OISF/suricata
1
0
Fork 0
mirror of https://github.com/OISF/suricata.git synced 2026-10-11 22:09:53 +00:00
Code Issues Packages Projects Releases Wiki Activity

app-layer: make number of alprotos dynamic

Browse Source 
Ticket: 5053

The names are now dynamically registered at runtime.
The AppProto alproto enum identifiers are still static for now.

This is the final step before app-layer plugins.
This commit is contained in:
Philippe Antoine
2025-01-13 13:35:13 +01:00
parent e6be049c5d
commit ae1a4ef757
17 changed files with 163 additions and 125 deletions
Download Patch File Download Diff File Expand all files Collapse all files
scripts/setup-app-layer.py
+1 -1
View File
@@ -129,7 +129,7 @@ def patch_app_layer_protos_h(protoname):
open(filename, "w").write(output.getvalue())
def patch_app_layer_protos_c(protoname):
filename = "src/app-layer-protos.c"
filename = "src/app-layer.c"
print("Patching %s." % (filename))
output = io.StringIO()
src/app-layer-detect-proto.c
+20 -20
View File
@@ -292,7 +292,7 @@ static inline int PMGetProtoInspect(AppLayerProtoDetectThreadCtx *tctx,
}
/* alproto bit field */
uint8_t pm_results_bf[(ALPROTO_MAX / 8) + 1];
uint8_t pm_results_bf[(g_alproto_max / 8) + 1];
memset(pm_results_bf, 0, sizeof(pm_results_bf));
/* loop through unique pattern id's. Can't use search_cnt here,
@@ -324,7 +324,7 @@ static inline int PMGetProtoInspect(AppLayerProtoDetectThreadCtx *tctx,
/** \internal
* \brief Run Pattern Sigs against buffer
* \param direction direction for the patterns
* \param pm_results[out] AppProto array of size ALPROTO_MAX */
* \param pm_results[out] AppProto array of size g_alproto_max */
static AppProto AppLayerProtoDetectPMGetProto(AppLayerProtoDetectThreadCtx *tctx, Flow *f,
const uint8_t *buf, uint32_t buflen, uint8_t flags, AppProto *pm_results, bool *rflow)
{
@@ -804,7 +804,7 @@ static AppLayerProtoDetectProbingParserElement *AppLayerProtoDetectProbingParser
"register the probing parser. min_depth >= max_depth");
goto error;
}
if (alproto <= ALPROTO_UNKNOWN || alproto >= ALPROTO_MAX) {
if (alproto <= ALPROTO_UNKNOWN || alproto >= g_alproto_max) {
SCLogError("Invalid arguments sent to register "
"the probing parser. Invalid alproto - %d",
alproto);
@@ -1411,7 +1411,7 @@ AppProto AppLayerProtoDetectGetProto(AppLayerProtoDetectThreadCtx *tctx, Flow *f
AppProto pm_alproto = ALPROTO_UNKNOWN;
if (!FLOW_IS_PM_DONE(f, flags)) {
AppProto pm_results[ALPROTO_MAX];
AppProto pm_results[g_alproto_max];
uint16_t pm_matches = AppLayerProtoDetectPMGetProto(
tctx, f, buf, buflen, flags, pm_results, reverse_flow);
if (pm_matches > 0) {
@@ -1725,12 +1725,12 @@ int AppLayerProtoDetectSetup(void)
}
}
alpd_ctx.alproto_names = SCCalloc(ALPROTO_MAX, sizeof(char *));
alpd_ctx.alproto_names = SCCalloc(g_alproto_max, sizeof(char *));
if (unlikely(alpd_ctx.alproto_names == NULL)) {
FatalError("Unable to alloc alproto_names.");
}
// to realloc when dynamic protos are added
alpd_ctx.expectation_proto = SCCalloc(ALPROTO_MAX, sizeof(uint8_t));
alpd_ctx.expectation_proto = SCCalloc(g_alproto_max, sizeof(uint8_t));
if (unlikely(alpd_ctx.expectation_proto == NULL)) {
FatalError("Unable to alloc expectation_proto.");
}
@@ -2090,7 +2090,7 @@ AppProto AppLayerProtoDetectGetProtoByName(const char *alproto_name)
AppProto a;
AppProto b = StringToAppProto(alproto_name);
for (a = 0; a < ALPROTO_MAX; a++) {
for (a = 0; a < g_alproto_max; a++) {
if (alpd_ctx.alproto_names[a] != NULL && AppProtoEquals(b, a)) {
// That means return HTTP_ANY if HTTP1 or HTTP2 is enabled
SCReturnCT(b, "AppProto");
@@ -2121,11 +2121,11 @@ void AppLayerProtoDetectSupportedAppProtocols(AppProto *alprotos)
{
SCEnter();
memset(alprotos, 0, ALPROTO_MAX * sizeof(AppProto));
memset(alprotos, 0, g_alproto_max * sizeof(AppProto));
int alproto;
for (alproto = 0; alproto != ALPROTO_MAX; alproto++) {
