suricata
app-layer.h File Reference
#include "threadvars.h"
#include "decode.h"
#include "flow.h"
#include "stream-tcp-private.h"
#include "stream-tcp-reassemble.h"
#include "stream.h"
#include "util-profiling.h"
Include dependency graph for app-layer.h:

Go to the source code of this file.

Macros

#define APP_LAYER_DATA_ALREADY_SENT_TO_APP_LAYER   (~STREAM_TOSERVER & ~STREAM_TOCLIENT)
 

Functions

int AppLayerHandleTCPData (ThreadVars *tv, TcpReassemblyThreadCtx *ra_ctx, Packet *p, Flow *f, TcpSession *ssn, TcpStream **stream, uint8_t *data, uint32_t data_len, uint8_t flags)
 Handles reassembled tcp stream. More...
 
int AppLayerHandleUdp (ThreadVars *tv, AppLayerThreadCtx *app_tctx, Packet *p, Flow *f)
 Handles an udp chunk. More...
 
AppProto AppLayerGetProtoByName (char *alproto_name)
 Given a protocol string, returns the corresponding internal protocol id. More...
 
const char * AppLayerGetProtoName (AppProto alproto)
 Given the internal protocol id, returns a string representation of the protocol. More...
 
void AppLayerListSupportedProtocols (void)
 
int AppLayerSetup (void)
 Setup the app layer. More...
 
int AppLayerDeSetup (void)
 De initializes the app layer. More...
 
AppLayerThreadCtxAppLayerGetCtxThread (ThreadVars *tv)
 Creates a new app layer thread context. More...
 
void AppLayerDestroyCtxThread (AppLayerThreadCtx *tctx)
 Destroys the context created by AppLayeGetCtxThread(). More...
 
void AppLayerRegisterThreadCounters (ThreadVars *tv)
 Registers per flow counters for all protocols. More...
 
void AppLayerProfilingResetInternal (AppLayerThreadCtx *app_tctx)
 
void AppLayerProfilingStoreInternal (AppLayerThreadCtx *app_tctx, Packet *p)
 
void AppLayerRegisterGlobalCounters (void)
 HACK to work around our broken unix manager (re)init loop. More...
 
void AppLayerUnittestsRegister (void)
 
void AppLayerIncTxCounter (ThreadVars *tv, Flow *f, uint64_t step)
 

Macro Definition Documentation

◆ APP_LAYER_DATA_ALREADY_SENT_TO_APP_LAYER

#define APP_LAYER_DATA_ALREADY_SENT_TO_APP_LAYER   (~STREAM_TOSERVER & ~STREAM_TOCLIENT)

Function Documentation

◆ AppLayerDeSetup()

int AppLayerDeSetup ( void  )

De initializes the app layer.

   Includes de initializing protocol detection and the protocol parser.

Definition at line 836 of file app-layer.c.

References AppLayerDeSetupCounters(), AppLayerParserDeSetup(), AppLayerProtoDetectDeSetup(), SCEnter, and SCReturnInt.

Here is the call graph for this function:

◆ AppLayerDestroyCtxThread()

void AppLayerDestroyCtxThread ( AppLayerThreadCtx tctx)

Destroys the context created by AppLayeGetCtxThread().

Parameters
tctxPointer to the thread context to destroy.

Definition at line 870 of file app-layer.c.

References AppLayerThreadCtx_::alp_tctx, AppLayerThreadCtx_::alpd_tctx, AppLayerParserThreadCtxFree(), AppLayerProtoDetectDestroyCtxThread(), SCEnter, SCFree, and SCReturn.

Referenced by AppLayerGetCtxThread(), DecodeThreadVarsFree(), and StreamTcpReassembleFreeThreadCtx().

Here is the call graph for this function:
Here is the caller graph for this function:

◆ AppLayerGetCtxThread()

AppLayerThreadCtx* AppLayerGetCtxThread ( ThreadVars tv)

Creates a new app layer thread context.

Return values
Pointerto the newly create thread context, on success; NULL, on failure.

Definition at line 848 of file app-layer.c.

References AppLayerThreadCtx_::alp_tctx, AppLayerThreadCtx_::alpd_tctx, AppLayerDestroyCtxThread(), AppLayerParserThreadCtxAlloc(), AppLayerProtoDetectGetCtxThread(), SCEnter, SCMalloc, and SCReturnPtr.

Referenced by DecodeThreadVarsAlloc(), and StreamTcpReassembleInitThreadCtx().

Here is the call graph for this function:
Here is the caller graph for this function:

◆ AppLayerGetProtoByName()

AppProto AppLayerGetProtoByName ( char *  alproto_name)

Given a protocol string, returns the corresponding internal protocol id.

Parameters
Theinternal protocol id.

Definition at line 787 of file app-layer.c.

References AppLayerProtoDetectGetProtoByName(), SCEnter, and SCReturnCT.

Here is the call graph for this function:

◆ AppLayerGetProtoName()

const char* AppLayerGetProtoName ( AppProto  alproto)

Given the internal protocol id, returns a string representation of the protocol.

Parameters
alprotoThe internal protocol id.
Return values
Stringrepresentation of the protocol.

Definition at line 794 of file app-layer.c.

