app-layer: add ApplyTxConfig API

Optional callback a parser can register for applying configuration
to the 'transaction'. Most parsers have a bidirectional tx. For those
parsers that have different types of transaction handling, this new
callback can be used to properly apply the config.
pull/5168/head
Victor Julien 6 years ago
parent df27205451
commit 5665fc8301

@ -234,6 +234,12 @@ pub struct RustParser {
pub get_tx_detect_flags: Option<GetTxDetectFlagsFn>,
pub get_tx_data: Option<GetTxDataFn>,
// Function to apply config to a TX. Optional. Normal (bidirectional)
// transactions don't need to set this. It is meant for cases where
// the requests and responses are not sharing tx. It is then up to
// the implementation to make sure the config is applied correctly.
pub apply_tx_config: Option<ApplyTxConfigFn>,
}
/// Create a slice, given a buffer and a length
@ -286,6 +292,7 @@ pub type GetTxIteratorFn = extern "C" fn (ipproto: u8, alproto: AppProto,
pub type GetTxDetectFlagsFn = unsafe extern "C" fn(*mut c_void, u8) -> u64;
pub type SetTxDetectFlagsFn = unsafe extern "C" fn(*mut c_void, u8, u64);
pub type GetTxDataFn = unsafe extern "C" fn(*mut c_void) -> *mut AppLayerTxData;
pub type ApplyTxConfigFn = unsafe extern "C" fn (*mut c_void, *mut c_void, c_int, AppLayerTxConfig);
// Defined in app-layer-register.h
extern {

@ -538,6 +538,7 @@ pub unsafe extern "C" fn rs_template_register_parser() {
get_tx_detect_flags: None,
set_tx_detect_flags: None,
get_tx_data: None,
apply_tx_config: None,
};
let ip_proto_str = CString::new("tcp").unwrap();

@ -452,6 +452,7 @@ pub unsafe extern "C" fn rs_dhcp_register_parser() {
set_tx_detect_flags: None,
get_tx_detect_flags: None,
get_tx_data : None,
apply_tx_config : None,
};
let ip_proto_str = CString::new("udp").unwrap();

@ -1033,6 +1033,7 @@ pub unsafe extern "C" fn rs_dns_udp_register_parser() {
get_de_state: rs_dns_state_get_tx_detect_state,
set_de_state: rs_dns_state_set_tx_detect_state,
get_tx_data: Some(rs_dns_state_get_tx_data),
apply_tx_config: None,
};
let ip_proto_str = CString::new("udp").unwrap();
@ -1079,6 +1080,7 @@ pub unsafe extern "C" fn rs_dns_tcp_register_parser() {
get_de_state: rs_dns_state_get_tx_detect_state,
set_de_state: rs_dns_state_set_tx_detect_state,
get_tx_data: Some(rs_dns_state_get_tx_data),
apply_tx_config: None,
};
let ip_proto_str = CString::new("tcp").unwrap();

@ -736,6 +736,7 @@ pub unsafe extern "C" fn rs_register_ikev2_parser() {
get_tx_detect_flags: None,
set_tx_detect_flags: None,
get_tx_data : None,
apply_tx_config : None,
};
let ip_proto_str = CString::new("udp").unwrap();

@ -683,6 +683,7 @@ pub unsafe extern "C" fn rs_register_krb5_parser() {
get_tx_detect_flags: Some(rs_krb5_tx_detect_flags_get),
set_tx_detect_flags: Some(rs_krb5_tx_detect_flags_set),
get_tx_data : None,
apply_tx_config : None,
};
// register UDP parser
let ip_proto_str = CString::new("udp").unwrap();

@ -435,6 +435,7 @@ pub unsafe extern "C" fn rs_register_ntp_parser() {
get_tx_detect_flags: None,
set_tx_detect_flags: None,
get_tx_data : None,
apply_tx_config : None,
};
let ip_proto_str = CString::new("udp").unwrap();

@ -533,6 +533,7 @@ pub unsafe extern "C" fn rs_rdp_register_parser() {
get_tx_detect_flags: None,
set_tx_detect_flags: None,
get_tx_data: None,
apply_tx_config: None,
};
let ip_proto_str = std::ffi::CString::new("tcp").unwrap();

@ -725,6 +725,7 @@ pub unsafe extern "C" fn rs_rfb_register_parser() {
get_tx_detect_flags: Some(rs_rfb_get_tx_detect_flags),
set_tx_detect_flags: Some(rs_rfb_set_tx_detect_flags),
get_tx_data: None,
apply_tx_config: None,
};
let ip_proto_str = CString::new("tcp").unwrap();

@ -413,6 +413,7 @@ pub unsafe extern "C" fn rs_sip_register_parser() {
get_tx_detect_flags: None,
set_tx_detect_flags: None,
get_tx_data: None,
apply_tx_config: None,
};
let ip_proto_str = CString::new("udp").unwrap();

@ -615,6 +615,7 @@ pub unsafe extern "C" fn rs_register_snmp_parser() {
get_tx_detect_flags: Some(rs_snmp_get_tx_detect_flags),
set_tx_detect_flags: Some(rs_snmp_set_tx_detect_flags),
get_tx_data : None,
apply_tx_config : None,
};
let ip_proto_str = CString::new("udp").unwrap();
if AppLayerProtoDetectConfProtoDetectionEnabled(ip_proto_str.as_ptr(), parser.name) != 0 {

@ -582,6 +582,7 @@ pub unsafe extern "C" fn rs_ssh_register_parser() {
get_tx_detect_flags: Some(rs_ssh_get_tx_detect_flags),
set_tx_detect_flags: Some(rs_ssh_set_tx_detect_flags),
get_tx_data: None,
apply_tx_config: None,
};
let ip_proto_str = CString::new("tcp").unwrap();

@ -126,6 +126,7 @@ typedef struct AppLayerParserProtoCtx_
uint64_t (*GetTxDetectFlags)(void *tx, uint8_t dir);
void (*SetTxDetectFlags)(void *tx, uint8_t dir, uint64_t);
AppLayerTxData *(*GetTxData)(void *tx);
bool (*ApplyTxConfig)(void *state, void *tx, int mode, AppLayerTxConfig);
void (*SetStreamDepthFlag)(void *tx, uint8_t flags);
@ -605,6 +606,16 @@ void AppLayerParserRegisterTxDataFunc(uint8_t ipproto, AppProto alproto,
SCReturn;
}
void AppLayerParserRegisterApplyTxConfigFunc(uint8_t ipproto, AppProto alproto,
bool (*ApplyTxConfig)(void *state, void *tx, int mode, AppLayerTxConfig))
{
SCEnter();
alp_ctx.ctxs[FlowGetProtoMapping(ipproto)][alproto].ApplyTxConfig = ApplyTxConfig;
SCReturn;
}
void AppLayerParserRegisterSetStreamDepthFlag(uint8_t ipproto, AppProto alproto,
void (*SetStreamDepthFlag)(void *tx, uint8_t flags))
{
@ -1219,6 +1230,16 @@ AppLayerTxData *AppLayerParserGetTxData(uint8_t ipproto, AppProto alproto, void
SCReturnPtr(NULL, "AppLayerTxData");
}
void AppLayerParserApplyTxConfig(uint8_t ipproto, AppProto alproto,
void *state, void *tx, enum ConfigAction mode, AppLayerTxConfig config)
{
SCEnter();
if (alp_ctx.ctxs[FlowGetProtoMapping(ipproto)][alproto].ApplyTxConfig) {
alp_ctx.ctxs[FlowGetProtoMapping(ipproto)][alproto].ApplyTxConfig(state, tx, mode, config);
}
SCReturn;
}
/***** General *****/
/** \retval int -1 in case of unrecoverable error. App-layer tracking stops for this flow.

@ -30,6 +30,7 @@
#include "util-file.h"
#include "stream-tcp-private.h"
#include "rust.h"
#include "util-config.h"
/* Flags for AppLayerParserState. */
#define APP_LAYER_PARSER_EOF BIT_U8(0)
@ -189,6 +190,8 @@ void AppLayerParserRegisterSetStreamDepthFlag(uint8_t ipproto, AppProto alproto,
void AppLayerParserRegisterTxDataFunc(uint8_t ipproto, AppProto alproto,
AppLayerTxData *(*GetTxData)(void *tx));
void AppLayerParserRegisterApplyTxConfigFunc(uint8_t ipproto, AppProto alproto,
bool (*ApplyTxConfig)(void *state, void *tx, int mode, AppLayerTxConfig));
/***** Get and transaction functions *****/
@ -240,6 +243,8 @@ void AppLayerParserSetTxDetectFlags(uint8_t ipproto, AppProto alproto, void *tx,
bool AppLayerParserSupportsTxDetectFlags(AppProto alproto);
AppLayerTxData *AppLayerParserGetTxData(uint8_t ipproto, AppProto alproto, void *tx);
void AppLayerParserApplyTxConfig(uint8_t ipproto, AppProto alproto,
void *state, void *tx, enum ConfigAction mode, AppLayerTxConfig);
/***** General *****/

@ -181,6 +181,11 @@ int AppLayerRegisterParser(const struct AppLayerParser *p, AppProto alproto)
p->GetTxData);
}
if (p->ApplyTxConfig) {
AppLayerParserRegisterApplyTxConfigFunc(p->ip_proto, alproto,
p->ApplyTxConfig);
}
return 0;
}

@ -73,6 +73,7 @@ typedef struct AppLayerParser {
uint64_t (*GetTxDetectFlags)(void *, uint8_t);
AppLayerTxData *(*GetTxData)(void *tx);
bool (*ApplyTxConfig)(void *state, void *tx, int mode, AppLayerTxConfig);
} AppLayerParser;
/**

Loading…
Cancel
Save