src: remove truncate fn and glue code

truncate fn is only active and used by dcerpc and smb parsers. In case
stream depth is reached for any side, truncate fn is supposed to set the
tx entity (request/response) in the same direction as complete so the
other side is not forever waiting for data.

However, whether the stream depth is reached is already checked by
AppLayerParserGetStateProgress fn which is called by:
- DetectTx
- DetectEngineInspectBufferGeneric
- AppLayerParserSetTransactionInspectId
- OutputTxLog
- AppLayerParserTransactionsCleanup

and, in such a case, StateGetProgressCompletionStatus is returned for
the respective direction. This fn following efc9a7a, always returns 1
as long as the direction is valid meaning that the progress for the
current direction is marked complete. So, there is no need for the additional
callback to mark the entities as done in case of depth or a gap.
Remove all such glue code and callbacks for truncate fns.

Bug 7044
pull/11488/head
Shivani Bhardwaj 2 years ago committed by Victor Julien
parent 80159eb519
commit f2de3e01cb

@ -394,10 +394,6 @@ pub struct RustParser {
pub flags: u32,
/// Function to handle the end of data coming on one of the sides
/// due to the stream reaching its 'depth' limit.
pub truncate: Option<TruncateFn>,
pub get_frame_id_by_name: Option<GetFrameIdByName>,
pub get_frame_name_by_id: Option<GetFrameNameById>,
}
@ -458,7 +454,6 @@ pub type GetTxIteratorFn = unsafe extern "C" fn (ipproto: u8, alproto: AppPro
pub type GetTxDataFn = unsafe extern "C" fn(*mut c_void) -> *mut AppLayerTxData;
pub type GetStateDataFn = unsafe extern "C" fn(*mut c_void) -> *mut AppLayerStateData;
pub type ApplyTxConfigFn = unsafe extern "C" fn (*mut c_void, *mut c_void, c_int, AppLayerTxConfig);
pub type TruncateFn = unsafe extern "C" fn (*mut c_void, u8);
pub type GetFrameIdByName = unsafe extern "C" fn(*const c_char) -> c_int;
pub type GetFrameNameById = unsafe extern "C" fn(u8) -> *const c_char;

@ -427,7 +427,6 @@ pub unsafe extern "C" fn rs_template_register_parser() {
get_state_data: rs_template_get_state_data,
apply_tx_config: None,
flags: APP_LAYER_PARSER_OPT_ACCEPT_GAPS,
truncate: None,
get_frame_id_by_name: None,
get_frame_name_by_id: None,
};

@ -282,7 +282,6 @@ pub unsafe extern "C" fn rs_bittorrent_dht_udp_register_parser() {
get_state_data: rs_bittorrent_dht_get_state_data,
apply_tx_config: None,
flags: 0,
truncate: None,
get_frame_id_by_name: None,
get_frame_name_by_id: None,
};

@ -322,8 +322,6 @@ pub struct DCERPCState {
pub tc_gap: bool,
pub ts_ssn_gap: bool,
pub tc_ssn_gap: bool,
pub ts_ssn_trunc: bool, /// true if Truncated in this direction
pub tc_ssn_trunc: bool,
pub flow: Option<*const core::Flow>,
state_data: AppLayerStateData,
}
@ -354,8 +352,6 @@ impl DCERPCState {
tx.call_id = call_id;
tx.endianness = endianness;
self.tx_id += 1;
tx.req_done = self.ts_ssn_trunc;
tx.resp_done = self.tc_ssn_trunc;
if self.transactions.len() > unsafe { DCERPC_MAX_TX } {
let mut index = self.tx_index_completed;
for tx_old in &mut self.transactions.range_mut(self.tx_index_completed..) {
@ -1187,33 +1183,6 @@ pub unsafe extern "C" fn rs_dcerpc_state_transaction_free(state: *mut std::os::r
dce_state.free_tx(tx_id);
}
#[no_mangle]
pub unsafe extern "C" fn rs_dcerpc_state_trunc(state: *mut std::os::raw::c_void, direction: u8) {
let dce_state = cast_pointer!(state, DCERPCState);
match direction.into() {
Direction::ToServer => {
dce_state.ts_ssn_trunc = true;
for tx in &mut dce_state.transactions {
tx.req_done = true;
if let Some(flow) = dce_state.flow {
sc_app_layer_parser_trigger_raw_stream_reassembly(flow, Direction::ToServer as i32);
}
}
SCLogDebug!("dce_state.ts_ssn_trunc = true; txs {}", dce_state.transactions.len());
}
Direction::ToClient => {
dce_state.tc_ssn_trunc = true;
for tx in &mut dce_state.transactions {
tx.resp_done = true;
if let Some(flow) = dce_state.flow {
sc_app_layer_parser_trigger_raw_stream_reassembly(flow, Direction::ToClient as i32);
}
}
SCLogDebug!("dce_state.tc_ssn_trunc = true; txs {}", dce_state.transactions.len());
}
}
}
#[no_mangle]
pub unsafe extern "C" fn rs_dcerpc_get_tx(
vtx: *mut std::os::raw::c_void, tx_id: u64,
@ -1367,7 +1336,6 @@ pub unsafe extern "C" fn rs_dcerpc_register_parser() {
get_state_data: rs_dcerpc_get_state_data,
apply_tx_config: None,
flags: APP_LAYER_PARSER_OPT_ACCEPT_GAPS,
truncate: None,
get_frame_id_by_name: None,
get_frame_name_by_id: None,
};

