suricata
app-layer-parser.h
Go to the documentation of this file.
1 /* Copyright (C) 2007-2013 Open Information Security Foundation
2  *
3  * You can copy, redistribute or modify this Program under the terms of
4  * the GNU General Public License version 2 as published by the Free
5  * Software Foundation.
6  *
7  * This program is distributed in the hope that it will be useful,
8  * but WITHOUT ANY WARRANTY; without even the implied warranty of
9  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
10  * GNU General Public License for more details.
11  *
12  * You should have received a copy of the GNU General Public License
13  * version 2 along with this program; if not, write to the Free Software
14  * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA
15  * 02110-1301, USA.
16  */
17 
18 /**
19  * \file
20  *
21  * \author Victor Julien <victor@inliniac.net>
22  * \author Anoop Saldanha <anoopsaldanha@gmail.com>
23  */
24 
25 #ifndef __APP_LAYER_PARSER_H__
26 #define __APP_LAYER_PARSER_H__
27 
28 #include "app-layer-events.h"
29 #include "detect-engine-state.h"
30 #include "util-file.h"
31 #include "stream-tcp-private.h"
32 
33 /* Flags for AppLayerParserState. */
34 #define APP_LAYER_PARSER_EOF BIT_U8(0)
35 #define APP_LAYER_PARSER_NO_INSPECTION BIT_U8(1)
36 #define APP_LAYER_PARSER_NO_REASSEMBLY BIT_U8(2)
37 #define APP_LAYER_PARSER_NO_INSPECTION_PAYLOAD BIT_U8(3)
38 #define APP_LAYER_PARSER_BYPASS_READY BIT_U8(4)
39 
40 /* Flags for AppLayerParserProtoCtx. */
41 #define APP_LAYER_PARSER_OPT_ACCEPT_GAPS BIT_U32(0)
42 
43 #define APP_LAYER_PARSER_INT_STREAM_DEPTH_SET BIT_U32(0)
44 
45 /* applies to DetectFlags uint64_t field */
46 
47 /** is tx fully inspected? */
48 #define APP_LAYER_TX_INSPECTED_FLAG BIT_U64(63)
49 /** other 63 bits are for tracking which prefilter engine is already
50  * completely inspected */
51 #define APP_LAYER_TX_PREFILTER_MASK ~APP_LAYER_TX_INSPECTED_FLAG
52 
53 int AppLayerParserProtoIsRegistered(uint8_t ipproto, AppProto alproto);
54 
55 /***** transaction handling *****/
56 
57 int AppLayerParserSetup(void);
59 int AppLayerParserDeSetup(void);
60 
62 
63 /**
64  * \brief Gets a new app layer protocol's parser thread context.
65  *
66  * \retval Non-NULL pointer on success.
67  * NULL pointer on failure.
68  */
70 
71 /**
72  * \brief Destroys the app layer parser thread context obtained
73  * using AppLayerParserThreadCtxAlloc().
74  *
75  * \param tctx Pointer to the thread context to be destroyed.
76  */
78 
79 /**
80  * \brief Given a protocol name, checks if the parser is enabled in
81  * the conf file.
82  *
83  * \param alproto_name Name of the app layer protocol.
84  *
85  * \retval 1 If enabled.
86  * \retval 0 If disabled.
87  */
88 int AppLayerParserConfParserEnabled(const char *ipproto,
89  const char *alproto_name);
90 
91 /** \brief Prototype for parsing functions */
92 typedef int (*AppLayerParserFPtr)(Flow *f, void *protocol_state,
93  AppLayerParserState *pstate,
94  uint8_t *buf, uint32_t buf_len,
95  void *local_storage, const uint8_t flags);
96 
97 typedef struct AppLayerGetTxIterTuple {
98  void *tx_ptr;
99  uint64_t tx_id;
100  bool has_next;
102 
103 typedef struct AppLayerGetTxIterState {
104  union {
105  void *ptr;
106  uint64_t u64;
107  } un;
109 
110 /** \brief tx iterator prototype */
112  (const uint8_t ipproto, const AppProto alproto,
113  void *alstate, uint64_t min_tx_id, uint64_t max_tx_id,
114  AppLayerGetTxIterState *state);
115 
116 /***** Parser related registration *****/
117 
118 /**
119  * \brief Register app layer parser for the protocol.
