suricata
app-layer.h File Reference
#include "threadvars.h"
#include "decode.h"
#include "flow.h"
#include "stream-tcp-private.h"
#include "stream-tcp-reassemble.h"
#include "stream.h"
#include "util-profiling.h"
Include dependency graph for app-layer.h:

Go to the source code of this file.

Macros

#define APP_LAYER_DATA_ALREADY_SENT_TO_APP_LAYER   (~STREAM_TOSERVER & ~STREAM_TOCLIENT)
 

Functions

int AppLayerHandleTCPData (ThreadVars *tv, TcpReassemblyThreadCtx *ra_ctx, Packet *p, Flow *f, TcpSession *ssn, TcpStream **stream, uint8_t *data, uint32_t data_len, uint8_t flags)
 Handles reassembled tcp stream. More...
 
int AppLayerHandleUdp (ThreadVars *tv, AppLayerThreadCtx *app_tctx, Packet *p, Flow *f)
 Handles an udp chunk. More...
 
AppProto AppLayerGetProtoByName (char *alproto_name)
 Given a protocol string, returns the corresponding internal protocol id. More...
 
const char * AppLayerGetProtoName (AppProto alproto)
 Given the internal protocol id, returns a string representation of the protocol. More...
 
void AppLayerListSupportedProtocols (void)
 
int AppLayerSetup (void)
 Setup the app layer. More...
 
int AppLayerDeSetup (void)
 De initializes the app layer. More...
 
AppLayerThreadCtxAppLayerGetCtxThread (ThreadVars *tv)
 Creates a new app layer thread context. More...
 
void AppLayerDestroyCtxThread (AppLayerThreadCtx *tctx)
 Destroys the context created by AppLayeGetCtxThread(). More...
 
void AppLayerRegisterThreadCounters (ThreadVars *tv)
 Registers per flow counters for all protocols. More...
 
void AppLayerProfilingResetInternal (AppLayerThreadCtx *app_tctx)
 
void AppLayerProfilingStoreInternal (AppLayerThreadCtx *app_tctx, Packet *p)
 
void AppLayerRegisterGlobalCounters (void)
 HACK to work around our broken unix manager (re)init loop. More...
 
void AppLayerUnittestsRegister (void)
 
void AppLayerIncTxCounter (ThreadVars *tv, Flow *f, uint64_t step)
 

Macro Definition Documentation

#define APP_LAYER_DATA_ALREADY_SENT_TO_APP_LAYER   (~STREAM_TOSERVER & ~STREAM_TOCLIENT)

Function Documentation

int AppLayerDeSetup ( void  )

De initializes the app layer.

Includes de initializing protocol detection and the protocol parser.

Definition at line 808 of file app-layer.c.

References AppLayerDeSetupCounters(), AppLayerParserDeSetup(), AppLayerProtoDetectDeSetup(), SCEnter, and SCReturnInt.

Referenced by GlobalsInitPreConfig().

Here is the call graph for this function:

Here is the caller graph for this function:

void AppLayerDestroyCtxThread ( AppLayerThreadCtx tctx)

Destroys the context created by AppLayeGetCtxThread().

Parameters
tctxPointer to the thread context to destroy.

Definition at line 842 of file app-layer.c.

References AppLayerThreadCtx_::alp_tctx, AppLayerThreadCtx_::alpd_tctx, AppLayerParserThreadCtxFree(), AppLayerProtoDetectDestroyCtxThread(), SCEnter, SCFree, and SCReturn.

Referenced by AppLayerGetCtxThread(), DecodeThreadVarsFree(), DetectDceOpnumRegister(), DetectReplaceFreeInternal(), and StreamTcpReassembleFreeThreadCtx().

Here is the call graph for this function:

Here is the caller graph for this function:

AppLayerThreadCtx* AppLayerGetCtxThread ( ThreadVars tv)

Creates a new app layer thread context.

Return values
Pointerto the newly create thread context, on success; NULL, on failure.

Definition at line 820 of file app-layer.c.

References AppLayerThreadCtx_::alp_tctx, AppLayerThreadCtx_::alpd_tctx, AppLayerDestroyCtxThread(), AppLayerParserThreadCtxAlloc(), AppLayerProtoDetectGetCtxThread(), SCEnter, SCMalloc, and SCReturnPtr.