@ -374,7 +374,6 @@ pub unsafe extern "C" fn rs_dcerpc_udp_register_parser() {
get_state_data: rs_dcerpc_udp_get_state_data,
apply_tx_config: None,
flags: 0,
truncate: None,
get_frame_id_by_name: None,
get_frame_name_by_id: None,
};

@ -298,7 +298,6 @@ pub unsafe extern "C" fn rs_dhcp_register_parser() {
get_state_data : rs_dhcp_get_state_data,
apply_tx_config : None,
flags : 0,
truncate : None,
get_frame_id_by_name: None,
get_frame_name_by_id: None,
};

@ -995,7 +995,6 @@ pub unsafe extern "C" fn SCRegisterDnsUdpParser() {
get_state_data: rs_dns_get_state_data,
apply_tx_config: Some(apply_tx_config),
flags: 0,
truncate: None,
get_frame_id_by_name: Some(DnsFrameType::ffi_id_from_name),
get_frame_name_by_id: Some(DnsFrameType::ffi_name_from_id),
};
@ -1041,7 +1040,6 @@ pub unsafe extern "C" fn SCRegisterDnsTcpParser() {
get_state_data: rs_dns_get_state_data,
apply_tx_config: Some(apply_tx_config),
flags: APP_LAYER_PARSER_OPT_ACCEPT_GAPS,
truncate: None,
get_frame_id_by_name: Some(DnsFrameType::ffi_id_from_name),
get_frame_name_by_id: Some(DnsFrameType::ffi_name_from_id),
};

@ -612,7 +612,6 @@ pub unsafe extern "C" fn SCEnipRegisterParsers() {
get_state_data: SCEnipTxGetState_data,
apply_tx_config: None,
flags: 0,
truncate: None,
get_frame_id_by_name: Some(EnipFrameType::ffi_id_from_name),
get_frame_name_by_id: Some(EnipFrameType::ffi_name_from_id),
};

@ -1366,7 +1366,6 @@ pub unsafe extern "C" fn rs_http2_register_parser() {
get_state_data: rs_http2_get_state_data,
apply_tx_config: None,
flags: 0,
truncate: None,
get_frame_id_by_name: None,
get_frame_name_by_id: None,
};

@ -424,7 +424,6 @@ pub unsafe extern "C" fn rs_ike_register_parser() {
get_state_data: rs_ike_get_state_data,
apply_tx_config: None,
flags: 0,
truncate: None,
get_frame_id_by_name: None,
get_frame_name_by_id: None,
};

@ -609,7 +609,6 @@ pub unsafe extern "C" fn rs_register_krb5_parser() {
get_state_data : rs_krb5_get_state_data,
apply_tx_config : None,
flags : 0,
truncate : None,
get_frame_id_by_name: None,
get_frame_name_by_id: None,
};

@ -407,7 +407,6 @@ pub unsafe extern "C" fn rs_modbus_register_parser() {
get_state_data: rs_modbus_get_state_data,
apply_tx_config: None,
flags: 0,
truncate: None,
get_frame_id_by_name: None,
get_frame_name_by_id: None,
};

