[people/ms/suricata.git] / src / app-layer-parser.h

/* Copyright (C) 2007-2020 Open Information Security Foundation
 *
 * You can copy, redistribute or modify this Program under the terms of
 * the GNU General Public License version 2 as published by the Free
 * Software Foundation.
 *
 * This program is distributed in the hope that it will be useful,
 * but WITHOUT ANY WARRANTY; without even the implied warranty of
 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
 * GNU General Public License for more details.
 *
 * You should have received a copy of the GNU General Public License
 * version 2 along with this program; if not, write to the Free Software
 * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA
 * 02110-1301, USA.
 */

/**
 * \file
 *
 * \author Victor Julien <victor@inliniac.net>
 * \author Anoop Saldanha <anoopsaldanha@gmail.com>
 */

#ifndef __APP_LAYER_PARSER_H__
#define __APP_LAYER_PARSER_H__

#include "app-layer-events.h"
#include "detect-engine-state.h"
#include "util-file.h"
#include "stream-tcp-private.h"
#include "rust.h"
#include "util-config.h"

/* Flags for AppLayerParserState. */
// flag available                               BIT_U8(0)
#define APP_LAYER_PARSER_NO_INSPECTION          BIT_U8(1)
#define APP_LAYER_PARSER_NO_REASSEMBLY          BIT_U8(2)
#define APP_LAYER_PARSER_NO_INSPECTION_PAYLOAD  BIT_U8(3)
#define APP_LAYER_PARSER_BYPASS_READY           BIT_U8(4)
#define APP_LAYER_PARSER_EOF_TS                 BIT_U8(5)
#define APP_LAYER_PARSER_EOF_TC                 BIT_U8(6)

/* Flags for AppLayerParserProtoCtx. */
#define APP_LAYER_PARSER_OPT_ACCEPT_GAPS        BIT_U32(0)
#define APP_LAYER_PARSER_OPT_UNIDIR_TXS         BIT_U32(1)

#define APP_LAYER_PARSER_INT_STREAM_DEPTH_SET   BIT_U32(0)

/* applies to DetectFlags uint64_t field */

/** reserved for future use */
#define APP_LAYER_TX_RESERVED1_FLAG  BIT_U64(48)
#define APP_LAYER_TX_RESERVED2_FLAG  BIT_U64(49)
#define APP_LAYER_TX_RESERVED3_FLAG  BIT_U64(50)
#define APP_LAYER_TX_RESERVED4_FLAG  BIT_U64(51)
#define APP_LAYER_TX_RESERVED5_FLAG  BIT_U64(52)
#define APP_LAYER_TX_RESERVED6_FLAG  BIT_U64(53)
#define APP_LAYER_TX_RESERVED7_FLAG  BIT_U64(54)
#define APP_LAYER_TX_RESERVED8_FLAG  BIT_U64(55)
#define APP_LAYER_TX_RESERVED9_FLAG  BIT_U64(56)
#define APP_LAYER_TX_RESERVED10_FLAG BIT_U64(57)
#define APP_LAYER_TX_RESERVED11_FLAG BIT_U64(58)
#define APP_LAYER_TX_RESERVED12_FLAG BIT_U64(59)
#define APP_LAYER_TX_RESERVED13_FLAG BIT_U64(60)
#define APP_LAYER_TX_RESERVED14_FLAG BIT_U64(61)
#define APP_LAYER_TX_RESERVED15_FLAG BIT_U64(62)

#define APP_LAYER_TX_RESERVED_FLAGS                                                                \
    (APP_LAYER_TX_RESERVED1_FLAG | APP_LAYER_TX_RESERVED2_FLAG | APP_LAYER_TX_RESERVED3_FLAG |     \
            APP_LAYER_TX_RESERVED4_FLAG | APP_LAYER_TX_RESERVED5_FLAG |                            \
            APP_LAYER_TX_RESERVED6_FLAG | APP_LAYER_TX_RESERVED7_FLAG |                            \
            APP_LAYER_TX_RESERVED8_FLAG | APP_LAYER_TX_RESERVED9_FLAG |                            \
            APP_LAYER_TX_RESERVED10_FLAG | APP_LAYER_TX_RESERVED11_FLAG |                          \
            APP_LAYER_TX_RESERVED12_FLAG | APP_LAYER_TX_RESERVED13_FLAG |                          \
            APP_LAYER_TX_RESERVED14_FLAG | APP_LAYER_TX_RESERVED15_FLAG)

/** is tx fully inspected? */
#define APP_LAYER_TX_INSPECTED_FLAG             BIT_U64(63)
/** other 63 bits are for tracking which prefilter engine is already
 *  completely inspected */
#define APP_LAYER_TX_PREFILTER_MASK ~(APP_LAYER_TX_INSPECTED_FLAG | APP_LAYER_TX_RESERVED_FLAGS)

/** parser has successfully processed in the input, and has consumed
 *  all of it. */
#define APP_LAYER_OK (AppLayerResult) { 0, 0, 0 }

/** parser has hit an unrecoverable error. Returning this to the API
 *  leads to no further calls to the parser. */
#define APP_LAYER_ERROR (AppLayerResult) { -1, 0, 0 }

/** parser needs more data. Through 'c' it will indicate how many
 *  of the input bytes it has consumed. Through 'n' it will indicate
 *  how many more bytes it needs before getting called again.
 *  \note consumed (c) should never be more than the input len
 *        needed (n) + consumed (c) should be more than the input len
 */
#define APP_LAYER_INCOMPLETE(c,n) (AppLayerResult) { 1, (c), (n) }

int AppLayerParserProtoIsRegistered(uint8_t ipproto, AppProto alproto);

/***** transaction handling *****/

int AppLayerParserSetup(void);
void AppLayerParserPostStreamSetup(void);
int AppLayerParserDeSetup(void);

typedef struct AppLayerParserThreadCtx_ AppLayerParserThreadCtx;

/**
 * \brief Gets a new app layer protocol's parser thread context.
 *
 * \retval Non-NULL pointer on success.
 *         NULL pointer on failure.
 */
AppLayerParserThreadCtx *AppLayerParserThreadCtxAlloc(void);

/**
 * \brief Destroys the app layer parser thread context obtained
 *        using AppLayerParserThreadCtxAlloc().
 *
 * \param tctx Pointer to the thread context to be destroyed.
 */
void AppLayerParserThreadCtxFree(AppLayerParserThreadCtx *tctx);

/**
 * \brief Given a protocol name, checks if the parser is enabled in
 *        the conf file.
 *
 * \param alproto_name Name of the app layer protocol.
 *
 * \retval 1 If enabled.
 * \retval 0 If disabled.
 */
int AppLayerParserConfParserEnabled(const char *ipproto,
                                    const char *alproto_name);

/** \brief Prototype for parsing functions */
typedef AppLayerResult (*AppLayerParserFPtr)(Flow *f, void *protocol_state,
        AppLayerParserState *pstate,
        const uint8_t *buf, uint32_t buf_len,
        void *local_storage, const uint8_t flags);

typedef struct AppLayerGetTxIterState {
    union {
        void *ptr;
        uint64_t u64;
    } un;
} AppLayerGetTxIterState;

/** \brief tx iterator prototype */
typedef AppLayerGetTxIterTuple (*AppLayerGetTxIteratorFunc)
       (const uint8_t ipproto, const AppProto alproto,
        void *alstate, uint64_t min_tx_id, uint64_t max_tx_id,
        AppLayerGetTxIterState *state);

