suricata
app-layer.h
Go to the documentation of this file.
1 /* Copyright (C) 2007-2014 Open Information Security Foundation
2  *
3  * You can copy, redistribute or modify this Program under the terms of
4  * the GNU General Public License version 2 as published by the Free
5  * Software Foundation.
6  *
7  * This program is distributed in the hope that it will be useful,
8  * but WITHOUT ANY WARRANTY; without even the implied warranty of
9  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
10  * GNU General Public License for more details.
11  *
12  * You should have received a copy of the GNU General Public License
13  * version 2 along with this program; if not, write to the Free Software
14  * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA
15  * 02110-1301, USA.
16  */
17 
18 /**
19  * \author Victor Julien <victor@inliniac.net>
20  * \author Anoop Saldanha <anoopsaldanha@gmail.com>
21  */
22 
23 #ifndef __APP_LAYER_H__
24 #define __APP_LAYER_H__
25 
26 #include "threadvars.h"
27 #include "decode.h"
28 #include "flow.h"
29 
30 #include "stream-tcp-private.h"
31 #include "stream-tcp-reassemble.h"
32 
33 
34 #include "rust.h"
35 
36 #define APP_LAYER_DATA_ALREADY_SENT_TO_APP_LAYER \
37  (~STREAM_TOSERVER & ~STREAM_TOCLIENT)
38 
39 /***** L7 layer dispatchers *****/
40 
41 /**
42  * \brief Handles reassembled tcp stream.
43  */
45  Packet *p, Flow *f,
46  TcpSession *ssn, TcpStream **stream,
47  uint8_t *data, uint32_t data_len,
48  uint8_t flags);
49 
50 /**
51  * \brief Handles an udp chunk.
52  */
54  Packet *p, Flow *f);
55 
56 /***** Utility *****/
57 
58 /**
59  * \brief Given a protocol string, returns the corresponding internal
60  * protocol id.
61  *
62  * \param The internal protocol id.
63  */
64 AppProto AppLayerGetProtoByName(char *alproto_name);
65 
66 /**
67  * \brief Given the internal protocol id, returns a string representation
68  * of the protocol.
69  *
70  * \param alproto The internal protocol id.
71  *
72  * \retval String representation of the protocol.
73  */
74 const char *AppLayerGetProtoName(AppProto alproto);
75 
77 
78 /***** Setup/General Registration *****/
79 
80 /**
81  * \brief Setup the app layer.
82  *
83  * Includes protocol detection setup and the protocol parser setup.
84  *
85  * \retval 0 On success.
86  * \retval -1 On failure.
87  */
88 int AppLayerSetup(void);
89 
90 /**
91  * \brief De initializes the app layer.
92  *
93  * Includes de initializing protocol detection and the protocol parser.
94  */
95 int AppLayerDeSetup(void);
96 
97 /**
98  * \brief Creates a new app layer thread context.
99  *
100  * \retval Pointer to the newly create thread context, on success;
101  * NULL, on failure.
102  */
104 
105 /**
106  * \brief Destroys the context created by AppLayeGetCtxThread().
107  *
108  * \param tctx Pointer to the thread context to destroy.
109  */
111 
112 /**
113  * \brief Registers per flow counters for all protocols
114  *
115  */
117 
118 /***** Profiling *****/
119 
121 
122 static inline void AppLayerProfilingReset(AppLayerThreadCtx *app_tctx)
123 {
124 #ifdef PROFILING
126 #endif
127 }
128 
130 
131 static inline void AppLayerProfilingStore(AppLayerThreadCtx *app_tctx, Packet *p)
132 {
133 #ifdef PROFILING
134  AppLayerProfilingStoreInternal(app_tctx, p);
135 #endif
136 }
137 
139 
140 /***** Unittests *****/
141 
142 #ifdef UNITTESTS
143 void AppLayerUnittestsRegister(void);
144 #endif
145 
146 void AppLayerIncTxCounter(ThreadVars *tv, Flow *f, uint64_t step);
151 
152 static inline uint8_t StreamSliceGetFlags(const StreamSlice *stream_slice)
153 {
154  return stream_slice->flags;
155 }
156 
157 static inline const uint8_t *StreamSliceGetData(const StreamSlice *stream_slice)
158 {
159  return stream_slice->input;
160 }
161 
162 static inline uint32_t StreamSliceGetDataLen(const StreamSlice *stream_slice)
163 {
164  return stream_slice->input_len;
165 }
166 
167 static inline bool StreamSliceIsGap(const StreamSlice *stream_slice)
168 {
169  return stream_slice->input == NULL && stream_slice->input_len > 0;
170 }
171 
172 static inline uint32_t StreamSliceGetGapSize(const StreamSlice *stream_slice)
173 {
174  return StreamSliceGetDataLen(stream_slice);
175 }
176 #endif
AppLayerProfilingStoreInternal
void AppLayerProfilingStoreInternal(AppLayerThreadCtx *app_tctx, Packet *p)
Definition: app-layer.c:1037
TcpStream_
Definition: stream-tcp-private.h:106
AppLayerIncParserErrorCounter
void AppLayerIncParserErrorCounter(ThreadVars *tv, Flow *f)
Definition: app-layer.c:146
AppLayerGetCtxThread
AppLayerThreadCtx * AppLayerGetCtxThread(ThreadVars *tv)
Creates a new app layer thread context.
Definition: app-layer.c:993
AppProto
uint16_t AppProto
Definition: app-layer-protos.h:80
Flow_
Flow data structure.
Definition: flow.h:357
rust.h
stream-tcp-reassemble.h
AppLayerRegisterGlobalCounters
void AppLayerRegisterGlobalCounters(void)
HACK to work around our broken unix manager (re)init loop.
Definition: app-layer.c:1045
AppLayerGetProtoName
const char * AppLayerGetProtoName(AppProto alproto)
Given the internal protocol id, returns a string representation of the protocol.
Definition: app-layer.c:939
AppLayerIncAllocErrorCounter
void AppLayerIncAllocErrorCounter(ThreadVars *tv, Flow *f)
Definition: app-layer.c:138
AppLayerHandleTCPData
int AppLayerHandleTCPData(ThreadVars *tv, TcpReassemblyThreadCtx *ra_ctx, Packet *p, Flow *f, TcpSession *ssn, TcpStream **stream, uint8_t *data, uint32_t data_len, uint8_t flags)
Handles reassembled tcp stream.
Definition: app-layer.c:644
AppLayerDeSetup
int AppLayerDeSetup(void)
De initializes the app layer.
Definition: app-layer.c:981
decode.h
AppLayerThreadCtx_
This is for the app layer in general and it contains per thread context relevant to both the alpd and...
Definition: app-layer.c:56
ThreadVars_
Per thread variable structure.
Definition: threadvars.h:57
AppLayerIncGapErrorCounter
void AppLayerIncGapErrorCounter(ThreadVars *tv, Flow *f)
Definition: app-layer.c:130
AppLayerSetup
int AppLayerSetup(void)
Setup the app layer.
Definition: app-layer.c:966
Packet_
Definition: decode.h:428
stream-tcp-private.h
flags
uint8_t flags
Definition: decode-gre.h:0
AppLayerRegisterThreadCounters
void AppLayerRegisterThreadCounters(ThreadVars *tv)
Registers per flow counters for all protocols.
Definition: app-layer.c:1135
tv
ThreadVars * tv
Definition: fuzz_decodepcapfile.c:32
threadvars.h
AppLayerUnittestsRegister
void AppLayerUnittestsRegister(void)
Definition: app-layer.c:2815
AppLayerIncInternalErrorCounter
void AppLayerIncInternalErrorCounter(ThreadVars *tv, Flow *f)
Definition: app-layer.c:154
AppLayerListSupportedProtocols
void AppLayerListSupportedProtocols(void)
Definition: app-layer.c:946
AppLayerDestroyCtxThread
void AppLayerDestroyCtxThread(AppLayerThreadCtx *tctx)
Destroys the context created by AppLayeGetCtxThread().
Definition: app-layer.c:1015
AppLayerGetProtoByName
AppProto AppLayerGetProtoByName(char *alproto_name)
Given a protocol string, returns the corresponding internal protocol id.
Definition: app-layer.c:932
TcpReassemblyThreadCtx_
Definition: stream-tcp-reassemble.h:59
TcpSession_
Definition: stream-tcp-private.h:279
AppLayerProfilingResetInternal
void AppLayerProfilingResetInternal(AppLayerThreadCtx *app_tctx)
Definition: app-layer.c:1032
flow.h
AppLayerHandleUdp
int AppLayerHandleUdp(ThreadVars *tv, AppLayerThreadCtx *app_tctx, Packet *p, Flow *f)
Handles an udp chunk.
Definition: app-layer.c:809
AppLayerIncTxCounter
void AppLayerIncTxCounter(ThreadVars *tv, Flow *f, uint64_t step)
Definition: app-layer.c:122