]>
Commit | Line | Data |
---|---|---|
429c6388 | 1 | /* Copyright (C) 2007-2013 Open Information Security Foundation |
ce019275 WM |
2 | * |
3 | * You can copy, redistribute or modify this Program under the terms of | |
4 | * the GNU General Public License version 2 as published by the Free | |
5 | * Software Foundation. | |
6 | * | |
7 | * This program is distributed in the hope that it will be useful, | |
8 | * but WITHOUT ANY WARRANTY; without even the implied warranty of | |
9 | * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the | |
10 | * GNU General Public License for more details. | |
11 | * | |
12 | * You should have received a copy of the GNU General Public License | |
13 | * version 2 along with this program; if not, write to the Free Software | |
14 | * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA | |
15 | * 02110-1301, USA. | |
16 | */ | |
17 | ||
18 | /** | |
19 | * \file | |
20 | * | |
21 | * \author Victor Julien <victor@inliniac.net> | |
429c6388 | 22 | * \author Anoop Saldanha <anoopsaldanha@gmail.com> |
ce019275 WM |
23 | */ |
24 | ||
59327e0f VJ |
25 | #ifndef __APP_LAYER_PARSER_H__ |
26 | #define __APP_LAYER_PARSER_H__ | |
8e10844f | 27 | |
347c0df9 | 28 | #include "app-layer-events.h" |
1cf02560 | 29 | #include "detect-engine-state.h" |
e1022ee5 | 30 | #include "util-file.h" |
b160c49e | 31 | #include "stream-tcp-private.h" |
e1022ee5 | 32 | |
c862bbdc | 33 | /* Flags for AppLayerParserState. */ |
26eb49d7 EL |
34 | #define APP_LAYER_PARSER_EOF BIT_U8(0) |
35 | #define APP_LAYER_PARSER_NO_INSPECTION BIT_U8(1) | |
36 | #define APP_LAYER_PARSER_NO_REASSEMBLY BIT_U8(2) | |
37 | #define APP_LAYER_PARSER_NO_INSPECTION_PAYLOAD BIT_U8(3) | |
38 | #define APP_LAYER_PARSER_BYPASS_READY BIT_U8(4) | |
2c857087 | 39 | |
c862bbdc JI |
40 | /* Flags for AppLayerParserProtoCtx. */ |
41 | #define APP_LAYER_PARSER_OPT_ACCEPT_GAPS BIT_U64(0) | |
42 | ||
5908dd08 | 43 | int AppLayerParserProtoIsRegistered(uint8_t ipproto, AppProto alproto); |
2c857087 VJ |
44 | |
45 | /***** transaction handling *****/ | |
46 | ||
47 | /** \brief Function ptr type for getting active TxId from a flow | |
48 | * Used by AppLayerTransactionGetActive. | |
49 | */ | |
50 | typedef uint64_t (*GetActiveTxIdFunc)(Flow *f, uint8_t flags); | |
51 | ||
52 | /** \brief Register GetActiveTxId Function | |
53 | * | |
54 | */ | |
55 | void RegisterAppLayerGetActiveTxIdFunc(GetActiveTxIdFunc FuncPtr); | |
56 | ||
57 | /** \brief active TX retrieval for normal ops: so with detection and logging | |
58 | * | |
59 | * \retval tx_id lowest tx_id that still needs work | |
60 | * | |
61 | * This is the default function. | |
62 | */ | |
63 | uint64_t AppLayerTransactionGetActiveDetectLog(Flow *f, uint8_t flags); | |
64 | ||
5cc880c5 VJ |
65 | /** \brief active TX retrieval for logging only ops |
66 | * | |
67 | * \retval tx_id lowest tx_id that still needs work | |
68 | */ | |
69 | uint64_t AppLayerTransactionGetActiveLogOnly(Flow *f, uint8_t flags); | |
70 | ||