for (alproto = 0; alproto != g_alproto_max; alproto++) {
if (alpd_ctx.alproto_names[alproto] != NULL)
alprotos[alproto] = 1;
}
@@ -2229,7 +2229,7 @@ static int AppLayerProtoDetectTest03(void)
AppLayerProtoDetectSetup();
uint8_t l7data[] = "HTTP/1.1 200 OK\r\nServer: Apache/1.0\r\n\r\n";
AppProto pm_results[ALPROTO_MAX];
AppProto pm_results[g_alproto_max];
memset(pm_results, 0, sizeof(pm_results));
Flow f;
memset(&f, 0x00, sizeof(f));
@@ -2276,7 +2276,7 @@ static int AppLayerProtoDetectTest04(void)
uint8_t l7data[] = "HTTP/1.1 200 OK\r\nServer: Apache/1.0\r\n\r\n";
Flow f;
memset(&f, 0x00, sizeof(f));
AppProto pm_results[ALPROTO_MAX];
AppProto pm_results[g_alproto_max];
memset(pm_results, 0, sizeof(pm_results));
f.protomap = FlowGetProtoMapping(IPPROTO_TCP);
@@ -2314,7 +2314,7 @@ static int AppLayerProtoDetectTest05(void)
AppLayerProtoDetectSetup();
uint8_t l7data[] = "HTTP/1.1 200 OK\r\nServer: Apache/1.0\r\n\r\n<HTML><BODY>Blahblah</BODY></HTML>";
AppProto pm_results[ALPROTO_MAX];
AppProto pm_results[g_alproto_max];
memset(pm_results, 0, sizeof(pm_results));
Flow f;
memset(&f, 0x00, sizeof(f));
@@ -2358,7 +2358,7 @@ static int AppLayerProtoDetectTest06(void)
AppLayerProtoDetectSetup();
uint8_t l7data[] = "220 Welcome to the OISF FTP server\r\n";
AppProto pm_results[ALPROTO_MAX];
AppProto pm_results[g_alproto_max];
memset(pm_results, 0, sizeof(pm_results));
Flow f;
memset(&f, 0x00, sizeof(f));
@@ -2404,7 +2404,7 @@ static int AppLayerProtoDetectTest07(void)
Flow f;
memset(&f, 0x00, sizeof(f));
f.protomap = FlowGetProtoMapping(IPPROTO_TCP);
AppProto pm_results[ALPROTO_MAX];
AppProto pm_results[g_alproto_max];
memset(pm_results, 0, sizeof(pm_results));
const char *buf = "HTTP";
@@ -2458,7 +2458,7 @@ static int AppLayerProtoDetectTest08(void)
0x20, 0x4c, 0x4d, 0x20, 0x30, 0x2e, 0x31, 0x32,
0x00
};
AppProto pm_results[ALPROTO_MAX];
AppProto pm_results[g_alproto_max];
memset(pm_results, 0, sizeof(pm_results));
Flow f;
memset(&f, 0x00, sizeof(f));
@@ -2513,7 +2513,7 @@ static int AppLayerProtoDetectTest09(void)
0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
0x00, 0x02, 0x02
};
AppProto pm_results[ALPROTO_MAX];
AppProto pm_results[g_alproto_max];
memset(pm_results, 0, sizeof(pm_results));
Flow f;
memset(&f, 0x00, sizeof(f));
@@ -2563,7 +2563,7 @@ static int AppLayerProtoDetectTest10(void)
0xeb, 0x1c, 0xc9, 0x11, 0x9f, 0xe8, 0x08, 0x00,
0x2b, 0x10, 0x48, 0x60, 0x02, 0x00, 0x00, 0x00
};
AppProto pm_results[ALPROTO_MAX];
AppProto pm_results[g_alproto_max];
memset(pm_results, 0, sizeof(pm_results));
Flow f;
memset(&f, 0x00, sizeof(f));
@@ -2608,7 +2608,7 @@ static int AppLayerProtoDetectTest11(void)
uint8_t l7data[] = "CONNECT www.ssllabs.com:443 HTTP/1.0\r\n";
uint8_t l7data_resp[] = "HTTP/1.1 405 Method Not Allowed\r\n";
AppProto pm_results[ALPROTO_MAX];
AppProto pm_results[g_alproto_max];
memset(pm_results, 0, sizeof(pm_results));
Flow f;
memset(&f, 0x00, sizeof(f));
@@ -2733,7 +2733,7 @@ static int AppLayerProtoDetectTest13(void)
uint8_t l7data[] = "CONNECT www.ssllabs.com:443 HTTP/1.0\r\n";
uint8_t l7data_resp[] = "HTTP/1.1 405 Method Not Allowed\r\n";
AppProto pm_results[ALPROTO_MAX];
AppProto pm_results[g_alproto_max];
Flow f;
memset(&f, 0x00, sizeof(f));
@@ -2804,7 +2804,7 @@ static int AppLayerProtoDetectTest14(void)
uint8_t l7data[] = "CONNECT www.ssllabs.com:443 HTTP/1.0\r\n";
uint8_t l7data_resp[] = "HTTP/1.1 405 Method Not Allowed\r\n";
AppProto pm_results[ALPROTO_MAX];
AppProto pm_results[g_alproto_max];
uint32_t cnt;
Flow f;
memset(&f, 0x00, sizeof(f));
src/app-layer-frames.c
+4 -4
View File
@@ -33,16 +33,16 @@
struct FrameConfig {
SC_ATOMIC_DECLARE(uint64_t, types);
};
/* This array should be allocated to contain ALPROTO_MAX protocols. */
/* This array should be allocated to contain g_alproto_max protocols. */
static struct FrameConfig *frame_config;
void FrameConfigInit(void)
{
frame_config = SCCalloc(ALPROTO_MAX, sizeof(struct FrameConfig));
frame_config = SCCalloc(g_alproto_max, sizeof(struct FrameConfig));
if (unlikely(frame_config == NULL)) {
FatalError("Unable to alloc frame_config.");
}
for (AppProto p = 0; p < ALPROTO_MAX; p++) {
for (AppProto p = 0; p < g_alproto_max; p++) {
SC_ATOMIC_INIT(frame_config[p].types);
}
}
@@ -55,7 +55,7 @@ void FrameConfigDeInit(void)
void FrameConfigEnableAll(void)
{
const uint64_t bits = UINT64_MAX;
for (AppProto p = 0; p < ALPROTO_MAX; p++) {
for (AppProto p = 0; p < g_alproto_max; p++) {
struct FrameConfig *fc = &frame_config[p];
SC_ATOMIC_OR(fc->types, bits);
}
src/app-layer-parser.c
+8 -8
View File
@@ -249,8 +249,8 @@ int AppLayerParserSetup(void)
{
SCEnter();
// initial allocation that will later be grown using realloc,
// when new protocols register themselves and make ALPROTO_MAX grow
alp_ctx.ctxs = SCCalloc(ALPROTO_MAX, sizeof(AppLayerParserProtoCtx[FLOW_PROTO_MAX]));
// when new protocols register themselves and make g_alproto_max grow
alp_ctx.ctxs = SCCalloc(g_alproto_max, sizeof(AppLayerParserProtoCtx[FLOW_PROTO_MAX]));
if (unlikely(alp_ctx.ctxs == NULL)) {
FatalError("Unable to alloc alp_ctx.ctxs.");
}
@@ -261,7 +261,7 @@ void AppLayerParserPostStreamSetup(void)
{
/* lets set a default value for stream_depth */
for (int flow_proto = 0; flow_proto < FLOW_PROTO_DEFAULT; flow_proto++) {
for (AppProto alproto = 0; alproto < ALPROTO_MAX; alproto++) {
for (AppProto alproto = 0; alproto < g_alproto_max; alproto++) {
if (!(alp_ctx.ctxs[alproto][flow_proto].internal_flags &
APP_LAYER_PARSER_INT_STREAM_DEPTH_SET)) {
alp_ctx.ctxs[alproto][flow_proto].stream_depth = stream_config.reassembly_depth;
@@ -290,14 +290,14 @@ AppLayerParserThreadCtx *AppLayerParserThreadCtxAlloc(void)
if (tctx == NULL)
goto end;
tctx->alproto_local_storage = SCCalloc(ALPROTO_MAX, sizeof(void *[FLOW_PROTO_MAX]));
tctx->alproto_local_storage = SCCalloc(g_alproto_max, sizeof(void *[FLOW_PROTO_MAX]));
if (unlikely(tctx->alproto_local_storage == NULL)) {
SCFree(tctx);
tctx = NULL;
goto end;
}
for (uint8_t flow_proto = 0; flow_proto < FLOW_PROTO_DEFAULT; flow_proto++) {
for (AppProto alproto = 0; alproto < ALPROTO_MAX; alproto++) {
for (AppProto alproto = 0; alproto < g_alproto_max; alproto++) {
uint8_t ipproto = FlowGetReverseProtoMapping(flow_proto);
tctx->alproto_local_storage[alproto][flow_proto] =
@@ -314,7 +314,7 @@ void AppLayerParserThreadCtxFree(AppLayerParserThreadCtx *tctx)
SCEnter();
for (uint8_t flow_proto = 0; flow_proto < FLOW_PROTO_DEFAULT; flow_proto++) {
for (AppProto alproto = 0; alproto < ALPROTO_MAX; alproto++) {
for (AppProto alproto = 0; alproto < g_alproto_max; alproto++) {
uint8_t ipproto = FlowGetReverseProtoMapping(flow_proto);
AppLayerParserDestroyProtocolParserLocalStorage(
@@ -1695,7 +1695,7 @@ static void ValidateParser(AppProto alproto)
static void ValidateParsers(void)
{
AppProto p = 0;
for ( ; p < ALPROTO_MAX; p++) {
for (; p < g_alproto_max; p++) {
ValidateParser(p);
}
}
@@ -1795,7 +1795,7 @@ void AppLayerParserRegisterUnittests(void)
AppLayerParserProtoCtx *ctx;
for (ip = 0; ip < FLOW_PROTO_DEFAULT; ip++) {
for (alproto = 0; alproto < ALPROTO_MAX; alproto++) {
for (alproto = 0; alproto < g_alproto_max; alproto++) {
ctx = &alp_ctx.ctxs[alproto][ip];
if (ctx->RegisterUnittests == NULL)
continue;
src/app-layer-protos.c
+37 -47
View File
@@ -24,53 +24,18 @@
#include "suricata-common.h"
#include "app-layer-protos.h"
#include "rust.h"
AppProto g_alproto_max = ALPROTO_MAX_STATIC + 1;
#define ARRAY_CAP_STEP 16
AppProto g_alproto_strings_cap = ALPROTO_MAX_STATIC + 1;
typedef struct AppProtoStringTuple {
AppProto alproto;
const char *str;
} AppProtoStringTuple;
const AppProtoStringTuple AppProtoStrings[ALPROTO_MAX] = {
