]>
Commit | Line | Data |
---|---|---|
ce019275 WM |
1 | /* Copyright (C) 2007-2010 Open Information Security Foundation |
2 | * | |
3 | * You can copy, redistribute or modify this Program under the terms of | |
4 | * the GNU General Public License version 2 as published by the Free | |
5 | * Software Foundation. | |
6 | * | |
7 | * This program is distributed in the hope that it will be useful, | |
8 | * but WITHOUT ANY WARRANTY; without even the implied warranty of | |
9 | * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the | |
10 | * GNU General Public License for more details. | |
11 | * | |
12 | * You should have received a copy of the GNU General Public License | |
13 | * version 2 along with this program; if not, write to the Free Software | |
14 | * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA | |
15 | * 02110-1301, USA. | |
16 | */ | |
17 | ||
18 | /** | |
19 | * \file | |
20 | * | |
21 | * \author Victor Julien <victor@inliniac.net> | |
22 | */ | |
23 | ||
8e10844f VJ |
24 | #ifndef __APP_LAYER_PARSER_H__ |
25 | #define __APP_LAYER_PARSER_H__ | |
26 | ||
eea5ab4a AS |
27 | #include "decode-events.h" |
28 | ||
e1022ee5 VJ |
29 | #include "util-file.h" |
30 | ||
5a9a23f9 VJ |
31 | /** Mapping between local parser id's (e.g. HTTP_FIELD_REQUEST_URI) and |
32 | * the dynamically assigned (at registration) global parser id. */ | |
33 | typedef struct AppLayerLocalMap_ { | |
fa5939ca | 34 | uint16_t parser_id; |
5a9a23f9 VJ |
35 | } AppLayerLocalMap; |
36 | ||
0d7159b5 AS |
37 | typedef uint16_t (*ProbingParserFPtr)(uint8_t *input, uint32_t input_len, |
38 | uint32_t *offset); | |
39 | ||
8e10844f VJ |
40 | /** \brief Mapping between ALPROTO_* and L7Parsers |
41 | * | |
42 | * Map the proto to the parsers for the to_client and to_server directions. | |
43 | */ | |
44 | typedef struct AppLayerProto_ { | |
f1f7df07 VJ |
45 | char *name; /**< name of the registered proto */ |
46 | ||
fa5939ca BR |
47 | uint16_t to_server; |
48 | uint16_t to_client; | |
06904c90 VJ |
49 | uint16_t map_size; |
50 | char logger; /**< does this proto have a logger enabled? */ | |
5a9a23f9 VJ |
51 | |
52 | AppLayerLocalMap **map; | |
9f78d47c VJ |
53 | |
54 | void *(*StateAlloc)(void); | |
55 | void (*StateFree)(void *); | |
f59f9033 | 56 | void (*StateTransactionFree)(void *, uint64_t); |
01a35bb6 | 57 | void *(*LocalStorageAlloc)(void); |
9a6aef45 | 58 | void (*LocalStorageFree)(void *); |
869109a6 VJ |
59 | |
60 | /** truncate state after a gap/depth event */ | |
61 | void (*Truncate)(void *, uint8_t); | |
d59ca75e | 62 | FileContainer *(*StateGetFiles)(void *, uint8_t); |
9dc04d9f | 63 | AppLayerDecoderEvents *(*StateGetEvents)(void *, uint64_t); |
e8ad876b VJ |
64 | /* bool indicating a state has decoder/parser events */ |
65 | int (*StateHasEvents)(void *); | |
70b32f73 | 66 | |
d4d18e31 AS |
67 | int (*StateGetAlstateProgress)(void *alstate, uint8_t direction); |
68 | uint64_t (*StateGetTxCnt)(void *alstate); | |
69 | void *(*StateGetTx)(void *alstate, uint64_t tx_id); | |
70 | int (*StateGetAlstateProgressCompletionStatus)(uint8_t direction); | |
9faa4b74 | 71 | |
5e2d9dbd AS |
72 | int (*StateGetEventInfo)(const char *event_name, |
73 | int *event_id, AppLayerEventType *event_type); | |
74 | ||
16144fe3 | 75 | ProbingParserFPtr PPAlprotoMap[2]; |
96d1ba91 AS |
76 | /* Indicates the direction the parser is ready to see the data |
77 | * the first time for a flow. Values accepted - | |
78 | * STREAM_TOSERVER, STREAM_TOCLIENT */ | |