71 | ||
429c6388 | 72 | int AppLayerParserSetup(void); |
6d562f3b | 73 | void AppLayerParserPostStreamSetup(void); |
429c6388 AS |
74 | int AppLayerParserDeSetup(void); |
75 | ||
9634e60e VJ |
76 | typedef struct AppLayerParserThreadCtx_ AppLayerParserThreadCtx; |
77 | ||
429c6388 AS |
78 | /** |
79 | * \brief Gets a new app layer protocol's parser thread context. | |
80 | * | |
81 | * \retval Non-NULL pointer on success. | |
82 | * NULL pointer on failure. | |
83 | */ | |
9634e60e | 84 | AppLayerParserThreadCtx *AppLayerParserThreadCtxAlloc(void); |
429c6388 AS |
85 | |
86 | /** | |
87 | * \brief Destroys the app layer parser thread context obtained | |
fdefb65b | 88 | * using AppLayerParserThreadCtxAlloc(). |
429c6388 AS |
89 | * |
90 | * \param tctx Pointer to the thread context to be destroyed. | |
91 | */ | |
9634e60e | 92 | void AppLayerParserThreadCtxFree(AppLayerParserThreadCtx *tctx); |
429c6388 AS |
93 | |
94 | /** | |
95 | * \brief Given a protocol name, checks if the parser is enabled in | |
96 | * the conf file. | |
97 | * | |
98 | * \param alproto_name Name of the app layer protocol. | |
99 | * | |
100 | * \retval 1 If enabled. | |
101 | * \retval 0 If disabled. | |
d4d18e31 | 102 | */ |
429c6388 AS |
103 | int AppLayerParserConfParserEnabled(const char *ipproto, |
104 | const char *alproto_name); | |
d4d18e31 | 105 | |
7c8bdfd3 PC |
106 | /** \brief Prototype for parsing functions */ |
107 | typedef int (*AppLayerParserFPtr)(Flow *f, void *protocol_state, | |
108 | AppLayerParserState *pstate, | |
109 | uint8_t *buf, uint32_t buf_len, | |
110 | void *local_storage); | |
111 | ||
429c6388 | 112 | /***** Parser related registration *****/ |
d4d18e31 AS |
113 | |
114 | /** | |
429c6388 | 115 | * \brief Register app layer parser for the protocol. |
d4d18e31 | 116 | * |
429c6388 AS |
117 | * \retval 0 On success. |
118 | * \retval -1 On failure. | |
d4d18e31 | 119 | */ |
5cdeadb3 | 120 | int AppLayerParserRegisterParser(uint8_t ipproto, AppProto alproto, |
429c6388 | 121 | uint8_t direction, |
7c8bdfd3 | 122 | AppLayerParserFPtr Parser); |
5cdeadb3 | 123 | void AppLayerParserRegisterParserAcceptableDataDirection(uint8_t ipproto, |
429c6388 AS |
124 | AppProto alproto, |
125 | uint8_t direction); | |
c862bbdc JI |
126 | void AppLayerParserRegisterOptionFlags(uint8_t ipproto, AppProto alproto, |
127 | uint64_t flags); | |
5cdeadb3 | 128 | void AppLayerParserRegisterStateFuncs(uint8_t ipproto, AppProto alproto, |
429c6388 AS |
129 | void *(*StateAlloc)(void), |
130 | void (*StateFree)(void *)); | |
5cdeadb3 | 131 | void AppLayerParserRegisterLocalStorageFunc(uint8_t ipproto, AppProto proto, |
429c6388 AS |
132 | void *(*LocalStorageAlloc)(void), |
133 | void (*LocalStorageFree)(void *)); | |
5cdeadb3 | 134 | void AppLayerParserRegisterGetFilesFunc(uint8_t ipproto, AppProto alproto, |
429c6388 | 135 | FileContainer *(*StateGetFiles)(void *, uint8_t)); |
5cdeadb3 | 136 | void AppLayerParserRegisterGetEventsFunc(uint8_t ipproto, AppProto proto, |
