suricata
app-layer-events.h
Go to the documentation of this file.
1 /* Copyright (C) 2014 Open Information Security Foundation
2  *
3  * You can copy, redistribute or modify this Program under the terms of
4  * the GNU General Public License version 2 as published by the Free
5  * Software Foundation.
6  *
7  * This program is distributed in the hope that it will be useful,
8  * but WITHOUT ANY WARRANTY; without even the implied warranty of
9  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
10  * GNU General Public License for more details.
11  *
12  * You should have received a copy of the GNU General Public License
13  * version 2 along with this program; if not, write to the Free Software
14  * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA
15  * 02110-1301, USA.
16  */
17 
18 /**
19  * \file
20  *
21  * \author Victor Julien <victor@inliniac.net>
22  * \author Anoop Saldanha <anoopsaldanha@gmail.com>
23  */
24 
25 #ifndef __APP_LAYER_EVENTS_H__
26 #define __APP_LAYER_EVENTS_H__
27 
28 /* contains fwd declaration of AppLayerDecoderEvents_ */
29 #include "decode.h"
30 
31 /**
32  * \brief Data structure to store app layer decoder events.
33  */
35  /* array of events */
36  uint8_t *events;
37  /* number of events in the above buffer */
38  uint8_t cnt;
39  /* current event buffer size */
41  /* last logged */
43 };
44 
45 /* app layer pkt level events */
46 enum {
53 };
54 
55 /* the event types for app events */
56 typedef enum AppLayerEventType_ {
60 
61 int AppLayerGetPktEventInfo(const char *event_name, int *event_id);
62 
63 int AppLayerGetEventInfoById(int event_id, const char **event_name,
65 void AppLayerDecoderEventsSetEventRaw(AppLayerDecoderEvents **sevents, uint8_t event);
66 void AppLayerDecoderEventsSetEvent(Flow *f, uint8_t event);
67 
68 static inline int AppLayerDecoderEventsIsEventSet(AppLayerDecoderEvents *devents,
69  uint8_t event)
70 {
71  if (devents == NULL)
72  return 0;
73 
74  int i;
75  int cnt = devents->cnt;
76  for (i = 0; i < cnt; i++) {
77  if (devents->events[i] == event)
78  return 1;
79  }
80 
81  return 0;
82 }
83 
86 
87 #endif /* __APP_LAYER_EVENTS_H__ */
88 
void AppLayerDecoderEventsSetEventRaw(AppLayerDecoderEvents **sevents, uint8_t event)
Set an app layer decoder event.
enum AppLayerEventType_ AppLayerEventType
void AppLayerDecoderEventsResetEvents(AppLayerDecoderEvents *events)
uint32_t event_type
Data structure to store app layer decoder events.
AppLayerEventType_
void AppLayerDecoderEventsFreeEvents(AppLayerDecoderEvents **events)
int AppLayerGetPktEventInfo(const char *event_name, int *event_id)
void AppLayerDecoderEventsSetEvent(Flow *f, uint8_t event)
Set an app layer decoder event.
int AppLayerGetEventInfoById(int event_id, const char **event_name, AppLayerEventType *event_type)
Flow data structure.
Definition: flow.h:325