@ -150,26 +150,27 @@ typedef struct AppLayerParserTableElement_ {
} AppLayerParserTableElement ; } AppLayerParserTableElement ;
typedef struct AppLayerProbingParserElement_ { typedef struct AppLayerProbingParserElement_ {
const char * al_proto_name ;
char * al_proto_name ;
uint16_t al_proto ;
uint16_t al_proto ;
/* \todo don't really need it. See if you can get rid of it */
uint16_t port ;
uint16_t port ;
uint16_t ip_proto ;
/* \todo calculate at runtime and get rid of this var */
uint8_t priority ;
uint8_t top ;
uint32_t al_proto_mask ;
uint32_t al_proto_mask ;
/* \todo check if we can reduce the bottom 2 vars to uint16_t */
/* the min length of data that has to be supplied to invoke the parser */
/* the min length of data that has to be supplied to invoke the parser */
uint32_t min_depth ;
uint32_t min_depth ;
/* the max length of data after which this parser won't be invoked */
/* the max length of data after which this parser won't be invoked */
uint32_t max_depth ;
uint32_t max_depth ;
/* the probing parser function */
/* the probing parser function */
uint16_t ( * ProbingParser ) ( uint8_t * input , uint32_t input_len ;
uint16_t ( * ProbingParser ) ( uint8_t * input , uint32_t input_len , uint32_t * offset );
struct AppLayerProbingParserElement_ * next ;
struct AppLayerProbingParserElement_ * next ;
} AppLayerProbingParserElement ; } AppLayerProbingParserElement ;
typedef struct AppLayerProbingParser _ { typedef struct AppLayerProbingParser Port _ {
/* the port no for which probing parser(s) are invoked */
/* the port no for which probing parser(s) are invoked */
uint16_t port ;
uint16_t port ;
uint32_t toserver_al_proto_mask ;
uint32_t toserver_al_proto_mask ;
uint32_t toclient_al_proto_mask ;
uint32_t toclient_al_proto_mask ;
/* the max depth for all the probing parsers registered for this port */
/* the max depth for all the probing parsers registered for this port */
@ -179,54 +180,44 @@ typedef struct AppLayerProbingParser_ {
AppLayerProbingParserElement * toserver ;
AppLayerProbingParserElement * toserver ;
AppLayerProbingParserElement * toclient ;
AppLayerProbingParserElement * toclient ;
struct AppLayerProbingParser _ * next ;
struct AppLayerProbingParser Port _ * next ;
} AppLayerProbingParser ; } AppLayerProbingParser Port ;
typedef struct AppLayerProbingParserInfo_ { typedef struct AppLayerProbingParser_ {
const char * al_proto_name ;
uint16_t ip_proto ;
uint16_t ip_proto ;
uint16_t al_proto ;
AppLayerProbingParserPort * port ;
uint16_t ( * ProbingParser ) ( uint8_t * input , uint32_t input_len ) ;
struct AppLayerProbingParserInfo_ * next ;
} AppLayerProbingParserInfo ;
# define APP_LAYER_PROBING_PARSER_PRIORITY_HIGH 1 struct AppLayerProbingParser_ * next ;
# define APP_LAYER_PROBING_PARSER_PRIORITY_MEDIUM 2 } AppLayerProbingParser ;
# define APP_LAYER_PROBING_PARSER_PRIORITY_LOW 3
extern AppLayerProto al_proto_table [ ] ; extern AppLayerProto al_proto_table [ ] ;
static inline static inline
AppLayerProbingParser * AppLayerGetProbingParsers ( AppLayerProbingParser * p robing_ parsers , AppLayerProbingParser Port * AppLayerGetProbingParsers ( AppLayerProbingParser * p p,
uint16_t ip_proto ,
uint16_t ip_proto ,
uint16_t port )
uint16_t port )
{ {
if ( probing_parsers = = NULL )
return NULL ;
AppLayerProbingParser * pp = probing_parsers ;
while ( pp ! = NULL ) {
while ( pp ! = NULL ) {
if ( pp - > port = = port | | pp - > port = = 0 ) {
if ( pp - > ip_proto = = ip_proto )
break ;
break ;
}
pp = pp - > next ;
pp = pp - > next ;
}
}
return pp ;
if ( pp = = NULL )
} return NULL ;
static inline AppLayerProbingParserPort * pp_port = pp - > port ;
AppLayerProbingParserInfo * AppLayerGetProbingParserInfo ( AppLayerProbingParserInfo * ppi , while ( pp_port ! = NULL ) {
const char * al_proto_name )
if ( pp_port - > port = = port | | pp_port - > port = = 0 ) {
{ break ;
while ( ppi ! = NULL ) {
}
if ( strcmp ( ppi - > al_proto_name , al_proto_name ) = = 0 )
pp_port = pp_port - > next ;
return ppi ;
ppi = ppi - > next ;
}
}
return NULL ;
return pp_port ;
} }
struct AlpProtoDetectCtx_ ; struct AlpProtoDetectCtx_ ;
/* prototypes */ /* prototypes */
@ -248,11 +239,13 @@ int AppLayerRegisterParser(char *name, uint16_t proto, uint16_t parser_id,
void * local_data ,
void * local_data ,
AppLayerParserResult * output ) ,
AppLayerParserResult * output ) ,
char * dependency ) ;
char * dependency ) ;
void AppLayerRegisterProbingParser ( struct AlpProtoDetectCtx_ * , uint16_t , uint16_t , void AppLayerRegisterProbingParser ( struct AlpProtoDetectCtx_ * ,
const char * , uint16_t ,
uint16_t ip_proto ,
uint16_t , uint16_t , uint8_t , uint8_t ,
char * portstr ,
uint8_t ,
char * al_proto_name , uint16_t al_proto ,
uint16_t ( * ProbingParser ) ( uint8_t * , uint32_t ) ) ;
uint16_t min_depth , uint16_t max_depth ,
uint8_t flags ,
uint16_t ( * ProbingParser ) ( uint8_t * input , uint32_t input_len , uint32_t * offset ) ) ;
# ifdef UNITTESTS # ifdef UNITTESTS
void AppLayerRegisterUnittests ( uint16_t proto , void ( * RegisterUnittests ) ( void ) ) ; void AppLayerRegisterUnittests ( uint16_t proto , void ( * RegisterUnittests ) ( void ) ) ;
# endif # endif
@ -340,7 +333,6 @@ void AppLayerSetEOF(Flow *);
void AppLayerParserCleanupState ( Flow * ) ; void AppLayerParserCleanupState ( Flow * ) ;
void AppLayerFreeProbingParsers ( AppLayerProbingParser * ) ; void AppLayerFreeProbingParsers ( AppLayerProbingParser * ) ;
void AppLayerFreeProbingParsersInfo ( AppLayerProbingParserInfo * ) ;
void AppLayerPrintProbingParsers ( AppLayerProbingParser * ) ; void AppLayerPrintProbingParsers ( AppLayerProbingParser * ) ;
void AppLayerListSupportedProtocols ( void ) ; void AppLayerListSupportedProtocols ( void ) ;
Anoop Saldanha
12 years ago