79 | uint8_t first_data_dir; | |
0d7159b5 | 80 | |
9faa4b74 VJ |
81 | #ifdef UNITTESTS |
82 | void (*RegisterUnittests)(void); | |
83 | #endif | |
8e10844f VJ |
84 | } AppLayerProto; |
85 | ||
9f78d47c VJ |
86 | /** flags for the result elmts */ |
87 | #define ALP_RESULT_ELMT_ALLOC 0x01 | |
88 | ||
89 | /** \brief Result elements for the parser */ | |
90 | typedef struct AppLayerParserResultElmt_ { | |
fa5939ca BR |
91 | uint16_t flags; /* flags. E.g. local alloc */ |
92 | uint16_t name_idx; /* idx for names like "http.request_line.uri" */ | |
8e10844f | 93 | |
fc248ca7 | 94 | uint32_t data_len; /* length of the data from the ptr */ |
fa5939ca | 95 | uint8_t *data_ptr; /* point to the position in the "input" data |
8e10844f | 96 | * or ptr to new mem if local alloc flag set */ |
9f78d47c VJ |
97 | struct AppLayerParserResultElmt_ *next; |
98 | } AppLayerParserResultElmt; | |
99 | ||
100 | /** \brief List head for parser result elmts */ | |
101 | typedef struct AppLayerParserResult_ { | |
102 | AppLayerParserResultElmt *head; | |
103 | AppLayerParserResultElmt *tail; | |
fa5939ca | 104 | uint32_t cnt; |
9f78d47c VJ |
105 | } AppLayerParserResult; |
106 | ||
a16e7b74 GS |
107 | #define APP_LAYER_PARSER_USE 0x01 |
108 | #define APP_LAYER_PARSER_EOF 0x02 | |
70b32f73 VJ |
109 | #define APP_LAYER_PARSER_DONE 0x04 /**< parser is done, ignore more |
110 | msgs */ | |
111 | #define APP_LAYER_PARSER_NO_INSPECTION 0x08 /**< Flag to indicate no more | |
112 | packets payload inspection */ | |
113 | #define APP_LAYER_PARSER_NO_REASSEMBLY 0x10 /**< Flag to indicate no more | |
114 | packets reassembly for this | |
115 | session */ | |
116 | ||
117 | #define APP_LAYER_TRANSACTION_EOF 0x01 /**< Session done, last transaction | |
118 | as well */ | |
b8fec77f VJ |
119 | #define APP_LAYER_TRANSACTION_TOSERVER 0x02 /**< transaction has been inspected |
120 | in to server direction. */ | |
121 | #define APP_LAYER_TRANSACTION_TOCLIENT 0x04 /**< transaction has been inspected | |
122 | in to server direction. */ | |
9f78d47c VJ |
123 | |
124 | typedef struct AppLayerParserState_ { | |
fa5939ca | 125 | uint8_t flags; |
70b32f73 | 126 | uint16_t cur_parser; /**< idx of currently active parser */ |
fa5939ca BR |
127 | uint8_t *store; |
128 | uint32_t store_len; | |
129 | uint16_t parse_field; | |
9f78d47c VJ |
130 | } AppLayerParserState; |
131 | ||
132 | typedef struct AppLayerParserStateStore_ { | |
133 | AppLayerParserState to_client; | |
134 | AppLayerParserState to_server; | |
70b32f73 VJ |
135 | |
136 | /** flags related to the id's */ | |
137 | uint8_t id_flags; | |
138 | ||
d4d18e31 AS |
139 | /* Indicates the current transaction that is being indicated. We have |
140 | * a var per direction. */ | |
141 | uint64_t inspect_id[2]; | |
142 | /* Indicates the current transaction being logged. Unlike inspect_id, | |
143 | * we don't need a var per direction since we don't log a transaction | |
144 | * unless we have the entire transaction. */ | |
145 | uint64_t log_id; | |
73efb4c7 VJ |
146 | uint16_t version; /**< state version, incremented for each update, |
147 | * can wrap around */ | |
eea5ab4a AS |
148 | |
149 | /* Used to store decoder events */ | |
150 | AppLayerDecoderEvents *decoder_events; | |
9f78d47c | 151 | } AppLayerParserStateStore; |
8e10844f VJ |
152 | |
153 | typedef struct AppLayerParserTableElement_ { | |
fc2f7f29 GS |
154 | int (*AppLayerParser)(Flow *f, void *protocol_state, AppLayerParserState |
155 | *parser_state, uint8_t *input, uint32_t input_len, | |