@ -790,7 +790,6 @@ pub unsafe extern "C" fn SCMqttRegisterParser() {
get_state_data: rs_mqtt_get_state_data,
apply_tx_config: None,
flags: 0,
truncate: None,
get_frame_id_by_name: Some(MQTTFrameType::ffi_id_from_name),
get_frame_name_by_id: Some(MQTTFrameType::ffi_name_from_id),
};

@ -1989,7 +1989,6 @@ pub unsafe extern "C" fn rs_nfs_register_parser() {
get_state_data: rs_nfs_get_state_data,
apply_tx_config: None,
flags: APP_LAYER_PARSER_OPT_ACCEPT_GAPS,
truncate: None,
get_frame_id_by_name: Some(NFSFrameType::ffi_id_from_name),
get_frame_name_by_id: Some(NFSFrameType::ffi_name_from_id),
};
@ -2067,7 +2066,6 @@ pub unsafe extern "C" fn rs_nfs_udp_register_parser() {
get_state_data: rs_nfs_get_state_data,
apply_tx_config: None,
flags: 0,
truncate: None,
get_frame_id_by_name: Some(NFSFrameType::ffi_id_from_name),
get_frame_name_by_id: Some(NFSFrameType::ffi_name_from_id),
};

@ -300,7 +300,6 @@ pub unsafe extern "C" fn rs_register_ntp_parser() {
get_state_data : rs_ntp_get_state_data,
apply_tx_config : None,
flags : 0,
truncate : None,
get_frame_id_by_name: None,
get_frame_name_by_id: None,
};

@ -761,7 +761,6 @@ pub unsafe extern "C" fn rs_pgsql_register_parser() {
get_state_data: rs_pgsql_get_state_data,
apply_tx_config: None,
flags: APP_LAYER_PARSER_OPT_ACCEPT_GAPS,
truncate: None,
get_frame_id_by_name: None,
get_frame_name_by_id: None,
};

@ -508,7 +508,6 @@ pub unsafe extern "C" fn rs_quic_register_parser() {
get_state_data: rs_quic_get_state_data,
apply_tx_config: None,
flags: 0,
truncate: None,
get_frame_id_by_name: None,
get_frame_name_by_id: None,
};

@ -493,7 +493,6 @@ pub unsafe extern "C" fn rs_rdp_register_parser() {
get_state_data: rs_rdp_get_state_data,
apply_tx_config: None,
flags: 0,
truncate: None,
get_frame_id_by_name: None,
get_frame_name_by_id: None,
};

@ -860,7 +860,6 @@ pub unsafe extern "C" fn rs_rfb_register_parser() {
get_state_data: rs_rfb_get_state_data,
apply_tx_config: None,
flags: 0,
truncate: None,
get_frame_id_by_name: Some(RFBFrameType::ffi_id_from_name),
get_frame_name_by_id: Some(RFBFrameType::ffi_name_from_id),
};

@ -570,7 +570,6 @@ pub unsafe extern "C" fn rs_sip_register_parser() {
get_state_data: rs_sip_get_state_data,
apply_tx_config: None,
flags: 0,
truncate: None,
get_frame_id_by_name: Some(SIPFrameType::ffi_id_from_name),
get_frame_name_by_id: Some(SIPFrameType::ffi_name_from_id),
};

@ -2201,23 +2201,6 @@ pub unsafe extern "C" fn rs_smb_get_tx_data(
return &mut tx.tx_data;
}
#[no_mangle]
pub unsafe extern "C" fn rs_smb_state_truncate(
state: *mut std::ffi::c_void,
direction: u8)
{
let state = cast_pointer!(state, SMBState);
match direction.into() {
Direction::ToServer => {
state.trunc_ts();
}
Direction::ToClient => {
state.trunc_tc();
}
}
}
#[no_mangle]
pub unsafe extern "C" fn rs_smb_state_get_event_info_by_id(
event_id: std::os::raw::c_int,
@ -2327,7 +2310,6 @@ pub unsafe extern "C" fn rs_smb_register_parser() {
get_state_data: rs_smb_get_state_data,
apply_tx_config: None,
flags: APP_LAYER_PARSER_OPT_ACCEPT_GAPS,
truncate: Some(rs_smb_state_truncate),
get_frame_id_by_name: Some(SMBFrameType::ffi_id_from_name),
get_frame_name_by_id: Some(SMBFrameType::ffi_name_from_id),
};