/***** Parser related registration *****/

/**
 * \brief Register app layer parser for the protocol.
 *
 * \retval 0 On success.
 * \retval -1 On failure.
 */
int AppLayerParserRegisterParser(uint8_t ipproto, AppProto alproto,
                      uint8_t direction,
                      AppLayerParserFPtr Parser);
void AppLayerParserRegisterParserAcceptableDataDirection(uint8_t ipproto,
                                              AppProto alproto,
                                              uint8_t direction);
void AppLayerParserRegisterOptionFlags(uint8_t ipproto, AppProto alproto,
        uint32_t flags);
void AppLayerParserRegisterStateFuncs(uint8_t ipproto, AppProto alproto,
        void *(*StateAlloc)(void *, AppProto), void (*StateFree)(void *));
void AppLayerParserRegisterLocalStorageFunc(uint8_t ipproto, AppProto proto,
                                 void *(*LocalStorageAlloc)(void),
                                 void (*LocalStorageFree)(void *));
void AppLayerParserRegisterGetFilesFunc(uint8_t ipproto, AppProto alproto,
                             FileContainer *(*StateGetFiles)(void *, uint8_t));
void AppLayerParserRegisterGetEventsFunc(uint8_t ipproto, AppProto proto,
    AppLayerDecoderEvents *(*StateGetEvents)(void *) __attribute__((nonnull)));
void AppLayerParserRegisterLoggerFuncs(uint8_t ipproto, AppProto alproto,
                         LoggerId (*StateGetTxLogged)(void *, void *),
                         void (*StateSetTxLogged)(void *, void *, LoggerId));
void AppLayerParserRegisterLogger(uint8_t ipproto, AppProto alproto);
void AppLayerParserRegisterLoggerBits(uint8_t ipproto, AppProto alproto, LoggerId bits);
void AppLayerParserRegisterTruncateFunc(uint8_t ipproto, AppProto alproto,
                             void (*Truncate)(void *, uint8_t));
void AppLayerParserRegisterGetStateProgressFunc(uint8_t ipproto, AppProto alproto,
    int (*StateGetStateProgress)(void *alstate, uint8_t direction));
void AppLayerParserRegisterTxFreeFunc(uint8_t ipproto, AppProto alproto,
                           void (*StateTransactionFree)(void *, uint64_t));
void AppLayerParserRegisterGetTxCnt(uint8_t ipproto, AppProto alproto,
                         uint64_t (*StateGetTxCnt)(void *alstate));
void AppLayerParserRegisterGetTx(uint8_t ipproto, AppProto alproto,
                      void *(StateGetTx)(void *alstate, uint64_t tx_id));
void AppLayerParserRegisterGetTxIterator(uint8_t ipproto, AppProto alproto,
                      AppLayerGetTxIteratorFunc Func);
void AppLayerParserRegisterStateProgressCompletionStatus(
        AppProto alproto, const int ts, const int tc);
void AppLayerParserRegisterGetEventInfo(uint8_t ipproto, AppProto alproto,
    int (*StateGetEventInfo)(const char *event_name, int *event_id,
                             AppLayerEventType *event_type));
void AppLayerParserRegisterGetEventInfoById(uint8_t ipproto, AppProto alproto,
    int (*StateGetEventInfoById)(int event_id, const char **event_name,
                                 AppLayerEventType *event_type));
void AppLayerParserRegisterGetStreamDepth(uint8_t ipproto,
                                          AppProto alproto,
                                          uint32_t (*GetStreamDepth)(void));
void AppLayerParserRegisterSetStreamDepthFlag(uint8_t ipproto, AppProto alproto,
        void (*SetStreamDepthFlag)(void *tx, uint8_t flags));

void AppLayerParserRegisterTxDataFunc(uint8_t ipproto, AppProto alproto,
        AppLayerTxData *(*GetTxData)(void *tx));
void AppLayerParserRegisterApplyTxConfigFunc(uint8_t ipproto, AppProto alproto,
        bool (*ApplyTxConfig)(void *state, void *tx, int mode, AppLayerTxConfig));

/***** Get and transaction functions *****/

uint32_t AppLayerParserGetOptionFlags(uint8_t protomap, AppProto alproto);
AppLayerGetTxIteratorFunc AppLayerGetTxIterator(const uint8_t ipproto,
         const AppProto alproto);

void *AppLayerParserGetProtocolParserLocalStorage(uint8_t ipproto, AppProto alproto);
void AppLayerParserDestroyProtocolParserLocalStorage(uint8_t ipproto, AppProto alproto,
                                          void *local_data);


uint64_t AppLayerParserGetTransactionLogId(AppLayerParserState *pstate);
void AppLayerParserSetTransactionLogId(AppLayerParserState *pstate, uint64_t tx_id);

uint64_t AppLayerParserGetTransactionInspectId(AppLayerParserState *pstate, uint8_t direction);
void AppLayerParserSetTransactionInspectId(const Flow *f, AppLayerParserState *pstate,
                                void *alstate, const uint8_t flags, bool tag_txs_as_inspected);

AppLayerDecoderEvents *AppLayerParserGetDecoderEvents(AppLayerParserState *pstate);
void AppLayerParserSetDecoderEvents(AppLayerParserState *pstate, AppLayerDecoderEvents *devents);
AppLayerDecoderEvents *AppLayerParserGetEventsByTx(uint8_t ipproto, AppProto alproto, void *tx);
FileContainer *AppLayerParserGetFiles(const Flow *f, const uint8_t direction);
int AppLayerParserGetStateProgress(uint8_t ipproto, AppProto alproto,
                        void *alstate, uint8_t direction);
uint64_t AppLayerParserGetTxCnt(const Flow *, void *alstate);
void *AppLayerParserGetTx(uint8_t ipproto, AppProto alproto, void *alstate, uint64_t tx_id);
int AppLayerParserGetStateProgressCompletionStatus(AppProto alproto, uint8_t direction);
int AppLayerParserGetEventInfo(uint8_t ipproto, AppProto alproto, const char *event_name,
                    int *event_id, AppLayerEventType *event_type);
int AppLayerParserGetEventInfoById(uint8_t ipproto, AppProto alproto, int event_id,
                    const char **event_name, AppLayerEventType *event_type);