9a6aef45 | 156 | void *local_storage, AppLayerParserResult *output); |
06904c90 VJ |
157 | |
158 | char *name; | |
159 | ||
160 | uint16_t proto; | |
161 | uint16_t parser_local_id; /**< local id of the parser in the parser itself. */ | |
8e10844f VJ |
162 | } AppLayerParserTableElement; |
163 | ||
7c31a232 | 164 | typedef struct AppLayerProbingParserElement_ { |
d9686fae | 165 | char *al_proto_name; |
7c31a232 | 166 | uint16_t al_proto; |
d9686fae | 167 | /* \todo don't really need it. See if you can get rid of it */ |
7c31a232 | 168 | uint16_t port; |
d9686fae | 169 | /* \todo calculate at runtime and get rid of this var */ |
d68775d4 | 170 | uint32_t al_proto_mask; |
d9686fae | 171 | /* \todo check if we can reduce the bottom 2 vars to uint16_t */ |
7c31a232 AS |
172 | /* the min length of data that has to be supplied to invoke the parser */ |
173 | uint32_t min_depth; | |
174 | /* the max length of data after which this parser won't be invoked */ | |
175 | uint32_t max_depth; | |
176 | /* the probing parser function */ | |
8e8bc490 | 177 | ProbingParserFPtr ProbingParser; |
7c31a232 AS |
178 | |
179 | struct AppLayerProbingParserElement_ *next; | |
180 | } AppLayerProbingParserElement; | |
181 | ||
d9686fae | 182 | typedef struct AppLayerProbingParserPort_ { |
7c31a232 AS |
183 | /* the port no for which probing parser(s) are invoked */ |
184 | uint16_t port; | |
d9686fae | 185 | |
d68775d4 AS |
186 | uint32_t toserver_al_proto_mask; |
187 | uint32_t toclient_al_proto_mask; | |
7c31a232 AS |
188 | /* the max depth for all the probing parsers registered for this port */ |
189 | uint16_t toserver_max_depth; | |
190 | uint16_t toclient_max_depth; | |
191 | ||
192 | AppLayerProbingParserElement *toserver; | |
193 | AppLayerProbingParserElement *toclient; | |
194 | ||
d9686fae AS |
195 | struct AppLayerProbingParserPort_ *next; |
196 | } AppLayerProbingParserPort; | |
7c31a232 | 197 | |
d9686fae | 198 | typedef struct AppLayerProbingParser_ { |
432c3317 | 199 | uint16_t ip_proto; |
d9686fae | 200 | AppLayerProbingParserPort *port; |
432c3317 | 201 | |
d9686fae AS |
202 | struct AppLayerProbingParser_ *next; |
203 | } AppLayerProbingParser; | |
7c31a232 | 204 | |
10966245 AS |
205 | extern AppLayerProto al_proto_table[]; |
206 | ||
a40fdc79 | 207 | static inline |
d9686fae AS |
208 | AppLayerProbingParserPort *AppLayerGetProbingParsers(AppLayerProbingParser *pp, |
209 | uint16_t ip_proto, | |
210 | uint16_t port) | |
7c31a232 | 211 | { |
7c31a232 | 212 | while (pp != NULL) { |
d9686fae | 213 | if (pp->ip_proto == ip_proto) |
7c31a232 | 214 | break; |
d9686fae | 215 | |
7c31a232 AS |
216 | pp = pp->next; |
217 | } | |
218 | ||
d9686fae AS |
219 | if (pp == NULL) |
220 | return NULL; | |
7c31a232 | 221 | |
d9686fae AS |
222 | AppLayerProbingParserPort *pp_port = pp->port; |
223 | while (pp_port != NULL) { | |
224 | if (pp_port->port == port || pp_port->port == 0) { | |
225 | break; | |
226 | } | |
227 | pp_port = pp_port->next; | |
432c3317 AS |
228 | } |
229 | ||
d9686fae | 230 | return pp_port; |
432c3317 | 231 | } |
d9686fae | 232 | |
6e0d98d9 AS |
233 | struct AlpProtoDetectCtx_; |
234 | ||
9f78d47c VJ |
235 | /* prototypes */ |
236 | void AppLayerParsersInitPostProcess(void); | |
237 | void RegisterAppLayerParsers(void); | |
06904c90 | 238 | void AppLayerParserRegisterTests(void); |
8e10844f | 239 | |
06904c90 | 240 | /* registration */ |
fc2f7f29 GS |
241 | int AppLayerRegisterProto(char *name, uint8_t proto, uint8_t flags, |
