ -1242,6 +1242,22 @@ static DetectTransaction GetDetectTx(const uint8_t ipproto, const AppProto alpro DetectTransaction no_tx = { NULL, 0, NULL, NULL, 0, 0, 0, 0, 0, }; return no_tx; } + if (detect_flags & APP_LAYER_TX_SKIP_INSPECT_FLAG) { + SCLogDebug("%" PRIu64 " tx should not be inspected in direction %s. Flags %016" PRIx64, + tx_id, flow_flags & STREAM_TOSERVER ? "toserver" : "toclient", detect_flags); + DetectTransaction no_tx = { + NULL, + 0, + NULL, + NULL, + 0, + 0, + 0, + 0, + 0, + }; + return no_tx; + } const int tx_progress = AppLayerParserGetStateProgress(ipproto, alproto, tx_ptr, flow_flags); const int dir_int = (flow_flags & STREAM_TOSERVER) ? 0 : 1;