429c6388 | 137 | AppLayerDecoderEvents *(*StateGetEvents)(void *, uint64_t)); |
5cdeadb3 | 138 | void AppLayerParserRegisterHasEventsFunc(uint8_t ipproto, AppProto alproto, |
429c6388 | 139 | int (*StateHasEvents)(void *)); |
f3599323 MK |
140 | void AppLayerParserRegisterLoggerFuncs(uint8_t ipproto, AppProto alproto, |
141 | int (*StateGetTxLogged)(void *, void *, uint32_t), | |
142 | void (*StateSetTxLogged)(void *, void *, uint32_t)); | |
5cdeadb3 | 143 | void AppLayerParserRegisterLogger(uint8_t ipproto, AppProto alproto); |
01724f04 | 144 | void AppLayerParserRegisterLoggerBits(uint8_t ipproto, AppProto alproto, LoggerId bits); |
5cdeadb3 | 145 | void AppLayerParserRegisterTruncateFunc(uint8_t ipproto, AppProto alproto, |
429c6388 | 146 | void (*Truncate)(void *, uint8_t)); |
5cdeadb3 | 147 | void AppLayerParserRegisterGetStateProgressFunc(uint8_t ipproto, AppProto alproto, |
429c6388 | 148 | int (*StateGetStateProgress)(void *alstate, uint8_t direction)); |
5cdeadb3 | 149 | void AppLayerParserRegisterTxFreeFunc(uint8_t ipproto, AppProto alproto, |
429c6388 | 150 | void (*StateTransactionFree)(void *, uint64_t)); |
5cdeadb3 | 151 | void AppLayerParserRegisterGetTxCnt(uint8_t ipproto, AppProto alproto, |
429c6388 | 152 | uint64_t (*StateGetTxCnt)(void *alstate)); |
5cdeadb3 | 153 | void AppLayerParserRegisterGetTx(uint8_t ipproto, AppProto alproto, |
429c6388 | 154 | void *(StateGetTx)(void *alstate, uint64_t tx_id)); |
c4b918b6 | 155 | void AppLayerParserRegisterGetStateProgressCompletionStatus(AppProto alproto, |
429c6388 | 156 | int (*StateGetStateProgressCompletionStatus)(uint8_t direction)); |
5cdeadb3 | 157 | void AppLayerParserRegisterGetEventInfo(uint8_t ipproto, AppProto alproto, |
429c6388 AS |
158 | int (*StateGetEventInfo)(const char *event_name, int *event_id, |
159 | AppLayerEventType *event_type)); | |
1cf02560 | 160 | void AppLayerParserRegisterDetectStateFuncs(uint8_t ipproto, AppProto alproto, |
f536099a | 161 | int (*StateHasTxDetectState)(void *alstate), |
1cf02560 | 162 | DetectEngineState *(*GetTxDetectState)(void *tx), |
f536099a | 163 | int (*SetTxDetectState)(void *alstate, void *tx, DetectEngineState *)); |
b160c49e GL |
164 | void AppLayerParserRegisterGetStreamDepth(uint8_t ipproto, |
165 | AppProto alproto, | |
166 | uint32_t (*GetStreamDepth)(void)); | |
a0fad6bb VJ |
167 | void AppLayerParserRegisterMpmIDsFuncs(uint8_t ipproto, AppProto alproto, |
168 | uint64_t (*GetTxMpmIDs)(void *tx), | |
169 | int (*SetTxMpmIDs)(void *tx, uint64_t)); | |
d4d18e31 | 170 | |
429c6388 | 171 | /***** Get and transaction functions *****/ |
16cfae2f | 172 | |
5cdeadb3 VJ |
173 | void *AppLayerParserGetProtocolParserLocalStorage(uint8_t ipproto, AppProto alproto); |
174 | void AppLayerParserDestroyProtocolParserLocalStorage(uint8_t ipproto, AppProto alproto, | |
429c6388 | 175 | void *local_data); |
6cb00142 | 176 | |
6cb00142 | 177 | |
9634e60e | 178 | uint64_t AppLayerParserGetTransactionLogId(AppLayerParserState *pstate); |