242 | int (*AppLayerParser)(Flow *f, void *protocol_state, | |
9a6aef45 AS |
243 | AppLayerParserState *parser_state, |
244 | uint8_t *input, uint32_t input_len, | |
245 | void *local_data, | |
246 | AppLayerParserResult *output)); | |
fc2f7f29 GS |
247 | int AppLayerRegisterParser(char *name, uint16_t proto, uint16_t parser_id, |
248 | int (*AppLayerParser)(Flow *f, void *protocol_state, | |
9a6aef45 AS |
249 | AppLayerParserState *parser_state, |
250 | uint8_t *input, uint32_t input_len, | |
251 | void *local_data, | |
252 | AppLayerParserResult *output), | |
18fe3818 | 253 | char *dependency); |
0d7159b5 AS |
254 | void AppLayerRegisterParserAcceptableDataDirection(uint16_t al_proto, |
255 | uint8_t flags); | |
256 | void AppLayerMapProbingParserAgainstAlproto(uint16_t al_proto, | |
257 | uint8_t flags, | |
258 | ProbingParserFPtr ProbingParser); | |
d9686fae AS |
259 | void AppLayerRegisterProbingParser(struct AlpProtoDetectCtx_ *, |
260 | uint16_t ip_proto, | |
261 | char *portstr, | |
262 | char *al_proto_name, uint16_t al_proto, | |
263 | uint16_t min_depth, uint16_t max_depth, | |
264 | uint8_t flags, | |
8e8bc490 | 265 | ProbingParserFPtr ProbingParser); |
9faa4b74 | 266 | #ifdef UNITTESTS |
0d7159b5 | 267 | void AppLayerParserRegisterUnittests(uint16_t proto, void (*RegisterUnittests)(void)); |
9faa4b74 | 268 | #endif |
fc2f7f29 GS |
269 | void AppLayerRegisterStateFuncs(uint16_t proto, void *(*StateAlloc)(void), |
270 | void (*StateFree)(void *)); | |
9a6aef45 AS |
271 | void AppLayerRegisterLocalStorageFunc(uint16_t proto, |
272 | void *(*LocalStorageAlloc)(void), | |
273 | void (*LocalStorageFree)(void *)); | |
01a35bb6 | 274 | void *AppLayerGetProtocolParserLocalStorage(uint16_t); |
e1022ee5 | 275 | void AppLayerRegisterGetFilesFunc(uint16_t proto, |
d59ca75e | 276 | FileContainer *(*StateGetFile)(void *, uint8_t)); |
9dc04d9f VJ |
277 | void AppLayerRegisterGetEventsFunc(uint16_t proto, |
278 | AppLayerDecoderEvents *(*StateGetEvents)(void *, uint64_t)); | |
e8ad876b VJ |
279 | void AppLayerRegisterHasEventsFunc(uint16_t proto, |
280 | int (*StateHasEvents)(void *)); | |
281 | ||
70b32f73 | 282 | void AppLayerRegisterLogger(uint16_t proto); |
06904c90 | 283 | uint16_t AppLayerGetProtoByName(const char *); |
68425453 | 284 | const char *AppLayerGetProtoString(int proto); |
869109a6 | 285 | void AppLayerRegisterTruncateFunc(uint16_t proto, void (*Truncate)(void *, uint8_t)); |
d4d18e31 AS |
286 | void AppLayerRegisterGetAlstateProgressFunc(uint16_t alproto, |
287 | int (*StateGetAlstateProgress)(void *alstate, uint8_t direction)); | |
f59f9033 VJ |
288 | void AppLayerRegisterTxFreeFunc(uint16_t proto, |
289 | void (*StateTransactionFree)(void *, uint64_t)); | |
d4d18e31 AS |
290 | void AppLayerRegisterGetTxCnt(uint16_t alproto, |
291 | uint64_t (*StateGetTxCnt)(void *alstate)); | |
292 | void AppLayerRegisterGetTx(uint16_t alproto, | |
293 | void *(*StateGetTx)(void *alstate, uint64_t tx_id)); | |
294 | void AppLayerRegisterGetAlstateProgressCompletionStatus(uint16_t alproto, | |
295 | int (*StateProgressCompletionStatus)(uint8_t direction)); | |
5e2d9dbd AS |
296 | void AppLayerRegisterGetEventInfo(uint16_t alproto, |
297 | int (*StateGetEventInfo)(const char *event_name, | |
298 | int *event_id, | |
299 | AppLayerEventType *event_type)); | |
fc2f7f29 | 300 | |
9a6aef45 AS |
301 | int AppLayerParse(void *, Flow *, uint8_t, |
302 | uint8_t, uint8_t *, uint32_t); | |
fc2f7f29 GS |
303 | |
304 | int AlpParseFieldBySize(AppLayerParserResult *, AppLayerParserState *, uint16_t, | |
