void AppLayerParserSetTransactionInspectId(AppLayerParserState *pstate, uint8_t ipproto, AppProto alproto, void *alstate, uint8_t direction) { SCEnter(); uint8_t dir = (direction & STREAM_TOSERVER) ? 0 : 1; uint64_t total_txs = AppLayerParserGetTxCnt(ipproto, alproto, alstate); uint64_t idx = AppLayerParserGetTransactionInspectId(pstate, direction); int state_done_progress = AppLayerParserGetStateProgressCompletionStatus(ipproto, alproto, direction); void *tx; int state_progress; for (; idx < total_txs; idx++) { tx = AppLayerParserGetTx(ipproto, alproto, alstate, idx); if (tx == NULL) continue; state_progress = AppLayerParserGetStateProgress(ipproto, alproto, tx, direction); if (state_progress >= state_done_progress) continue; else break; } pstate->inspect_id[dir] = idx; SCReturn; }
/** \brief active TX retrieval for logging only: so NO detection * * If the logger is enabled, we simply return the log_id here. * * Otherwise, we go look for the tx id. There probably is no point * in running this function in that case though. With no detection * and no logging, why run a parser in the first place? **/ uint64_t AppLayerTransactionGetActiveLogOnly(Flow *f, uint8_t flags) { AppLayerParserProtoCtx *p = &alp_ctx.ctxs[f->protomap][f->alproto]; if (p->logger == TRUE) { uint64_t log_id = f->alparser->log_id; SCLogDebug("returning %"PRIu64, log_id); return log_id; } /* logger is disabled, return highest 'complete' tx id */ uint64_t total_txs = AppLayerParserGetTxCnt(f->proto, f->alproto, f->alstate); uint64_t idx = AppLayerParserGetTransactionInspectId(f->alparser, flags); int state_done_progress = AppLayerParserGetStateProgressCompletionStatus(f->alproto, flags); void *tx; int state_progress; for (; idx < total_txs; idx++) { tx = AppLayerParserGetTx(f->proto, f->alproto, f->alstate, idx); if (tx == NULL) continue; state_progress = AppLayerParserGetStateProgress(f->proto, f->alproto, tx, flags); if (state_progress >= state_done_progress) continue; else break; } SCLogDebug("returning %"PRIu64, idx); return idx; }
int AppLayerParserHasDecoderEvents(uint8_t ipproto, AppProto alproto, void *alstate, AppLayerParserState *pstate, uint8_t flags) { SCEnter(); if (alstate == NULL || pstate == NULL) goto not_present; AppLayerDecoderEvents *decoder_events; uint64_t tx_id; uint64_t max_id; if (AppLayerParserProtocolIsTxEventAware(ipproto, alproto)) { /* fast path if supported by alproto */ if (alp_ctx.ctxs[FlowGetProtoMapping(ipproto)][alproto].StateHasEvents != NULL) { if (alp_ctx.ctxs[FlowGetProtoMapping(ipproto)][alproto]. StateHasEvents(alstate) == 1) { goto present; } } else { /* check each tx */ tx_id = AppLayerParserGetTransactionInspectId(pstate, flags); max_id = AppLayerParserGetTxCnt(ipproto, alproto, alstate); for ( ; tx_id < max_id; tx_id++) { decoder_events = AppLayerParserGetEventsByTx(ipproto, alproto, alstate, tx_id); if (decoder_events && decoder_events->cnt) goto present; } } } decoder_events = AppLayerParserGetDecoderEvents(pstate); if (decoder_events && decoder_events->cnt) goto present; /* if we have reached here, we don't have events */ not_present: SCReturnInt(0); present: SCReturnInt(1); }