suricata
app-layer-parser.h
Go to the documentation of this file.
1 /* Copyright (C) 2007-2013 Open Information Security Foundation
2  *
3  * You can copy, redistribute or modify this Program under the terms of
4  * the GNU General Public License version 2 as published by the Free
5  * Software Foundation.
6  *
7  * This program is distributed in the hope that it will be useful,
8  * but WITHOUT ANY WARRANTY; without even the implied warranty of
9  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
10  * GNU General Public License for more details.
11  *
12  * You should have received a copy of the GNU General Public License
13  * version 2 along with this program; if not, write to the Free Software
14  * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA
15  * 02110-1301, USA.
16  */
17 
18 /**
19  * \file
20  *
21  * \author Victor Julien <victor@inliniac.net>
22  * \author Anoop Saldanha <anoopsaldanha@gmail.com>
23  */
24 
25 #ifndef __APP_LAYER_PARSER_H__
26 #define __APP_LAYER_PARSER_H__
27 
28 #include "app-layer-events.h"
29 #include "detect-engine-state.h"
30 #include "util-file.h"
31 #include "stream-tcp-private.h"
32 
33 /* Flags for AppLayerParserState. */
34 #define APP_LAYER_PARSER_EOF BIT_U8(0)
35 #define APP_LAYER_PARSER_NO_INSPECTION BIT_U8(1)
36 #define APP_LAYER_PARSER_NO_REASSEMBLY BIT_U8(2)
37 #define APP_LAYER_PARSER_NO_INSPECTION_PAYLOAD BIT_U8(3)
38 #define APP_LAYER_PARSER_BYPASS_READY BIT_U8(4)
39 
40 /* Flags for AppLayerParserProtoCtx. */
41 #define APP_LAYER_PARSER_OPT_ACCEPT_GAPS BIT_U32(0)
42 
43 #define APP_LAYER_PARSER_INT_STREAM_DEPTH_SET BIT_U32(0)
44 
45 /* applies to DetectFlags uint64_t field */
46 
47 /** is tx fully inspected? */
48 #define APP_LAYER_TX_INSPECTED_FLAG BIT_U64(63)
49 /** other 63 bits are for tracking which prefilter engine is already
50  * completely inspected */
51 #define APP_LAYER_TX_PREFILTER_MASK ~APP_LAYER_TX_INSPECTED_FLAG
52 
53 int AppLayerParserProtoIsRegistered(uint8_t ipproto, AppProto alproto);
54 
55 /***** transaction handling *****/
56 
57 int AppLayerParserSetup(void);
59 int AppLayerParserDeSetup(void);
60 
62 
63 /**
64  * \brief Gets a new app layer protocol's parser thread context.
65  *
66  * \retval Non-NULL pointer on success.
67  * NULL pointer on failure.
68  */
70 
71 /**
72  * \brief Destroys the app layer parser thread context obtained
73  * using AppLayerParserThreadCtxAlloc().
74  *
75  * \param tctx Pointer to the thread context to be destroyed.
76  */
78 
79 /**
80  * \brief Given a protocol name, checks if the parser is enabled in
81  * the conf file.
82  *
83  * \param alproto_name Name of the app layer protocol.
84  *
85  * \retval 1 If enabled.
86  * \retval 0 If disabled.
87  */
88 int AppLayerParserConfParserEnabled(const char *ipproto,
89  const char *alproto_name);
90 
91 /** \brief Prototype for parsing functions */
92 typedef int (*AppLayerParserFPtr)(Flow *f, void *protocol_state,
93  AppLayerParserState *pstate,
94  uint8_t *buf, uint32_t buf_len,
95  void *local_storage, const uint8_t flags);
96 
97 typedef struct AppLayerGetTxIterTuple {
98  void *tx_ptr;
99  uint64_t tx_id;
100  bool has_next;
102 
103 typedef struct AppLayerGetTxIterState {
104  union {
105  void *ptr;
106  uint64_t u64;
107  } un;
109 
110 /** \brief tx iterator prototype */
112  (const uint8_t ipproto, const AppProto alproto,
113  void *alstate, uint64_t min_tx_id, uint64_t max_tx_id,
114  AppLayerGetTxIterState *state);
115 
116 /***** Parser related registration *****/
117 
118 /**
119  * \brief Register app layer parser for the protocol.