uint64_t AppLayerParserGetTransactionActive(const Flow *f, AppLayerParserState *pstate, uint8_t direction);

uint8_t AppLayerParserGetFirstDataDir(uint8_t ipproto, AppProto alproto);

int AppLayerParserSupportsFiles(uint8_t ipproto, AppProto alproto);
int AppLayerParserHasTxDetectState(uint8_t ipproto, AppProto alproto, void *alstate);
DetectEngineState *AppLayerParserGetTxDetectState(uint8_t ipproto, AppProto alproto, void *tx);
int AppLayerParserSetTxDetectState(const Flow *f, void *tx, DetectEngineState *s);

AppLayerTxData *AppLayerParserGetTxData(uint8_t ipproto, AppProto alproto, void *tx);
void AppLayerParserApplyTxConfig(uint8_t ipproto, AppProto alproto,
        void *state, void *tx, enum ConfigAction mode, AppLayerTxConfig);

/***** General *****/

int AppLayerParserParse(ThreadVars *tv, AppLayerParserThreadCtx *tctx, Flow *f, AppProto alproto,
                   uint8_t flags, const uint8_t *input, uint32_t input_len);
void AppLayerParserSetEOF(AppLayerParserState *pstate);
bool AppLayerParserHasDecoderEvents(AppLayerParserState *pstate);
int AppLayerParserProtocolIsTxEventAware(uint8_t ipproto, AppProto alproto);
int AppLayerParserProtocolHasLogger(uint8_t ipproto, AppProto alproto);
LoggerId AppLayerParserProtocolGetLoggerBits(uint8_t ipproto, AppProto alproto);
void AppLayerParserTriggerRawStreamReassembly(Flow *f, int direction);
void AppLayerParserSetStreamDepth(uint8_t ipproto, AppProto alproto, uint32_t stream_depth);
uint32_t AppLayerParserGetStreamDepth(const Flow *f);
void AppLayerParserSetStreamDepthFlag(uint8_t ipproto, AppProto alproto, void *state, uint64_t tx_id, uint8_t flags);
int AppLayerParserIsEnabled(AppProto alproto);

/***** Cleanup *****/

void AppLayerParserStateProtoCleanup(
        uint8_t protomap, AppProto alproto, void *alstate, AppLayerParserState *pstate);
void AppLayerParserStateCleanup(const Flow *f, void *alstate, AppLayerParserState *pstate);

void AppLayerParserRegisterProtocolParsers(void);


void AppLayerParserStateSetFlag(AppLayerParserState *pstate, uint8_t flag);
int AppLayerParserStateIssetFlag(AppLayerParserState *pstate, uint8_t flag);

void AppLayerParserStreamTruncated(uint8_t ipproto, AppProto alproto, void *alstate,
                        uint8_t direction);


AppLayerParserState *AppLayerParserStateAlloc(void);
void AppLayerParserStateFree(AppLayerParserState *pstate);

void AppLayerParserTransactionsCleanup(Flow *f);

#ifdef DEBUG
void AppLayerParserStatePrintDetails(AppLayerParserState *pstate);
#endif


/***** Unittests *****/

#ifdef UNITTESTS
void AppLayerParserRegisterProtocolUnittests(uint8_t ipproto, AppProto alproto,
                                  void (*RegisterUnittests)(void));
void AppLayerParserRegisterUnittests(void);
void AppLayerParserBackupParserTable(void);
void AppLayerParserRestoreParserTable(void);
void UTHAppLayerParserStateGetIds(void *ptr, uint64_t *i1, uint64_t *i2, uint64_t *log, uint64_t *min);
#endif