Referenced by DecodeThreadVarsAlloc(), DetectFragBitsRegister(), DetectReplaceFreeInternal(), and StreamTcpReassembleInitThreadCtx().

Here is the call graph for this function:

Here is the caller graph for this function:

AppProto AppLayerGetProtoByName ( char *  alproto_name)

Given a protocol string, returns the corresponding internal protocol id.

Parameters
Theinternal protocol id.

Definition at line 759 of file app-layer.c.

References AppLayerProtoDetectGetProtoByName(), SCEnter, and SCReturnCT.

Referenced by DetectAppLayerEventRegister(), and SigMatchListSMBelongsTo().

Here is the call graph for this function:

Here is the caller graph for this function:

const char* AppLayerGetProtoName ( AppProto  alproto)

Given the internal protocol id, returns a string representation of the protocol.

Parameters
alprotoThe internal protocol id.
Return values
Stringrepresentation of the protocol.

Definition at line 766 of file app-layer.c.

References AppLayerProtoDetectGetProtoName(), SCEnter, and SCReturnCT.

Referenced by AppLayerListSupportedProtocols(), AppLayerParserParse(), AppLayerSetupCounters(), DetectLuaRegister(), and JsonTlsLogJSONExtended().

Here is the call graph for this function:

Here is the caller graph for this function:

int AppLayerHandleTCPData ( ThreadVars tv,
TcpReassemblyThreadCtx ra_ctx,
Packet p,
Flow f,
TcpSession ssn,
TcpStream **  stream,
uint8_t *  data,
uint32_t  data_len,
uint8_t  flags 
)
int AppLayerHandleUdp ( ThreadVars tv,
AppLayerThreadCtx tctx,
Packet p,
Flow f 
)

Handles an udp chunk.

Handles an udp chunk.

If the protocol is yet unknown, the proto detection code is run first.

Parameters
dp_ctxThread app layer detect context
flocked flow
pUDP packet
Return values
0ok
-1error

Definition at line 688 of file app-layer.c.

References AppLayerThreadCtx_::alp_tctx, AppLayerThreadCtx_::alpd_tctx, Flow_::alproto, ALPROTO_FAILED, ALPROTO_UNKNOWN, AppLayerParserParse(), AppLayerProtoDetectGetProto(), FLOW_PKT_TOSERVER, Packet_::flowflags, FlowSwap(), PACKET_PROFILING_APP_END, PACKET_PROFILING_APP_PD_END, PACKET_PROFILING_APP_PD_START, PACKET_PROFILING_APP_START, PACKET_PROFILING_APP_STORE, PacketSwap(), Packet_::payload, Packet_::payload_len, SCEnter, SCLogDebug, SCReturnInt, STREAM_TOCLIENT, STREAM_TOSERVER, and SWAP_FLAGS.

Here is the call graph for this function:

void AppLayerIncTxCounter ( ThreadVars tv,
Flow f,
uint64_t  step 
)

Definition at line 113 of file app-layer.c.

References AppLayerThreadCtx_::alp_tctx, AppLayerThreadCtx_::alpd_tctx, AppLayerThreadCtx_::alproto, Flow_::alproto, ALPROTO_FAILED, Flow_::alproto_tc, Flow_::alproto_ts, ALPROTO_UNKNOWN, APP_LAYER_DATA_ALREADY_SENT_TO_APP_LAYER, Packet_::app_layer_events, APPLAYER_DETECT_PROTOCOL_ONLY_ONE_DIRECTION, APPLAYER_MISMATCH_PROTOCOL_BOTH_DIRECTIONS, APPLAYER_PROTO_DETECTION_SKIPPED, APPLAYER_WRONG_DIRECTION_FIRST_DATA, AppLayerDecoderEventsSetEventRaw(), AppLayerParserGetFirstDataDir(), AppLayerParserGetStreamDepth(), AppLayerParserParse(), AppLayerProtoDetectGetProto(), AppProtoToString(), BUG_ON, TcpSession_::client, AppLayerCounters_::counter_tx_id, TcpSession_::data_first_seen_dir, EngineModeIsIPS(), TcpStream_::flags, TcpSession_::flags, flags, Flow_::flags, Packet_::flags, FLOW_IS_PM_DONE, FLOW_IS_PP_DONE, FLOW_PKT_TOCLIENT, FLOW_PKT_TOSERVER, FLOW_PROTO_DETECT_TC_DONE, FLOW_PROTO_DETECT_TS_DONE, FLOW_RESET_PE_DONE, FLOW_RESET_PM_DONE, FLOW_RESET_PP_DONE, FlowCleanupAppLayer(), Packet_::flowflags, FlowSwap(), TcpStream_::isn, TcpStream_::last_ack, likely, PACKET_PROFILING_APP_END, PACKET_PROFILING_APP_PD_END, PACKET_PROFILING_APP_PD_START, PACKET_PROFILING_APP_START, PacketSwap(), Packet_::pcap_cnt, PKT_PROTO_DETECT_TC_DONE, PKT_PROTO_DETECT_TS_DONE, PrintRawDataFp(), Flow_::proto, Flow_::protoctx, Flow_::protomap, SCLogDebug, TcpSession_::server, StatsAddUI64(), STREAM_TOCLIENT, STREAM_TOSERVER, STREAMTCP_FLAG_MIDSTREAM, STREAMTCP_FLAG_MIDSTREAM_SYNACK, STREAMTCP_STREAM_FLAG_GAP, STREAMTCP_STREAM_FLAG_NOREASSEMBLY, StreamTcpDisableAppLayer(), StreamTcpInlineMode(), StreamTcpReassembleAppLayer(), StreamTcpResetStreamFlagAppProtoDetectionCompleted, StreamTcpSetStreamFlagAppProtoDetectionCompleted, SWAP_FLAGS, TcpSessionSetReassemblyDepth(), UPDATE_DIR_OPPOSING, and UPDATE_DIR_PACKET.

Referenced by AppLayerParserParse().

Here is the call graph for this function:

Here is the caller graph for this function:

void AppLayerListSupportedProtocols ( void  )

Definition at line 773 of file app-layer.c.

References AppLayerThreadCtx_::alproto, ALPROTO_MAX, AppLayerGetProtoName(), AppLayerProtoDetectSupportedAppProtocols(), SCEnter, and SCReturn.

Referenced by ListAppLayerProtocols().

Here is the call graph for this function:

Here is the caller graph for this function:

void AppLayerProfilingResetInternal ( AppLayerThreadCtx app_tctx)

Definition at line 858 of file app-layer.c.

References PACKET_PROFILING_APP_RESET.

void AppLayerProfilingStoreInternal ( AppLayerThreadCtx app_tctx,
Packet p 
)

Definition at line 863 of file app-layer.c.

References PACKET_PROFILING_APP_STORE.

void AppLayerRegisterGlobalCounters ( void  )

HACK to work around our broken unix manager (re)init loop.

Definition at line 870 of file app-layer.c.

References ExpectationGetCounter(), FTPMemcapGlobalCounter(), FTPMemuseGlobalCounter(), HTPMemcapGlobalCounter(), HTPMemuseGlobalCounter(), and StatsRegisterGlobalCounter().

Referenced by PreRunInit().

Here is the call graph for this function:

Here is the caller graph for this function:

void AppLayerRegisterThreadCounters ( ThreadVars tv)

Registers per flow counters for all protocols.

Definition at line 926 of file app-layer.c.

References AppLayerThreadCtx_::alproto, ALPROTO_FAILED, ALPROTO_MAX, AppLayerProtoDetectSupportedAppProtocols(), AppLayerCounters_::counter_id, AppLayerCounters_::counter_tx_id, FlowGetProtoMapping(), IPPROTOS_MAX, and StatsRegisterCounter().

Here is the call graph for this function:

int AppLayerSetup ( void  )

Setup the app layer.

Includes protocol detection setup and the protocol parser setup.

Return values
0On success.
-1On failure.

Definition at line 793 of file app-layer.c.

References AppLayerParserRegisterProtocolParsers(), AppLayerParserSetup(), AppLayerProtoDetectPrepareState(), AppLayerProtoDetectSetup(), AppLayerSetupCounters(), SCEnter, and SCReturnInt.

Referenced by ListAppLayerProtocols(), ListKeywords(), PostRunDeinit(), and RunUnittests().

Here is the call graph for this function:

Here is the caller graph for this function:

void AppLayerUnittestsRegister ( void  )

Definition at line 2621 of file app-layer.c.

References SCEnter, SCReturn, and UtRegisterTest().

Here is the call graph for this function: