suricata
app-layer.h
Go to the documentation of this file.
1 /* Copyright (C) 2007-2014 Open Information Security Foundation
2  *
3  * You can copy, redistribute or modify this Program under the terms of
4  * the GNU General Public License version 2 as published by the Free
5  * Software Foundation.
6  *
7  * This program is distributed in the hope that it will be useful,
8  * but WITHOUT ANY WARRANTY; without even the implied warranty of
9  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
10  * GNU General Public License for more details.
11  *
12  * You should have received a copy of the GNU General Public License
13  * version 2 along with this program; if not, write to the Free Software
14  * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA
15  * 02110-1301, USA.
16  */
17 
18 /**
19  * \author Victor Julien <victor@inliniac.net>
20  * \author Anoop Saldanha <anoopsaldanha@gmail.com>
21  */
22 
23 #ifndef __APP_LAYER_H__
24 #define __APP_LAYER_H__
25 
26 #include "threadvars.h"
27 #include "decode.h"
28 #include "flow.h"
29 
30 #include "stream-tcp-private.h"
31 #include "stream-tcp-reassemble.h"
32 
33 
34 #include "rust.h"
35 
36 #define APP_LAYER_DATA_ALREADY_SENT_TO_APP_LAYER \
37  (~STREAM_TOSERVER & ~STREAM_TOCLIENT)
38 
39 /***** L7 layer dispatchers *****/
40 
41 /**
42  * \brief Handles reassembled tcp stream.
43  */
45  TcpSession *ssn, TcpStream **stream, uint8_t *data, uint32_t data_len, uint8_t flags,
46  enum StreamUpdateDir dir);
47 
48 /**
49  * \brief Handles an udp chunk.
50  */
52  Packet *p, Flow *f);
53 
54 /***** Utility *****/
55 
56 /**
57  * \brief Given a protocol string, returns the corresponding internal
58  * protocol id.
59  *
60  * \param The internal protocol id.
61  */
62 AppProto AppLayerGetProtoByName(char *alproto_name);
63 
64 /**
65  * \brief Given the internal protocol id, returns a string representation
66  * of the protocol.
67  *
68  * \param alproto The internal protocol id.
69  *
70  * \retval String representation of the protocol.
71  */
72 const char *AppLayerGetProtoName(AppProto alproto);
73 
75 
76 /***** Setup/General Registration *****/
77 
78 /**
79  * \brief Setup the app layer.
80  *
81  * Includes protocol detection setup and the protocol parser setup.
82  *
83  * \retval 0 On success.
84  * \retval -1 On failure.
85  */
86 int AppLayerSetup(void);
87 
88 /**
89  * \brief De initializes the app layer.
90  *
91  * Includes de initializing protocol detection and the protocol parser.
92  */
93 int AppLayerDeSetup(void);
94 
95 /**
96  * \brief Creates a new app layer thread context.
97  *
98  * \retval Pointer to the newly create thread context, on success;
99  * NULL, on failure.
100  */
102 
103 /**
104  * \brief Destroys the context created by AppLayerGetCtxThread().
105  *
106  * \param tctx Pointer to the thread context to destroy.
107  */
109 
110 /**
111  * \brief Registers per flow counters for all protocols
112  *
113  */
115 
116 /***** Profiling *****/
117 
119 
120 static inline void AppLayerProfilingReset(AppLayerThreadCtx *app_tctx)
121 {
122 #ifdef PROFILING
124 #endif
125 }
126 
128 
129 static inline void AppLayerProfilingStore(AppLayerThreadCtx *app_tctx, Packet *p)
130 {
131 #ifdef PROFILING
132  AppLayerProfilingStoreInternal(app_tctx, p);
133 #endif
134 }
135 
137 
138 /***** Unittests *****/
139 
140 #ifdef UNITTESTS
141 void AppLayerUnittestsRegister(void);
142 #endif
143 
144 void AppLayerIncTxCounter(ThreadVars *tv, Flow *f, uint64_t step);
149 
150 static inline const uint8_t *StreamSliceGetData(const StreamSlice *stream_slice)
151 {
152  return stream_slice->input;
153 }
154 
155 static inline uint32_t StreamSliceGetDataLen(const StreamSlice *stream_slice)
156 {
157  return stream_slice->input_len;
158 }
159 
160 #endif
AppLayerProfilingStoreInternal
void AppLayerProfilingStoreInternal(AppLayerThreadCtx *app_tctx, Packet *p)
Definition: app-layer.c:1035
TcpStream_
Definition: stream-tcp-private.h:106
AppLayerIncParserErrorCounter
void AppLayerIncParserErrorCounter(ThreadVars *tv, Flow *f)
Definition: app-layer.c:146
AppLayerGetCtxThread
AppLayerThreadCtx * AppLayerGetCtxThread(ThreadVars *tv)
Creates a new app layer thread context.