@ -406,7 +406,6 @@ pub unsafe extern "C" fn rs_register_snmp_parser() {
get_state_data : rs_snmp_get_state_data,
apply_tx_config : None,
flags : 0,
truncate : None,
get_frame_id_by_name: None,
get_frame_name_by_id: None,
};

@ -464,7 +464,6 @@ pub unsafe extern "C" fn rs_ssh_register_parser() {
get_state_data: rs_ssh_get_state_data,
apply_tx_config: None,
flags: 0,
truncate: None,
get_frame_id_by_name: None,
get_frame_name_by_id: None,
};

@ -537,7 +537,6 @@ pub unsafe extern "C" fn rs_telnet_register_parser() {
get_state_data: rs_telnet_get_state_data,
apply_tx_config: None,
flags: APP_LAYER_PARSER_OPT_ACCEPT_GAPS,
truncate: None,
get_frame_id_by_name: Some(TelnetFrameType::ffi_id_from_name),
get_frame_name_by_id: Some(TelnetFrameType::ffi_name_from_id),

@ -366,7 +366,6 @@ pub unsafe extern "C" fn rs_websocket_register_parser() {
get_state_data: rs_websocket_get_state_data,
apply_tx_config: None,
flags: 0, // do not accept gaps as there is no good way to resync
truncate: None,
get_frame_id_by_name: Some(WebSocketFrameType::ffi_id_from_name),
get_frame_name_by_id: Some(WebSocketFrameType::ffi_name_from_id),
};

@ -83,8 +83,6 @@ typedef struct AppLayerParserProtoCtx_
void *(*LocalStorageAlloc)(void);
void (*LocalStorageFree)(void *);
void (*Truncate)(void *, uint8_t);
/** get FileContainer reference from the TX. MUST return a non-NULL reference if the TX
* has or may have files in the requested direction at some point. */
AppLayerGetFileState (*GetTxFiles)(void *, uint8_t);
@ -465,16 +463,6 @@ void AppLayerParserRegisterLogger(uint8_t ipproto, AppProto alproto)
SCReturn;
}
void AppLayerParserRegisterTruncateFunc(uint8_t ipproto, AppProto alproto,
void (*Truncate)(void *, uint8_t))
{
SCEnter();
alp_ctx.ctxs[FlowGetProtoMapping(ipproto)][alproto].Truncate = Truncate;
SCReturn;
}
void AppLayerParserRegisterGetStateProgressFunc(uint8_t ipproto, AppProto alproto,
int (*StateGetProgress)(void *alstate, uint8_t direction))
{

@ -182,8 +182,6 @@ void AppLayerParserRegisterGetTxFilesFunc(
uint8_t ipproto, AppProto alproto, AppLayerGetFileState (*GetTxFiles)(void *, uint8_t));
void AppLayerParserRegisterLogger(uint8_t ipproto, AppProto alproto);
void AppLayerParserRegisterLoggerBits(uint8_t ipproto, AppProto alproto, LoggerId bits);
void AppLayerParserRegisterTruncateFunc(uint8_t ipproto, AppProto alproto,
void (*Truncate)(void *, uint8_t));
void AppLayerParserRegisterGetStateProgressFunc(uint8_t ipproto, AppProto alproto,
int (*StateGetStateProgress)(void *alstate, uint8_t direction));
void AppLayerParserRegisterTxFreeFunc(uint8_t ipproto, AppProto alproto,

@ -183,10 +183,6 @@ int AppLayerRegisterParser(const struct AppLayerParser *p, AppProto alproto)
}
if (p->Truncate) {
AppLayerParserRegisterTruncateFunc(p->ip_proto, alproto, p->Truncate);
}
if (p->GetFrameIdByName && p->GetFrameNameById) {
AppLayerParserRegisterGetFrameFuncs(
p->ip_proto, alproto, p->GetFrameIdByName, p->GetFrameNameById);

@ -71,8 +71,6 @@ typedef struct AppLayerParser {
uint32_t flags;
void (*Truncate)(void *state, uint8_t direction);
AppLayerParserGetFrameIdByNameFn GetFrameIdByName;
AppLayerParserGetFrameNameByIdFn GetFrameNameById;

Loading…
Cancel
Save