// $Id$ #ifndef XML_H #define XML_H #include #include #include #include #include #include #include #include using XERCES_CPP_NAMESPACE_QUALIFIER DOMElement; #include using XERCES_CPP_NAMESPACE_QUALIFIER DOMNode; #include using XERCES_CPP_NAMESPACE_QUALIFIER MemoryManager; #include "Analyzer.h" #include "Conn.h" #include "Type.h" #include "Val.h" #ifdef DEBUG # define DBG_XML(conn, txt) \ DBG_LOG(DBG_XML, "%s " txt, \ fmt_conn_id(conn->OrigAddr(), ntohs(conn->OrigPort()), \ conn->RespAddr(), ntohs(conn->RespPort()))); # define DBG_XML_ARGS(conn, fmt, args...) \ DBG_LOG(DBG_XML, "%s " fmt, \ fmt_conn_id(conn->OrigAddr(), ntohs(conn->OrigPort()), \ conn->RespAddr(), ntohs(conn->RespPort())), ##args); #else # define DBG_XML(conn, txt) # define DBG_XML_ARGS(conn, fmt, args...) #endif class XML_Analyzer; static const char * TAG_NAME_EVENT = "event"; static const char * TAG_NAME_BOOL = "bool"; static const char * TAG_NAME_COUNT = "count"; static const char * TAG_NAME_INT = "int"; static const char * TAG_NAME_DOUBLE = "double"; static const char * TAG_NAME_STRING = "string"; static const char * TAG_NAME_RECORD = "record"; static const char * TAG_NAME_SET = "set"; static const char * TAG_NAME_TABLE = "table"; static const char * TAG_NAME_TABLE_ENTRY = "tableEntry"; static const char * ATTR_NAME_TYPE = "type"; static const char * ATTR_NAME_VALUE = "value"; class QueryStore { public: QueryStore(const char * query_files); QueryStore(const char * query_dir, const char * query_files); ~QueryStore(); unsigned int size() { return queries.size(); } XQQuery * item(unsigned int idx) { return queries[idx]; } const char * name(unsigned int idx) { return names[idx].c_str(); } DynamicContext * createContext() { return xqilla_.createContext(); } private: QueryStore(const QueryStore &); QueryStore &operator=(const QueryStore &); void loadQuery(const char * query, const char * name); std::string getURIForPath(const char * path); XQilla xqilla_; std::vector queries; std::vector names; }; // Hacking class to allow access to the DOMParser for setting // parsing properties class DocumentCacheHack : public DocumentCacheImpl { public: DocumentCacheHack(MemoryManager * mgr) : DocumentCacheImpl(mgr) {} void setParsingProperties(); }; class XML_AnalyzerEndpoint { public: XML_AnalyzerEndpoint(XML_Analyzer * a, QueryStore * q, bool is_orig); ~XML_AnalyzerEndpoint(); void Deliver(int len, const u_char* data); void EndOfData(); private: void DoEndOfData(); XML_Analyzer * analyzer; Connection * conn; QueryStore * queries; bool orig; std::vector * buffer; bool skip_data; bool data_tested; }; class XML_Analyzer : public Analyzer { public: XML_Analyzer(Connection* conn); ~XML_Analyzer(); virtual void DeliverStream(int len, const u_char* data, bool orig); virtual void EndOfData(bool orig); void xml_weird(const char * msg) { Weird( "XML_Analyzer problem", msg ); } void generateEvents(Result& result, DynamicContext * ctx); static unsigned int next_doc_nr() { return doc_count_++; } static int doc_frag_size() { return doc_frag_size_; } static Analyzer* InstantiateAnalyzer(Connection* conn) { return new XML_Analyzer(conn); } static bool Available() { return true; } private: static void initialize(); val_list * getEventValList(const DOMElement * elt); BroType * getType(DOMElement * elt); Val * getVal(DOMElement * elt); Val * getBoolVal(DOMElement * elt); Val * getCountVal(DOMElement * elt); Val * getIntVal(DOMElement * elt); Val * getDoubleVal(DOMElement * elt); StringVal * getStringVal(DOMElement * elt); RecordVal * getRecordVal(DOMElement * elt); TableVal * getSetVal(DOMElement * elt); TableVal * getTableVal(DOMElement * elt); int addTableEntry(DOMNode * elt, TableVal * table); static bool inited_; static QueryStore * queries; static unsigned int doc_count_; static int doc_frag_size_; static std::map val_types; static XMLCh * X_TYPE_NAME; static XMLCh * X_VALUE_NAME; XML_AnalyzerEndpoint * orig_endp; XML_AnalyzerEndpoint * resp_endp; Connection * conn; }; extern void xml_warn(const char * msg); extern void xml_warn(const char * msg, Connection * conn); extern void xml_error(const char * msg); extern void xml_error(const char * msg, Connection * conn); extern void xml_ev_error(const char * msg); extern void xml_ev_error(const char * msg, Connection * conn); #endif