Definition: app-layer.c:991
AppProto
uint16_t AppProto
Definition: app-layer-protos.h:80
Flow_
Flow data structure.
Definition: flow.h:347
rust.h
stream-tcp-reassemble.h
AppLayerRegisterGlobalCounters
void AppLayerRegisterGlobalCounters(void)
HACK to work around our broken unix manager (re)init loop.
Definition: app-layer.c:1043
AppLayerGetProtoName
const char * AppLayerGetProtoName(AppProto alproto)
Given the internal protocol id, returns a string representation of the protocol.
Definition: app-layer.c:937
AppLayerIncAllocErrorCounter
void AppLayerIncAllocErrorCounter(ThreadVars *tv, Flow *f)
Definition: app-layer.c:138
AppLayerHandleTCPData
int AppLayerHandleTCPData(ThreadVars *tv, TcpReassemblyThreadCtx *ra_ctx, Packet *p, Flow *f, TcpSession *ssn, TcpStream **stream, uint8_t *data, uint32_t data_len, uint8_t flags, enum StreamUpdateDir dir)
Handles reassembled tcp stream.
Definition: app-layer.c:643
AppLayerDeSetup
int AppLayerDeSetup(void)
De initializes the app layer.
Definition: app-layer.c:979
decode.h
AppLayerThreadCtx_
This is for the app layer in general and it contains per thread context relevant to both the alpd and...
Definition: app-layer.c:56
ThreadVars_
Per thread variable structure.
Definition: threadvars.h:57
AppLayerIncGapErrorCounter
void AppLayerIncGapErrorCounter(ThreadVars *tv, Flow *f)
Definition: app-layer.c:130
AppLayerSetup
int AppLayerSetup(void)
Setup the app layer.
Definition: app-layer.c:964
Packet_
Definition: decode.h:430
stream-tcp-private.h
flags
uint8_t flags
Definition: decode-gre.h:0
AppLayerRegisterThreadCounters
void AppLayerRegisterThreadCounters(ThreadVars *tv)
Registers per flow counters for all protocols.
Definition: app-layer.c:1133
tv
ThreadVars * tv
Definition: fuzz_decodepcapfile.c:32
threadvars.h
AppLayerUnittestsRegister
void AppLayerUnittestsRegister(void)
Definition: app-layer.c:2813
AppLayerIncInternalErrorCounter
void AppLayerIncInternalErrorCounter(ThreadVars *tv, Flow *f)
Definition: app-layer.c:154
AppLayerListSupportedProtocols
void AppLayerListSupportedProtocols(void)
Definition: app-layer.c:944
AppLayerDestroyCtxThread
void AppLayerDestroyCtxThread(AppLayerThreadCtx *tctx)
Destroys the context created by AppLayerGetCtxThread().
Definition: app-layer.c:1013
AppLayerGetProtoByName
AppProto AppLayerGetProtoByName(char *alproto_name)
Given a protocol string, returns the corresponding internal protocol id.
Definition: app-layer.c:930
TcpReassemblyThreadCtx_
Definition: stream-tcp-reassemble.h:60
StreamUpdateDir
StreamUpdateDir
Definition: stream-tcp-reassemble.h:53
TcpSession_
Definition: stream-tcp-private.h:283
AppLayerProfilingResetInternal
void AppLayerProfilingResetInternal(AppLayerThreadCtx *app_tctx)
Definition: app-layer.c:1030
flow.h
AppLayerHandleUdp
int AppLayerHandleUdp(ThreadVars *tv, AppLayerThreadCtx *app_tctx, Packet *p, Flow *f)
Handles an udp chunk.
Definition: app-layer.c:807
AppLayerIncTxCounter
void AppLayerIncTxCounter(ThreadVars *tv, Flow *f, uint64_t step)
Definition: app-layer.c:122