#endif /* __APP_LAYER_PARSER_H__ */
Commit	Line	Data
	1	/* Copyright (C) 2007-2020 Open Information Security Foundation
	2	*
	3	* You can copy, redistribute or modify this Program under the terms of
	4	* the GNU General Public License version 2 as published by the Free
	5	* Software Foundation.
	6	*
	7	* This program is distributed in the hope that it will be useful,
	8	* but WITHOUT ANY WARRANTY; without even the implied warranty of
	9	* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
	10	* GNU General Public License for more details.
	11	*
	12	* You should have received a copy of the GNU General Public License
	13	* version 2 along with this program; if not, write to the Free Software
	14	* Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA
	15	* 02110-1301, USA.
	16	*/
	17
	18	/**
	19	* \file
	20	*
	21	* \author Victor Julien <victor@inliniac.net>
	22	* \author Anoop Saldanha <anoopsaldanha@gmail.com>
	23	*/
	24
	25	#ifndef __APP_LAYER_PARSER_H__
	26	#define __APP_LAYER_PARSER_H__
	27
	28	#include "app-layer-events.h"
	29	#include "detect-engine-state.h"
	30	#include "util-file.h"
	31	#include "stream-tcp-private.h"
	32	#include "rust.h"
	33	#include "util-config.h"
	34
	35	/* Flags for AppLayerParserState. */
	36	// flag available BIT_U8(0)
	37	#define APP_LAYER_PARSER_NO_INSPECTION BIT_U8(1)
	38	#define APP_LAYER_PARSER_NO_REASSEMBLY BIT_U8(2)
	39	#define APP_LAYER_PARSER_NO_INSPECTION_PAYLOAD BIT_U8(3)
	40	#define APP_LAYER_PARSER_BYPASS_READY BIT_U8(4)
	41	#define APP_LAYER_PARSER_EOF_TS BIT_U8(5)
	42	#define APP_LAYER_PARSER_EOF_TC BIT_U8(6)
	43
	44	/* Flags for AppLayerParserProtoCtx. */
	45	#define APP_LAYER_PARSER_OPT_ACCEPT_GAPS BIT_U32(0)
	46	#define APP_LAYER_PARSER_OPT_UNIDIR_TXS BIT_U32(1)
	47
	48	#define APP_LAYER_PARSER_INT_STREAM_DEPTH_SET BIT_U32(0)
	49
	50	/* applies to DetectFlags uint64_t field */
	51
	52	/** reserved for future use */
	53	#define APP_LAYER_TX_RESERVED1_FLAG BIT_U64(48)
	54	#define APP_LAYER_TX_RESERVED2_FLAG BIT_U64(49)
	55	#define APP_LAYER_TX_RESERVED3_FLAG BIT_U64(50)
	56	#define APP_LAYER_TX_RESERVED4_FLAG BIT_U64(51)
	57	#define APP_LAYER_TX_RESERVED5_FLAG BIT_U64(52)
	58	#define APP_LAYER_TX_RESERVED6_FLAG BIT_U64(53)
	59	#define APP_LAYER_TX_RESERVED7_FLAG BIT_U64(54)
	60	#define APP_LAYER_TX_RESERVED8_FLAG BIT_U64(55)
	61	#define APP_LAYER_TX_RESERVED9_FLAG BIT_U64(56)
	62	#define APP_LAYER_TX_RESERVED10_FLAG BIT_U64(57)
	63	#define APP_LAYER_TX_RESERVED11_FLAG BIT_U64(58)
	64	#define APP_LAYER_TX_RESERVED12_FLAG BIT_U64(59)
	65	#define APP_LAYER_TX_RESERVED13_FLAG BIT_U64(60)
	66	#define APP_LAYER_TX_RESERVED14_FLAG BIT_U64(61)
	67	#define APP_LAYER_TX_RESERVED15_FLAG BIT_U64(62)
	68
	69	#define APP_LAYER_TX_RESERVED_FLAGS \
	70	(APP_LAYER_TX_RESERVED1_FLAG \| APP_LAYER_TX_RESERVED2_FLAG \| APP_LAYER_TX_RESERVED3_FLAG \| \
	71	APP_LAYER_TX_RESERVED4_FLAG \| APP_LAYER_TX_RESERVED5_FLAG \| \
	72	APP_LAYER_TX_RESERVED6_FLAG \| APP_LAYER_TX_RESERVED7_FLAG \| \
	73	APP_LAYER_TX_RESERVED8_FLAG \| APP_LAYER_TX_RESERVED9_FLAG \| \
	74	APP_LAYER_TX_RESERVED10_FLAG \| APP_LAYER_TX_RESERVED11_FLAG \| \
	75	APP_LAYER_TX_RESERVED12_FLAG \| APP_LAYER_TX_RESERVED13_FLAG \| \
	76	APP_LAYER_TX_RESERVED14_FLAG \| APP_LAYER_TX_RESERVED15_FLAG)
	77
	78	/** is tx fully inspected? */
	79	#define APP_LAYER_TX_INSPECTED_FLAG BIT_U64(63)
	80	/** other 63 bits are for tracking which prefilter engine is already
	81	* completely inspected */
	82	#define APP_LAYER_TX_PREFILTER_MASK ~(APP_LAYER_TX_INSPECTED_FLAG \| APP_LAYER_TX_RESERVED_FLAGS)
	83
	84	/** parser has successfully processed in the input, and has consumed
	85	* all of it. */
	86	#define APP_LAYER_OK (AppLayerResult) { 0, 0, 0 }
	87
	88	/** parser has hit an unrecoverable error. Returning this to the API
	89	* leads to no further calls to the parser. */
	90	#define APP_LAYER_ERROR (AppLayerResult) { -1, 0, 0 }
	91
	92	/** parser needs more data. Through 'c' it will indicate how many
	93	* of the input bytes it has consumed. Through 'n' it will indicate
	94	* how many more bytes it needs before getting called again.
	95	* \note consumed (c) should never be more than the input len
	96	* needed (n) + consumed (c) should be more than the input len
	97	*/
	98	#define APP_LAYER_INCOMPLETE(c,n) (AppLayerResult) { 1, (c), (n) }
	99
	100	int AppLayerParserProtoIsRegistered(uint8_t ipproto, AppProto alproto);
	101
	102	/*** transaction handling ***/
	103
	104	int AppLayerParserSetup(void);
	105	void AppLayerParserPostStreamSetup(void);
	106	int AppLayerParserDeSetup(void);
	107
	108	typedef struct AppLayerParserThreadCtx_ AppLayerParserThreadCtx;
	109
	110	/**
	111	* \brief Gets a new app layer protocol's parser thread context.
	112	*
	113	* \retval Non-NULL pointer on success.
	114	* NULL pointer on failure.
	115	*/
	116	AppLayerParserThreadCtx *AppLayerParserThreadCtxAlloc(void);
	117
	118	/**
	119	* \brief Destroys the app layer parser thread context obtained
	120	* using AppLayerParserThreadCtxAlloc().
	121	*
	122	* \param tctx Pointer to the thread context to be destroyed.
	123	*/
	124	void AppLayerParserThreadCtxFree(AppLayerParserThreadCtx *tctx);
	125
	126	/**
	127	* \brief Given a protocol name, checks if the parser is enabled in
	128	* the conf file.
	129	*
	130	* \param alproto_name Name of the app layer protocol.
	131	*
	132	* \retval 1 If enabled.
	133	* \retval 0 If disabled.
	134	*/
	135	int AppLayerParserConfParserEnabled(const char *ipproto,
	136	const char *alproto_name);
	137
	138	/** \brief Prototype for parsing functions */
	139	typedef AppLayerResult (AppLayerParserFPtr)(Flow f, void *protocol_state,
	140	AppLayerParserState *pstate,
	141	const uint8_t *buf, uint32_t buf_len,
	142	void *local_storage, const uint8_t flags);
	143
	144	typedef struct AppLayerGetTxIterState {
	145	union {
	146	void *ptr;
	147	uint64_t u64;
	148	} un;
	149	} AppLayerGetTxIterState;
	150
	151	/** \brief tx iterator prototype */
	152	typedef AppLayerGetTxIterTuple (*AppLayerGetTxIteratorFunc)
	153	(const uint8_t ipproto, const AppProto alproto,
	154	void *alstate, uint64_t min_tx_id, uint64_t max_tx_id,
	155	AppLayerGetTxIterState *state);
	156
	157	/*** Parser related registration ***/
	158
	159	/**
	160	* \brief Register app layer parser for the protocol.
	161	*
	162	* \retval 0 On success.
	163	* \retval -1 On failure.
	164	*/
	165	int AppLayerParserRegisterParser(uint8_t ipproto, AppProto alproto,
	166	uint8_t direction,
	167	AppLayerParserFPtr Parser);
	168	void AppLayerParserRegisterParserAcceptableDataDirection(uint8_t ipproto,
	169	AppProto alproto,
	170	uint8_t direction);
	171	void AppLayerParserRegisterOptionFlags(uint8_t ipproto, AppProto alproto,
	172	uint32_t flags);
	173	void AppLayerParserRegisterStateFuncs(uint8_t ipproto, AppProto alproto,
	174	void (StateAlloc)(void , AppProto), void (StateFree)(void *));
	175	void AppLayerParserRegisterLocalStorageFunc(uint8_t ipproto, AppProto proto,
	176	void (LocalStorageAlloc)(void),
	177	void (LocalStorageFree)(void ));
	178	void AppLayerParserRegisterGetFilesFunc(uint8_t ipproto, AppProto alproto,
	179	FileContainer (StateGetFiles)(void *, uint8_t));
	180	void AppLayerParserRegisterGetEventsFunc(uint8_t ipproto, AppProto proto,
	181	AppLayerDecoderEvents (StateGetEvents)(void *) __attribute__((nonnull)));