120  *
121  * \retval 0 On success.
122  * \retval -1 On failure.
123  */
124 int AppLayerParserRegisterParser(uint8_t ipproto, AppProto alproto,
125  uint8_t direction,
126  AppLayerParserFPtr Parser);
128  AppProto alproto,
129  uint8_t direction);
130 void AppLayerParserRegisterOptionFlags(uint8_t ipproto, AppProto alproto,
131  uint32_t flags);
132 void AppLayerParserRegisterStateFuncs(uint8_t ipproto, AppProto alproto,
133  void *(*StateAlloc)(void),
134  void (*StateFree)(void *));
136  void *(*LocalStorageAlloc)(void),
137  void (*LocalStorageFree)(void *));
138 void AppLayerParserRegisterGetFilesFunc(uint8_t ipproto, AppProto alproto,
139  FileContainer *(*StateGetFiles)(void *, uint8_t));
140 void AppLayerParserRegisterGetEventsFunc(uint8_t ipproto, AppProto proto,
141  AppLayerDecoderEvents *(*StateGetEvents)(void *, uint64_t));
142 void AppLayerParserRegisterLoggerFuncs(uint8_t ipproto, AppProto alproto,
143  LoggerId (*StateGetTxLogged)(void *, void *),
144  void (*StateSetTxLogged)(void *, void *, LoggerId));
145 void AppLayerParserRegisterLogger(uint8_t ipproto, AppProto alproto);
146 void AppLayerParserRegisterLoggerBits(uint8_t ipproto, AppProto alproto, LoggerId bits);
147 void AppLayerParserRegisterTruncateFunc(uint8_t ipproto, AppProto alproto,
148  void (*Truncate)(void *, uint8_t));
149 void AppLayerParserRegisterGetStateProgressFunc(uint8_t ipproto, AppProto alproto,
150  int (*StateGetStateProgress)(void *alstate, uint8_t direction));
151 void AppLayerParserRegisterTxFreeFunc(uint8_t ipproto, AppProto alproto,
152  void (*StateTransactionFree)(void *, uint64_t));
153 void AppLayerParserRegisterGetTxCnt(uint8_t ipproto, AppProto alproto,
154  uint64_t (*StateGetTxCnt)(void *alstate));
155 void AppLayerParserRegisterGetTx(uint8_t ipproto, AppProto alproto,
156  void *(StateGetTx)(void *alstate, uint64_t tx_id));
157 void AppLayerParserRegisterGetTxIterator(uint8_t ipproto, AppProto alproto,
160  int (*StateGetStateProgressCompletionStatus)(uint8_t direction));
161 void AppLayerParserRegisterGetEventInfo(uint8_t ipproto, AppProto alproto,
162  int (*StateGetEventInfo)(const char *event_name, int *event_id,
164 void AppLayerParserRegisterDetectStateFuncs(uint8_t ipproto, AppProto alproto,
165  DetectEngineState *(*GetTxDetectState)(void *tx),
166  int (*SetTxDetectState)(void *tx, DetectEngineState *));
167 void AppLayerParserRegisterGetStreamDepth(uint8_t ipproto,
168  AppProto alproto,
169  uint32_t (*GetStreamDepth)(void));
170 void AppLayerParserRegisterMpmIDsFuncs(uint8_t ipproto, AppProto alproto,
171  uint64_t (*GetTxMpmIDs)(void *tx),
172  int (*SetTxMpmIDs)(void *tx, uint64_t));
173 void AppLayerParserRegisterDetectFlagsFuncs(uint8_t ipproto, AppProto alproto,
174  uint64_t(*GetTxDetectFlags)(void *tx, uint8_t dir),
175  void (*SetTxDetectFlags)(void *tx, uint8_t dir, uint64_t));
176 
177 /***** Get and transaction functions *****/
178 
180  const AppProto alproto);
181 
182 void *AppLayerParserGetProtocolParserLocalStorage(uint8_t ipproto, AppProto alproto);
183 void AppLayerParserDestroyProtocolParserLocalStorage(uint8_t ipproto, AppProto alproto,
184  void *local_data);
185 
186 
189 
190 void AppLayerParserSetTxLogged(uint8_t ipproto, AppProto alproto, void *alstate,
191  void *tx, LoggerId logged);
192 LoggerId AppLayerParserGetTxLogged(const Flow *f, void *alstate, void *tx);
193 
194 uint64_t AppLayerParserGetTransactionInspectId(AppLayerParserState *pstate, uint8_t direction);
