htp.h

Go to the documentation of this file.

/***************************************************************************
 * Copyright (c) 2009-2010 Open Information Security Foundation
 * Copyright (c) 2010-2013 Qualys, Inc.
 * All rights reserved.
 * 
 * Redistribution and use in source and binary forms, with or without
 * modification, are permitted provided that the following conditions are
 * met:
 * 
 * - Redistributions of source code must retain the above copyright
 *   notice, this list of conditions and the following disclaimer.
 
 * - Redistributions in binary form must reproduce the above copyright
 *   notice, this list of conditions and the following disclaimer in the
 *   documentation and/or other materials provided with the distribution.
 
 * - Neither the name of the Qualys, Inc. nor the names of its
 *   contributors may be used to endorse or promote products derived from
 *   this software without specific prior written permission.
 * 
 * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
 * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
 * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
 * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
 * HOLDER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
 * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
 * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
 * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
 * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
 * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
 * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
 ***************************************************************************/

 
#ifndef _HTP_H
#define _HTP_H
 
#ifdef __cplusplus
extern "C" {
#endif
 
#include <sys/time.h>
 
#include "htp_version.h"
#include "htp_core.h"
 
#include "bstr.h"
#include "htp_base64.h"
#include "htp_config.h"
#include "htp_connection_parser.h"
#include "htp_decompressors.h"
#include "htp_hooks.h"
#include "htp_list.h"
#include "htp_multipart.h"
#include "htp_table.h"
#include "htp_transaction.h"
#include "htp_urlencoded.h"
#include "htp_utf8_decoder.h"

struct htp_conn_t {
    char *client_addr;

    int client_port;

    char *server_addr;

    int server_port;

    htp_list_t *transactions;

    htp_list_t *messages;

    uint8_t flags;

    htp_time_t open_timestamp;

    htp_time_t close_timestamp;

    int64_t in_data_counter;

    int64_t out_data_counter;
};

struct htp_file_t {
    enum htp_file_source_t source;

    bstr *filename;   

    int64_t len;

    char *tmpname;

    int fd;
};

struct htp_file_data_t {
    htp_file_t *file;

    const unsigned char *data;

    size_t len;
};

struct htp_log_t {
    htp_connp_t *connp;

    htp_tx_t *tx;

    const char *msg;

    enum htp_log_level_t level;

    int code;

    const char *file;

    unsigned int line;
};

struct htp_header_t {
    bstr *name;

    bstr *value;   

    uint64_t flags;
};

struct htp_param_t {
    bstr *name;

    bstr *value;

    enum htp_data_source_t source;

    enum htp_parser_id_t parser_id;

    void *parser_data;
};

struct htp_tx_t {
    htp_connp_t *connp;

    htp_conn_t *conn;   

    htp_cfg_t *cfg;

    int is_config_shared;
 
    SCAN_BUILD_X64_PADDING(int pad0;)

    void *user_data;
    
    
    // Request fields

    unsigned int request_ignored_lines;
 
    SCAN_BUILD_X64_PADDING(int pad1;)

    bstr *request_line;      

    bstr *request_method;

    enum htp_method_t request_method_number;
 
    SCAN_BUILD_X64_PADDING(int pad2;)

    bstr *request_uri;   

    bstr *request_protocol;

    int request_protocol_number;

    int is_protocol_0_9;

    htp_uri_t *parsed_uri;

    htp_uri_t *parsed_uri_raw;
    
    /* HTTP 1.1 RFC
     * 
     * 4.3 Message Body
     * 
     * The message-body (if any) of an HTTP message is used to carry the
     * entity-body associated with the request or response. The message-body
     * differs from the entity-body only when a transfer-coding has been
     * applied, as indicated by the Transfer-Encoding header field (section
     * 14.41).
     *
     *     message-body = entity-body
     *                  | <entity-body encoded as per Transfer-Encoding>
     */

    int64_t request_message_len;

    int64_t request_entity_len;   

    htp_table_t *request_headers;   

    enum htp_transfer_coding_t request_transfer_coding;

    enum htp_content_encoding_t request_content_encoding;

    bstr *request_content_type;

    int64_t request_content_length;

    htp_hook_t *hook_request_body_data;

    htp_hook_t *hook_response_body_data;

    htp_urlenp_t *request_urlenp_query;

    htp_urlenp_t *request_urlenp_body;

    htp_mpartp_t *request_mpartp;

    htp_table_t *request_params;

    htp_table_t *request_cookies;

    enum htp_auth_type_t request_auth_type;

    bstr *request_auth_username;

    bstr *request_auth_password;

    bstr *request_hostname;

    int request_port_number;
 
 
    // Response fields

    unsigned int response_ignored_lines;

    bstr *response_line;   

    bstr *response_protocol;

    int response_protocol_number;
 
    SCAN_BUILD_X64_PADDING(int pad3;)

    bstr *response_status;

    int response_status_number;

    int response_status_expected_number;

    bstr *response_message;

    int seen_100continue;      
 
    SCAN_BUILD_X64_PADDING(int pad4;)

    htp_table_t *response_headers;   
 
    /* HTTP 1.1 RFC
     * 
     * 4.3 Message Body
     * 
     * The message-body (if any) of an HTTP message is used to carry the
     * entity-body associated with the request or response. The message-body
     * differs from the entity-body only when a transfer-coding has been
     * applied, as indicated by the Transfer-Encoding header field (section
     * 14.41).
     *
     *     message-body = entity-body
     *                  | <entity-body encoded as per Transfer-Encoding>
     */

    int64_t response_message_len;

    int64_t response_entity_len;

    int64_t response_content_length;
    
    enum htp_transfer_coding_t response_transfer_coding;

    enum htp_content_encoding_t response_content_encoding;

    enum htp_content_encoding_t response_content_encoding_processing;
    
    SCAN_BUILD_X64_PADDING(int pad5;)

    bstr *response_content_type;
 
    
    // Common fields

    uint64_t flags;

    enum htp_tx_req_progress_t request_progress;

    enum htp_tx_res_progress_t response_progress;

    size_t index;

    uint16_t req_header_repetitions;

    uint16_t res_header_repetitions;
};

struct htp_tx_data_t {
    htp_tx_t *tx;

    const unsigned char *data;

    size_t len;

    int is_last;
};

struct htp_uri_t {
    bstr *scheme;

    bstr *username;

    bstr *password;

    bstr *hostname;

    bstr *port;

    int port_number;

    bstr *path;

    bstr *query;

    bstr *fragment;
};

void htp_uri_free(htp_uri_t *uri);

htp_uri_t *htp_uri_alloc(void);

void htp_log(htp_connp_t *connp, const char *file, int line, enum htp_log_level_t level, int code, const char *fmt, ...);
    
htp_status_t htp_urldecode_inplace(htp_cfg_t *cfg, enum htp_decoder_ctx_t ctx, bstr *input, uint64_t *flags);

htp_status_t htp_urldecode_inplace_ex(htp_cfg_t *cfg, enum htp_decoder_ctx_t ctx, bstr *input, uint64_t *flags, int *expected_status_code);

char *htp_get_version(void);
 
#ifdef __cplusplus
}
#endif
 
#endif  /* _HTP_H */