References AppLayerProtoDetectGetProtoName(), SCEnter, and SCReturnCT.

Referenced by AppLayerListSupportedProtocols().

Here is the call graph for this function:
Here is the caller graph for this function:

◆ AppLayerHandleTCPData()

int AppLayerHandleTCPData ( ThreadVars tv,
TcpReassemblyThreadCtx ra_ctx,
Packet p,
Flow f,
TcpSession ssn,
TcpStream **  stream,
uint8_t *  data,
uint32_t  data_len,
uint8_t  flags 
)

Handles reassembled tcp stream.

Handles reassembled tcp stream.

First run protocol detection and then when the protocol is known invoke the app layer parser.

Parameters
streamptr-to-ptr to stream object. Might change if flow dir is reversed.

Definition at line 572 of file app-layer.c.

References AppLayerThreadCtx_::alp_tctx, Flow_::alproto, Flow_::alproto_tc, Flow_::alproto_ts, ALPROTO_UNKNOWN, TcpReassemblyThreadCtx_::app_tctx, AppLayerParserParse(), DEBUG_ASSERT_FLOW_LOCKED, DEBUG_VALIDATE_BUG_ON, flags, TcpSession_::flags, PACKET_PROFILING_APP_END, PACKET_PROFILING_APP_START, SCEnter, SCLogDebug, STREAM_GAP, STREAM_START, STREAM_TOSERVER, STREAMTCP_FLAG_APP_LAYER_DISABLED, StreamTcpSetStreamFlagAppProtoDetectionCompleted, StreamTcpUpdateAppLayerProgress(), and tv.

Referenced by StreamTcpReassembleAppLayer().

Here is the call graph for this function:
Here is the caller graph for this function:

◆ AppLayerHandleUdp()

int AppLayerHandleUdp ( ThreadVars tv,
AppLayerThreadCtx tctx,
Packet p,
Flow f 
)

Handles an udp chunk.

Handles an udp chunk.

If the protocol is yet unknown, the proto detection code is run first.

Parameters
dp_ctxThread app layer detect context
flocked flow
pUDP packet
Return values
0ok
-1error

Definition at line 716 of file app-layer.c.

References Flow_::alproto, ALPROTO_FAILED, flags, FLOW_PKT_TOSERVER, Packet_::flowflags, SCEnter, SCReturnInt, STREAM_TOCLIENT, and STREAM_TOSERVER.

◆ AppLayerIncTxCounter()

void AppLayerIncTxCounter ( ThreadVars tv,
Flow f,
uint64_t  step 
)

Definition at line 112 of file app-layer.c.

References Flow_::alproto, applayer_counters, AppLayerCounters_::counter_tx_id, likely, Flow_::protomap, StatsAddUI64(), and tv.

Here is the call graph for this function:

◆ AppLayerListSupportedProtocols()

void AppLayerListSupportedProtocols ( void  )

Definition at line 801 of file app-layer.c.

References ALPROTO_MAX, AppLayerGetProtoName(), AppLayerProtoDetectSupportedAppProtocols(), SCEnter, and SCReturn.

Referenced by ListAppLayerProtocols().

Here is the call graph for this function:
Here is the caller graph for this function:

◆ AppLayerProfilingResetInternal()

void AppLayerProfilingResetInternal ( AppLayerThreadCtx app_tctx)

Definition at line 886 of file app-layer.c.

References PACKET_PROFILING_APP_RESET.

◆ AppLayerProfilingStoreInternal()

void AppLayerProfilingStoreInternal ( AppLayerThreadCtx app_tctx,
Packet p 
)

Definition at line 891 of file app-layer.c.

References PACKET_PROFILING_APP_STORE.

◆ AppLayerRegisterGlobalCounters()

void AppLayerRegisterGlobalCounters ( void  )

HACK to work around our broken unix manager (re)init loop.

Definition at line 898 of file app-layer.c.

References ExpectationGetCounter(), FTPMemcapGlobalCounter(), FTPMemuseGlobalCounter(), HTPMemcapGlobalCounter(), HTPMemuseGlobalCounter(), and StatsRegisterGlobalCounter().

Referenced by PreRunInit().

Here is the call graph for this function:
Here is the caller graph for this function:

◆ AppLayerRegisterThreadCounters()

void AppLayerRegisterThreadCounters ( ThreadVars tv)

◆ AppLayerSetup()

int AppLayerSetup ( void  )

Setup the app layer.

   Includes protocol detection setup and the protocol parser setup.
Return values
0On success.
-1On failure.

Definition at line 821 of file app-layer.c.

References AppLayerParserRegisterProtocolParsers(), AppLayerParserSetup(), AppLayerProtoDetectPrepareState(), AppLayerProtoDetectSetup(), AppLayerSetupCounters(), SCEnter, and SCReturnInt.

Referenced by ListAppLayerProtocols(), ListKeywords(), PostConfLoadedSetup(), and RunUnittests().

Here is the call graph for this function:
Here is the caller graph for this function:

◆ AppLayerUnittestsRegister()

void AppLayerUnittestsRegister ( void  )

Definition at line 2649 of file app-layer.c.

References SCEnter, and UtRegisterTest().

Here is the call graph for this function: