#include "threadvars.h"
#include "decode.h"
#include "flow.h"
#include "stream-tcp-private.h"
#include "stream-tcp-reassemble.h"
#include "rust.h"

Include dependency graph for app-layer.h:

Macros
#define	APP_LAYER_DATA_ALREADY_SENT_TO_APP_LAYER (~STREAM_TOSERVER & ~STREAM_TOCLIENT)

#define	AppLayerProfilingReset(app_tctx) AppLayerProfilingResetInternal(app_tctx)

#define	AppLayerProfilingStore(app_tctx, p) AppLayerProfilingStoreInternal(app_tctx, p)

Functions
int	AppLayerHandleTCPData (ThreadVars tv, TcpReassemblyThreadCtx ra_ctx, Packet p, Flow f, TcpSession ssn, TcpStream stream, uint8_t data, uint32_t data_len, uint8_t flags, enum StreamUpdateDir dir)
	Handles reassembled tcp stream. More...

int	AppLayerHandleUdp (ThreadVars tv, AppLayerThreadCtx app_tctx, Packet p, Flow f)
	Handles an udp chunk. More...

AppProto	AppLayerGetProtoByName (const char *alproto_name)
	Given a protocol string, returns the corresponding internal protocol id. More...

const char *	AppLayerGetProtoName (AppProto alproto)
	Given the internal protocol id, returns a string representation of the protocol. More...

void	AppLayerListSupportedProtocols (void)

int	AppLayerSetup (void)
	Setup the app layer. More...

int	AppLayerDeSetup (void)
	De initializes the app layer. More...

AppLayerThreadCtx *	AppLayerGetCtxThread (void)
	Creates a new app layer thread context. More...

void	AppLayerDestroyCtxThread (AppLayerThreadCtx *tctx)
	Destroys the context created by AppLayerGetCtxThread(). More...

void	AppLayerRegisterThreadCounters (ThreadVars *tv)
	Registers per flow counters for all protocols. More...

void	AppLayerProfilingResetInternal (AppLayerThreadCtx *app_tctx)

void	AppLayerProfilingStoreInternal (AppLayerThreadCtx app_tctx, Packet p)

void	AppLayerRegisterGlobalCounters (void)
	HACK to work around our broken unix manager (re)init loop. More...

void	AppLayerUnittestsRegister (void)

void	AppLayerIncTxCounter (ThreadVars tv, Flow f, uint64_t step)

void	AppLayerIncGapErrorCounter (ThreadVars tv, Flow f)

void	AppLayerIncAllocErrorCounter (ThreadVars tv, Flow f)

void	AppLayerIncParserErrorCounter (ThreadVars tv, Flow f)

void	AppLayerIncInternalErrorCounter (ThreadVars tv, Flow f)

Detailed Description

Author: Victor Julien victo.nosp@m.r@in.nosp@m.linia.nosp@m.c.ne.nosp@m.t; Anoop Saldanha anoop.nosp@m.sald.nosp@m.anha@.nosp@m.gmai.nosp@m.l.com

Application layer handling and protocols implementation

Definition in file app-layer.h.

Macro Definition Documentation

◆ APP_LAYER_DATA_ALREADY_SENT_TO_APP_LAYER

#define APP_LAYER_DATA_ALREADY_SENT_TO_APP_LAYER (~STREAM_TOSERVER & ~STREAM_TOCLIENT)

Definition at line 41 of file app-layer.h.

◆ AppLayerProfilingReset

#define AppLayerProfilingReset ( app_tctx ) AppLayerProfilingResetInternal(app_tctx)

Definition at line 128 of file app-layer.h.

◆ AppLayerProfilingStore

#define AppLayerProfilingStore	(	app_tctx,
		p
	)	AppLayerProfilingStoreInternal(app_tctx, p)

Definition at line 129 of file app-layer.h.

Function Documentation

◆ AppLayerDeSetup()

int AppLayerDeSetup ( void )

De initializes the app layer.

   Includes de initializing protocol detection and the protocol parser.

Definition at line 1089 of file app-layer.c.

References AppLayerDeSetupCounters(), AppLayerParserDeSetup(), AppLayerProtoDetectDeSetup(), FrameConfigDeInit(), SCEnter, and SCReturnInt.

Referenced by GlobalsDestroy().

Here is the call graph for this function:

Here is the caller graph for this function:

◆ AppLayerDestroyCtxThread()

void AppLayerDestroyCtxThread ( AppLayerThreadCtx * tctx )

Destroys the context created by AppLayerGetCtxThread().

Parameters

tctx	Pointer to the thread context to destroy.

Definition at line 1123 of file app-layer.c.

References AppLayerThreadCtx_::alp_tctx, AppLayerThreadCtx_::alpd_tctx, AppLayerParserThreadCtxFree(), AppLayerProtoDetectDestroyCtxThread(), SCEnter, SCFree, and SCReturn.

Referenced by AppLayerGetCtxThread(), DecodeThreadVarsFree(), and StreamTcpReassembleFreeThreadCtx().

Here is the call graph for this function:

Here is the caller graph for this function:

◆ AppLayerGetCtxThread()

AppLayerThreadCtx* AppLayerGetCtxThread ( void )

Creates a new app layer thread context.

Return values

Pointer to the newly create thread context, on success; NULL, on failure.

Definition at line 1102 of file app-layer.c.

References AppLayerThreadCtx_::alp_tctx, AppLayerThreadCtx_::alpd_tctx, AppLayerDestroyCtxThread(), AppLayerParserThreadCtxAlloc(), AppLayerProtoDetectGetCtxThread(), SCCalloc, SCEnter, and SCReturnPtr.

Referenced by DecodeThreadVarsAlloc(), and StreamTcpReassembleInitThreadCtx().

Here is the call graph for this function:

Here is the caller graph for this function:

◆ AppLayerGetProtoByName()

AppProto AppLayerGetProtoByName ( const char * alproto_name )

Given a protocol string, returns the corresponding internal protocol id.

Parameters

The	internal protocol id.

Definition at line 996 of file app-layer.c.

References AppLayerProtoDetectGetProtoByName(), SCEnter, and SCReturnCT.

Here is the call graph for this function:

◆ AppLayerGetProtoName()

const char* AppLayerGetProtoName ( AppProto alproto )

Given the internal protocol id, returns a string representation of the protocol.

Parameters

alproto The internal protocol id.

Return values

String representation of the protocol.

Definition at line 1003 of file app-layer.c.

References AppLayerProtoDetectGetProtoName(), SCEnter, and SCReturnCT.

Referenced by AppLayerListSupportedProtocols().

Here is the call graph for this function:

Here is the caller graph for this function:

◆ AppLayerHandleTCPData()

int AppLayerHandleTCPData	(	ThreadVars *	tv,
		TcpReassemblyThreadCtx *	ra_ctx,
		Packet *	p,
		Flow *	f,
		TcpSession *	ssn,
		TcpStream **	stream,
		uint8_t *	data,
		uint32_t	data_len,
		uint8_t	flags,
		enum StreamUpdateDir	app_update_dir
	)

Handles reassembled tcp stream.

First run protocol detection and then when the protocol is known invoke the app layer parser.

Parameters

stream ptr-to-ptr to stream object. Might change if flow dir is reversed.

Definition at line 707 of file app-layer.c.

References Flow_::alproto, Flow_::alproto_tc, Flow_::alproto_ts, ALPROTO_UNKNOWN, TcpReassemblyThreadCtx_::app_tctx, DEBUG_ASSERT_FLOW_LOCKED, DEBUG_VALIDATE_BUG_ON, flags, TcpSession_::flags, SCEnter, SCLogDebug, STREAMTCP_FLAG_APP_LAYER_DISABLED, and StreamTcpSetStreamFlagAppProtoDetectionCompleted.

◆ AppLayerHandleUdp()

int AppLayerHandleUdp	(	ThreadVars *	tv,
		AppLayerThreadCtx *	tctx,
		Packet *	p,
		Flow *	f
	)

Handles an udp chunk.

If the protocol is yet unknown, the proto detection code is run first.

Parameters

dp_ctx	Thread app layer detect context
f	locked flow
p	UDP packet

Return values

0	ok
-1	error

Definition at line 872 of file app-layer.c.

References AppLayerThreadCtx_::alpd_tctx, Flow_::alproto, ALPROTO_FAILED, Flow_::alproto_tc, Flow_::alproto_ts, ALPROTO_UNKNOWN, Packet_::app_layer_events, APPLAYER_MISMATCH_PROTOCOL_BOTH_DIRECTIONS, AppLayerProfilingReset, AppLayerProtoDetectGetProto(), flags, FLOW_PKT_TOSERVER, Packet_::flowflags, PACKET_PROFILING_APP_PD_END, PACKET_PROFILING_APP_PD_START, Packet_::payload, Packet_::payload_len, SCAppLayerDecoderEventsSetEventRaw(), SCEnter, SCLogDebug, and SCReturnInt.

Here is the call graph for this function:

◆ AppLayerIncAllocErrorCounter()

void AppLayerIncAllocErrorCounter	(	ThreadVars *	tv,
		Flow *	f
	)

Definition at line 171 of file app-layer.c.

References AppLayerCounters_::alloc_error_id, Flow_::alproto, applayer_counters, likely, Flow_::protomap, StatsIncr(), and tv.

Here is the call graph for this function:

◆ AppLayerIncGapErrorCounter()

void AppLayerIncGapErrorCounter	(	ThreadVars *	tv,
		Flow *	f
	)

Definition at line 163 of file app-layer.c.

References Flow_::alproto, applayer_counters, AppLayerCounters_::gap_error_id, likely, Flow_::protomap, StatsIncr(), and tv.

Here is the call graph for this function:

◆ AppLayerIncInternalErrorCounter()

void AppLayerIncInternalErrorCounter	(	ThreadVars *	tv,
		Flow *	f
	)

Definition at line 187 of file app-layer.c.