{ ALPROTO_UNKNOWN, "unknown" },
{ ALPROTO_FAILED, "failed" },
{ ALPROTO_HTTP1, "http1" },
{ ALPROTO_FTP, "ftp" },
{ ALPROTO_SMTP, "smtp" },
{ ALPROTO_TLS, "tls" },
{ ALPROTO_SSH, "ssh" },
{ ALPROTO_IMAP, "imap" },
{ ALPROTO_JABBER, "jabber" },
{ ALPROTO_SMB, "smb" },
{ ALPROTO_DCERPC, "dcerpc" },
{ ALPROTO_IRC, "irc" },
{ ALPROTO_DNS, "dns" },
{ ALPROTO_MODBUS, "modbus" },
{ ALPROTO_ENIP, "enip" },
{ ALPROTO_DNP3, "dnp3" },
{ ALPROTO_NFS, "nfs" },
{ ALPROTO_NTP, "ntp" },
{ ALPROTO_FTPDATA, "ftp-data" },
{ ALPROTO_TFTP, "tftp" },
{ ALPROTO_IKE, "ike" },
{ ALPROTO_KRB5, "krb5" },
{ ALPROTO_QUIC, "quic" },
{ ALPROTO_DHCP, "dhcp" },
{ ALPROTO_SNMP, "snmp" },
{ ALPROTO_SIP, "sip" },
{ ALPROTO_RFB, "rfb" },
{ ALPROTO_MQTT, "mqtt" },
{ ALPROTO_PGSQL, "pgsql" },
{ ALPROTO_TELNET, "telnet" },
{ ALPROTO_WEBSOCKET, "websocket" },
{ ALPROTO_LDAP, "ldap" },
{ ALPROTO_DOH2, "doh2" },
{ ALPROTO_TEMPLATE, "template" },
{ ALPROTO_RDP, "rdp" },
{ ALPROTO_HTTP2, "http2" },
{ ALPROTO_BITTORRENT_DHT, "bittorrent-dht" },
{ ALPROTO_POP3, "pop3" },
{ ALPROTO_HTTP, "http" },
};
AppProtoStringTuple *g_alproto_strings = NULL;
const char *AppProtoToString(AppProto alproto)
{
@@ -84,9 +49,9 @@ const char *AppProtoToString(AppProto alproto)
proto_name = "http_any";
break;
default:
if (alproto < ARRAY_SIZE(AppProtoStrings)) {
BUG_ON(AppProtoStrings[alproto].alproto != alproto);
proto_name = AppProtoStrings[alproto].str;
if (alproto < g_alproto_max) {
BUG_ON(g_alproto_strings[alproto].alproto != alproto);
proto_name = g_alproto_strings[alproto].str;
}
}
return proto_name;
@@ -98,10 +63,35 @@ AppProto StringToAppProto(const char *proto_name)
return ALPROTO_UNKNOWN;
// We could use a Multi Pattern Matcher
for (size_t i = 0; i < ARRAY_SIZE(AppProtoStrings); i++) {
if (strcmp(proto_name, AppProtoStrings[i].str) == 0)
return AppProtoStrings[i].alproto;
for (size_t i = 0; i < g_alproto_max; i++) {
if (strcmp(proto_name, g_alproto_strings[i].str) == 0)
return g_alproto_strings[i].alproto;
}
return ALPROTO_UNKNOWN;
}
void AppProtoRegisterProtoString(AppProto alproto, const char *proto_name)
{
if (alproto < ALPROTO_MAX_STATIC) {
if (g_alproto_strings == NULL) {
g_alproto_strings = SCCalloc(g_alproto_strings_cap, sizeof(AppProtoStringTuple));
if (g_alproto_strings == NULL) {
FatalError("Unable to allocate g_alproto_strings");
}
}
} else if (alproto + 1 == g_alproto_max) {
if (g_alproto_max == g_alproto_strings_cap) {
void *tmp = SCRealloc(g_alproto_strings,
sizeof(AppProtoStringTuple) * (g_alproto_strings_cap + ARRAY_CAP_STEP));
if (tmp == NULL) {
FatalError("Unable to reallocate g_alproto_strings");
}
g_alproto_strings_cap += ARRAY_CAP_STEP;
g_alproto_strings = tmp;
}
g_alproto_max++;
}
g_alproto_strings[alproto].str = proto_name;
g_alproto_strings[alproto].alproto = alproto;
}
src/app-layer-protos.h
+6 -2
View File
@@ -76,16 +76,18 @@ enum AppProtoEnum {
ALPROTO_HTTP,
/* keep last */
ALPROTO_MAX,
ALPROTO_MAX_STATIC,
// After this ALPROTO_MAX_STATIC can come dynamic alproto ids
};
// NOTE: if ALPROTO's get >= 256, update SignatureNonPrefilterStore
/* not using the enum as that is a unsigned int, so 4 bytes */
typedef uint16_t AppProto;
extern AppProto g_alproto_max;
static inline bool AppProtoIsValid(AppProto a)
{
return ((a > ALPROTO_FAILED && a < ALPROTO_MAX));
return ((a > ALPROTO_FAILED && a < g_alproto_max));
}
// whether a signature AppProto matches a flow (or signature) AppProto
@@ -173,4 +175,6 @@ const char *AppProtoToString(AppProto alproto);
*/
AppProto StringToAppProto(const char *proto_name);
void AppProtoRegisterProtoString(AppProto alproto, const char *proto_name);
#endif /* SURICATA_APP_LAYER_PROTOS_H */
src/app-layer.c
+51 -8
View File
@@ -1015,12 +1015,12 @@ void AppLayerListSupportedProtocols(void)
SCEnter();
AppProto alproto;
AppProto alprotos[ALPROTO_MAX];
AppProto alprotos[g_alproto_max];
AppLayerProtoDetectSupportedAppProtocols(alprotos);
printf("=========Supported App Layer Protocols=========\n");
for (alproto = 0; alproto < ALPROTO_MAX; alproto++) {
for (alproto = 0; alproto < g_alproto_max; alproto++) {
if (alprotos[alproto] == 1)
printf("%s\n", AppLayerGetProtoName(alproto));
}
@@ -1029,11 +1029,54 @@ void AppLayerListSupportedProtocols(void)
}
/***** Setup/General Registration *****/
static void AppLayerNamesSetup(void)
{
AppProtoRegisterProtoString(ALPROTO_UNKNOWN, "unknown");
AppProtoRegisterProtoString(ALPROTO_FAILED, "failed");
AppProtoRegisterProtoString(ALPROTO_HTTP1, "http1");
AppProtoRegisterProtoString(ALPROTO_FTP, "ftp");
AppProtoRegisterProtoString(ALPROTO_SMTP, "smtp");
AppProtoRegisterProtoString(ALPROTO_TLS, "tls");
AppProtoRegisterProtoString(ALPROTO_SSH, "ssh");
AppProtoRegisterProtoString(ALPROTO_IMAP, "imap");
AppProtoRegisterProtoString(ALPROTO_JABBER, "jabber");
AppProtoRegisterProtoString(ALPROTO_SMB, "smb");
AppProtoRegisterProtoString(ALPROTO_DCERPC, "dcerpc");
AppProtoRegisterProtoString(ALPROTO_IRC, "irc");
AppProtoRegisterProtoString(ALPROTO_DNS, "dns");
AppProtoRegisterProtoString(ALPROTO_MODBUS, "modbus");
AppProtoRegisterProtoString(ALPROTO_ENIP, "enip");
AppProtoRegisterProtoString(ALPROTO_DNP3, "dnp3");
AppProtoRegisterProtoString(ALPROTO_NFS, "nfs");
AppProtoRegisterProtoString(ALPROTO_NTP, "ntp");
AppProtoRegisterProtoString(ALPROTO_FTPDATA, "ftp-data");
AppProtoRegisterProtoString(ALPROTO_TFTP, "tftp");
AppProtoRegisterProtoString(ALPROTO_IKE, "ike");
AppProtoRegisterProtoString(ALPROTO_KRB5, "krb5");
AppProtoRegisterProtoString(ALPROTO_QUIC, "quic");
AppProtoRegisterProtoString(ALPROTO_DHCP, "dhcp");
AppProtoRegisterProtoString(ALPROTO_SNMP, "snmp");
AppProtoRegisterProtoString(ALPROTO_SIP, "sip");
AppProtoRegisterProtoString(ALPROTO_RFB, "rfb");
AppProtoRegisterProtoString(ALPROTO_MQTT, "mqtt");
AppProtoRegisterProtoString(ALPROTO_PGSQL, "pgsql");
AppProtoRegisterProtoString(ALPROTO_TELNET, "telnet");
AppProtoRegisterProtoString(ALPROTO_WEBSOCKET, "websocket");
AppProtoRegisterProtoString(ALPROTO_LDAP, "ldap");
AppProtoRegisterProtoString(ALPROTO_DOH2, "doh2");
AppProtoRegisterProtoString(ALPROTO_TEMPLATE, "template");
AppProtoRegisterProtoString(ALPROTO_RDP, "rdp");
AppProtoRegisterProtoString(ALPROTO_HTTP2, "http2");
AppProtoRegisterProtoString(ALPROTO_BITTORRENT_DHT, "bittorrent-dht");
AppProtoRegisterProtoString(ALPROTO_POP3, "pop3");
AppProtoRegisterProtoString(ALPROTO_HTTP, "http");
}
int AppLayerSetup(void)
{
SCEnter();
AppLayerNamesSetup();
AppLayerProtoDetectSetup();
AppLayerParserSetup();
@@ -1152,16 +1195,16 @@ static void AppLayerSetupExceptionPolicyPerProtoCounters(
void AppLayerSetupCounters(void)
{
const uint8_t ipprotos[] = { IPPROTO_TCP, IPPROTO_UDP };
AppProto alprotos[ALPROTO_MAX];
AppProto alprotos[g_alproto_max];
const char *str = "app_layer.flow.";
const char *estr = "app_layer.error.";
applayer_counter_names =
SCCalloc(ALPROTO_MAX, sizeof(AppLayerCounterNames[FLOW_PROTO_APPLAYER_MAX]));
SCCalloc(g_alproto_max, sizeof(AppLayerCounterNames[FLOW_PROTO_APPLAYER_MAX]));
if (unlikely(applayer_counter_names == NULL)) {
FatalError("Unable to alloc applayer_counter_names.");
}
applayer_counters = SCCalloc(ALPROTO_MAX, sizeof(AppLayerCounters[FLOW_PROTO_APPLAYER_MAX]));
applayer_counters = SCCalloc(g_alproto_max, sizeof(AppLayerCounters[FLOW_PROTO_APPLAYER_MAX]));
if (unlikely(applayer_counters == NULL)) {
FatalError("Unable to alloc applayer_counters.");
}
@@ -1186,7 +1229,7 @@ void AppLayerSetupCounters(void)
const char *ipproto_suffix = (ipproto == IPPROTO_TCP) ? "_tcp" : "_udp";
uint8_t ipprotos_all[256 / 8];
for (AppProto alproto = 0; alproto < ALPROTO_MAX; alproto++) {
for (AppProto alproto = 0; alproto < g_alproto_max; alproto++) {
if (alprotos[alproto] == 1) {
