void AppLayerParserSetTransactionInspectId(AppLayerParserState *pstate,
uint8_t ipproto, AppProto alproto, void *alstate,
uint8_t direction)
{
SCEnter();
uint8_t dir = (direction & STREAM_TOSERVER) ? 0 : 1;
uint64_t total_txs = AppLayerParserGetTxCnt(ipproto, alproto, alstate);
uint64_t idx = AppLayerParserGetTransactionInspectId(pstate, direction);
int state_done_progress = AppLayerParserGetStateProgressCompletionStatus(ipproto, alproto, direction);
void *tx;
int state_progress;
for (; idx < total_txs; idx++) {
tx = AppLayerParserGetTx(ipproto, alproto, alstate, idx);
if (tx == NULL)
continue;
state_progress = AppLayerParserGetStateProgress(ipproto, alproto, tx, direction);
if (state_progress >= state_done_progress)
continue;
else
break;
}
pstate->inspect_id[dir] = idx;
SCReturn;
}
/** \brief active TX retrieval for logging only: so NO detection
*
* If the logger is enabled, we simply return the log_id here.
*
* Otherwise, we go look for the tx id. There probably is no point
* in running this function in that case though. With no detection
* and no logging, why run a parser in the first place?
**/
uint64_t AppLayerTransactionGetActiveLogOnly(Flow *f, uint8_t flags)
{
AppLayerParserProtoCtx *p = &alp_ctx.ctxs[f->protomap][f->alproto];
if (p->logger == TRUE) {
uint64_t log_id = f->alparser->log_id;
SCLogDebug("returning %"PRIu64, log_id);
return log_id;
}
/* logger is disabled, return highest 'complete' tx id */
uint64_t total_txs = AppLayerParserGetTxCnt(f->proto, f->alproto, f->alstate);
uint64_t idx = AppLayerParserGetTransactionInspectId(f->alparser, flags);
int state_done_progress = AppLayerParserGetStateProgressCompletionStatus(f->alproto, flags);
void *tx;
int state_progress;
for (; idx < total_txs; idx++) {
tx = AppLayerParserGetTx(f->proto, f->alproto, f->alstate, idx);
if (tx == NULL)
continue;
state_progress = AppLayerParserGetStateProgress(f->proto, f->alproto, tx, flags);
if (state_progress >= state_done_progress)
continue;
else
break;
}
SCLogDebug("returning %"PRIu64, idx);
return idx;
}
int AppLayerParserHasDecoderEvents(uint8_t ipproto, AppProto alproto,
void *alstate, AppLayerParserState *pstate,
uint8_t flags)
{
SCEnter();
if (alstate == NULL || pstate == NULL)
goto not_present;
AppLayerDecoderEvents *decoder_events;
uint64_t tx_id;
uint64_t max_id;
if (AppLayerParserProtocolIsTxEventAware(ipproto, alproto)) {
/* fast path if supported by alproto */
if (alp_ctx.ctxs[FlowGetProtoMapping(ipproto)][alproto].StateHasEvents != NULL) {
if (alp_ctx.ctxs[FlowGetProtoMapping(ipproto)][alproto].
StateHasEvents(alstate) == 1)
{
goto present;
}
} else {
/* check each tx */
tx_id = AppLayerParserGetTransactionInspectId(pstate, flags);
max_id = AppLayerParserGetTxCnt(ipproto, alproto, alstate);
for ( ; tx_id < max_id; tx_id++) {
decoder_events = AppLayerParserGetEventsByTx(ipproto, alproto, alstate, tx_id);
if (decoder_events && decoder_events->cnt)
goto present;
}
}
}
decoder_events = AppLayerParserGetDecoderEvents(pstate);
if (decoder_events && decoder_events->cnt)
goto present;
/* if we have reached here, we don't have events */
not_present:
SCReturnInt(0);
present:
SCReturnInt(1);
}