e9fccfa6 | 179 | void AppLayerParserSetTransactionLogId(AppLayerParserState *pstate, uint64_t tx_id); |
5c01b409 | 180 | |
f3599323 MK |
181 | void AppLayerParserSetTxLogged(uint8_t ipproto, AppProto alproto, void *alstate, |
182 | void *tx, uint32_t logger); | |
4459b887 | 183 | int AppLayerParserGetTxLogged(const Flow *f, void *alstate, |
f3599323 | 184 | void *tx, uint32_t logger); |
5c01b409 | 185 | |
9634e60e | 186 | uint64_t AppLayerParserGetTransactionInspectId(AppLayerParserState *pstate, uint8_t direction); |
5c01b409 VJ |
187 | void AppLayerParserSetTransactionInspectId(const Flow *f, AppLayerParserState *pstate, |
188 | void *alstate, const uint8_t flags); | |
189 | ||
9634e60e VJ |
190 | AppLayerDecoderEvents *AppLayerParserGetDecoderEvents(AppLayerParserState *pstate); |
191 | void AppLayerParserSetDecoderEvents(AppLayerParserState *pstate, AppLayerDecoderEvents *devents); | |
5cdeadb3 | 192 | AppLayerDecoderEvents *AppLayerParserGetEventsByTx(uint8_t ipproto, AppProto alproto, void *alstate, |
429c6388 | 193 | uint64_t tx_id); |
5cdeadb3 | 194 | FileContainer *AppLayerParserGetFiles(uint8_t ipproto, AppProto alproto, |
429c6388 | 195 | void *alstate, uint8_t direction); |
5cdeadb3 | 196 | int AppLayerParserGetStateProgress(uint8_t ipproto, AppProto alproto, |
429c6388 | 197 | void *alstate, uint8_t direction); |
5c01b409 | 198 | uint64_t AppLayerParserGetTxCnt(const Flow *, void *alstate); |
5cdeadb3 | 199 | void *AppLayerParserGetTx(uint8_t ipproto, AppProto alproto, void *alstate, uint64_t tx_id); |
c4b918b6 | 200 | int AppLayerParserGetStateProgressCompletionStatus(AppProto alproto, uint8_t direction); |
5cdeadb3 | 201 | int AppLayerParserGetEventInfo(uint8_t ipproto, AppProto alproto, const char *event_name, |
429c6388 | 202 | int *event_id, AppLayerEventType *event_type); |
6cb00142 | 203 | |
3148ff34 | 204 | uint64_t AppLayerParserGetTransactionActive(const Flow *f, AppLayerParserState *pstate, uint8_t direction); |
6cb00142 | 205 | |
f5f14880 | 206 | uint8_t AppLayerParserGetFirstDataDir(uint8_t ipproto, AppProto alproto); |
ddde572f | 207 | |
bcfa484b | 208 | int AppLayerParserSupportsFiles(uint8_t ipproto, AppProto alproto); |
1cf02560 | 209 | int AppLayerParserSupportsTxDetectState(uint8_t ipproto, AppProto alproto); |
f536099a | 210 | int AppLayerParserHasTxDetectState(uint8_t ipproto, AppProto alproto, void *alstate); |
1cf02560 | 211 | DetectEngineState *AppLayerParserGetTxDetectState(uint8_t ipproto, AppProto alproto, void *tx); |
3148ff34 | 212 | int AppLayerParserSetTxDetectState(const Flow *f, void *alstate, void *tx, DetectEngineState *s); |
1cf02560 | 213 | |
a0fad6bb VJ |
214 | uint64_t AppLayerParserGetTxMpmIDs(uint8_t ipproto, AppProto alproto, void *tx); |
215 | int AppLayerParserSetTxMpmIDs(uint8_t ipproto, AppProto alproto, void *tx, uint64_t); | |
216 | ||
429c6388 AS |
217 | /***** General *****/ |
218 | ||
675fa564 | 219 | int AppLayerParserParse(ThreadVars *tv, AppLayerParserThreadCtx *tctx, Flow *f, AppProto alproto, |