const char *tx_str = "app_layer.tx.";
const char *alproto_str = AppLayerGetProtoName(alproto);
@@ -1261,7 +1304,7 @@ void AppLayerSetupCounters(void)
void AppLayerRegisterThreadCounters(ThreadVars *tv)
{
const uint8_t ipprotos[] = { IPPROTO_TCP, IPPROTO_UDP };
AppProto alprotos[ALPROTO_MAX];
AppProto alprotos[g_alproto_max];
AppLayerProtoDetectSupportedAppProtocols(alprotos);
/* We don't log stats counters if exception policy is `ignore`/`not set` */
@@ -1279,7 +1322,7 @@ void AppLayerRegisterThreadCounters(ThreadVars *tv)
const uint8_t ipproto = ipprotos[p];
const uint8_t ipproto_map = FlowGetProtoMapping(ipproto);
for (AppProto alproto = 0; alproto < ALPROTO_MAX; alproto++) {
for (AppProto alproto = 0; alproto < g_alproto_max; alproto++) {
if (alprotos[alproto] == 1) {
applayer_counters[alproto][ipproto_map].counter_id =
StatsRegisterCounter(applayer_counter_names[alproto][ipproto_map].name, tv);
src/detect-engine-build.c
+4 -3
View File
@@ -625,10 +625,11 @@ static json_t *RulesGroupPrintSghStats(const DetectEngineCtx *de_ctx, const SigG
} mpm_stats[max_buffer_type_id];
memset(mpm_stats, 0x00, sizeof(mpm_stats));
uint32_t alstats[ALPROTO_MAX] = {0};
uint32_t alstats[g_alproto_max];
memset(alstats, 0, g_alproto_max * sizeof(uint32_t));
uint32_t mpm_sizes[max_buffer_type_id][256];
memset(mpm_sizes, 0, sizeof(mpm_sizes));
uint32_t alproto_mpm_bufs[ALPROTO_MAX][max_buffer_type_id];
uint32_t alproto_mpm_bufs[g_alproto_max][max_buffer_type_id];
memset(alproto_mpm_bufs, 0, sizeof(alproto_mpm_bufs));
DEBUG_VALIDATE_BUG_ON(sgh->init == NULL);
@@ -790,7 +791,7 @@ static json_t *RulesGroupPrintSghStats(const DetectEngineCtx *de_ctx, const SigG
json_object_set_new(types, "any5", json_integer(any5_cnt));
json_object_set_new(stats, "types", types);
for (AppProto i = 0; i < ALPROTO_MAX; i++) {
for (AppProto i = 0; i < g_alproto_max; i++) {
if (alstats[i] > 0) {
json_t *app = json_object();
json_object_set_new(app, "total", json_integer(alstats[i]));
src/detect-engine-mpm.c
+1 -1
View File
@@ -1975,7 +1975,7 @@ static void PrepareMpms(DetectEngineCtx *de_ctx, SigGroupHead *sh)
const int max_buffer_id = de_ctx->buffer_type_id + 1;
const uint32_t max_sid = DetectEngineGetMaxSigId(de_ctx) / 8 + 1;
AppProto engines[max_buffer_id][ALPROTO_MAX];
AppProto engines[max_buffer_id][g_alproto_max];
memset(engines, 0, sizeof(engines));
int engines_idx[max_buffer_id];
memset(engines_idx, 0, sizeof(engines_idx));
src/detect-engine-prefilter.c
+1 -1
View File
@@ -521,7 +521,7 @@ void PrefilterSetupRuleGroup(DetectEngineCtx *de_ctx, SigGroupHead *sgh)
/* per alproto to set is_last_for_progress per alproto because the inspect
* loop skips over engines that are not the correct alproto */
for (AppProto a = ALPROTO_FAILED + 1; a < ALPROTO_MAX; a++) {
for (AppProto a = ALPROTO_FAILED + 1; a < g_alproto_max; a++) {
int last_tx_progress = 0;
bool last_tx_progress_set = false;
PrefilterEngine *prev_engine = NULL;
src/detect-file-data.c
+2 -2
View File
@@ -97,11 +97,11 @@ static void SetupDetectEngineConfig(DetectEngineCtx *de_ctx) {
if (de_ctx->filedata_config)
return;
de_ctx->filedata_config = SCMalloc(ALPROTO_MAX * sizeof(DetectFileDataCfg));
de_ctx->filedata_config = SCMalloc(g_alproto_max * sizeof(DetectFileDataCfg));
if (unlikely(de_ctx->filedata_config == NULL))
return;
/* initialize default */
for (AppProto i = 0; i < ALPROTO_MAX; i++) {
for (AppProto i = 0; i < g_alproto_max; i++) {
de_ctx->filedata_config[i].content_limit = FILEDATA_CONTENT_LIMIT;
de_ctx->filedata_config[i].content_inspect_min_size = FILEDATA_CONTENT_INSPECT_MIN_SIZE;
}
src/output-tx.c
+7 -7
View File
@@ -67,7 +67,7 @@ int SCOutputRegisterTxLogger(LoggerId id, const char *name, AppProto alproto, Tx
ThreadInitFunc ThreadInit, ThreadDeinitFunc ThreadDeinit)
{
if (list == NULL) {
list = SCCalloc(ALPROTO_MAX, sizeof(OutputTxLogger *));
list = SCCalloc(g_alproto_max, sizeof(OutputTxLogger *));
if (unlikely(list == NULL)) {
SCLogError("Failed to allocate OutputTx list");
return -1;
@@ -547,14 +547,14 @@ end:
static TmEcode OutputTxLogThreadInit(ThreadVars *tv, const void *_initdata, void **data)
{
OutputTxLoggerThreadData *td =
SCCalloc(1, sizeof(*td) + ALPROTO_MAX * sizeof(OutputLoggerThreadStore *));
SCCalloc(1, sizeof(*td) + g_alproto_max * sizeof(OutputLoggerThreadStore *));
if (td == NULL)
return TM_ECODE_FAILED;
*data = (void *)td;
SCLogDebug("OutputTxLogThreadInit happy (*data %p)", *data);
for (AppProto alproto = 0; alproto < ALPROTO_MAX; alproto++) {
for (AppProto alproto = 0; alproto < g_alproto_max; alproto++) {
OutputTxLogger *logger = list[alproto];
while (logger) {
if (logger->ThreadInit) {
@@ -603,7 +603,7 @@ static TmEcode OutputTxLogThreadDeinit(ThreadVars *tv, void *thread_data)
{
OutputTxLoggerThreadData *op_thread_data = (OutputTxLoggerThreadData *)thread_data;
for (AppProto alproto = 0; alproto < ALPROTO_MAX; alproto++) {
for (AppProto alproto = 0; alproto < g_alproto_max; alproto++) {
OutputLoggerThreadStore *store = op_thread_data->store[alproto];
OutputTxLogger *logger = list[alproto];
@@ -633,7 +633,7 @@ static TmEcode OutputTxLogThreadDeinit(ThreadVars *tv, void *thread_data)
static uint32_t OutputTxLoggerGetActiveCount(void)
{
uint32_t cnt = 0;
for (AppProto alproto = 0; alproto < ALPROTO_MAX; alproto++) {
for (AppProto alproto = 0; alproto < g_alproto_max; alproto++) {
for (OutputTxLogger *p = list[alproto]; p != NULL; p = p->next) {
cnt++;
}
@@ -655,7 +655,7 @@ static uint32_t OutputTxLoggerGetActiveCount(void)
void OutputTxLoggerRegister (void)
{
BUG_ON(list);
list = SCCalloc(ALPROTO_MAX, sizeof(OutputTxLogger *));
list = SCCalloc(g_alproto_max, sizeof(OutputTxLogger *));
if (unlikely(list == NULL)) {
FatalError("Failed to allocate OutputTx list");
}
@@ -669,7 +669,7 @@ void OutputTxShutdown(void)
if (list == NULL) {
return;
}
for (AppProto alproto = 0; alproto < ALPROTO_MAX; alproto++) {
for (AppProto alproto = 0; alproto < g_alproto_max; alproto++) {
OutputTxLogger *logger = list[alproto];
while (logger) {
OutputTxLogger *next_logger = logger->next;
src/output.c
+2 -2
View File
@@ -835,7 +835,7 @@ void TmModuleLoggerRegister(void)
EveJsonSimpleAppLayerLogger *SCEveJsonSimpleGetLogger(AppProto alproto)
{
if (alproto < ALPROTO_MAX) {
if (alproto < g_alproto_max) {
return &simple_json_applayer_loggers[alproto];
}
return NULL;
@@ -857,7 +857,7 @@ static void RegisterSimpleJsonApplayerLogger(
*/
void OutputRegisterRootLoggers(void)
{
simple_json_applayer_loggers = SCCalloc(ALPROTO_MAX, sizeof(EveJsonSimpleAppLayerLogger));
simple_json_applayer_loggers = SCCalloc(g_alproto_max, sizeof(EveJsonSimpleAppLayerLogger));
if (unlikely(simple_json_applayer_loggers == NULL)) {
FatalError("Failed to allocate simple_json_applayer_loggers");
}
src/runmodes.c
+4 -4
View File
@@ -758,8 +758,9 @@ void RunModeInitializeOutputs(void)
char tls_log_enabled = 0;
char tls_store_present = 0;
// ALPROTO_MAX is set to its final value
LoggerId logger_bits[ALPROTO_MAX] = { 0 };
// g_alproto_max is set to its final value
LoggerId logger_bits[g_alproto_max];
memset(logger_bits, 0, g_alproto_max * sizeof(LoggerId));
TAILQ_FOREACH(output, &outputs->head, next) {
output_config = ConfNodeLookupChild(output, output->val);
@@ -885,7 +886,7 @@ void RunModeInitializeOutputs(void)
/* register the logger bits to the app-layer */
AppProto a;
for (a = 0; a < ALPROTO_MAX; a++) {
for (a = 0; a < g_alproto_max; a++) {
if (AppLayerParserSupportsFiles(IPPROTO_TCP, a)) {
if (g_file_logger_enabled)
logger_bits[a] |= BIT_U32(LOGGER_FILE);
@@ -920,7 +921,6 @@ void RunModeInitializeOutputs(void)
AppLayerParserRegisterLoggerBits(IPPROTO_TCP, a, logger_bits[a]);
if (udp)