	182	void AppLayerParserRegisterLoggerFuncs(uint8_t ipproto, AppProto alproto,
	183	LoggerId (StateGetTxLogged)(void , void *),
	184	void (StateSetTxLogged)(void , void *, LoggerId));
	185	void AppLayerParserRegisterLogger(uint8_t ipproto, AppProto alproto);
	186	void AppLayerParserRegisterLoggerBits(uint8_t ipproto, AppProto alproto, LoggerId bits);
	187	void AppLayerParserRegisterTruncateFunc(uint8_t ipproto, AppProto alproto,
	188	void (Truncate)(void , uint8_t));
	189	void AppLayerParserRegisterGetStateProgressFunc(uint8_t ipproto, AppProto alproto,
	190	int (StateGetStateProgress)(void alstate, uint8_t direction));
	191	void AppLayerParserRegisterTxFreeFunc(uint8_t ipproto, AppProto alproto,
	192	void (StateTransactionFree)(void , uint64_t));
	193	void AppLayerParserRegisterGetTxCnt(uint8_t ipproto, AppProto alproto,
	194	uint64_t (StateGetTxCnt)(void alstate));
	195	void AppLayerParserRegisterGetTx(uint8_t ipproto, AppProto alproto,
	196	void (StateGetTx)(void alstate, uint64_t tx_id));
	197	void AppLayerParserRegisterGetTxIterator(uint8_t ipproto, AppProto alproto,
	198	AppLayerGetTxIteratorFunc Func);
	199	void AppLayerParserRegisterStateProgressCompletionStatus(
	200	AppProto alproto, const int ts, const int tc);
	201	void AppLayerParserRegisterGetEventInfo(uint8_t ipproto, AppProto alproto,
	202	int (StateGetEventInfo)(const char event_name, int *event_id,
	203	AppLayerEventType *event_type));
	204	void AppLayerParserRegisterGetEventInfoById(uint8_t ipproto, AppProto alproto,
	205	int (StateGetEventInfoById)(int event_id, const char *event_name,
	206	AppLayerEventType *event_type));
	207	void AppLayerParserRegisterGetStreamDepth(uint8_t ipproto,
	208	AppProto alproto,
	209	uint32_t (*GetStreamDepth)(void));
	210	void AppLayerParserRegisterSetStreamDepthFlag(uint8_t ipproto, AppProto alproto,
	211	void (SetStreamDepthFlag)(void tx, uint8_t flags));
	212
	213	void AppLayerParserRegisterTxDataFunc(uint8_t ipproto, AppProto alproto,
	214	AppLayerTxData (GetTxData)(void *tx));
	215	void AppLayerParserRegisterApplyTxConfigFunc(uint8_t ipproto, AppProto alproto,
	216	bool (ApplyTxConfig)(void state, void *tx, int mode, AppLayerTxConfig));
	217
	218	/*** Get and transaction functions ***/
	219
	220	uint32_t AppLayerParserGetOptionFlags(uint8_t protomap, AppProto alproto);
	221	AppLayerGetTxIteratorFunc AppLayerGetTxIterator(const uint8_t ipproto,
	222	const AppProto alproto);
	223
	224	void *AppLayerParserGetProtocolParserLocalStorage(uint8_t ipproto, AppProto alproto);
	225	void AppLayerParserDestroyProtocolParserLocalStorage(uint8_t ipproto, AppProto alproto,
	226	void *local_data);
	227
	228
	229	uint64_t AppLayerParserGetTransactionLogId(AppLayerParserState *pstate);
	230	void AppLayerParserSetTransactionLogId(AppLayerParserState *pstate, uint64_t tx_id);
	231
	232	uint64_t AppLayerParserGetTransactionInspectId(AppLayerParserState *pstate, uint8_t direction);
	233	void AppLayerParserSetTransactionInspectId(const Flow f, AppLayerParserState pstate,
	234	void *alstate, const uint8_t flags, bool tag_txs_as_inspected);
	235
	236	AppLayerDecoderEvents AppLayerParserGetDecoderEvents(AppLayerParserState pstate);
	237	void AppLayerParserSetDecoderEvents(AppLayerParserState pstate, AppLayerDecoderEvents devents);
	238	AppLayerDecoderEvents AppLayerParserGetEventsByTx(uint8_t ipproto, AppProto alproto, void tx);
	239	FileContainer AppLayerParserGetFiles(const Flow f, const uint8_t direction);
	240	int AppLayerParserGetStateProgress(uint8_t ipproto, AppProto alproto,
	241	void *alstate, uint8_t direction);
	242	uint64_t AppLayerParserGetTxCnt(const Flow , void alstate);
	243	void AppLayerParserGetTx(uint8_t ipproto, AppProto alproto, void alstate, uint64_t tx_id);
	244	int AppLayerParserGetStateProgressCompletionStatus(AppProto alproto, uint8_t direction);
	245	int AppLayerParserGetEventInfo(uint8_t ipproto, AppProto alproto, const char *event_name,
	246	int event_id, AppLayerEventType event_type);
	247	int AppLayerParserGetEventInfoById(uint8_t ipproto, AppProto alproto, int event_id,
	248	const char *event_name, AppLayerEventType event_type);
	249
	250	uint64_t AppLayerParserGetTransactionActive(const Flow f, AppLayerParserState pstate, uint8_t direction);
	251
	252	uint8_t AppLayerParserGetFirstDataDir(uint8_t ipproto, AppProto alproto);
	253
	254	int AppLayerParserSupportsFiles(uint8_t ipproto, AppProto alproto);
	255	int AppLayerParserHasTxDetectState(uint8_t ipproto, AppProto alproto, void *alstate);
	256	DetectEngineState AppLayerParserGetTxDetectState(uint8_t ipproto, AppProto alproto, void tx);
	257	int AppLayerParserSetTxDetectState(const Flow f, void tx, DetectEngineState *s);
	258
	259	AppLayerTxData AppLayerParserGetTxData(uint8_t ipproto, AppProto alproto, void tx);
	260	void AppLayerParserApplyTxConfig(uint8_t ipproto, AppProto alproto,
	261	void state, void tx, enum ConfigAction mode, AppLayerTxConfig);
	262
	263	/*** General ***/
	264
	265	int AppLayerParserParse(ThreadVars tv, AppLayerParserThreadCtx tctx, Flow *f, AppProto alproto,
	266	uint8_t flags, const uint8_t *input, uint32_t input_len);
	267	void AppLayerParserSetEOF(AppLayerParserState *pstate);
	268	bool AppLayerParserHasDecoderEvents(AppLayerParserState *pstate);
	269	int AppLayerParserProtocolIsTxEventAware(uint8_t ipproto, AppProto alproto);
	270	int AppLayerParserProtocolHasLogger(uint8_t ipproto, AppProto alproto);
	271	LoggerId AppLayerParserProtocolGetLoggerBits(uint8_t ipproto, AppProto alproto);
	272	void AppLayerParserTriggerRawStreamReassembly(Flow *f, int direction);
	273	void AppLayerParserSetStreamDepth(uint8_t ipproto, AppProto alproto, uint32_t stream_depth);
	274	uint32_t AppLayerParserGetStreamDepth(const Flow *f);
	275	void AppLayerParserSetStreamDepthFlag(uint8_t ipproto, AppProto alproto, void *state, uint64_t tx_id, uint8_t flags);
	276	int AppLayerParserIsEnabled(AppProto alproto);
	277
	278	/*** Cleanup ***/
	279
	280	void AppLayerParserStateProtoCleanup(
	281	uint8_t protomap, AppProto alproto, void alstate, AppLayerParserState pstate);
	282	void AppLayerParserStateCleanup(const Flow f, void alstate, AppLayerParserState *pstate);
	283
	284	void AppLayerParserRegisterProtocolParsers(void);
	285
	286
	287	void AppLayerParserStateSetFlag(AppLayerParserState *pstate, uint8_t flag);
	288	int AppLayerParserStateIssetFlag(AppLayerParserState *pstate, uint8_t flag);
	289
	290	void AppLayerParserStreamTruncated(uint8_t ipproto, AppProto alproto, void *alstate,
	291	uint8_t direction);
	292
	293
	294
	295	AppLayerParserState *AppLayerParserStateAlloc(void);
	296	void AppLayerParserStateFree(AppLayerParserState *pstate);
	297
	298	void AppLayerParserTransactionsCleanup(Flow *f);
	299
	300	#ifdef DEBUG
	301	void AppLayerParserStatePrintDetails(AppLayerParserState *pstate);
	302	#endif
	303
	304
	305	/*** Unittests ***/
	306
	307	#ifdef UNITTESTS
	308	void AppLayerParserRegisterProtocolUnittests(uint8_t ipproto, AppProto alproto,
	309	void (*RegisterUnittests)(void));
	310	void AppLayerParserRegisterUnittests(void);
	311	void AppLayerParserBackupParserTable(void);
	312	void AppLayerParserRestoreParserTable(void);
	313	void UTHAppLayerParserStateGetIds(void ptr, uint64_t i1, uint64_t i2, uint64_t log, uint64_t *min);
	314	#endif
	315
	316	#endif /* __APP_LAYER_PARSER_H__ */