Skip to content

Commit

Permalink
stats: always use tcp/udp prefix
Browse files Browse the repository at this point in the history
Even when on detection-only mode.
So that we always have enip_tcp and enip_udp in stats
and never just `enip`.
Suricata needs to know beyond suricata.yaml configuration which
protocols can be enabled on both tcp and udp...

Ticket: 6304
  • Loading branch information
catenacyber committed Nov 20, 2023
1 parent d2b25af commit 1d00583
Showing 1 changed file with 17 additions and 3 deletions.
20 changes: 17 additions & 3 deletions src/app-layer.c
Original file line number Diff line number Diff line change
Expand Up @@ -1049,6 +1049,22 @@ void AppLayerRegisterGlobalCounters(void)
StatsRegisterGlobalCounter("app_layer.expectations", ExpectationGetCounter);
}

static bool AppLayerParserBothTcpUdp(AppProto alproto) {
switch (alproto) {
case ALPROTO_DCERPC:
//fallthrough
case ALPROTO_DNS:
//fallthrough
case ALPROTO_ENIP:
//fallthrough
case ALPROTO_KRB5:
//fallthrough
case ALPROTO_NFS:
return true;
}
return false;
}

#define IPPROTOS_MAX 2
void AppLayerSetupCounters(void)
{
Expand All @@ -1062,16 +1078,14 @@ void AppLayerSetupCounters(void)
for (uint8_t p = 0; p < IPPROTOS_MAX; p++) {
const uint8_t ipproto = ipprotos[p];
const uint8_t ipproto_map = FlowGetProtoMapping(ipproto);
const uint8_t other_ipproto = ipproto == IPPROTO_TCP ? IPPROTO_UDP : IPPROTO_TCP;
const char *ipproto_suffix = (ipproto == IPPROTO_TCP) ? "_tcp" : "_udp";

for (AppProto alproto = 0; alproto < ALPROTO_MAX; alproto++) {
if (alprotos[alproto] == 1) {
const char *tx_str = "app_layer.tx.";
const char *alproto_str = AppLayerGetProtoName(alproto);

if (AppLayerParserProtoIsRegistered(ipproto, alproto) &&
AppLayerParserProtoIsRegistered(other_ipproto, alproto)) {
if (AppLayerParserBothTcpUdp(alproto)) {
snprintf(applayer_counter_names[ipproto_map][alproto].name,
sizeof(applayer_counter_names[ipproto_map][alproto].name),
"%s%s%s", str, alproto_str, ipproto_suffix);
Expand Down

0 comments on commit 1d00583

Please sign in to comment.