References Flow_::alproto, applayer_counters, AppLayerCounters_::internal_error_id, likely, Flow_::protomap, StatsIncr(), and tv.

Here is the call graph for this function:

◆ AppLayerIncParserErrorCounter()

void AppLayerIncParserErrorCounter	(	ThreadVars *	tv,
		Flow *	f
	)

Definition at line 179 of file app-layer.c.

References Flow_::alproto, applayer_counters, likely, AppLayerCounters_::parser_error_id, Flow_::protomap, StatsIncr(), and tv.

Here is the call graph for this function:

◆ AppLayerIncTxCounter()

void AppLayerIncTxCounter	(	ThreadVars *	tv,
		Flow *	f,
		uint64_t	step
	)

Definition at line 155 of file app-layer.c.

References Flow_::alproto, applayer_counters, AppLayerCounters_::counter_tx_id, likely, Flow_::protomap, StatsAddUI64(), and tv.

Here is the call graph for this function:

◆ AppLayerListSupportedProtocols()

void AppLayerListSupportedProtocols ( void )

Definition at line 1010 of file app-layer.c.

References AppLayerGetProtoName(), AppLayerProtoDetectSupportedAppProtocols(), g_alproto_max, SCEnter, and SCReturn.

Referenced by ListAppLayerProtocols().

Here is the call graph for this function:

Here is the caller graph for this function:

◆ AppLayerProfilingResetInternal()

void AppLayerProfilingResetInternal ( AppLayerThreadCtx * app_tctx )

Definition at line 1140 of file app-layer.c.

References PACKET_PROFILING_APP_RESET.

◆ AppLayerProfilingStoreInternal()

void AppLayerProfilingStoreInternal	(	AppLayerThreadCtx *	app_tctx,
		Packet *	p
	)

Definition at line 1145 of file app-layer.c.

References PACKET_PROFILING_APP_STORE.

◆ AppLayerRegisterGlobalCounters()

void AppLayerRegisterGlobalCounters ( void )

HACK to work around our broken unix manager (re)init loop.

Definition at line 1153 of file app-layer.c.

References ExpectationGetCounter(), FTPMemcapGlobalCounter(), FTPMemuseGlobalCounter(), HostGetMemcap(), HostGetMemuse(), HTPByteRangeMemcapGlobalCounter(), HTPByteRangeMemuseGlobalCounter(), HTPMemcapGlobalCounter(), HTPMemuseGlobalCounter(), IPPairGetMemcap(), IPPairGetMemuse(), and StatsRegisterGlobalCounter().

Referenced by PreRunInit().

Here is the call graph for this function:

Here is the caller graph for this function:

◆ AppLayerRegisterThreadCounters()

void AppLayerRegisterThreadCounters ( ThreadVars * tv )

Registers per flow counters for all protocols.

Definition at line 1301 of file app-layer.c.

References AppLayerProtoDetectSupportedAppProtocols(), EXCEPTION_POLICY_MAX, EXCEPTION_POLICY_NOT_SET, g_alproto_max, and g_applayerparser_error_policy.

Here is the call graph for this function:

◆ AppLayerSetup()

int AppLayerSetup ( void )

Setup the app layer.

   Includes protocol detection setup and the protocol parser setup.

Return values

0	On success.
-1	On failure.

Definition at line 1072 of file app-layer.c.

References SCEnter.

Referenced by ListAppLayerHooks(), ListAppLayerProtocols(), ListKeywords(), LLVMFuzzerTestOneInput(), PostConfLoadedSetup(), and RunUnittests().

Here is the caller graph for this function:

◆ AppLayerUnittestsRegister()

void AppLayerUnittestsRegister ( void )

Definition at line 2886 of file app-layer.c.

References SCEnter, and UtRegisterTest().

Here is the call graph for this function:

Macros

Functions

Detailed Description

Macro Definition Documentation

◆ APP_LAYER_DATA_ALREADY_SENT_TO_APP_LAYER

◆ AppLayerProfilingReset

◆ AppLayerProfilingStore

Function Documentation

◆ AppLayerDeSetup()

◆ AppLayerDestroyCtxThread()

◆ AppLayerGetCtxThread()

◆ AppLayerGetProtoByName()

◆ AppLayerGetProtoName()

◆ AppLayerHandleTCPData()

◆ AppLayerHandleUdp()

◆ AppLayerIncAllocErrorCounter()

◆ AppLayerIncGapErrorCounter()

◆ AppLayerIncInternalErrorCounter()

◆ AppLayerIncParserErrorCounter()

◆ AppLayerIncTxCounter()

◆ AppLayerListSupportedProtocols()

◆ AppLayerProfilingResetInternal()

◆ AppLayerProfilingStoreInternal()

◆ AppLayerRegisterGlobalCounters()

◆ AppLayerRegisterThreadCounters()

◆ AppLayerSetup()

◆ AppLayerUnittestsRegister()