120  *
121  * \retval 0 On success.
122  * \retval -1 On failure.
123  */
124 int AppLayerParserRegisterParser(uint8_t ipproto, AppProto alproto,
125  uint8_t direction,
126  AppLayerParserFPtr Parser);
128  AppProto alproto,
129  uint8_t direction);
130 void AppLayerParserRegisterOptionFlags(uint8_t ipproto, AppProto alproto,
131  uint32_t flags);
132 void AppLayerParserRegisterStateFuncs(uint8_t ipproto, AppProto alproto,
133  void *(*StateAlloc)(void),
134  void (*StateFree)(void *));
136  void *(*LocalStorageAlloc)(void),
137  void (*LocalStorageFree)(void *));
138 void AppLayerParserRegisterGetFilesFunc(uint8_t ipproto, AppProto alproto,
139  FileContainer *(*StateGetFiles)(void *, uint8_t));
140 void AppLayerParserRegisterGetEventsFunc(uint8_t ipproto, AppProto proto,
141  AppLayerDecoderEvents *(*StateGetEvents)(void *) __attribute__((nonnull)));
142 void AppLayerParserRegisterLoggerFuncs(uint8_t ipproto, AppProto alproto,
143  LoggerId (*StateGetTxLogged)(void *, void *),
144  void (*StateSetTxLogged)(void *, void *, LoggerId));
145 void AppLayerParserRegisterLogger(uint8_t ipproto, AppProto alproto);
146 void AppLayerParserRegisterLoggerBits(uint8_t ipproto, AppProto alproto, LoggerId bits);
147 void AppLayerParserRegisterTruncateFunc(uint8_t ipproto, AppProto alproto,
148  void (*Truncate)(void *, uint8_t));
149 void AppLayerParserRegisterGetStateProgressFunc(uint8_t ipproto, AppProto alproto,
150  int (*StateGetStateProgress)(void *alstate, uint8_t direction));
151 void AppLayerParserRegisterTxFreeFunc(uint8_t ipproto, AppProto alproto,
152  void (*StateTransactionFree)(void *, uint64_t));
153 void AppLayerParserRegisterGetTxCnt(uint8_t ipproto, AppProto alproto,
154  uint64_t (*StateGetTxCnt)(void *alstate));
155 void AppLayerParserRegisterGetTx(uint8_t ipproto, AppProto alproto,
156  void *(StateGetTx)(void *alstate, uint64_t tx_id));
157 void AppLayerParserRegisterGetTxIterator(uint8_t ipproto, AppProto alproto,
160  int (*StateGetStateProgressCompletionStatus)(uint8_t direction));
161 void AppLayerParserRegisterGetEventInfo(uint8_t ipproto, AppProto alproto,
162  int (*StateGetEventInfo)(const char *event_name, int *event_id,
164 void AppLayerParserRegisterGetEventInfoById(uint8_t ipproto, AppProto alproto,
165  int (*StateGetEventInfoById)(int event_id, const char **event_name,
167 void AppLayerParserRegisterDetectStateFuncs(uint8_t ipproto, AppProto alproto,
168  DetectEngineState *(*GetTxDetectState)(void *tx),
169  int (*SetTxDetectState)(void *tx, DetectEngineState *));
170 void AppLayerParserRegisterGetStreamDepth(uint8_t ipproto,
171  AppProto alproto,
172  uint32_t (*GetStreamDepth)(void));
173 void AppLayerParserRegisterMpmIDsFuncs(uint8_t ipproto, AppProto alproto,
174  uint64_t (*GetTxMpmIDs)(void *tx),
175  int (*SetTxMpmIDs)(void *tx, uint64_t));
176 void AppLayerParserRegisterDetectFlagsFuncs(uint8_t ipproto, AppProto alproto,
177  uint64_t(*GetTxDetectFlags)(void *tx, uint8_t dir),
178  void (*SetTxDetectFlags)(void *tx, uint8_t dir, uint64_t));
179 
180 /***** Get and transaction functions *****/
181 
183  const AppProto alproto);
184 
185 void *AppLayerParserGetProtocolParserLocalStorage(uint8_t ipproto, AppProto alproto);
186 void AppLayerParserDestroyProtocolParserLocalStorage(uint8_t ipproto, AppProto alproto,
187  void *local_data);
188 
189 
192 
193 void AppLayerParserSetTxLogged(uint8_t ipproto, AppProto alproto, void *alstate,
194  void *tx, LoggerId logged);
195 LoggerId AppLayerParserGetTxLogged(const Flow *f, void *alstate, void *tx);
196 
197 uint64_t AppLayerParserGetTransactionInspectId(AppLayerParserState *pstate, uint8_t direction);
199  void *alstate, const uint8_t flags, bool tag_txs_as_inspected);
200 
203 AppLayerDecoderEvents *AppLayerParserGetEventsByTx(uint8_t ipproto, AppProto alproto, void *tx);
204 FileContainer *AppLayerParserGetFiles(uint8_t ipproto, AppProto alproto,
205  void *alstate, uint8_t direction);
206 int AppLayerParserGetStateProgress(uint8_t ipproto, AppProto alproto,
207  void *alstate, uint8_t direction);
208 uint64_t AppLayerParserGetTxCnt(const Flow *, void *alstate);
209 void *AppLayerParserGetTx(uint8_t ipproto, AppProto alproto, void *alstate, uint64_t tx_id);
210 int AppLayerParserGetStateProgressCompletionStatus(AppProto alproto, uint8_t direction);
211 int AppLayerParserGetEventInfo(uint8_t ipproto, AppProto alproto, const char *event_name,
212  int *event_id, AppLayerEventType *event_type);
213 int AppLayerParserGetEventInfoById(uint8_t ipproto, AppProto alproto, int event_id,
214  const char **event_name, AppLayerEventType *event_type);
215 
216 uint64_t AppLayerParserGetTransactionActive(const Flow *f, AppLayerParserState *pstate, uint8_t direction);
217 
218 uint8_t AppLayerParserGetFirstDataDir(uint8_t ipproto, AppProto alproto);
219 
220 int AppLayerParserSupportsFiles(uint8_t ipproto, AppProto alproto);
221 int AppLayerParserSupportsTxDetectState(uint8_t ipproto, AppProto alproto);
222 int AppLayerParserHasTxDetectState(uint8_t ipproto, AppProto alproto, void *alstate);
223 DetectEngineState *AppLayerParserGetTxDetectState(uint8_t ipproto, AppProto alproto, void *tx);
224 int AppLayerParserSetTxDetectState(const Flow *f, void *tx, DetectEngineState *s);
225 
226 uint64_t AppLayerParserGetTxDetectFlags(uint8_t ipproto, AppProto alproto, void *tx, uint8_t dir);
227 void AppLayerParserSetTxDetectFlags(uint8_t ipproto, AppProto alproto, void *tx, uint8_t dir, uint64_t);
228 
229 /***** General *****/
230 
232  uint8_t flags, uint8_t *input, uint32_t input_len);
235 int AppLayerParserIsTxAware(AppProto alproto);
236 int AppLayerParserProtocolIsTxEventAware(uint8_t ipproto, AppProto alproto);
237 int AppLayerParserProtocolHasLogger(uint8_t ipproto, AppProto alproto);
238 LoggerId AppLayerParserProtocolGetLoggerBits(uint8_t ipproto, AppProto alproto);
239 void AppLayerParserTriggerRawStreamReassembly(Flow *f, int direction);
240 void AppLayerParserSetStreamDepth(uint8_t ipproto, AppProto alproto, uint32_t stream_depth);
241 uint32_t AppLayerParserGetStreamDepth(const Flow *f);
242 
243 /***** Cleanup *****/
244 
245 void AppLayerParserStateCleanup(const Flow *f, void *alstate, AppLayerParserState *pstate);
246 
248 
249 
250 void AppLayerParserStateSetFlag(AppLayerParserState *pstate, uint8_t flag);
251 int AppLayerParserStateIssetFlag(AppLayerParserState *pstate, uint8_t flag);
252 
253 void AppLayerParserStreamTruncated(uint8_t ipproto, AppProto alproto, void *alstate,
254  uint8_t direction);
255 
256 
257 
260 
262 
263 #ifdef DEBUG
264 void AppLayerParserStatePrintDetails(AppLayerParserState *pstate);
265 #endif
266 
267 #ifdef AFLFUZZ_APPLAYER
268 int AppLayerParserRequestFromFile(uint8_t ipproto, AppProto alproto, char *filename);
269 int AppLayerParserRequestFromFileSerie(uint8_t ipproto, AppProto alproto, char *prefix);
270 int AppLayerParserFromFile(uint8_t ipproto, AppProto alproto, char *filename);
271 int AppLayerParserFromFileSerie(uint8_t ipproto, AppProto alproto, char *prefix);
272 #endif
273 
274 /***** Unittests *****/
275 
276 #ifdef UNITTESTS
277 void AppLayerParserRegisterProtocolUnittests(uint8_t ipproto, AppProto alproto,
278  void (*RegisterUnittests)(void));
282 void UTHAppLayerParserStateGetIds(void *ptr, uint64_t *i1, uint64_t *i2, uint64_t *log, uint64_t *min);
283 #endif
284 
285 #endif /* __APP_LAYER_PARSER_H__ */
enum AppLayerEventType_ AppLayerEventType
AppLayerDecoderEvents * AppLayerParserGetEventsByTx(uint8_t ipproto, AppProto alproto, void *tx)
int AppLayerParserGetEventInfoById(uint8_t ipproto, AppProto alproto, int event_id, const char **event_name, AppLayerEventType *event_type)
uint16_t flags
void AppLayerParserSetDecoderEvents(AppLayerParserState *pstate, AppLayerDecoderEvents *devents)
struct AppLayerGetTxIterTuple AppLayerGetTxIterTuple
void AppLayerParserRegisterLogger(uint8_t ipproto, AppProto alproto)
void AppLayerParserSetEOF(AppLayerParserState *pstate)
int(* AppLayerParserFPtr)(Flow *f, void *protocol_state, AppLayerParserState *pstate, uint8_t *buf, uint32_t buf_len, void *local_storage, const uint8_t flags)
Prototype for parsing functions.
uint64_t AppLayerParserGetTransactionActive(const Flow *f, AppLayerParserState *pstate, uint8_t direction)
void AppLayerParserTransactionsCleanup(Flow *f)
remove obsolete (inspected and logged) transactions
void AppLayerParserRegisterGetTxCnt(uint8_t ipproto, AppProto alproto, uint64_t(*StateGetTxCnt)(void *alstate))
void AppLayerParserRegisterStateFuncs(uint8_t ipproto, AppProto alproto, void *(*StateAlloc)(void), void(*StateFree)(void *))
uint32_t event_type
LoggerId
DetectEngineState * AppLayerParserGetTxDetectState(uint8_t ipproto, AppProto alproto, void *tx)
int logged
int AppLayerParserParse(ThreadVars *tv, AppLayerParserThreadCtx *tctx, Flow *f, AppProto alproto, uint8_t flags, uint8_t *input, uint32_t input_len)
int AppLayerParserSetTxDetectState(const Flow *f, void *tx, DetectEngineState *s)
void AppLayerParserRegisterGetStreamDepth(uint8_t ipproto, AppProto alproto, uint32_t(*GetStreamDepth)(void))
void AppLayerParserRegisterGetFilesFunc(uint8_t ipproto, AppProto alproto, FileContainer *(*StateGetFiles)(void *, uint8_t))
int AppLayerParserProtoIsRegistered(uint8_t ipproto, AppProto alproto)
int AppLayerParserHasTxDetectState(uint8_t ipproto, AppProto alproto, void *alstate)
void AppLayerParserRegisterMpmIDsFuncs(uint8_t ipproto, AppProto alproto, uint64_t(*GetTxMpmIDs)(void *tx), int(*SetTxMpmIDs)(void *tx, uint64_t))
void AppLayerParserPostStreamSetup(void)
AppLayerDecoderEvents * AppLayerParserGetDecoderEvents(AppLayerParserState *pstate)
void AppLayerParserSetStreamDepth(uint8_t ipproto, AppProto alproto, uint32_t stream_depth)
void * AppLayerParserGetProtocolParserLocalStorage(uint8_t ipproto, AppProto alproto)
LoggerId AppLayerParserGetTxLogged(const Flow *f, void *alstate, void *tx)
uint16_t AppProto
void UTHAppLayerParserStateGetIds(void *ptr, uint64_t *i1, uint64_t *i2, uint64_t *log, uint64_t *min)
LoggerId AppLayerParserProtocolGetLoggerBits(uint8_t ipproto, AppProto alproto)
void AppLayerParserSetTxDetectFlags(uint8_t ipproto, AppProto alproto, void *tx, uint8_t dir, uint64_t)
typedef __attribute__
DNP3 application header.
void AppLayerParserStateSetFlag(AppLayerParserState *pstate, uint8_t flag)
int AppLayerParserSetup(void)
int AppLayerParserGetEventInfo(uint8_t ipproto, AppProto alproto, const char *event_name, int *event_id, AppLayerEventType *event_type)
void AppLayerParserSetTxLogged(uint8_t ipproto, AppProto alproto, void *alstate, void *tx, LoggerId logged)
Data structure to store app layer decoder events.
int AppLayerParserStateIssetFlag(AppLayerParserState *pstate, uint8_t flag)
void AppLayerParserRegisterTxFreeFunc(uint8_t ipproto, AppProto alproto, void(*StateTransactionFree)(void *, uint64_t))
void AppLayerParserRegisterDetectStateFuncs(uint8_t ipproto, AppProto alproto, DetectEngineState *(*GetTxDetectState)(void *tx), int(*SetTxDetectState)(void *tx, DetectEngineState *))
int AppLayerParserSupportsFiles(uint8_t ipproto, AppProto alproto)
void AppLayerParserSetTransactionInspectId(const Flow *f, AppLayerParserState *pstate, void *alstate, const uint8_t flags, bool tag_txs_as_inspected)
void AppLayerParserDestroyProtocolParserLocalStorage(uint8_t ipproto, AppProto alproto, void *local_data)
Data structures and function prototypes for keeping state for the detection engine.
void AppLayerParserRegisterOptionFlags(uint8_t ipproto, AppProto alproto, uint32_t flags)
void AppLayerParserRegisterLoggerFuncs(uint8_t ipproto, AppProto alproto, LoggerId(*StateGetTxLogged)(void *, void *), void(*StateSetTxLogged)(void *, void *, LoggerId))
void AppLayerParserBackupParserTable(void)
void AppLayerParserRegisterProtocolUnittests(uint8_t ipproto, AppProto alproto, void(*RegisterUnittests)(void))
bool AppLayerParserHasDecoderEvents(AppLayerParserState *pstate)
void AppLayerParserRegisterGetEventsFunc(uint8_t ipproto, AppProto proto, AppLayerDecoderEvents *(*StateGetEvents)(void *) __attribute__((nonnull)))
void AppLayerParserRegisterLocalStorageFunc(uint8_t ipproto, AppProto proto, void *(*LocalStorageAlloc)(void), void(*LocalStorageFree)(void *))
uint64_t AppLayerParserGetTransactionInspectId(AppLayerParserState *pstate, uint8_t direction)
void AppLayerParserRegisterGetTxIterator(uint8_t ipproto, AppProto alproto, AppLayerGetTxIteratorFunc Func)
uint8_t AppLayerParserGetFirstDataDir(uint8_t ipproto, AppProto alproto)
void AppLayerParserRegisterDetectFlagsFuncs(uint8_t ipproto, AppProto alproto, uint64_t(*GetTxDetectFlags)(void *tx, uint8_t dir), void(*SetTxDetectFlags)(void *tx, uint8_t dir, uint64_t))
uint8_t proto
int AppLayerParserConfParserEnabled(const char *ipproto, const char *alproto_name)
Given a protocol name, checks if the parser is enabled in the conf file.
void AppLayerParserTriggerRawStreamReassembly(Flow *f, int direction)
int AppLayerParserRegisterParser(uint8_t ipproto, AppProto alproto, uint8_t direction, AppLayerParserFPtr Parser)
Register app layer parser for the protocol.
uint64_t AppLayerParserGetTransactionLogId(AppLayerParserState *pstate)
int AppLayerParserProtocolIsTxEventAware(uint8_t ipproto, AppProto alproto)
void AppLayerParserRegisterGetStateProgressCompletionStatus(AppProto alproto, int(*StateGetStateProgressCompletionStatus)(uint8_t direction))
void AppLayerParserRestoreParserTable(void)
AppLayerGetTxIteratorFunc AppLayerGetTxIterator(const uint8_t ipproto, const AppProto alproto)
void AppLayerParserRegisterGetEventInfo(uint8_t ipproto, AppProto alproto, int(*StateGetEventInfo)(const char *event_name, int *event_id, AppLayerEventType *event_type))
FileContainer * AppLayerParserGetFiles(uint8_t ipproto, AppProto alproto, void *alstate, uint8_t direction)
void AppLayerParserSetTransactionLogId(AppLayerParserState *pstate, uint64_t tx_id)
struct AppLayerGetTxIterState AppLayerGetTxIterState
int AppLayerParserIsTxAware(AppProto alproto)
simpler way to globally test if a alproto is registered and fully enabled in the configuration.
int AppLayerParserDeSetup(void)
void AppLayerParserRegisterProtocolParsers(void)
uint64_t AppLayerParserGetTxDetectFlags(uint8_t ipproto, AppProto alproto, void *tx, uint8_t dir)
void AppLayerParserRegisterGetStateProgressFunc(uint8_t ipproto, AppProto alproto, int(*StateGetStateProgress)(void *alstate, uint8_t direction))
AppLayerParserThreadCtx * AppLayerParserThreadCtxAlloc(void)
Gets a new app layer protocol&#39;s parser thread context.
void AppLayerParserRegisterTruncateFunc(uint8_t ipproto, AppProto alproto, void(*Truncate)(void *, uint8_t))
void * AppLayerParserGetTx(uint8_t ipproto, AppProto alproto, void *alstate, uint64_t tx_id)
void AppLayerParserStateCleanup(const Flow *f, void *alstate, AppLayerParserState *pstate)
void AppLayerParserRegisterGetTx(uint8_t ipproto, AppProto alproto, void *(StateGetTx)(void *alstate, uint64_t tx_id))
void AppLayerParserStateFree(AppLayerParserState *pstate)
uint64_t AppLayerParserGetTxCnt(const Flow *, void *alstate)
AppLayerParserState * AppLayerParserStateAlloc(void)
int AppLayerParserProtocolHasLogger(uint8_t ipproto, AppProto alproto)
Per thread variable structure.
Definition: threadvars.h:57
int AppLayerParserGetStateProgressCompletionStatus(AppProto alproto, uint8_t direction)
int AppLayerParserGetStateProgress(uint8_t ipproto, AppProto alproto, void *alstate, uint8_t direction)
get the progress value for a tx/protocol
void AppLayerParserRegisterUnittests(void)
uint32_t AppLayerParserGetStreamDepth(const Flow *f)
void AppLayerParserStreamTruncated(uint8_t ipproto, AppProto alproto, void *alstate, uint8_t direction)
void AppLayerParserRegisterParserAcceptableDataDirection(uint8_t ipproto, AppProto alproto, uint8_t direction)
Flow data structure.
Definition: flow.h:325
int AppLayerParserSupportsTxDetectState(uint8_t ipproto, AppProto alproto)
void AppLayerParserRegisterLoggerBits(uint8_t ipproto, AppProto alproto, LoggerId bits)
void AppLayerParserThreadCtxFree(AppLayerParserThreadCtx *tctx)
Destroys the app layer parser thread context obtained using AppLayerParserThreadCtxAlloc().
void AppLayerParserRegisterGetEventInfoById(uint8_t ipproto, AppProto alproto, int(*StateGetEventInfoById)(int event_id, const char **event_name, AppLayerEventType *event_type))
AppLayerGetTxIterTuple(* AppLayerGetTxIteratorFunc)(const uint8_t ipproto, const AppProto alproto, void *alstate, uint64_t min_tx_id, uint64_t max_tx_id, AppLayerGetTxIterState *state)
tx iterator prototype