305 | uint32_t, uint8_t *, uint32_t, uint32_t *); | |
306 | int AlpParseFieldByEOF(AppLayerParserResult *, AppLayerParserState *, uint16_t, | |
307 | uint8_t *, uint32_t); | |
308 | int AlpParseFieldByDelimiter(AppLayerParserResult *, AppLayerParserState *, | |
309 | uint16_t, const uint8_t *, uint8_t, uint8_t *, | |
310 | uint32_t, uint32_t *); | |
8e10844f | 311 | |
f1f7df07 | 312 | |
d4d18e31 AS |
313 | /***** transaction handling *****/ |
314 | ||
315 | /** | |
316 | * \brief Update the current log id. Does one step increments currently. | |
317 | * | |
318 | * \param f Flow. | |
319 | */ | |
320 | void AppLayerTransactionUpdateLogId(Flow *f); | |
321 | ||
322 | /** | |
323 | * \brief Get the current log id. | |
324 | * | |
325 | * \param f Flow. | |
326 | */ | |
327 | uint64_t AppLayerTransactionGetLogId(Flow *f); | |
328 | ||
329 | /** | |
330 | * \brief Updates the inspection id for the alstate. | |
331 | * | |
332 | * \param f Pointer to the flow(LOCKED). | |
333 | * \param direction Direction. 0 - toserver, 1 - toclient. | |
334 | */ | |
335 | void AppLayerTransactionUpdateInspectId(Flow *f, uint8_t direction); | |
336 | ||
337 | /** | |
338 | * \brief Get the current tx id to be inspected. | |
339 | * | |
340 | * \param f Flow. | |
341 | * \param flags Flags. | |
342 | * | |
343 | * \retval A positive integer value. | |
344 | */ | |
345 | uint64_t AppLayerTransactionGetInspectId(Flow *f, uint8_t flags); | |
346 | ||
3b3dce83 | 347 | uint64_t AppLayerTransactionGetActive(Flow *f, uint8_t flags); |
d4d18e31 | 348 | |
70b32f73 | 349 | |
23e01d23 VJ |
350 | void AppLayerSetEOF(Flow *); |
351 | ||
d4d18e31 AS |
352 | |
353 | ||
354 | /***** cleanup *****/ | |
355 | ||
8cc525c9 | 356 | void AppLayerParserCleanupState(Flow *); |
a40fdc79 | 357 | void AppLayerFreeProbingParsers(AppLayerProbingParser *); |
432c3317 | 358 | void AppLayerPrintProbingParsers(AppLayerProbingParser *); |
ba12f3c1 | 359 | |
10966245 | 360 | void AppLayerListSupportedProtocols(void); |
eea5ab4a | 361 | AppLayerDecoderEvents *AppLayerGetDecoderEventsForFlow(Flow *); |
9dc04d9f VJ |
362 | AppLayerDecoderEvents *AppLayerGetEventsFromFlowByTx(Flow *f, uint64_t tx_id); |
363 | int AppLayerProtoIsTxEventAware(uint16_t alproto); | |
364 | int AppLayerFlowHasDecoderEvents(Flow *f, uint8_t flags); | |
e1022ee5 | 365 | |
d4d18e31 AS |
366 | /***** Alproto param retrieval ******/ |
367 | ||
368 | /** | |
369 | * \brief get the version of the state in a direction | |
370 | * | |
371 | * \param f Flow(LOCKED). | |
372 | * \param direction STREAM_TOSERVER or STREAM_TOCLIENT | |
373 | */ | |
374 | uint16_t AppLayerGetStateVersion(Flow *f); | |
375 | ||
376 | FileContainer *AppLayerGetFilesFromFlow(Flow *, uint8_t); | |
377 | ||
378 | /** | |
379 | * \brief Get the state progress. | |
380 | * | |
381 | * This is a generic wrapper to each ALPROTO. The value returned | |
382 | * needs to be interpreted by the caller, based on the ALPROTO_* | |
383 | * the caller supplies. | |
384 | * | |
385 | * The state can be anything based on what the ALPROTO handler | |
386 | * expects. We have given a return value of int, although a range | |
387 | * of -128 to 127 (int8_t) should be more than sufficient. | |
388 | * | |
389 | * \param alproto The app protocol. | |
390 | * \param state App state. | |
391 | * \param dir Directin. 0 - ts, 1 - tc. | |
392 | * | |
393 | * \retval An integer value indicating the current progress of "state". | |
394 | */ | |