196  void *alstate, const uint8_t flags, bool tag_txs_as_inspected);
197 
200 AppLayerDecoderEvents *AppLayerParserGetEventsByTx(uint8_t ipproto, AppProto alproto, void *alstate,
201  uint64_t tx_id);
202 FileContainer *AppLayerParserGetFiles(uint8_t ipproto, AppProto alproto,
203  void *alstate, uint8_t direction);
204 int AppLayerParserGetStateProgress(uint8_t ipproto, AppProto alproto,
205  void *alstate, uint8_t direction);
206 uint64_t AppLayerParserGetTxCnt(const Flow *, void *alstate);
207 void *AppLayerParserGetTx(uint8_t ipproto, AppProto alproto, void *alstate, uint64_t tx_id);
208 int AppLayerParserGetStateProgressCompletionStatus(AppProto alproto, uint8_t direction);
209 int AppLayerParserGetEventInfo(uint8_t ipproto, AppProto alproto, const char *event_name,
210  int *event_id, AppLayerEventType *event_type);
211 
212 uint64_t AppLayerParserGetTransactionActive(const Flow *f, AppLayerParserState *pstate, uint8_t direction);
213 
214 uint8_t AppLayerParserGetFirstDataDir(uint8_t ipproto, AppProto alproto);
215 
216 int AppLayerParserSupportsFiles(uint8_t ipproto, AppProto alproto);
217 int AppLayerParserSupportsTxDetectState(uint8_t ipproto, AppProto alproto);
218 int AppLayerParserHasTxDetectState(uint8_t ipproto, AppProto alproto, void *alstate);
219 DetectEngineState *AppLayerParserGetTxDetectState(uint8_t ipproto, AppProto alproto, void *tx);
220 int AppLayerParserSetTxDetectState(const Flow *f, void *tx, DetectEngineState *s);
221 
222 uint64_t AppLayerParserGetTxDetectFlags(uint8_t ipproto, AppProto alproto, void *tx, uint8_t dir);
223 void AppLayerParserSetTxDetectFlags(uint8_t ipproto, AppProto alproto, void *tx, uint8_t dir, uint64_t);
224 
225 /***** General *****/
226 
228  uint8_t flags, uint8_t *input, uint32_t input_len);
231 int AppLayerParserIsTxAware(AppProto alproto);
232 int AppLayerParserProtocolIsTxAware(uint8_t ipproto, AppProto alproto);
233 int AppLayerParserProtocolIsTxEventAware(uint8_t ipproto, AppProto alproto);
234 int AppLayerParserProtocolSupportsTxs(uint8_t ipproto, AppProto alproto);
235 int AppLayerParserProtocolHasLogger(uint8_t ipproto, AppProto alproto);
236 LoggerId AppLayerParserProtocolGetLoggerBits(uint8_t ipproto, AppProto alproto);
237 void AppLayerParserTriggerRawStreamReassembly(Flow *f, int direction);
238 void AppLayerParserSetStreamDepth(uint8_t ipproto, AppProto alproto, uint32_t stream_depth);
239 uint32_t AppLayerParserGetStreamDepth(const Flow *f);
240 
241 /***** Cleanup *****/
242 
243 void AppLayerParserStateCleanup(const Flow *f, void *alstate, AppLayerParserState *pstate);
244 
246 
247 
248 void AppLayerParserStateSetFlag(AppLayerParserState *pstate, uint8_t flag);
249 int AppLayerParserStateIssetFlag(AppLayerParserState *pstate, uint8_t flag);
250 
251 void AppLayerParserStreamTruncated(uint8_t ipproto, AppProto alproto, void *alstate,
252  uint8_t direction);
253 
254 
255 
258 
260 
261 #ifdef DEBUG
262 void AppLayerParserStatePrintDetails(AppLayerParserState *pstate);
263 #endif
264 
265 #ifdef AFLFUZZ_APPLAYER
266 int AppLayerParserRequestFromFile(uint8_t ipproto, AppProto alproto, char *filename);
267 int AppLayerParserRequestFromFileSerie(uint8_t ipproto, AppProto alproto, char *prefix);
268 int AppLayerParserFromFile(uint8_t ipproto, AppProto alproto, char *filename);
269 int AppLayerParserFromFileSerie(uint8_t ipproto, AppProto alproto, char *prefix);
270 #endif
271 
272 /***** Unittests *****/
273 
274 #ifdef UNITTESTS
275 void AppLayerParserRegisterProtocolUnittests(uint8_t ipproto, AppProto alproto,
276  void (*RegisterUnittests)(void));
280 void UTHAppLayerParserStateGetIds(void *ptr, uint64_t *i1, uint64_t *i2, uint64_t *log, uint64_t *min);
281 #endif
282 
283 #endif /* __APP_LAYER_PARSER_H__ */
enum AppLayerEventType_ AppLayerEventType
uint16_t flags
void AppLayerParserSetDecoderEvents(AppLayerParserState *pstate, AppLayerDecoderEvents *devents)
struct AppLayerGetTxIterTuple AppLayerGetTxIterTuple
void AppLayerParserRegisterLogger(uint8_t ipproto, AppProto alproto)
void AppLayerParserSetEOF(AppLayerParserState *pstate)
int(* AppLayerParserFPtr)(Flow *f, void *protocol_state, AppLayerParserState *pstate, uint8_t *buf, uint32_t buf_len, void *local_storage, const uint8_t flags)
Prototype for parsing functions.
void AppLayerParserRegisterGetEventsFunc(uint8_t ipproto, AppProto proto, AppLayerDecoderEvents *(*StateGetEvents)(void *, uint64_t))
uint64_t AppLayerParserGetTransactionActive(const Flow *f, AppLayerParserState *pstate, uint8_t direction)
void AppLayerParserTransactionsCleanup(Flow *f)
remove obsolete (inspected and logged) transactions
void AppLayerParserRegisterGetTxCnt(uint8_t ipproto, AppProto alproto, uint64_t(*StateGetTxCnt)(void *alstate))
void AppLayerParserRegisterStateFuncs(uint8_t ipproto, AppProto alproto, void *(*StateAlloc)(void), void(*StateFree)(void *))
uint32_t event_type
LoggerId
DetectEngineState * AppLayerParserGetTxDetectState(uint8_t ipproto, AppProto alproto, void *tx)
int logged
int AppLayerParserParse(ThreadVars *tv, AppLayerParserThreadCtx *tctx, Flow *f, AppProto alproto, uint8_t flags, uint8_t *input, uint32_t input_len)
int AppLayerParserSetTxDetectState(const Flow *f, void *tx, DetectEngineState *s)
void AppLayerParserRegisterGetStreamDepth(uint8_t ipproto, AppProto alproto, uint32_t(*GetStreamDepth)(void))
void AppLayerParserRegisterGetFilesFunc(uint8_t ipproto, AppProto alproto, FileContainer *(*StateGetFiles)(void *, uint8_t))
int AppLayerParserProtoIsRegistered(uint8_t ipproto, AppProto alproto)
int AppLayerParserHasTxDetectState(uint8_t ipproto, AppProto alproto, void *alstate)
void AppLayerParserRegisterMpmIDsFuncs(uint8_t ipproto, AppProto alproto, uint64_t(*GetTxMpmIDs)(void *tx), int(*SetTxMpmIDs)(void *tx, uint64_t))
void AppLayerParserPostStreamSetup(void)
AppLayerDecoderEvents * AppLayerParserGetDecoderEvents(AppLayerParserState *pstate)
void AppLayerParserSetStreamDepth(uint8_t ipproto, AppProto alproto, uint32_t stream_depth)
void * AppLayerParserGetProtocolParserLocalStorage(uint8_t ipproto, AppProto alproto)
LoggerId AppLayerParserGetTxLogged(const Flow *f, void *alstate, void *tx)
uint16_t AppProto
void UTHAppLayerParserStateGetIds(void *ptr, uint64_t *i1, uint64_t *i2, uint64_t *log, uint64_t *min)
LoggerId AppLayerParserProtocolGetLoggerBits(uint8_t ipproto, AppProto alproto)
void AppLayerParserSetTxDetectFlags(uint8_t ipproto, AppProto alproto, void *tx, uint8_t dir, uint64_t)
void AppLayerParserStateSetFlag(AppLayerParserState *pstate, uint8_t flag)
int AppLayerParserSetup(void)
int AppLayerParserGetEventInfo(uint8_t ipproto, AppProto alproto, const char *event_name, int *event_id, AppLayerEventType *event_type)
void AppLayerParserSetTxLogged(uint8_t ipproto, AppProto alproto, void *alstate, void *tx, LoggerId logged)
Data structure to store app layer decoder events.
int AppLayerParserStateIssetFlag(AppLayerParserState *pstate, uint8_t flag)
void AppLayerParserRegisterTxFreeFunc(uint8_t ipproto, AppProto alproto, void(*StateTransactionFree)(void *, uint64_t))
void AppLayerParserRegisterDetectStateFuncs(uint8_t ipproto, AppProto alproto, DetectEngineState *(*GetTxDetectState)(void *tx), int(*SetTxDetectState)(void *tx, DetectEngineState *))
int AppLayerParserSupportsFiles(uint8_t ipproto, AppProto alproto)
void AppLayerParserSetTransactionInspectId(const Flow *f, AppLayerParserState *pstate, void *alstate, const uint8_t flags, bool tag_txs_as_inspected)
void AppLayerParserDestroyProtocolParserLocalStorage(uint8_t ipproto, AppProto alproto, void *local_data)
Data structures and function prototypes for keeping state for the detection engine.
void AppLayerParserRegisterOptionFlags(uint8_t ipproto, AppProto alproto, uint32_t flags)
void AppLayerParserRegisterLoggerFuncs(uint8_t ipproto, AppProto alproto, LoggerId(*StateGetTxLogged)(void *, void *), void(*StateSetTxLogged)(void *, void *, LoggerId))
void AppLayerParserBackupParserTable(void)
void AppLayerParserRegisterProtocolUnittests(uint8_t ipproto, AppProto alproto, void(*RegisterUnittests)(void))
bool AppLayerParserHasDecoderEvents(AppLayerParserState *pstate)
void AppLayerParserRegisterLocalStorageFunc(uint8_t ipproto, AppProto proto, void *(*LocalStorageAlloc)(void), void(*LocalStorageFree)(void *))
uint64_t AppLayerParserGetTransactionInspectId(AppLayerParserState *pstate, uint8_t direction)
void AppLayerParserRegisterGetTxIterator(uint8_t ipproto, AppProto alproto, AppLayerGetTxIteratorFunc Func)
uint8_t AppLayerParserGetFirstDataDir(uint8_t ipproto, AppProto alproto)
void AppLayerParserRegisterDetectFlagsFuncs(uint8_t ipproto, AppProto alproto, uint64_t(*GetTxDetectFlags)(void *tx, uint8_t dir), void(*SetTxDetectFlags)(void *tx, uint8_t dir, uint64_t))
uint8_t proto
int AppLayerParserConfParserEnabled(const char *ipproto, const char *alproto_name)
Given a protocol name, checks if the parser is enabled in the conf file.
void AppLayerParserTriggerRawStreamReassembly(Flow *f, int direction)
AppLayerDecoderEvents * AppLayerParserGetEventsByTx(uint8_t ipproto, AppProto alproto, void *alstate, uint64_t tx_id)
int AppLayerParserRegisterParser(uint8_t ipproto, AppProto alproto, uint8_t direction, AppLayerParserFPtr Parser)
Register app layer parser for the protocol.