429c6388 | 220 | uint8_t flags, uint8_t *input, uint32_t input_len); |
9634e60e | 221 | void AppLayerParserSetEOF(AppLayerParserState *pstate); |
948dee9a VJ |
222 | bool AppLayerParserHasDecoderEvents(const Flow *f, void *alstate, AppLayerParserState *pstate, |
223 | const uint8_t flags); | |
01913f6a | 224 | int AppLayerParserIsTxAware(AppProto alproto); |
b2d420be | 225 | int AppLayerParserProtocolIsTxAware(uint8_t ipproto, AppProto alproto); |
5cdeadb3 VJ |
226 | int AppLayerParserProtocolIsTxEventAware(uint8_t ipproto, AppProto alproto); |
227 | int AppLayerParserProtocolSupportsTxs(uint8_t ipproto, AppProto alproto); | |
078ff0c0 | 228 | int AppLayerParserProtocolHasLogger(uint8_t ipproto, AppProto alproto); |
2d223b69 | 229 | void AppLayerParserTriggerRawStreamReassembly(Flow *f, int direction); |
b160c49e | 230 | void AppLayerParserSetStreamDepth(uint8_t ipproto, AppProto alproto, uint32_t stream_depth); |
3148ff34 | 231 | uint32_t AppLayerParserGetStreamDepth(const Flow *f); |
429c6388 AS |
232 | |
233 | /***** Cleanup *****/ | |
234 | ||
3148ff34 | 235 | void AppLayerParserStateCleanup(const Flow *f, void *alstate, AppLayerParserState *pstate); |
429c6388 AS |
236 | |
237 | void AppLayerParserRegisterProtocolParsers(void); | |
238 | ||
239 | ||
9634e60e VJ |
240 | void AppLayerParserStateSetFlag(AppLayerParserState *pstate, uint8_t flag); |
241 | int AppLayerParserStateIssetFlag(AppLayerParserState *pstate, uint8_t flag); | |
429c6388 | 242 | |
5cdeadb3 | 243 | void AppLayerParserStreamTruncated(uint8_t ipproto, AppProto alproto, void *alstate, |
429c6388 AS |
244 | uint8_t direction); |
245 | ||
246 | ||
247 | ||
9634e60e VJ |
248 | AppLayerParserState *AppLayerParserStateAlloc(void); |
249 | void AppLayerParserStateFree(AppLayerParserState *pstate); | |
429c6388 AS |
250 | |
251 | ||
252 | ||
253 | #ifdef DEBUG | |
9634e60e | 254 | void AppLayerParserStatePrintDetails(AppLayerParserState *pstate); |
429c6388 | 255 | #endif |
6cb00142 | 256 | |
077ac816 | 257 | #ifdef AFLFUZZ_APPLAYER |
4683b0e6 | 258 | int AppLayerParserRequestFromFile(uint8_t ipproto, AppProto alproto, char *filename); |
31daf435 | 259 | int AppLayerParserRequestFromFileSerie(uint8_t ipproto, AppProto alproto, char *prefix); |
4683b0e6 | 260 | int AppLayerParserFromFile(uint8_t ipproto, AppProto alproto, char *filename); |
31daf435 | 261 | int AppLayerParserFromFileSerie(uint8_t ipproto, AppProto alproto, char *prefix); |
077ac816 VJ |
262 | #endif |
263 | ||
6cb00142 AS |
264 | /***** Unittests *****/ |
265 | ||
429c6388 | 266 | #ifdef UNITTESTS |
5cdeadb3 | 267 | void AppLayerParserRegisterProtocolUnittests(uint8_t ipproto, AppProto alproto, |
429c6388 AS |
268 | void (*RegisterUnittests)(void)); |
269 | void AppLayerParserRegisterUnittests(void); | |
270 | void AppLayerParserBackupParserTable(void); | |
271 | void AppLayerParserRestoreParserTable(void); | |
272 | #endif | |
6cb00142 | 273 | |
59327e0f | 274 | #endif /* __APP_LAYER_PARSER_H__ */ |