AppLayerParserRegisterLoggerBits(IPPROTO_UDP, a, logger_bits[a]);
}
OutputSetupActiveLoggers();
}
src/tests/fuzz/fuzz_applayerparserparse.c
+1 -1
View File
@@ -96,7 +96,7 @@ int LLVMFuzzerTestOneInput(const uint8_t *data, size_t size)
return 0;
}
if (data[0] >= ALPROTO_MAX) {
if (data[0] >= g_alproto_max) {
return 0;
}
//no UTHBuildFlow to have storage
src/util-profiling.c
+8 -8
View File
@@ -158,11 +158,11 @@ SCProfilingInit(void)
memset(&packet_profile_data6, 0, sizeof(packet_profile_data6));
memset(&packet_profile_tmm_data4, 0, sizeof(packet_profile_tmm_data4));
memset(&packet_profile_tmm_data6, 0, sizeof(packet_profile_tmm_data6));
packet_profile_app_data4 = SCCalloc(ALPROTO_MAX * 257, sizeof(SCProfilePacketData));
packet_profile_app_data4 = SCCalloc(g_alproto_max * 257, sizeof(SCProfilePacketData));
if (packet_profile_app_data4 == NULL) {
FatalError("Failed to allocate packet_profile_app_data4");
}
packet_profile_app_data6 = SCCalloc(ALPROTO_MAX * 257, sizeof(SCProfilePacketData));
packet_profile_app_data6 = SCCalloc(g_alproto_max * 257, sizeof(SCProfilePacketData));
if (packet_profile_app_data6 == NULL) {
FatalError("Failed to allocate packet_profile_app_data6");
}
@@ -503,7 +503,7 @@ void SCProfilingDumpPacketStats(void)
"--------------------", "------", "-----", "----------", "------------", "------------", "-----------");
total = 0;
for (AppProto a = 0; a < ALPROTO_MAX; a++) {
for (AppProto a = 0; a < g_alproto_max; a++) {
for (int p = 0; p < 257; p++) {
SCProfilePacketData *pd = &packet_profile_app_data4[a * 257 + p];
total += pd->tot;
@@ -512,7 +512,7 @@ void SCProfilingDumpPacketStats(void)
total += pd->tot;
}
}
for (AppProto a = 0; a < ALPROTO_MAX; a++) {
for (AppProto a = 0; a < g_alproto_max; a++) {
for (int p = 0; p < 257; p++) {
SCProfilePacketData *pd = &packet_profile_app_data4[a * 257 + p];
if (pd->cnt == 0) {
@@ -531,7 +531,7 @@ void SCProfilingDumpPacketStats(void)
}
}
for (AppProto a = 0; a < ALPROTO_MAX; a++) {
for (AppProto a = 0; a < g_alproto_max; a++) {
for (int p = 0; p < 257; p++) {
SCProfilePacketData *pd = &packet_profile_app_data6[a * 257 + p];
if (pd->cnt == 0) {
@@ -820,7 +820,7 @@ void SCProfilingPrintPacketProfile(Packet *p)
/* count ticks for app layer */
uint64_t app_total = 0;
for (AppProto i = 0; i < ALPROTO_MAX; i++) {
for (AppProto i = 0; i < g_alproto_max; i++) {
const PktProfilingAppData *pdt = &p->profile->app[i];
if (p->proto == IPPROTO_TCP) {
@@ -951,7 +951,7 @@ static void SCProfilingUpdatePacketAppRecord(int alproto, uint8_t ipproto, PktPr
static void SCProfilingUpdatePacketAppRecords(Packet *p)
{
int i;
for (i = 0; i < ALPROTO_MAX; i++) {
for (i = 0; i < g_alproto_max; i++) {
PktProfilingAppData *pdt = &p->profile->app[i];
if (pdt->ticks_spent > 0) {
@@ -1199,7 +1199,7 @@ PktProfiling *SCProfilePacketStart(void)
{
uint64_t sample = SC_ATOMIC_ADD(samples, 1);
if (sample % rate == 0)
return SCCalloc(1, sizeof(PktProfiling) + ALPROTO_MAX * sizeof(PktProfilingAppData));
return SCCalloc(1, sizeof(PktProfiling) + g_alproto_max * sizeof(PktProfilingAppData));
return NULL;
}
src/util-profiling.h
+6 -6
View File
@@ -203,12 +203,12 @@ PktProfiling *SCProfilePacketStart(void);
(dp)->proto_detect_ticks_spent = 0; \
}
#define PACKET_PROFILING_APP_STORE(dp, p) \
if (profiling_packets_enabled && (p)->profile != NULL) { \
if ((dp)->alproto < ALPROTO_MAX) { \
(p)->profile->app[(dp)->alproto].ticks_spent += (dp)->ticks_spent; \
(p)->profile->proto_detect += (dp)->proto_detect_ticks_spent; \
} \
#define PACKET_PROFILING_APP_STORE(dp, p) \
if (profiling_packets_enabled && (p)->profile != NULL) { \
if ((dp)->alproto < g_alproto_max) { \
(p)->profile->app[(dp)->alproto].ticks_spent += (dp)->ticks_spent; \
(p)->profile->proto_detect += (dp)->proto_detect_ticks_spent; \
} \
}
#define PACKET_PROFILING_DETECT_START(p, id) \