uint64_t AppLayerParserGetTransactionLogId(AppLayerParserState *pstate)
int AppLayerParserProtocolIsTxEventAware(uint8_t ipproto, AppProto alproto)
void AppLayerParserRegisterGetStateProgressCompletionStatus(AppProto alproto, int(*StateGetStateProgressCompletionStatus)(uint8_t direction))
void AppLayerParserRestoreParserTable(void)
AppLayerGetTxIteratorFunc AppLayerGetTxIterator(const uint8_t ipproto, const AppProto alproto)
void AppLayerParserRegisterGetEventInfo(uint8_t ipproto, AppProto alproto, int(*StateGetEventInfo)(const char *event_name, int *event_id, AppLayerEventType *event_type))
FileContainer * AppLayerParserGetFiles(uint8_t ipproto, AppProto alproto, void *alstate, uint8_t direction)
void AppLayerParserSetTransactionLogId(AppLayerParserState *pstate, uint64_t tx_id)
struct AppLayerGetTxIterState AppLayerGetTxIterState
int AppLayerParserIsTxAware(AppProto alproto)
simpler way to globally test if a alproto is registered and fully enabled in the configuration.
int AppLayerParserProtocolIsTxAware(uint8_t ipproto, AppProto alproto)
int AppLayerParserProtocolSupportsTxs(uint8_t ipproto, AppProto alproto)
int AppLayerParserDeSetup(void)
void AppLayerParserRegisterProtocolParsers(void)
uint64_t AppLayerParserGetTxDetectFlags(uint8_t ipproto, AppProto alproto, void *tx, uint8_t dir)
void AppLayerParserRegisterGetStateProgressFunc(uint8_t ipproto, AppProto alproto, int(*StateGetStateProgress)(void *alstate, uint8_t direction))
AppLayerParserThreadCtx * AppLayerParserThreadCtxAlloc(void)
Gets a new app layer protocol&#39;s parser thread context.
void AppLayerParserRegisterTruncateFunc(uint8_t ipproto, AppProto alproto, void(*Truncate)(void *, uint8_t))
void * AppLayerParserGetTx(uint8_t ipproto, AppProto alproto, void *alstate, uint64_t tx_id)
void AppLayerParserStateCleanup(const Flow *f, void *alstate, AppLayerParserState *pstate)
void AppLayerParserRegisterGetTx(uint8_t ipproto, AppProto alproto, void *(StateGetTx)(void *alstate, uint64_t tx_id))
void AppLayerParserStateFree(AppLayerParserState *pstate)
uint64_t AppLayerParserGetTxCnt(const Flow *, void *alstate)
AppLayerParserState * AppLayerParserStateAlloc(void)
int AppLayerParserProtocolHasLogger(uint8_t ipproto, AppProto alproto)
Per thread variable structure.
Definition: threadvars.h:57
int AppLayerParserGetStateProgressCompletionStatus(AppProto alproto, uint8_t direction)
int AppLayerParserGetStateProgress(uint8_t ipproto, AppProto alproto, void *alstate, uint8_t direction)
get the progress value for a tx/protocol
void AppLayerParserRegisterUnittests(void)
uint32_t AppLayerParserGetStreamDepth(const Flow *f)
void AppLayerParserStreamTruncated(uint8_t ipproto, AppProto alproto, void *alstate, uint8_t direction)
void AppLayerParserRegisterParserAcceptableDataDirection(uint8_t ipproto, AppProto alproto, uint8_t direction)
Flow data structure.
Definition: flow.h:324
int AppLayerParserSupportsTxDetectState(uint8_t ipproto, AppProto alproto)
void AppLayerParserRegisterLoggerBits(uint8_t ipproto, AppProto alproto, LoggerId bits)
void AppLayerParserThreadCtxFree(AppLayerParserThreadCtx *tctx)
Destroys the app layer parser thread context obtained using AppLayerParserThreadCtxAlloc().
AppLayerGetTxIterTuple(* AppLayerGetTxIteratorFunc)(const uint8_t ipproto, const AppProto alproto, void *alstate, uint64_t min_tx_id, uint64_t max_tx_id, AppLayerGetTxIterState *state)
tx iterator prototype