app-layer: detect flags API calls

Add API meant to replace the MpmIDs API. It uses a u64 for each direction
in a tx to keep track of 2 things:

1. is inspection done?
2. which prefilter engines (like mpm) are already completed
pull/3182/head
Victor Julien 8 years ago
parent 51d429b3b1
commit daeb8fd343

@ -117,6 +117,9 @@ typedef struct AppLayerParserProtoCtx_
DetectEngineState *(*GetTxDetectState)(void *tx);
int (*SetTxDetectState)(void *alstate, void *tx, DetectEngineState *);
uint64_t (*GetTxDetectFlags)(void *tx, uint8_t dir);
void (*SetTxDetectFlags)(void *tx, uint8_t dir, uint64_t);
uint64_t (*GetTxMpmIDs)(void *tx);
int (*SetTxMpmIDs)(void *tx, uint64_t);
@ -563,6 +566,18 @@ void AppLayerParserRegisterDetectStateFuncs(uint8_t ipproto, AppProto alproto,
SCReturn;
}
void AppLayerParserRegisterDetectFlagsFuncs(uint8_t ipproto, AppProto alproto,
uint64_t(*GetTxDetectFlags)(void *tx, uint8_t dir),
void (*SetTxDetectFlags)(void *tx, uint8_t dir, uint64_t))
{
SCEnter();
alp_ctx.ctxs[FlowGetProtoMapping(ipproto)][alproto].GetTxDetectFlags = GetTxDetectFlags;
alp_ctx.ctxs[FlowGetProtoMapping(ipproto)][alproto].SetTxDetectFlags = SetTxDetectFlags;
SCReturn;
}
void AppLayerParserRegisterMpmIDsFuncs(uint8_t ipproto, AppProto alproto,
uint64_t(*GetTxMpmIDs)(void *tx),
int (*SetTxMpmIDs)(void *tx, uint64_t))
@ -971,6 +986,25 @@ int AppLayerParserSetTxDetectState(const Flow *f,
SCReturnInt(r);
}
uint64_t AppLayerParserGetTxDetectFlags(uint8_t ipproto, AppProto alproto, void *tx, uint8_t dir)
{
SCEnter();
uint64_t flags = 0;
if (alp_ctx.ctxs[FlowGetProtoMapping(ipproto)][alproto].GetTxDetectFlags != NULL) {
flags = alp_ctx.ctxs[FlowGetProtoMapping(ipproto)][alproto].GetTxDetectFlags(tx, dir);
}
SCReturnUInt(flags);
}
void AppLayerParserSetTxDetectFlags(uint8_t ipproto, AppProto alproto, void *tx, uint8_t dir, uint64_t flags)
{
SCEnter();
if (alp_ctx.ctxs[FlowGetProtoMapping(ipproto)][alproto].SetTxDetectFlags != NULL) {
alp_ctx.ctxs[FlowGetProtoMapping(ipproto)][alproto].SetTxDetectFlags(tx, dir, flags);
}
SCReturn;
}
uint64_t AppLayerParserGetTxMpmIDs(uint8_t ipproto, AppProto alproto, void *tx)
{
if (alp_ctx.ctxs[FlowGetProtoMapping(ipproto)][alproto].GetTxMpmIDs != NULL) {

@ -40,6 +40,14 @@
/* Flags for AppLayerParserProtoCtx. */
#define APP_LAYER_PARSER_OPT_ACCEPT_GAPS BIT_U64(0)
/* applies to DetectFlags uint64_t field */
/** is tx fully inspected? */
#define APP_LAYER_TX_INSPECTED_FLAG BIT_U64(63)
/** other 63 bits are for tracking which prefilter engine is already
* completely inspected */
#define APP_LAYER_TX_PREFILTER_MASK ~APP_LAYER_TX_INSPECTED_FLAG
int AppLayerParserProtoIsRegistered(uint8_t ipproto, AppProto alproto);
/***** transaction handling *****/
@ -167,6 +175,9 @@ void AppLayerParserRegisterGetStreamDepth(uint8_t ipproto,
void AppLayerParserRegisterMpmIDsFuncs(uint8_t ipproto, AppProto alproto,
uint64_t (*GetTxMpmIDs)(void *tx),
int (*SetTxMpmIDs)(void *tx, uint64_t));
void AppLayerParserRegisterDetectFlagsFuncs(uint8_t ipproto, AppProto alproto,
uint64_t(*GetTxDetectFlags)(void *tx, uint8_t dir),
void (*SetTxDetectFlags)(void *tx, uint8_t dir, uint64_t));
/***** Get and transaction functions *****/
@ -210,6 +221,9 @@ int AppLayerParserHasTxDetectState(uint8_t ipproto, AppProto alproto, void *alst
DetectEngineState *AppLayerParserGetTxDetectState(uint8_t ipproto, AppProto alproto, void *tx);
int AppLayerParserSetTxDetectState(const Flow *f, void *alstate, void *tx, DetectEngineState *s);
uint64_t AppLayerParserGetTxDetectFlags(uint8_t ipproto, AppProto alproto, void *tx, uint8_t dir);
void AppLayerParserSetTxDetectFlags(uint8_t ipproto, AppProto alproto, void *tx, uint8_t dir, uint64_t);
uint64_t AppLayerParserGetTxMpmIDs(uint8_t ipproto, AppProto alproto, void *tx);
int AppLayerParserSetTxMpmIDs(uint8_t ipproto, AppProto alproto, void *tx, uint64_t);

Loading…
Cancel
Save