395 | int AppLayerGetAlstateProgress(uint16_t alproto, void *state, uint8_t direction); | |
396 | ||
397 | /** | |
398 | * \brief Get the no of txs. | |
399 | * | |
400 | * \param alproto The app protocol. | |
401 | * \param alstate App state. | |
402 | * | |
403 | * \retval A positive integer value indicating the no of txs. | |
404 | */ | |
405 | uint64_t AppLayerGetTxCnt(uint16_t alproto, void *alstate); | |
406 | ||
407 | /** | |
408 | * \brief Get a tx referenced by the id. | |
409 | * | |
410 | * \param alproto The app protocol | |
411 | * \param alstate App state. | |
412 | * \param tx_id The transaction id. | |
413 | * | |
414 | * \retval Tx instance. | |
415 | */ | |
416 | void *AppLayerGetTx(uint16_t alproto, void *alstate, uint64_t tx_id); | |
417 | ||
418 | /** | |
419 | * \brief Get the state value for the following alproto, that corresponds to | |
420 | * COMPLETE or DONE. | |
421 | * | |
422 | * \param alproto The app protocol. | |
423 | * \param direction The direction. 0 - ts, 1 - tc. | |
424 | * | |
425 | * \retval An integer value indicating the state value. | |
426 | */ | |
427 | int AppLayerGetAlstateProgressCompletionStatus(uint16_t alproto, uint8_t direction); | |
428 | ||
429 | /** | |
430 | * \brief Informs if the alproto supports transactions or not. | |
431 | * | |
432 | * \param alproto The app protocol. | |
433 | * \param direction The direction. 0 - ts, 1 - tc. | |
434 | * | |
435 | * \retval 1 If true; 0 If false. | |
436 | */ | |
437 | int AppLayerAlprotoSupportsTxs(uint16_t alproto); | |
438 | ||
6cb00142 AS |
439 | /** |
440 | * \brief Triggers raw reassembly. | |
441 | * | |
442 | * \param f Flow pointer. | |
443 | */ | |
16cfae2f VJ |
444 | void AppLayerTriggerRawStreamReassembly(Flow *); |
445 | ||
6cb00142 AS |
446 | /** |
447 | * \brief Informs if the specified alproto's parser is enabled. | |
448 | * | |
449 | * \param alproto Character string holding the alproto name. | |
450 | */ | |
ddde572f | 451 | int AppLayerParserEnabled(const char *alproto); |
6cb00142 AS |
452 | |
453 | /** | |
454 | * \brief Informs if the specified alproto has detection enabled. | |
455 | * | |
456 | * \param alproto Character string holding the alproto name. | |
457 | */ | |
ddde572f | 458 | int AppLayerProtoDetectionEnabled(const char *alproto); |
6cb00142 AS |
459 | |
460 | /** | |
461 | * \brief Gets event info for this alproto. | |
462 | * | |
463 | * \param alproto Character string holding the alproto name. | |
464 | * \param event_name Name of the event. | |
465 | * \param event_id Pointer to an instance to send back event id. | |
466 | */ | |
5e2d9dbd AS |
467 | int AppLayerGetEventInfo(uint16_t alproto, const char *event_name, |
468 | int *event_id, AppLayerEventType *event_type); | |
6cb00142 AS |
469 | |
470 | /***** Utility *****/ | |
471 | ||
6f8cfd99 AS |
472 | void AppLayerParseProbingParserPorts(const char *al_proto_name, uint16_t al_proto, |
473 | uint16_t min_depth, uint16_t max_depth, | |
8e8bc490 | 474 | ProbingParserFPtr ProbingParser); |
ddde572f | 475 | |
6cb00142 AS |
476 | |
477 | /***** Unittests *****/ | |
478 | ||
5e2d9dbd AS |
479 | /** |
480 | * \brief Backup al_proto_table. | |
481 | * | |
482 | * Currently we backup only the event table. Feel free to backup | |
483 | * other stuff as and when required. | |
484 | */ | |
6cb00142 AS |
485 | void AppLayerParserBackupAlprotoTable(void); |
486 | void AppLayerParserRestoreAlprotoTable(void); | |
487 | ||
8e10844f | 488 | #endif /* __APP_LAYER_PARSER_H__ */ |